Privacy Policy

1. Who we are

OnboardConnect is a product of Zentrosoft LLC ("Zentrosoft," "we," "us," or "our"), a software company that provides automated account provisioning and onboarding workflow services for students, staff and faculty to higher education institutions. Our principal place of business is in the United States. You can reach us at solutions@zentrosoft.com.

2. Scope of this policy

This Privacy Policy applies to:

• Visitors to our marketing website at oc-marketing-site.pages.dev
• Representatives of institutions who request access, create accounts, or use the OnboardConnect platform
• Admitted and enrolled students whose records are processed through the platform on behalf of an institution (see Section 8 — FERPA)
• Staff and faculty whose details an institution submits through internal forms, CSV imports or other configured sources for account provisioning

This policy does not apply to third-party websites or services linked from our site.

3. Information we collect

3a. Information you provide directly

• Contact information — name, work email address, job title, institution name, and details about your systems when you submit a trial request or contact us
• Account credentials — email and password when you create a platform account
• Integration credentials — Active Directory bind credentials, LDAP configuration, Microsoft Graph and Google Workspace credentials, Slate, Student Information System and SQL Server credentials, and other connection credentials provided during platform setup (see Section 6 for how these are protected)

3b. Information collected automatically

• Usage data — pages visited, features used, timestamps, and session duration within the platform
• Log data — IP address, browser type, operating system, and referring URL for security and debugging purposes
• Audit logs and run history — records of administrative actions (including the actor, action, and timestamp) and of workflow runs and their step results

3c. Student, staff and faculty data (processed on behalf of institutions)

When an institution connects Slate CRM, a Student Information System (such as Ellucian Banner or Colleague via Ethos, PeopleSoft or Workday) or SQL Server, imports CSV files, or submits records through internal forms, OnboardConnect processes those records for account provisioning and configured campus-system workflows. Internal forms and CSV imports can be used for any population and can contain fields the institution defines. Form submissions keep a history of who submitted and edited them and of the workflow activity on them. Where an institution configures a workflow to do so, OnboardConnect may email a generated one-time password for a new or reset account. This data is processed as a service provider acting on the institution's behalf — not collected for our own purposes. See Section 8 for our FERPA position on student data.

4. How we use information

We use the information we collect to:

• Provide, operate, and improve the OnboardConnect platform
• Process and fulfill access requests from institutions
• Communicate with platform users about their accounts, service updates, and support requests
• Generate audit logs for compliance and security purposes
• Detect and prevent security incidents and abuse
• Meet our legal obligations

We do not sell personal information to third parties. We do not use student, staff or faculty data for advertising, analytics, or any purpose beyond providing the services the institution configures.

5. How we share information

We share information only in the following circumstances:

• Service providers (sub-processors) — infrastructure vendors who process data on our behalf under confidentiality agreements. We currently use the following sub-processors:

• Cloudflare — compute, database, storage, and content delivery (CDN)
• Mailgun — transactional and notification email delivery

If an institution configures its own messaging provider (for example, its own SMTP server or Twilio account for SMS), messages are sent through that provider under the institution's own agreement with it.

• The institution — provisioning results and audit logs are made available to the institution that owns the account
• Legal requirements — if required by law, court order, or to protect the rights and safety of Zentrosoft, our customers, or the public
• Business transfers — if Zentrosoft is acquired or merges with another entity, customer data may be transferred as part of that transaction, subject to the same privacy commitments

6. How we protect credentials and sensitive data

Integration credentials (such as Active Directory passwords, Microsoft Graph and Google Workspace credentials, and Slate, Student Information System and SQL Server credentials) are:

• Encrypted with AES-256-GCM before being written to storage
• Never logged, included in error messages, or returned in API responses
• Revocable at any time from the institution's dashboard

On Windows servers, the on-premises agent token, and the directory, SIS and database credentials the agent holds, are encrypted with AES-256-GCM on the institution's server under a key sealed with Windows DPAPI, readable only by Administrators and the agent service — never stored in a plaintext config file. On Linux servers, the same credentials are encrypted with AES-256-GCM under a key file that file permissions restrict to the account running the agent.

7. Data retention

• Audit logs — retained for the duration of the institution's account
• Backups — database backups are retained for approximately 30 days
• Form submissions and CSV imports — retained with their history for the duration of the institution's account, unless the institution deletes them sooner, and handled like other account data after termination
• Self-service password reset logs — retained for a period the institution sets (365 days by default)
• Account data — retained for the duration of the institution's account; after termination, deleted on the institution's request or as set out in its agreement or data processing agreement
• Directory records — OnboardConnect stores the student, staff and faculty directory data the institution configures it to use to provision and manage accounts (such as names, email address, recovery contact details, directory identifiers, and any other fields the institution chooses to map or collect) for the duration of the institution's contract, protected by encryption at rest in our infrastructure provider and, where configured, a dedicated per-institution database
• Contact form submissions — retained until the inquiry is resolved or for up to 2 years

8. FERPA and student data

OnboardConnect operates as a school official under FERPA (20 U.S.C. § 1232g) pursuant to the legitimate educational interest exception, acting under the direct control of the institution and using student education records only for the purpose of provisioning accounts as directed by the institution.

Specifically:

• We store only the student data the institution configures OnboardConnect to process in order to provision and manage accounts
• Audit log entries record the actor, action and affected resource, which can include identifiers such as a staff email address or a student's directory username
• We do not use student data for any purpose beyond fulfilling the institution's provisioning instructions
• Institutions remain the data controller; Zentrosoft is the data processor

Institutions are responsible for ensuring their use of OnboardConnect complies with FERPA and their own institutional data governance policies.

9. Cookies and tracking

Our marketing website does not set cookies and does not use analytics or advertising trackers. It loads fonts from Google Fonts, so your browser shares standard request information, such as your IP address, with Google when the fonts load. The platform application uses the session storage required for authentication.

You can configure your browser to block or delete cookies and site data; note that blocking the platform's session storage will prevent you from signing in.

10. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port personal information we hold about you. To make a request, contact us at solutions@zentrosoft.com.

For student data rights under FERPA, requests must be directed to the institution — they are the record custodian, not Zentrosoft.

11. Children's privacy

OnboardConnect is designed for use by higher education institutions and their adult staff. We do not knowingly collect personal information from individuals under the age of 13. If you believe a minor has provided personal information through our site, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify active platform users via email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

13. Contact us

For privacy-related questions or requests, contact: