Effective date: 2026-10-05 · Version: 2026-10-05
Devo Productions LLC ("we") provides Scriptorium. This policy explains what personal information we handle, why, and the choices people have. It applies to the Service and to this website.
For account and School Content data, the School is the "controller" (or "business") and we act as its "processor" (or "service provider"), handling data on the School's instructions under the Data Processing Addendum. For limited data we need to run our own business (billing, security, support), we act as controller.
Account information (provided by the School's administrators): name, work email, role, and the courses a person is assigned to. Credentials and security data: a salted, one-way hash of the password (we never store or see the password itself), two-step sign-in secret if enabled, sign-in times, IP address and browser type for security logging, and account-lockout counters. School Content: curriculum maps, units, lessons, standards, templates, tags and related text the School's Users create. Audit records: a log of who did what and when (for example, sign-ins and edits), kept for security and accountability. Email: we send account emails (invitations, password resets, review notices). We keep delivery logs for a short period. Support: messages you send us.
We do not intend to collect student information. The Service is not designed to hold student records, and Schools agree not to enter them (see Terms §3).
To provide, secure and support the Service; to authenticate Users and prevent abuse; to send service emails; to diagnose problems and improve reliability; to meet legal obligations. We do not sell personal information, do not use School Content to train AI models, and do not show advertising.
We use a single strictly necessary session cookie to keep you signed in (HTTP-only and Secure). We do not use advertising or cross-site tracking cookies. The marketing website at scriptoriumcms.com uses no cookies or analytics.
Only with subprocessors that help us run the Service (see the current list), under contracts that require appropriate protection; where required by law or to protect rights and safety; or in a merger or sale of the business with notice to the School.
We use encryption in transit, strong password hashing, per-school data isolation enforced in the database, access controls, an audit log, and routine backups. No system is perfectly secure; we will notify the School without undue delay (and in any case as required by law) if we confirm a breach affecting its data.
We keep data while the School's account is active. After termination we delete School Content as described in the Terms. Security logs are kept for 12 months. Encrypted backups expire on a rolling schedule of 90 days.
Depending on where you live you may have the right to access, correct, delete, export or restrict use of your personal information, and to complain to a regulator. Because the School controls its account data, please contact your School's administrator first; we will assist the School in responding. You can also write to [email protected].
The Service is for educators and school staff. It is not directed to children under 13 (or under 16 where applicable), and we do not knowingly collect their personal information. If you believe a child's information has been entered, contact [email protected] and we will help remove it.
Data is hosted in the United States, on hardware we operate. Where data is transferred across borders we rely on appropriate safeguards such as standard contractual clauses.
We will post updates here and give notice of material changes to School administrators.
Contact: Devo Productions LLC · [email protected] · Williamsport, Pennsylvania, USA