Privacy Policy

1. Interpretation & Definitions

Interpretation

Words with initial capital letters have meanings defined below. These definitions apply whether they appear in singular or plural form.

Definitions

For the purposes of this Privacy Policy:

• Account — a unique account created for you to access Trellis or parts of Trellis.
• Affiliate — an entity that controls, is controlled by, or is under common control with Oncore, LLC, where "control" means ownership of 50% or more of the shares or voting securities.
• Application — the Trellis MTSS software product operated by Oncore, LLC.
• Company (also "We," "Us," or "Our") — Oncore, LLC, 63 E 11400 S #153, Sandy, UT 84070.
• Country — Utah, United States.
• Device — any device that can access the Service, such as a computer, phone, or tablet.
• Personal Data — any information that identifies or can identify a living individual.
• Service — the Trellis MTSS web application accessible at trellismtss.com.
• Service Provider — any natural or legal person who processes data on Our behalf to facilitate the Service.
• Student Data — educational records or personally identifiable information relating to students that is provided to Us through our school or district customers.
• Usage Data — data collected automatically when you use the Service (e.g., page views, session length, browser type).
• You — the individual accessing the Service, or the school, district, or organization on whose behalf that individual acts.

2. Data We Collect

Personal Data You Provide

When you create an account or contact us, we may collect:

• First and last name
• Email address
• School or district name and role
• Any other information you voluntarily submit through forms or communications

Payment Data

When you purchase a subscription, payment is processed by Stripe. We collect billing contact information (name, email, billing address) necessary to complete the transaction, but we do not store full payment card numbers on our servers — those are handled entirely by Stripe. We receive a tokenized reference and basic transaction metadata (plan, amount, date) to manage your subscription.

Usage Data

We automatically collect Usage Data when you interact with the Service, which may include your device's IP address, browser type and version, the pages you visit, the time and date of your visit, time spent on pages, unique device identifiers, and diagnostic data. When you access the Service from a mobile device, we may also collect information about your mobile device type and operating system.

Student & Educator Intervention Data

Trellis is an MTSS platform used by schools and districts. When educators use the Service to document Tier 1 interventions and student progress, that data is processed on behalf of the school or district (the "Customer"). We act as a data processor for such Student Data; the Customer is the data controller. We do not use Student Data for any purpose other than providing and improving the Service as directed by the Customer.

3. How We Use Your Data

We use the data we collect for the following purposes:

• To provide and maintain the Service, including monitoring its performance and reliability.
• To manage your Account and give you access to the features of the Service available to registered users.
• To fulfill a contract — processing data as necessary to deliver services you or your school/district have purchased.
• To contact you — via email or in-app notifications regarding updates, security alerts, or support responses.
• To send you information about features, events, or other services we offer that are similar to what you have already used, unless you have opted out.
• To handle your requests and respond to inquiries.
• To improve the Service through analysis of usage patterns, crash reports, and feature engagement — always in aggregate or de-identified form.
• For business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
• For legal compliance — to comply with applicable law or respond to valid legal processes.

4. Sharing Your Data

We may share your Personal Data in the following situations:

• With Service Providers — We share data with third-party vendors who help us operate the Service (e.g., hosting, analytics, email delivery). These providers are contractually obligated to protect your data and use it only as directed by us.
• With your school or district — If you are an educator using Trellis under a school or district subscription, your usage and intervention data may be visible to authorized administrators at that institution.
• For business transfers — In connection with any merger, sale of company assets, financing, or acquisition, your data may be among the assets transferred. We will notify you via email and/or a prominent notice on the Service if a change of ownership occurs.
• With Affiliates — We may share your information with Our affiliates, who are required to honor this Privacy Policy.
• With your consent — We may disclose your Personal Data for any other purpose with your explicit consent.
• As required by law — We may disclose your data where required to comply with a legal obligation or to protect the rights or safety of the Company, users, or the public.

Third-Party Service Providers We Use

We currently use the following third-party services that may process your data:

• Google Analytics — website usage analytics. See Google's Privacy Policy.
• Stripe — payment processing. When you make a purchase, payment card data is transmitted directly to Stripe and is not stored on our servers. See Stripe's Privacy Policy.
• Resend — transactional email delivery.
• Fly.io / Render — cloud application hosting.

We do not sell Personal Data to third parties. We do not share Student Data with third parties for advertising or marketing purposes.

5. Data Retention

We retain your Personal Data only for as long as necessary for the purposes described in this Policy or as required by law. Account data is retained for the duration of your active subscription plus a reasonable period afterward to allow for account recovery or dispute resolution, typically no longer than 12 months after account closure.

Student Data is retained in accordance with our agreement with the school or district Customer and applicable law (including FERPA). Upon termination of a Customer agreement, we will delete or return Student Data as directed by the Customer within a commercially reasonable timeframe.

Usage Data is generally retained for shorter periods and used in aggregate or anonymized form for product improvement.

6. Data Transfer

Your data, including Personal Data, is processed at the Company's operating offices in the United States and on servers operated by our hosting providers. If you are located outside the United States, your data is transferred to and processed in the U.S., which may have different data protection laws than your country.

By using the Service or providing data to us, you consent to this transfer. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy, including using standard contractual clauses or other lawful mechanisms where required.

7. Delete Your Data

You have the right to request deletion of the Personal Data we hold about you. You can:

• Delete your account directly from the settings page within the Application, which will remove your profile information.
• Contact us at privacy@trellismtss.com to request deletion of specific data or to close your account entirely.

Note that we may need to retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements. If you are an educator using Trellis under a school/district subscription, please contact your school or district administrator — they control the retention of Student Data records.

8. Security

We take data security seriously and employ commercially reasonable technical and organizational measures to protect your Personal Data. These measures include encrypted data transmission (TLS/HTTPS), access controls, and regular security reviews.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you suspect a security incident involving your data, please contact us immediately at privacy@trellismtss.com.

9. Children's Privacy

Trellis is a platform designed for use by educators and school administrators — not by children directly. We do not knowingly collect Personal Data directly from children under the age of 13.

Student Data relating to minors is processed solely on behalf of schools and districts (the Customers), consistent with their obligations under FERPA, COPPA, and applicable state law. Schools and districts are responsible for obtaining any required parental consent before providing student information to the Service.

If you believe a child under 13 has provided Personal Data to us directly without appropriate consent, please contact us at privacy@trellismtss.com and we will take steps to delete that information.

10. FERPA

When Trellis is used by schools or districts subject to the Family Educational Rights and Privacy Act (FERPA), we recognize that student education records are owned by the school or district, not by Oncore, LLC. We process such records only as directed by the school or district and consistent with their obligations under FERPA.

We do not use student education records for any purpose other than providing and improving the Trellis Service as contracted. We do not disclose student education records without written consent of the parent or eligible student, except as permitted by FERPA and our Customer agreement (e.g., disclosure to school officials with legitimate educational interests).

Schools and districts using Trellis remain responsible for their own FERPA compliance, including providing appropriate notice to parents and students about the use of service providers.

11. GDPR Rights (EEA & UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under GDPR:

• Right of Access — You may request a copy of the Personal Data we hold about you.
• Right to Rectification — You may request correction of inaccurate or incomplete data.
• Right to Erasure — You may request deletion of your Personal Data under certain conditions.
• Right to Restrict Processing — You may request that we limit our use of your data under certain conditions.
• Right to Data Portability — You may request that we transfer your data to you or to a third party in a machine-readable format.
• Right to Object — You may object to our processing of your Personal Data where we rely on legitimate interests as the legal basis.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at privacy@trellismtss.com. We will respond within 30 days. If you believe we have not adequately addressed your rights, you may lodge a complaint with your local data protection authority.

Legal Bases for Processing (GDPR)

We process Personal Data on the following legal bases:

• Contract performance — to provide the Service you or your institution have requested.
• Legitimate interests — to improve the Service, ensure security, and communicate about our products, where our interests do not override your rights.
• Legal obligation — where processing is necessary for compliance with law.
• Consent — where you have given explicit consent to a specific processing activity.

12. CCPA / CPRA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know — You may request disclosure of the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You may request deletion of Personal Data we have collected, subject to certain exceptions.
• Right to Correct — You may request correction of inaccurate Personal Data we maintain about you.
• Right to Opt-Out of Sale or Sharing — We do not sell Personal Data. We do not share Personal Data with third parties for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right of Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

California residents may submit rights requests by contacting us at privacy@trellismtss.com or by sending a written request to Oncore, LLC, 63 E 11400 S #153, Sandy, UT 84070. We will verify your identity and respond within 45 days (extendable to 90 days with notice).

If you are a minor under 16, we will not sell or share your Personal Data without your opt-in consent (or the consent of a parent/guardian if you are under 13).

13. Third-Party Links

The Service may contain links to third-party websites not operated by us. Clicking those links will direct you away from the Service. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policy of every site you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are material, we will notify you by email (to the address on your Account) or by a prominent notice on the Service at least 30 days before the changes take effect.

We encourage you to review this Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated Policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: