Effective October 15, 2026
This policy explains how Dandelion handles information when your school uses the service. Your school is the controller of the records it manages in Dandelion; Dandelion is the processor that stores and handles those records on your school's instructions.
To run a program, Dandelion stores the information your school enters: student and family records, attendance and daily logs, observations and learning stories, photos and videos teachers take, staff records and credentials, billing details, and the messages and documents exchanged inside the app. We also keep basic account information for the people who sign in.
We use this information only to provide and operate the service for your school, to keep accounts secure, and to provide support. We do not sell personal information and we do not use students' information to target advertising.
Several features draft text for a teacher or the office to edit: learning stories, a spoken observation turned into a written moment, replies to families, newsletter copy, meal plans, and the reading of documents your school uploads, such as class lists, rate sheets and credential cards. To draft, Dandelion sends an AI provider what the draft needs and nothing more: a student's first name, the observations a teacher chose, the words a teacher dictated, the text of a message thread, or the document uploaded. Photos and videos of students are never sent to an AI, and nothing recognizes faces. Every draft is read and edited by a person before it is saved or shared. Nothing we send is used to train any model.
Dictation uses the speech recognition built into your browser, so the words a teacher speaks are turned into text by the maker of that browser before they reach Dandelion. School admins can also ask an assistant about their school; it reads the school's records to answer and changes nothing until the admin confirms.
We rely on a small set of service providers: hosting, a database, transactional email, payment processing, product analytics, and an AI provider for drafting. Each processes data only to provide its service to us and is bound to protect it. Our hosting and database providers hold SOC 2 Type II, on infrastructure that holds ISO 27001 and SOC 1, 2 and 3. Card details are entered directly with our payment processor and never pass through Dandelion. Analytics never records what is typed and never records a session. The named list of providers is in our data processing agreement, available on request. We disclose information otherwise only if the law requires it.
Teachers take photos of children through the day to share with their families. When you use the app, your school may send you photos of your child, and your child may appear in group photos and newsletters that go to other families at the same school or program. Photos stay inside your school: they are never used on a public page, in marketing, or outside your school's own families. If you would rather your child not appear in photos shared with other families, tell your school, which records that and Dandelion honors it.
Information about students is provided and controlled by your school. Dandelion does not knowingly collect information directly from students, and no student uses Dandelion. Parents who wish to review or remove a student's information should contact their school, which directs how that information is handled in Dandelion.
Data is encrypted at rest with AES-256 and in transit with TLS. Each school's records are walled off in the database itself, so a person sees only their own school, their own rooms, or their own family. Two step verification is required for school admins and available to everyone. Support access by Dandelion is by named request and is written to a log that cannot be edited, which admins can read. No system is perfectly secure, so we also depend on your staff keeping their sign in details safe. A weakness can be reported through our security page.
We keep your school's data for as long as the account is active. When an account closes, or on your request, we keep it for a further 12 months so you can export it or reopen the account, and then we permanently delete it. You can export everything yourself at any time, including after closing, as a spreadsheet covering students, families, attendance, immunizations, incidents, staff credentials, and billing history. Because several of these are records you may be required to retain after your program closes, we recommend exporting a copy for your own files rather than relying on ours.
Where your school is subject to the GDPR or the UK GDPR, your school is the controller of your records and Dandelion is its processor. You have the right to see your records, correct them, have them deleted, restrict or object to how they are used, and take them elsewhere. Make a request to your school, which decides it; a request sent to us goes to your school within five working days. Records are stored in the United States and transferred there under the standard contractual clauses in our data processing agreement. For the account details of the people who sign in, Dandelion is the controller and relies on providing the service your school asked for and on keeping it secure. You may also complain to the data protection authority where you live.
For privacy questions or requests, email support@mydandelion.com.
Questions? Email support@mydandelion.com or call (737) 235-7160.