Terms of Service, Privacy Policy & Security Disclosure

What DISC Software Is

DISC Software provides a student interaction and data management platform designed for school counselors. The Service allows counselors to record and analyze student sessions, contacts, group work, lessons, consultations, and time tracking data. It is intended for use by licensed school counseling professionals and their supervising administrators.

Acceptance of Terms

By accessing or using the Service, you agree to these terms. If you do not agree, do not use the Service. We may update these terms from time to time — when we do, we’ll update the effective date at the top of this document and post the revised version at discsoftware.org/terms. If changes are material, we’ll make reasonable efforts to notify you directly. Continued use of the Service after updates are posted constitutes acceptance of the revised terms.

Your Account

You are responsible for keeping your login credentials secure. Do not share your password or allow others to access your account. If you believe your account has been compromised, contact us immediately at [email protected]. Each account is licensed to one individual user — accounts may not be transferred or shared.

Permitted Use

You may use the Service only for its intended purpose: managing student counseling interactions and related data as part of your role as a school counselor or administrator. You may not:

• Rent, lease, sell, sublicense, or otherwise transfer your account or access to the Service without our prior written authorization.
• Attempt to circumvent, disable, or interfere with security features of the Service.
• Use the Service in any way that could harm DISC Software, its users, or any third party.
• Use the Service to violate any individual’s privacy rights.
• Reverse engineer, copy, or reproduce any part of the Service or its underlying technology.

Intellectual Property

All technology, content, features, and functionality of the Service are owned by DISC Software. The DISC Software name, logo, and product names are trademarks of DISC Software. Nothing in these terms grants you any right to use our trademarks. Content you enter into the Service remains yours — we claim no ownership over the data you create.

Service Availability

We provide the Service on an “as is, as available” basis. We don’t guarantee uninterrupted availability, and we may perform maintenance, updates, or modifications at any time. We’ll do our best to notify you of significant changes. We may suspend or limit access at our discretion, including in response to violations of these terms.

Subscriptions, Billing & Data Retention

Access to the Service requires a paid subscription. Pricing is available at discsoftware.org/pricing. When your subscription ends — whether by cancellation, non-renewal, or termination — the following applies:

• Your data will be retained for 120 days after the end of your paid access. During this window you can view, export, and delete your data, but you cannot add new records.
• After the 120-day window, all of your data will be permanently deleted, with the exception of your email address and payment history, which we retain for 3 years as required for billing and legal compliance.
• For district or institutional accounts, data handling upon termination is governed by the executed DPA.

Refunds

If you are not satisfied with the Service, you may request a full refund within 30 days of your subscription payment by sending a written request to [email protected]. Please include your account email and the reason for your request. Refund requests submitted after 30 days, or from accounts found to have violated these terms, are not eligible. We process approved refunds within 30 days of receipt.

For institutional or district purchases made by purchase order, refund requests should be submitted in writing by the authorized district representative to [email protected] within 30 days of the invoice date.

Termination

We may terminate or suspend your access at any time for any reason, including violation of these terms or inappropriate conduct, with or without notice. You may cancel your account at any time through the account settings or by contacting us. Upon termination, the previously described data retention policy applies.

No Professional Advice

The Service is a data management and organizational tool. Nothing in the Service constitutes clinical, psychological, legal, or other professional advice. Your use of the Service does not create any advisory or professional relationship between you and DISC Software.

Third-Party Content & Links

The Service may contain links to third-party websites or content. We don’t endorse or control third-party sites and are not responsible for their content, privacy practices, or terms. Any interaction you have with third-party sites is solely between you and that third party.

Indemnification

You agree to defend and hold harmless DISC Software, its contractors, employees, and agents from any claims, losses, or expenses — including reasonable legal fees — arising from your misuse of the Service or your violation of these terms.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, DISC SOFTWARE WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR SPECIAL DAMAGES ARISING FROM YOUR USE OF OR INABILITY TO USE THE SERVICE. IN ALL CASES, OUR TOTAL LIABILITY TO YOU WILL NOT EXCEED THE AMOUNT YOU PAID TO ACCESS THE SERVICE IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE CLAIM.

Governing Law & Disputes

These terms are governed by the laws of the State of Washington, without regard to conflict of law principles. Any disputes arising under or related to these terms will be resolved exclusively in the state or federal courts located in Whatcom County, Washington. You consent to personal jurisdiction in those courts.

Severability

If any provision of these terms is found to be unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force.

What We Collect and Why

When you visit our website

We use Cloudflare’s basic site analytics to understand traffic patterns. We do not use any third-party tracking analytics or advertising trackers.

When you create an account

We collect and store:

• Your email address
• Your password (stored as a hashed and salted value — we never store your password in plain text)
• Date of account creation
• Time of most recent login

When you use the Service

You enter counseling-related data as part of normal use. This data falls into two categories: encrypted data that only you can read, and unencrypted data used for aggregation and reporting features such as team and district comparisons. The tables below list exactly which fields fall into each category for every record type in the Service.

Students

Individual Sessions

Guardian Contacts

Consultations

Groups

Assessments

Lessons

Time Tracking

Sticky Notes

Uploaded Files

Your Custom Settings Values

The dropdown values you define in Settings — including visit types, referral sources, concerns, domains, contact types, consultation roles, topics, behaviors, mindsets, time tracking events, student genders, races, tags, and teacher names — are stored without encryption. These values are used to generate aggregated reports and are not considered personally identifiable information.

How We Use Your Data

We use the data you enter solely to provide the Service to you. We do not:

• Sell your data or student data to any third party
• Use student data to target advertising to students or anyone else
• Build profiles of students for any purpose other than delivering the Service
• Share your data with anyone except as described in this policy or required by law

If you purchase a subscription, we maintain a record of that transaction and the data provided by our payment processor for 3 years.

Student Data & FERPA

DISC Software is designed for use by school counselors who work with student education records. In this capacity, DISC Software acts as a “school official” as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, operating under the direction and control of the employing school or district solely with respect to the use of student data provided under the service agreement. This direction and control does not extend to DISC Software’s general business operations, technology, product design, or any aspect of the Service unrelated to the handling of student data.

We are committed to the following with respect to student data:

• Student data is used only to provide the Service and for no other purpose
• We do not sell student data
• We do not use student data to inform, influence, or enable targeted advertising
• We do not build profiles of students for commercial purposes
• Student data is stored within the United States
• Personally identifiable student data is encrypted at rest using AES-256 encryption on a per-user basis. We cannot decrypt this data — only the individual counselor who entered it can do so. This means that even in response to a valid legal request, we are technically unable to provide decrypted personally identifiable student information. Such requests must be directed to the individual user.

Districts requiring a formal Student Data Privacy Agreement (DPA) may request one at [email protected]. Our standard DPA follows the WA-NDPA format.

Data Sharing

We do not share your data or student data with third parties except in the following limited circumstances:

• Law enforcement: If served with a valid legal warrant or court order, we will comply to the extent technically possible. Because personally identifiable student data is encrypted and only decryptable by the individual user, we can confirm its existence but cannot provide readable content.
• Subprocessors: We use third-party infrastructure providers to operate the Service. These providers process data only as necessary to operate the Service and are bound by data protection obligations.
• Business transfers: If DISC Software is acquired by or merges with another company, we will provide advance notice to affected users and districts. We will require, as a condition of any such transfer, that the successor agree to honor these terms and any executed DPAs. If the successor does not agree to those obligations, affected users and districts may terminate their agreements with us prior to the transfer taking effect.

Data Breach Notification

In the event of an unauthorized access, disclosure, or acquisition of data that compromises the security or confidentiality of your information, we will:

• Notify affected users within 72 hours of confirming the incident, unless law enforcement directs us to delay notification for investigative purposes
• Provide notice describing the nature of the breach, the types of data affected, the approximate date of the breach, and the steps we are taking in response
• For district accounts, notify the designated LEA representative within the same 72-hour window and cooperate fully with the district’s response efforts

We maintain a written incident response plan consistent with industry standards and applicable federal and Washington State law.

Security Infrastructure

We take the security of your data seriously and have designed our infrastructure around protecting it.

• Firewall & Network Security: Cloudflare provides our firewall, DDoS protection, rate limiting, and SSL/TLS services. All traffic to and from the Service is protected by full end-to-end SSL/TLS encryption.
• Front-End Hosting: The Service front end is hosted on Vercel, whose infrastructure is SOC 2 compliant. All data stored on Vercel servers is encrypted at rest. Full technical specifications are available at vercel.com/security.
• Database: Our database is hosted on PlanetScale. All connections between PlanetScale and our application require an established TLS session before any data is exchanged. PlanetScale is SOC 2 compliant and encrypts all data at rest. Full technical specifications are available at planetscale.com/docs/concepts/security.
• User-Level Encryption: Personally identifiable information is encrypted using AES-256 before it is sent to our database. Encryption is performed on a per-user basis. Decryption is technically impossible without the individual user’s credentials — not even DISC Software can decrypt this data.

We align our security practices with the NIST Cybersecurity Framework Version 1.1.

Deleting Your Account

You may delete your account at any time through your account settings. When you do:

• All of your data is immediately and permanently deleted, with the exception of your email address and payment history
• Your email address and payment history are retained for 3 years
• Encrypted data cannot be recovered after deletion — there is no backup accessible to us

Password Loss & Data Recovery

Because all personally identifiable data in the Service is encrypted on a per-user basis using your credentials, DISC Software has no ability to reset your password or recover your data if your password is lost. There is no password recovery mechanism that would allow us or anyone else to decrypt your data — this is a deliberate feature of our security architecture, not a limitation we can work around.

If you lose access to your account credentials:

• Your encrypted data cannot be recovered by DISC Software under any circumstances
• No third party, including law enforcement, can recover your encrypted data
• This outcome does not qualify for a refund under our refund policy

DPA Requirement

Institutions accessing the Service on behalf of counselors who work with student records are strongly encouraged to execute a Student Data Privacy Agreement (DPA) with DISC Software. Our standard DPA follows the WA-NDPA format and is available upon request at [email protected]. In any conflict between this Terms of Service document and an executed DPA, the DPA controls.

Administrator Accounts

Administrator accounts are provided at no charge and are intended for district-level staff who need oversight and reporting access across counselor accounts. Administrator accounts do not have access to encrypted counselor data — they can view aggregate and unencrypted reporting data only.

Authorized Use & Data Ownership

All data entered into the Service by counselors employed by or contracted with an Institution remains the property of the Institution and its users. DISC Software does not claim any ownership of that data.

Institutional Refunds

Institutions may request a refund for any subscription fees within 30 days of the invoice date by submitting a written request to [email protected] from an authorized representative. Refund requests submitted after 30 days are not eligible.

How to Reach Us

For questions about these terms, privacy, security, or to request a DPA, contact us at:

[email protected]

We aim to respond to all inquiries within 2 business days.

Entire Agreement

This document, together with any executed DPA, constitutes the entire agreement between you and DISC Software regarding your use of the Service. It supersedes all prior agreements, representations, or understandings, whether written or oral. If any provision of this document is found unenforceable, the remaining provisions remain in effect.