Security and privacy at Daystage
One page with what a district review actually asks for: what we store, where it lives, who can reach it, who we share it with, and what we can sign. If something you need is not here, email team@daystage.com and we will answer it.
Last updated: August 2026
Data we hold
What Daystage stores.
Daystage is a tool for emailing adults. Everything below exists to build a newsletter, send it, and tell you whether it arrived.
Staff accounts
Name, email address, school or district name, role, and plan. Created when a teacher or administrator signs up.
Contact lists
Email address and, optionally, a name for each recipient. These are the adults a school emails: parents, guardians, and staff.
Newsletter content
The text and images a school puts into a newsletter, plus any photos uploaded to the school's image library.
Delivery records
Per recipient: whether an email was delivered, opened, clicked, bounced, or unsubscribed, and when.
Billing records
Plan, subscription status, and invoices. Card numbers are handled by Stripe and never reach Daystage servers.
What Daystage does not store
- Student records. Daystage has no field for a student ID, grade, transcript, attendance record, IEP, or disciplinary record, and no import path from a student information system.
- Card numbers, CVVs, or bank details. Stripe handles payment collection end to end.
- Passwords. Daystage never sets or stores one. See Access and sign-in below.
- Health, biometric, or geolocation data of any kind.
Data residency
Where the data lives.
Every system that touches school data, and the region it runs in.
| Layer | Provider | Region | What runs there |
|---|---|---|---|
| Application | Vercel | US East | Serves the app and the marketing site. |
| Database | Neon (PostgreSQL) | US East (us-east-1) | Accounts, contact lists, newsletters, delivery records. |
| File storage | Cloudflare R2 | Cloudflare global network | Uploaded photos and newsletter images. |
| Email delivery | Amazon SES | EU North (eu-north-1) | Outbound newsletter delivery. Recipient addresses and newsletter content pass through this region. |
| Payments | Stripe | Stripe infrastructure | Card data is collected by Stripe directly and never touches Daystage. |
On the email region
Daystage has no student information system integration and no field for student records, so what crosses regions is adult email addresses and the newsletter content already being sent to those addresses. Delivery runs in EU North today. We are moving it to US East and will update this table when that is done.
Access control
Who can reach the data.
No passwords, ever
Daystage does not have a password field. Staff sign in with a Google Workspace account or a single-use magic link sent to their school email. There is no password database to breach, reuse, or phish.
Data is scoped to the account that owns it
Contact lists and newsletters are scoped to the staff account, and to the organization or district above it on team plans. One school cannot read another school's contacts.
Role-based district access
District plans have a district administrator role that can see schools under that district and nothing outside it.
Encrypted in transit and at rest
All traffic runs over HTTPS. Our database and storage providers encrypt data at rest on their infrastructure.
Third parties
Sub-processors.
The complete list of services that can process school data on our behalf, and why each one exists.
| Service | Purpose | Data it can see |
|---|---|---|
| Vercel | Application and website hosting | All request traffic |
| Neon | Managed PostgreSQL database | Accounts, contacts, newsletters, delivery records |
| Amazon Web Services (SES) | Outbound email delivery | Recipient email addresses, newsletter content |
| Cloudflare (R2) | Image and file storage | Uploaded photos and newsletter images |
| Stripe | Payments and subscription billing | Billing contact and payment details |
| Optional sign-in with a Google Workspace account | Email address and name from the Google account | |
| Anthropic | Optional AI drafting assistance inside the editor | The prompt and draft text a staff member submits |
| PostHog | Product analytics, cookie-consent gated | Usage events, only after consent |
Marketing trackers on daystage.com are gated behind the cookie banner and do not run until a visitor consents. They never receive contact list data.
Retention
Keeping and deleting data.
Data stays for as long as the account is open. We do not expire contact lists, newsletters, or delivery history on our own, because schools reference past newsletters years later.
A recipient who unsubscribes is marked as unsubscribed and stops receiving mail immediately. Their address is kept in that state so a later import cannot silently re-subscribe them.
To delete an account and everything under it, email team@daystage.com from an address on the account. Deleting the account removes its contact lists, newsletters, uploaded images, and delivery records.
If something goes wrong
Incident response.
What we commit to doing if we discover a security incident affecting your data.
We contain it first
The immediate priority is stopping the exposure: revoking access, rotating credentials, or taking a system offline. Containment does not wait on notification.
We notify you within 72 hours
Within 72 hours of discovering an incident that affects your data, we notify you. If we do not yet know the full scope at that point, we tell you what we do know rather than waiting for a complete picture.
We notify the district, not just the account holder
On district plans we notify the district administrator as well as the account owner. Districts have their own reporting obligations with their own clocks, and those clocks start when the district learns of an incident, not when one of its schools does.
You get a written report
Every affected school receives a written report covering what happened and when, which data was affected, what we did to contain it, and what we changed so it does not happen again. The fourth part is the one that takes longest, and we send it when it is real rather than promising it in advance.
Reporting a security concern
If you believe you have found a vulnerability or you are seeing something that looks wrong, email team@daystage.com with the words “security report” in the subject line. Include what you saw and how to reproduce it, and we will come back to you.
Questions district reviews ask.
How does Daystage handle student data under FERPA?
Daystage is a communication tool for emailing adults. It stores email addresses for parents, guardians, and staff, and it has no field for a student ID, grade, attendance record, or any other education record, and no integration with a student information system. Any student information a school chooses to include in a newsletter is handled on that school's behalf and under its direction. We do not use it for any purpose other than providing the service to the school, and we never use it for advertising or sell it. We recommend treating newsletter content the same way you treat any other outbound family communication.
Do you sign a data privacy agreement?
Send us your district's agreement and we will review and return it. Email team@daystage.com with the document and your deadline.
Can we get a W-9 and an invoice for a purchase order?
Yes. Daystage Inc is a Delaware corporation and can provide a W-9, a subscription invoice, and send reports for your purchase order package. We accept PO and invoice billing with no credit card.
Is Daystage COPPA relevant?
COPPA governs collecting personal information online from children under 13. Daystage accounts are created by school staff, and the contact lists schools build are addresses for parents, guardians, and staff. Daystage does not knowingly collect information from children and provides no student-facing sign-up.
Who at Daystage can see our data?
A small number of staff hold an administrative role used for support and billing. Access is used to resolve a specific issue, such as a delivery failure or a billing question, and it is not used to read newsletter content otherwise.
What is your breach notification commitment?
We notify you within 72 hours of discovering an incident that affects your data. On district plans we notify the district administrator as well as the account owner, because districts have their own reporting obligations that start when the district learns of an incident. Every affected school receives a written report covering what happened and when, which data was affected, what we did to contain it, and what we changed to prevent a repeat.
What happens to our data if we cancel?
Your account and its contact lists, newsletters, and delivery records remain until you ask us to delete them. Email team@daystage.com from an address on the account and we will delete the account and its data.
Need something for your approval packet?
W-9, a signed data privacy agreement, a subscription invoice, or send reports. Tell us which form you are filling out and your deadline, and we will get it back to you.