Data Sharing

Last updated: September 22, 2026

This page describes where CoPilot Data gets district data, what we receive through automated rostering, and which service providers we use. It supplements our Privacy Policy, which remains the governing document for how we handle student information, and our Terms and Conditions.

What CoPilot Data does

CoPilot Data helps Texas districts understand state assessment results. We combine a district's roster with STAAR, TELPAS, and related state assessment data so campus and district staff can see performance by student, campus, teacher of record, and student group, and track progress against accountability targets.

Students do not hold accounts and do not use the Service.

Where district data comes from

Districts provide data in one of two ways.

Spreadsheet upload. A district uploads roster and assessment files directly.

Automated rostering. A district connects CoPilot Data through a rostering provider, currently ClassLink Roster Server using the OneRoster 1.1 API. CoPilot Data pulls the roster nightly at 3:00 AM Central. The connection is read only. CoPilot Data never writes back to a district's rostering system or student information system.

A district controls exactly which data is shared, and can revoke the connection at any time through their rostering provider.

What we receive through rostering

Schools and campuses: identifiers and names
Students: name, state student identifier, grade level, campus, enrollment status
Demographics: race and ethnicity, and where the district provides them, date of birth and sex. These are used for the student group reporting that state accountability requires.
Staff: teacher name and identifier, used to attach a teacher of record to each tested subject
Courses, classes, and enrollments: used to determine which students are enrolled in which tested subjects, and with which teacher

We explicitly decline several fields the OneRoster standard makes available, because we do not need them: passwords, phone numbers, SMS numbers, and agent (parent or guardian) identifiers.

The state student identifier

CoPilot Data requires the Texas state student identifier (the TSDS/PEIMS unique ID) to match a student to their state assessment results. Without it, a roster record cannot be connected to STAAR data.

Districts may provide it in the OneRoster userIds field, in the identifier field, or in a metadata field the district names. We use it only for that matching purpose, consistent with Texas Education Code Chapter 32, Subchapter D.

Service providers

CoPilot Data uses a small number of third-party service providers to operate the platform. Each is bound by written terms no less protective than our agreement with the district, as required by the Texas Student Data Privacy Agreement.

Category	Purpose	Receives student data?	Location
Cloud infrastructure	Application hosting, database, and file storage	Yes	United States
Rostering provider	Nightly roster sync, only for districts that enable it	Yes	United States
Transactional email	Account invitations and password resets	No. Staff names and work email addresses only	United States
AI processors	Narrative summaries, described below	No identifying information. See below	United States

We name ClassLink elsewhere on this page because a district selects and enables that connection itself, through its own ClassLink account.

A current list of the specific providers behind each category is available to districts on request, and to any district conducting a security review or completing a data privacy agreement. We keep the public list at the category level so we can change providers for technical or commercial reasons without renegotiating published commitments.

AI features and student data

Two features use a language model to write a short plain-English summary. Everything else on those pages and documents is calculated locally and is not model-generated.

No AI provider ever receives a student's name, identifier, date of birth, campus, or district. The two features send different things, and the difference matters:

The CCMR Outcomes Bonus caption receives aggregate counts and dollar figures only: how many graduates are in each group, how many qualified, and what the funding totals are. No student-level record of any kind is included.

The HB 1416 Accelerated Education Plan paragraph receives a de-identified description of one student's performance pattern, because the paragraph has to describe that pattern. It contains only:

the subject (mathematics or reading)
a coarse grade band, such as "middle school." The exact grade level is deliberately not sent.
prior STAAR performance levels by year
the number of consecutive years below grade level
up to four weak reporting categories, such as "Numbers and operations"
the output language

It does not contain the student's name, any identifier, date of birth, campus, or district. Before the request is sent, an automated check compares the payload against the student's actual identifying values and raises an error and blocks the request if any of them appear. That check is part of the code path, so the guarantee is enforced rather than promised.

If the AI providers are unavailable, both features fall back to a deterministic template. No AI service is required for the product to work.

District data is never used to train any AI model.

Retention, deletion, and security incidents

These are governed by our Privacy Policy and by each district's signed data privacy agreement. In summary:

We delete a student's covered information within 60 days of a district's deletion request, consistent with Texas Education Code Section 32.156, and can provide written certification of destruction on request.
We notify a district within 72 hours of confirming a security incident involving student information, consistent with the Texas Student Data Privacy Agreement.
We maintain a written incident response plan, available to districts on request as part of a security review.
Backup and archive copies are subject to a rolling purge and remain encrypted and confidential for as long as they exist.

Where a district's signed agreement is stricter than anything described here, the agreement governs.

Compliance

CoPilot Data acts as a school official with a legitimate educational interest under FERPA. We sign the Texas Student Data Privacy Agreement (TX-NDPA) and district specific data privacy agreements.

CoPilot Data does not sell student data, does not use it for targeted advertising, and does not create student profiles for any purpose other than providing the Service.

Questions

Districts with questions about data handling, or who need a data privacy agreement signed, can reach us at [email protected] or 817-752-4766.