Data protection and security
This document is for a school's IT, data protection or privacy officer. It summarizes how Fieldbook handles personal information, and sets out the data processing terms that apply when a school, district or group of schools buys a licence. Our full privacy policy has the detail.
In short
- No student data. Students never create accounts, sign in or submit work to Fieldbook. Lessons are printed PDFs used offline.
- Teacher data only, and little of it: names, school email addresses, optional profile details, and what was downloaded or bought.
- No advertising, no selling of data, no third-party trackers. Visit counts use Cloudflare Web Analytics, without cookies, and only with consent.
- Nothing to install. No apps, plug-ins, browser extensions or integrations with school systems.
Personal information we process
| Whose | Teachers and staff the School adds to its licence, and the School's purchasing contact. |
|---|---|
| What | Name, email address, optional role, school and grades; downloads and saved lessons; lesson feedback a teacher chooses to give; order and invoice records. |
| Why | To provide the licence, sign teachers in, count downloads, invoice, and answer support requests. |
| Never | Student names, images, work, grades or any other information about students. Sensitive or special-category data. |
Subprocessors
We use these service providers, under written agreements that require them to protect personal information and use it only to provide their service to us. We tell licence holders before adding a subprocessor that handles their teachers' personal information.
| Provider | Service | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting, database and file storage, internal email alerts | Account, licence and order records | Global network; may include the United States |
| Stripe, Inc. / Stripe Payments Canada | Card payments, subscriptions, invoices and refunds | Name, email, billing address, purchase details (never card numbers to us) | Canada and the United States |
| Resend | Delivers sign-in link emails | Email address and the message | United States |
| Google LLC | Optional "Continue with Google" sign-in | Name, email address, Google account ID | United States and elsewhere |
Security
- HTTPS (TLS) on every page and download; data encrypted at rest by our hosting provider.
- Sign-in by Google or by a one-time email link that expires in 20 minutes. We hold no passwords.
- Session cookies are secure and HTTP-only, and only a hashed form of each session token is stored.
- Card details go directly to Stripe (PCI DSS Level 1); they never reach our systems.
- Administrative access is limited to the people who run Fieldbook.
- Paid lesson files are served only to signed-in accounts with access.
Retention and deletion
- Teacher accounts: until deleted, or automatically after two years without a sign-in.
- Teacher lists on a school licence: until the School removes a teacher, and deleted 90 days after the licence ends.
- Messages and quote requests: deleted two years after they arrive.
- Orders and invoices: seven years, as Canadian tax law requires.
Data processing terms
When a School buys a licence and adds teachers to it, these terms apply in addition to the school licence agreement.
- Roles. For the teacher list the School gives us, the School decides what is shared and Fieldbook processes it on the School's behalf, to provide the licence. For teachers' own accounts, sign-in and purchases, Fieldbook is responsible for that information under its privacy policy.
- Instructions. We process the School's personal information only to provide the licence and as the School instructs in writing, and never for advertising or to sell.
- Confidentiality. Everyone at Fieldbook with access to personal information is bound by confidentiality.
- Security. We keep the safeguards described above, and review them at least once a year.
- Subprocessors. The School authorizes the subprocessors listed above. We give notice of new ones, and the School may object.
- Requests from individuals. We help the School answer requests to access, correct or delete personal information, and respond to teachers who contact us directly within 30 days.
- Breach notification. We notify the School without undue delay, and within 72 hours, after we become aware of a breach affecting its personal information, with what we know and what we're doing about it. We also report to the Information and Privacy Commissioner of Alberta where the law requires.
- End of licence. Teacher lists are deleted 90 days after the licence ends, or sooner on the School's written request, except records we must keep by law.
- Audit. We answer the School's reasonable security and privacy questionnaires, once a year or after a breach.
- Transfers outside Canada. Some subprocessors store or process information outside Canada, including in the United States. Where a School is subject to the GDPR or UK GDPR, we sign the EU Standard Contractual Clauses or the UK International Data Transfer Addendum on request.
Laws we work under
ZalaStack Inc. is subject to Alberta's Personal Information Protection Act and Canada's anti-spam law. Because we collect no student data, US student privacy laws such as FERPA and COPPA are not triggered by using Fieldbook; we will still sign a district's student data privacy agreement, such as the Student Data Privacy Consortium's National Data Privacy Agreement, where a district requires one.
Data protection questions, a signed copy of these terms, or a completed security questionnaire: privacy@fieldbooklearning.com.
ZalaStack Inc. · Data protection and security · Document FB-P03, version of October 22, 2026. The current version is always at https://fieldbooklearning.com/procurement/data-protection/.