Phi Unit · study sheet · checked 29 Sep 2026

Data policies

What I need to know cold before telling a nonprofit what data it can put into AI. Written after a call where I got parts of this wrong in front of a client's data person. I'm not a lawyer. This is what an operator should know, plus the point where I hand off to one.

The whole answer in three questions

Almost every "can we put this into Claude?" question gets settled by three questions, asked in this order.

Who controls this data?

If the org collected it directly from families with its own consent, the org decides. If a school or district handed it over, the school's agreement decides, and the org is only a contractor.

What exactly goes in?

Names, IDs, birthdates, disability or health details, notes. Most AI use cases need far less than people think. Aggregates need none.

What terms is the tool on?

Consumer plans and commercial plans have different rules. The same model can be fine on one account and a problem on another.

The vendor's terms (question 3) are usually the least binding of the three. Clients always ask it first. Redirect them to question 1.

Vocabulary I have to use precisely

PII (personally identifiable information): A name is PII. So is anything that identifies a person alone or in combination: email, phone, address, birthdate, student ID, photo, voice. Never say "names go in but PII stays out." That sentence contradicts itself.
Sensitive PII: Stricter tier: SSN or tax ID, government ID, financial accounts, health and disability information, immigration status, precise location. Should almost never be in an AI system. W-9s count, because they hold SSNs or tax IDs.
Pseudonymized: Names swapped for IDs, with a key table somewhere that maps them back. It is still personal data. With small cohorts, "ID 047, age 14, Tuesday class, autism" identifies the kid.
De-identified / anonymized: Stripped so nobody could reasonably re-identify the person, even by combining fields. Much harder than it sounds with small populations.
Aggregate: Counts and rates ("212 students, 81% attendance"). The safest thing to put into AI, and enough for most grant reporting.
Controller vs. processor: The controller decides why and how data is used. The processor handles it on the controller's instructions. A nonprofit working inside a school is usually the school's processor or contractor, not the controller.
DPA (data processing agreement): The contract that sets what a vendor or contractor may do with data. In NY schools it's also called a data privacy agreement, and it includes the Parents' Bill of Rights.
Subprocessor: A vendor your vendor uses. When a nonprofit sends school data into Claude, Anthropic becomes a subprocessor. The school's DPA may limit or forbid that.

The laws that come up

Confidence tags are mine: high means verified against a primary or legal-firm source this month; moderate means solid but check before quoting.

Law	Who it binds	What matters for AI	Conf.
FERPA	Schools receiving federal funds. Reaches a nonprofit through the "school official" exception when the nonprofit works under the school's direct control.	Education records from a school can't be redisclosed without consent. If the data came from a school, the nonprofit is bound by the school's terms.	high
NY Education Law §2-d + Part 121	NY educational agencies and every third-party contractor that receives student data from one under contract.	Contractor must sign a DPA with a data security and privacy plan, sign the Parents' Bill of Rights, train staff before access, minimize data, encrypt it, and report breaches. Subcontractors (AI vendors) are held to the same terms. Part 121 regulations added 2020.	high
COPPA (FTC)	Operators of websites and online services directed at kids under 13, or with actual knowledge they're collecting from them.	2025 amendments took effect June 23, 2025; full compliance required from April 22, 2026. They add biometrics and government IDs to "personal information," require separate parental consent to disclose kids' data for non-integral purposes, and require a written security program and written retention policy. Matters the moment a client launches its own student app or signup.	high
NY SHIELD Act	Any business or nonprofit holding private information of NY residents.	Reasonable security safeguards, plus breach notification. Applies to donor and staff data, not just students.	moderate
CA SOPIPA / student privacy laws	Operators of K-12 sites and apps in California. About 40 states have similar student-privacy laws.	No selling student data, no targeted ads, and no building profiles except for school purposes. Relevant if a client's product is used by schools.	moderate
CCPA / CPRA (California)	For-profit businesses over thresholds. Most nonprofits are exempt.	Usually doesn't apply to a nonprofit client. Does apply to a for-profit arm or vendor.	moderate
HIPAA	Covered health entities and their business associates.	Usually doesn't apply to a youth or arts nonprofit, even when it holds health info like allergies. The data is still sensitive-tier; it's just not HIPAA.	moderate

The question I couldn't answer on the TKU call, and still can't without a lawyer: does §2-d reach data a nonprofit collects directly from families for its own after-school programs? The statute is triggered by receiving data from an educational agency. Direct-collected data probably falls outside it. It's still governed by the org's own promises to families and COPPA if it's online. Say "probably outside 2-d, confirm with counsel." Don't say "it doesn't apply."

AI vendor terms: consumer vs. commercial

This is the distinction I blurred on the call. The model is the same; the contract is not.

Plan type	Anthropic examples	Training on chats	Retention
Consumer	Free, Pro, Max	On by default since Aug 28, 2025 unless the user turns off "Help improve Claude" in Privacy settings.	Up to 5 years if training is on; 30 days if off.
Commercial	Team, Enterprise ("Claude for Work"), Education, Government, and the API (incl. Bedrock, Vertex)	Not used for training by default. Consumer-terms change explicitly excluded these.	Set by the commercial agreement; DPA available.

Claude for Nonprofits (launched Dec 2, 2025) is a discount of up to 75% on Team and Enterprise. Team starts around $8 per user per month for nonprofits. Team and Enterprise are different plans. The nonprofit plan is not "the Enterprise version with a discount."
The real leak path at most orgs: staff using personal Pro or Max logins for work. That's consumer terms. Ask about it every time.
A custom tool built on the API (like the Building Beats brain) is on commercial terms regardless of what chat plan anyone has.
OpenAI and Google follow the same consumer / commercial split. Full comparison below.
"Doesn't train on it" ≠ "allowed to have it." Commercial terms solve question 3. They don't answer questions 1 and 2.

The model vendors, side by side

Same rule everywhere: the account type decides, not the brand. Every vendor has a consumer tier that may train on chats and a business tier that doesn't by default.

Vendor	Consumer tier	Business tier	API / developer	Conf.
Anthropic (Claude)	Free, Pro, Max: trains by default since Aug 28, 2025. Turn off "Help improve Claude" in Privacy. Retention up to 5 years if on, 30 days if off.	Team, Enterprise, Education, Government: not used for training. DPA available. Nonprofit discount up to 75%.	Not used for training. Commercial terms.	high
OpenAI (ChatGPT)	Free, Plus, personal Pro: trains by default. Turn off "Improve the model for everyone" in Settings → Data Controls.	ChatGPT Business (formerly Team), Enterprise, Edu, for Healthcare, for Teachers: not used for training unless the customer opts in.	Not used for training by default. Default retention 30 days. Zero Data Retention only by approval on an enterprise agreement, eligible endpoints only.	high
Google (Gemini)	Personal Google account: conversations may be read by human reviewers and used to improve Google's products, including ML. Reviewed chats can be kept after you delete activity. Google itself says not to enter confidential info.	Google Workspace with Gemini: governed by the Workspace agreement. Not human-reviewed, not used to train models outside the domain. Workspace for Education users get the same protection in the Gemini app.	Gemini API free tier: data may be used to improve products, with human review. Paid tier: not used for training, covered by a DPA.	high

The Google trap: a nonprofit on Google Workspace thinks it's covered, then a staffer opens Gemini while signed into their personal Gmail. That's the consumer tier, with human review. Same pattern for anyone who builds a quick prototype on a free API key: free-tier Gemini API data can be used for training. Ask which account and which key, every time.

The tools where the data actually lives

Before any AI touches it, student data already sits in SaaS tools. Each one is a subprocessor in its own right. And most now ship built-in AI features that send your data to OpenAI or Anthropic. Clients rarely know that.

Tool	Its built-in AI	Training and retention	What to tell a client	Conf.
Airtable	Airtable AI (field agents, summaries, generation) runs on third-party models.	Per Airtable's AI Privacy and Security Overview (2025): customer data is not retained by its AI vendors and not used for training by Airtable or those vendors, backed by vendor DPAs and security review.	Reasonable place to keep a roster and the ID key. Turning on Airtable AI means data flows to a model vendor under Airtable's contracts, so list Airtable AI in the data policy. Restrict key-table access with permissions; don't rely on the AI setting.	high
Notion	Notion AI and Enterprise Search, processed by OpenAI or Anthropic.	AI subprocessors are contractually barred from training on customer data. Enterprise uses zero-retention APIs (deleted after processing). Non-Enterprise plans keep AI data 30 days. SOC 2 Type 2, ISO 27001; HIPAA BAA on Enterprise only.	Fine for SOPs and program knowledge. For student records, the plan tier matters: below Enterprise, anything run through Notion AI sits with the provider for 30 days.	high
Google Drive / Sheets	Gemini in Workspace (side panel, Sheets, Docs).	Workspace terms apply: not used to train outside the domain, not human-reviewed.	Covered if staff use the org account. The weak point is a sheet shared to a personal account, or a download opened in a consumer AI.	high
Enrollment / registration tools (e.g. Enrollsy)	Varies.	Check the vendor's DPA and subprocessor list directly. Don't assume.	No API often means CSV exports, and exports are where data escapes: downloaded to laptops, emailed, pasted into chats. Treat the export step as the risk point and script it.	moderate

Two questions to ask about every tool a client uses: Is its AI feature on, and which model vendor does it call? And what plan are we on? The answer to the second one usually decides retention.

The pattern I actually recommend

Split by controller first. Data the org collected itself, with consent, can go in at individual level if restricted by role. Data received from schools goes in aggregate only unless the school's DPA explicitly allows the tool.
Keep the roster in its system of record (Airtable, Sheets, the SIS, the enrollment tool). Add a stable student ID.
The ID-to-name key never leaves that system. Two or three people have access.
Minimize before export. Birthdate becomes an age band. Drop school name if it isn't needed. Disability, health, and demographic fields are out by default. Demographics for grant reports go out as aggregates only.
Scrub with a script, not a prompt. A deterministic step (column drop, regex for names, emails, phone numbers) runs before anything reaches the AI. Telling the model to "ignore PII" is not a control. It's probabilistic, and a data person will spot the difference immediately.
Free text is where names leak. Staff notes, feedback, incident reports. Scrub or exclude them.
Work on IDs; re-join names locally afterward, only if a human needs them.
Prefer aggregates. "How many students hit 80% attendance" needs no rows.
Never in any AI system: SSN or tax ID (including W-9s), government ID, bank details, medical records, home address.

The one-page AI data policy every client needs

Funders, schools, and parents will ask. This page is the answer. Keep it to one page.

Which AI tools are approved, on which account type (org commercial accounts only; no personal logins for org data).
Data tiers: allowed, restricted (role-scoped), aggregate-only, never.
The controller split: own-program data vs. school-provided data.
Who holds the ID key, who can see restricted data.
What families are told. Say "AI" out loud in consent and privacy language; "stays within our organization" isn't disclosure once an AI vendor is involved.
How deletion requests are honored, including removal from any AI knowledge base.
Breach contact and who reviews the policy each year.

What I say, and what I stop saying

Say

"First question: did this data come from a school, or from families directly?"
"The vendor's no-training terms are necessary, not sufficient."
"We scrub with a script before anything reaches the model."
"Replacing names with IDs is pseudonymization. It still counts as personal data."
"That part needs your counsel or the DOE privacy office. Here's the exact question to ask them."
"Building Beats keeps named data only where we hold our own consent, restricted by role. School programs are aggregate-only."

Stop saying

"I told Claude not to ingest PII." (That's not a control.)
"Names go in, PII stays out." (Names are PII.)
"The nonprofit plan is Enterprise with a discount." (It's a discount on Team or Enterprise.)
"I'll have to look into whether it trains." (Know it: commercial doesn't by default.)
Anything about what my own plan costs.
Any real student's name, on screen or out loud, in a meeting about protecting student data.

When I hand off to a lawyer

Interpreting a specific signed DPA or whether a new tool is allowed under it.
Whether §2-d or FERPA reaches a particular data set.
COPPA compliance for anything a client launches online for under-13s.
Any breach, or any suspected one.
Writing the privacy notice families actually sign.

For NY nonprofits the first call is Lawyers Alliance for New York (pro bono and low-cost). For school-provided data, the district's data privacy officer is the authority on their own DPA.

Sources

Checked 29 Sep 2026. Vendor terms change; recheck before quoting any of this to a client.