Skip to main content
Fides.network

The policy reading room

Privacy / Student data / Plain language

Trust begins with
an understandable answer.

What is the purpose? Who makes the decision? What can the evidence tell us?

Fides is the outward policy trust center for administrators and families. Read the questions behind a useful privacy explanation, explore concrete examples, and identify the person responsible for the answer you need.

This is a public guide. It submits no request, records no consent, and changes no student information.

Inside the reading room

Find the question
that matters now.

Each chapter explains a decision, the information it needs, and a limit worth keeping in view. Open a question for a plain-language answer. These controls change the page display only.

01 Orientation

A trust center should help you ask a better question.

Fides is the outward policy trust center for administrators and families: a place to understand how questions about privacy, student data, and accountability fit together. Begin with the decision in front of you. A family deciding what to ask about a photograph needs a different explanation from an administrator reviewing a vendor relationship. Both deserve plain language, a clear owner, and a distinction between a stated policy and evidence that a particular operation occurred.

Bring the relevant activity, the people affected, and the result you need to understand. You do not need to provide a student's name or upload a document to use this guide. “A portrait used in a class publication” is enough to begin a useful discussion about purpose, audience, and permission. Actual personal references belong in the approved private channel used by the responsible school or service, not in a public policy conversation.

The output of a good first reading is a focused question with an appropriate destination. For example: “Who decides whether this portrait appears in the class publication, and how can our family ask about that decision?” That is more actionable than asking whether a platform is generally safe. A broad concern is legitimate; the guide helps turn it into a question that a responsible person can answer with relevant facts.

Fides explains the outward policy questions. Castra is the separate destination for technical security architecture: how controls are built and what technical evidence supports them. Custodia concerns vendor access and records custody. Those subjects connect, but one does not substitute for another. A policy statement about limited access does not itself show a live access record, and a technical description does not decide a school's policy for a particular use.

This page is a public reading surface. It does not inspect a school's configuration, retrieve a child's record, verify a person's identity, or submit a request on their behalf. Its examples show how to evaluate an explanation without pretending that a real case has been opened. When a question requires facts from an actual environment, identify the accountable owner and ask that person to explain the relevant scope and evidence.

An honest trust center leaves room for uncertainty. A reader may finish with a clear answer to one question and a precise open question about another. That is a better result than an attractive badge that implies every legal, operational, and technical issue has been settled. Trust grows from understandable commitments and reviewable answers. It weakens when a general sentence is stretched to cover a use, audience, or deployment the sentence never actually described.

Can I treat this page as a decision about my child's particular record?

No. Use it to identify the question and responsible owner. A decision about an actual record requires the relevant context, authority, and private process. Reading a public explanation neither changes that record nor establishes that a request has reached the person who can act.

02 Purpose

Explain the use before describing the data.

A privacy explanation becomes useful when it connects information to a specific purpose. Start with the activity: preparing a publication, organizing a permitted photo association, responding to a support question, or administering an authorized workflow. Then ask which information that activity needs. A list of data categories without their purposes leaves families guessing why the information exists and leaves administrators unable to evaluate whether the proposed use is proportionate to the task.

The inputs for a purpose review are the intended outcome, the audience, the participating organizations, and the information believed necessary. Keep optional convenience separate from necessity. A staff member may find a broad roster easier to work with, but that does not explain why every field belongs in a particular handoff. Ask what would fail if a field were omitted, and whether a less identifying example could answer the same operational question.

The output should be a sentence a family can understand and an administrator can test. An illustrative sentence is: “The school is reviewing the class association needed for its publication.” That identifies an activity without promising that every surrounding use is covered. Add the audience and the responsible decision maker where they matter. Avoid replacing the purpose with a circular explanation such as “we use data to provide services” when the reader is asking about one concrete use.

A new purpose deserves its own review. Information collected for one activity does not automatically belong in another simply because it is already available. If a team proposes a different audience, a new type of analysis, or reuse in an unrelated communication, explain the change to the accountable owner. This guide does not determine whether that change is permitted. It helps reveal that the decision has changed and should not be hidden inside a familiar workflow label.

Consider a fictional school using a class list to check names in a yearbook proof. The purpose is the proof review, not an unrestricted invitation to circulate the list. A discussion about adding personal contact details should ask what decision those details support. A discussion about sharing the proof with a wider audience should examine that audience separately. The same underlying project can contain several distinct uses with different questions.

Policy language should also explain what a statement leaves out. A description of a publication workflow does not establish the handling of a school's separate files, another vendor's product, or a family's downloaded copy. Clear limits are not evasions when they direct the reader to the right owner. They become evasions when the explanation refuses to name the owner or uses a narrow scope to avoid acknowledging the broader question the person raised.

Is a broad promise to use information only for school purposes specific enough?

It may express an intention, but a concrete review needs the activity, audience, information, and responsible decision maker. Ask what the phrase means for the use you are considering. A useful answer should help you understand both the permitted purpose and the boundary around it.

03 Responsibility

Name who can explain, decide, and act.

Privacy questions often cross organizational boundaries. A school may decide how a publication is used, a studio may carry out photography work, a platform operator may support a technical workflow, and a family may seek an explanation about its own information. Those participants do not automatically hold the same authority. A trust-center answer should identify the organization responsible for the decision under discussion instead of treating “we” as a substitute for a clear relationship.

Start with three inputs: the activity, the relevant organizations, and the decision the reader wants made. Separate the person who can explain a policy from the person authorized to change a record or decide a request. A helpful support contact may be able to route a question without being the school official who can approve the proposed use. A family should not have to infer that distinction from an unanswered message.

A useful output is a responsibility map written in ordinary language. Identify the policy owner, operational owner, and contact responsible for coordinating the response where those roles differ. This guide does not assign legal classifications to a particular school or contract. Those classifications depend on the actual relationship and applicable requirements. The practical task here is to make sure the reader knows which organization can answer which question and where an unresolved issue should go.

The distinction matters when a requested correction affects a school-controlled fact. A platform operator may identify a technical mismatch while the school validates the intended class or name. An explanation should not imply that the operator independently decides every educational record question. Equally, a school should not be left with a technical question it cannot inspect when the vendor is the party able to explain the relevant system behavior.

Use a coordinated handoff rather than a chain of referrals with no owner. If the first recipient cannot decide the matter, ask that recipient to identify the appropriate next contact and explain what context should accompany the question. Share only the information needed for that handoff through an approved channel. Forwarding a large sensitive packet to several possible owners can create more privacy work without making the responsibility clearer.

A responsibility map can change when a staff member leaves, a service relationship ends, or a workflow moves to another team. Ask who currently owns an open question rather than relying on an old title or a familiar address. This page maintains no directory of live case owners and promises no automatic routing. The important result is a confirmed accountable destination for the real question, with the limits of each participant's role stated plainly.

If a vendor supplies the software, does it make every decision about the school's information?

No such conclusion follows from supplying software. Ask about the specific activity and actual relationship. The school, vendor, and other participants may have different decisions to make. A useful answer identifies those responsibilities without turning a product description into a universal statement of authority.

04 The data journey

Follow the information through its handoffs.

A readable data journey follows an activity from its starting point to its intended result. It asks where information comes from, who handles it, what changes, who receives the result, and what remains afterward. The journey is not a decorative arrow diagram that assumes every handoff is known. It is a way to locate the questions that matter when a family or administrator wants to understand one actual use.

Bring the source category, the intended output, the participating organizations, and any known intermediate copies. Use abstract labels in a public discussion: school-provided list, selected portrait, review proof, permitted publication. Actual records can remain in the authorized private process. The first output is a map of the stages that the responsible people can confirm. Mark a stage as unknown if the available explanation does not establish it.

At collection, ask which party supplies the information and how an error can be identified. At use, ask what operation requires the information and which people are involved. At sharing, ask who receives the result and for what purpose. At the end, ask what remains and which handling decision applies. These are distinct questions. A clear explanation of collection does not automatically answer what happens to a later export or a paper copy.

Consider a fictional proofing workflow. A school supplies a permitted reference, an authorized participant prepares a proof, the school reviews the result, and an approved audience eventually receives an output. Each stage can introduce a different responsibility. The proof may contain information absent from the final output, and the audience for review may differ from the audience for publication. A policy explanation should make those differences visible when they affect a reader's decision.

Do not confuse the disappearance of a screen with the end of a data journey. A view being closed does not tell the reader whether an export, attachment, or other copy remains. Likewise, a new version of an output does not establish that an older copy was recalled. Ask the actual owner about the relevant copies and the limits of any handling action. This guide performs no deletion, recall, or inspection of another system.

The journey's final value is a set of reviewable statements and assigned open questions. An administrator can use it to identify a missing explanation before approving a workflow. A family can use it to ask where a particular audience or use enters the process. Neither reader needs an exhaustive technical architecture to start. They need an accurate account of the meaningful handoffs and a responsible person who can answer the questions left open.

Does a simple diagram prove that information never goes anywhere else?

No. A diagram is a representation of the scope its author describes. Ask what it includes, what it excludes, and what evidence supports the important handoffs. A clear map should reveal uncertainty and responsibility, not turn an incomplete explanation into an absolute claim.

05 Choices and authority

Make the decision visible to the person affected.

A meaningful choice begins with an explanation of what is being decided. The reader needs the activity, the audience, the consequences of each available option, and the person or organization responsible for recording the decision. A checkbox without that context can produce a record of a click while leaving the person unsure what they agreed to. Fides offers a reading framework; it does not collect consent or determine whether a particular use requires it.

The inputs for a choice review include the proposed use, the governing school process, the people affected, and the practical alternatives. Ask whether the choice concerns participation, publication, communication, or another distinct action. Avoid bundling unrelated uses into one vague agreement merely because they occur during the same school year. The correct process depends on the actual circumstances, and the responsible owner should explain that process in language the audience can understand.

The output should make the decision and its limit apparent. An illustrative explanation might distinguish permission for a particular publication audience from permission for an unrelated promotional use. It should also explain where the real decision is recorded and how a person can ask about it. Reading this page, opening a disclosure, or following a topic link records no such decision. There is no hidden agreement created by exploring the guide.

Ask what happens if the person declines or asks for clarification. A useful explanation identifies available alternatives and practical consequences without inventing a right or promising an option the actual workflow does not provide. If the answer depends on school policy, the school owner should say so. If a requested alternative is unavailable, explain the boundary directly and identify who can discuss the underlying concern. Ambiguity should not be used to make refusal feel impossible.

A later change also needs context. A family may wish to revisit a decision after learning more about an audience or use. Ask the responsible owner what can be changed, what has already happened, and what limits apply to distributed material. This page does not withdraw permission, recall an output, or alter a school record. A truthful explanation distinguishes a request to change future handling from a guarantee that every past copy can be recovered.

An administrator reviewing a choice process should test it with a concrete scenario. Give a reader the explanation and ask them to describe the intended use, the available options, and the next step in their own words. If the reader cannot tell those apart, the process needs clearer communication before the form is considered complete. Good policy writing supports an informed decision; it does not hide the decision behind a long paragraph of general assurances.

Does visiting Fides or opening a policy explanation count as agreeing to a student-data use?

No. This reading surface collects no consent decision. Any real authorization or choice belongs in the appropriate process with the relevant context. Ask the responsible school or service how that decision is explained, recorded, and reviewed for the particular activity.

06 Access

Say which people the explanation covers.

“Access is limited” is a starting point, not a complete explanation. A reader should be able to ask which people, which information, which purpose, and which environment the statement concerns. The answer may involve school staff, a studio, vendor administrators, families, or other participants with different responsibilities. Those categories should not disappear into one reassuring word such as “authorized” when the person is asking how the boundary is actually understood.

Bring the activity under review, the actor category, and the reason access may be needed. A family asking about a teacher's use of a class list has a different question from a school reviewing a vendor support administrator's examination of a record. Both questions matter. A policy trust center should help identify the distinction and the accountable owner instead of directing both readers to the same narrow evidence and implying it resolves everything.

Custodia provides the separate vendor-access and records-custody subject. Its described trail concerns platform-side administrator access. It does not log reads by your own teachers, advisers or office staff. A school governs its own internal access. Keep that boundary in any family-facing explanation that refers to the trail. An empty vendor result must not be presented as proof that nobody at the school opened or handled the information.

The output of an access-policy conversation should name the roles involved, the permitted purpose, the relevant evidence source, and the limits of that evidence. A public explanation may summarize those facts without publishing private operator details. An authorized reviewer may need more specific attribution through a protected process. Different audiences can receive different levels of detail while sharing the same honest statement about what was and was not examined.

Consider a support issue involving one incorrect association. A school contact may establish the intended school fact, while a vendor operator investigates the technical behavior through an approved path. The policy explanation should distinguish those actions. It should not imply that the vendor makes the school decision, or that the vendor's access trail accounts for the school's own handling. Responsibility becomes clearer when the explanation follows the actual work rather than the boundaries of a marketing sentence.

Fides does not inspect live permissions, revoke an account, or query an access history. Technical questions about how controls are built belong with the appropriate technical evidence, including Castra's separate architecture subject. Questions about a particular person's access belong with the responsible operational owner. The public guide helps prepare those questions while leaving room for a factual answer that may identify an unresolved scope or a limit in the available evidence.

Can a policy promise about access replace an actual review of a disputed event?

No. The promise describes an intended boundary; the event requires relevant evidence and an accountable explanation. Ask which scope and period were examined, which people were included, and what remains unknown. Preserve the difference between policy, technical design, and observation.

07 Sharing and providers

A recipient needs a purpose and a boundary.

A sharing explanation should identify who receives information, why they receive it, and what kind of information is involved. It should also distinguish an internal participant from another organization where that distinction matters. A long list of possible recipients can be less useful than a clear account of the specific handoff a reader is considering. Start with the actual activity and ask the responsible owner to explain the relevant recipient and purpose.

The inputs include the proposed output, its audience, the participating service, and the reason the handoff is needed. Ask whether the recipient receives a complete record, a limited subset, or a non-identifying result. Do not assume that every provider mentioned in a product discussion receives every type of student information. Equally, do not assume that an unnamed provider receives nothing. A useful answer is grounded in the configured workflow being reviewed.

The output should make the handoff reviewable: recipient category, purpose, information category, responsible owner, and any important handling limit. This page supplies no verified live provider inventory and makes no claim about the configuration of a school's environment. If the decision depends on a particular provider, ask for the current applicable explanation from the accountable party. A generic logo or a familiar brand name is not evidence of a specific data relationship.

A change in recipient can change the question even when the information stays the same. Sharing a proof with an authorized school reviewer is different from making it available to a wider audience. Sending a diagnostic example to support is different from sending a real student record to an external analysis service. Identify the change explicitly. Existing availability of the information does not explain the necessity or authority for every proposed destination.

Consider a fictional administrator reviewing a proposed support handoff. The first question is whether a fabricated example can reproduce the problem. If it can, the real record may be unnecessary for that diagnostic step. If it cannot, the administrator needs an explanation of the narrower real information required and the approved route. The review should not start by distributing the broadest possible packet and asking the recipient to discard whatever proves irrelevant.

A provider question may also involve what happens after the initial handoff: further recipients, retention, access, and the handling of derived outputs. Ask those questions when they matter to the decision. Fides does not contact providers, transmit an inquiry, or verify a contract from this page. It helps the reader identify the concrete relationship to review and avoids turning a general statement about partners into a guarantee about every downstream use.

If a provider appears in a product description, does that prove it is connected to our school's data?

No. Ask about the actual configured workflow and the information involved. A product description can identify a topic or integration possibility without proving a live connection. The responsible owner should distinguish declared capabilities, current configuration, and observed use.

08 Photographs and identity

A photograph deserves its own explanation.

A photograph can carry context beyond the image itself: a name association, a class, an event, a caption, or the audience for a publication. A privacy explanation should address the intended use of the image and the surrounding information together. It should not assume that a family asking about a portrait is only asking where a file is stored. The concern may be about identification, visibility, reuse, or a mistaken association.

Begin with the image's intended purpose, the source of its association, the proposed audience, and the person responsible for validating the result. Use a non-sensitive example when discussing the shape of a problem publicly. An actual portrait or student reference belongs in the approved private process. This page accepts no uploads and performs no image analysis. A reader can explore the policy questions without supplying a photograph or exposing a child's identity.

Face recognition is not wired in the shipping configuration; no face template is computed from a photo. Do not turn a description of portrait organization into a claim that the platform recognizes a student's face. A recorded association and a biometric identification are different things. When an association is wrong or unclear, the appropriate question is how an authorized person validates and corrects it through the actual workflow, not how to activate an imagined recognition service.

The output of a useful image-policy discussion identifies the permitted purpose, the intended audience, the validation owner, and the route for raising a concern. It should also describe any important limits on changing distributed material. A request to correct a future output differs from a promise that every previously shared copy can be recovered. The responsible owner should explain the actual options and avoid suggesting that a public policy page can recall a photograph.

Consider a fictional family who finds a portrait associated with the wrong class. The immediate question may be how the school verifies the intended class and how the affected output is handled. A separate question may concern who viewed the record during support. Another may concern whether the incorrect version reached an audience. Treat those as connected but distinct questions, each requiring its own relevant evidence and accountable explanation.

Avoid sensational language and absolute promises. An ordinary photograph should not be described as harmless merely because it is familiar, and a policy guide should not imply that every photograph is automatically used for advanced analysis. Explain the use that is actually in scope. If a proposed new use involves another audience or a different analytical process, identify that change and ask the responsible owner to evaluate it before assuming the existing explanation covers it.

Does a student tag mean the system recognized the person from their face?

No. A recorded association does not establish biometric recognition. Ask how the association was supplied and validated in the actual workflow. The stated shipping boundary is that face recognition is not wired and no face template is computed from a photo.

09 Retention and deletion

Explain what remains, and why.

Retention is a decision about keeping information for a purpose over time. A useful explanation identifies the category of information, the responsible owner, the reason it remains, and the condition that prompts review or another action. A single number presented without that context can mislead a reader into thinking every record and every copy follows one schedule. The actual decision may differ across a student record, an output, a support case, and access evidence.

The inputs for a retention conversation are the record category, its purpose, the applicable organizational instruction, and any relevant preservation question. This page does not prescribe a universal period or determine a legal obligation. Ask the appropriate owner to explain the rule that applies to the activity being reviewed. If that rule is unresolved, preserve the uncertainty rather than filling the gap with a convenient default that no responsible person has approved.

The Custodia retention scheduler is specified but unavailable. No schedule runs from this page, and no reading action creates a deletion timer. The output of a retention review should therefore distinguish the governing decision, the system or person responsible for carrying it out, and the evidence of completion. A written instruction may be necessary, but it is not by itself proof that an archive, deletion, or other handling action occurred.

A family asking for information to be removed deserves an explanation of the actual process and its scope. Identify who can receive the question, what context is needed, and how the responsible owner will evaluate it. Do not promise that every request produces immediate deletion or that every copy can be recalled. The correct answer depends on the information, the relationship, the applicable requirements, and what has already happened in the real workflow.

Consider a fictional publication proof that has been replaced with a corrected version. The new version's existence does not establish the handling of the earlier proof, a downloaded copy, or an attachment in a support case. Ask about the relevant artifacts separately. A clear explanation can say which action was completed and what remains outside its scope. A broad phrase such as “the old data is gone” may conceal the very copy the family is concerned about.

Preservation and disposal questions can intersect during a dispute or review. The responsible owner should evaluate the relevant instruction before a routine action affects material needed for that review. Fides creates no hold, releases no hold, and offers no legal conclusion. Its practical role is to keep the decision visible and to help a reader distinguish an approved handling policy from an observed operation, a future intention, or an unsupported guarantee of total erasure.

If something disappears from my screen, does that establish that every copy was deleted?

No. A change in one view does not establish the handling of every copy or system. Ask what operation occurred, which information it covered, and what limits remain. The responsible owner should explain the actual result without turning a display change into an absolute erasure claim.

10 Family questions

Prepare a request without oversharing.

A family does not need to master a technical vocabulary to raise a useful privacy question. Begin with the activity, the concern, and the answer or change you are seeking. “I want to understand who can see this portrait” and “I believe this association is incorrect” are different requests, and both can be expressed plainly. The responsible recipient can then explain what context is necessary and which process applies.

The initial inputs should be as limited as possible: a general description of the issue, the relevant school or service relationship, and the type of response sought. Keep actual student identifiers, documents, and photographs out of public comments or general policy discussions. Use the approved private channel for the real case. This page contains no request form, upload field, account lookup, or message-sending service, so exploring it submits nothing to a school or vendor.

A prepared question can have four parts: what happened or what you are considering, why it concerns you, what you want explained, and which organization you believe is involved. If the final part is uncertain, say so. The output is a focused starting point for the appropriate owner, not a legal characterization of the event. Avoid adding speculative accusations merely to make the request seem more urgent; the concrete concern should be enough to begin a responsible review.

For a correction question, describe the information believed inaccurate and the intended result through the authorized process. Ask who can validate the correct fact and who can carry out any permitted change. The person who receives the message may need to coordinate those roles. A request being acknowledged does not establish that a correction has occurred, and a corrected future output does not automatically answer what happened to previously distributed material.

For an access question, identify the actor category if known: school staff, vendor support, or another participant. Custodia's vendor trail does not cover the school's own teachers, advisers, or office staff. The family should receive a coordinated explanation if the question spans those boundaries. It should not be necessary to repeat sensitive details to several unrelated recipients just to discover who owns the relevant part of the inquiry.

Ask the actual recipient to explain the next step, the responsible owner, and how the response will reach you. This guide promises no response deadline and creates no tracked case. Keep a record in your own appropriate process of what you asked and what the responsible party actually answered. If the response addresses only part of the concern, identify the remaining question clearly rather than assuming that an official-looking reply resolved the entire matter.

Can I paste a student's full record into a public question to avoid a follow-up?

Use the approved private process and share only what the responsible recipient needs. A general description can establish the kind of question first. A broad public disclosure creates a separate handling problem and may expose details unrelated to the decision you are trying to resolve.

11 Policy changes

A changed sentence can mean a changed decision.

A policy change is useful to a reader when its practical effect is understandable. Ask what changed, which activity it affects, who is affected, and what decision or action follows. A new date at the top of a document does not explain those things. A trust center should help readers compare the meaning of statements rather than requiring them to infer the consequence of a revision from a long uninterrupted block of text.

The inputs for a change review are the earlier applicable statement, the revised statement, the relevant activity, and the responsible policy owner. Verify which version actually applies to the relationship being discussed. Do not assume that the newest public wording retroactively describes every past operation. Equally, do not rely on a remembered sentence without checking its context when an administrator is making a current decision about a proposed use.

The output should distinguish clarification from a substantive change in purpose, audience, recipient, or handling. A rewritten explanation may make the same boundary easier to understand. A new use or wider audience raises a different question. The responsible owner should describe the actual effect and any process that applies. This page does not deliver policy notices, record acknowledgments, or determine whether a particular change requires a particular legal response.

Consider a fictional revision that replaces “school community” with a more specific description of intended recipients. The administrator should ask whether the revision clarifies an existing audience or changes who receives the output. The answer affects how the school explains the activity to families. A clearer phrase is helpful, but clarity alone does not establish that the underlying distribution matched the phrase in every environment or at every earlier time.

A family reading a change should be able to identify where to ask about its effect on an existing activity. If the response depends on the school's decision or a particular service relationship, name that owner. Avoid a circular referral back to the same policy paragraph when the family is asking how it applies to a concrete situation. A useful explanation connects the general statement to the relevant context without disclosing unrelated personal information.

Keep the record of the comparison in the organization's approved process when the change matters to a decision. Preserve enough context to explain why the owner accepted, questioned, or rejected a proposed use. This guide stores no revision history for a school's policies and does not certify the completeness of another document set. Its purpose is to make policy reading active: identify the changed meaning, identify the affected decision, and ask the accountable owner to resolve any remaining ambiguity.

Does a new policy date prove that something important changed for our school?

No. Compare the relevant statements and ask about their practical effect. A date may accompany clarification, a substantive change, or another revision. The responsible owner should explain which activity and decision are affected, rather than leaving the reader to guess from the date alone.

12 When something seems wrong

Keep the concern, the evidence, and the conclusion separate.

A concern may begin with an unexpected image, an unfamiliar access explanation, an incorrect association, or a message that appears to contain information intended for someone else. Start by preserving the concrete observation and identifying the responsible private channel. Avoid publishing the sensitive material in an effort to obtain a faster response. A public discussion can unintentionally widen the audience for the information whose handling is already in question.

Useful inputs include what was observed, when it was observed in the reader's own context, which activity appears involved, and what immediate question needs answering. Do not demand that a family classify the event technically or legally before a responsible person will examine it. The first report can be plain and limited. The accountable owner can explain what additional information is necessary and how to provide it safely.

The output of an initial review should distinguish established facts, possible explanations, and unresolved questions. An unexpected result may indicate a mistake, a misunderstood workflow, an inappropriate disclosure, or something that requires further investigation. Neither reassurance nor alarm should outrun the evidence. Fides does not determine that an event is a breach, make a legal notification decision, or run an incident-response service from this public page.

If the concern involves several organizations, identify an owner for coordinating the explanation. A school-side decision and a vendor-side technical investigation may both be relevant. Keep those responsibilities visible while avoiding repeated redistribution of the same sensitive packet. The family should understand who will address the remaining question, not simply receive several separate messages saying that one narrow part belongs somewhere else.

Consider a fictional case in which a proof contains an unexpected name. The immediate question may be how to prevent further inappropriate use of that proof through the actual school process. The investigation may then examine the intended association, the workflow that produced the output, and the audience that received it. Those questions need different evidence. A corrected proof alone does not establish the answer to every question about the earlier version.

A final explanation should state what was examined, what was found, the limits of the evidence, and any remaining action assigned to a responsible owner. It should protect unrelated people's information while answering the concern in understandable terms. This page creates no case and promises no automatic alert or resolution time. Its contribution is a disciplined way to ask for an accountable response without substituting a broad trust statement for the facts of the event.

Should I call an unexpected result harmless or a confirmed incident before reporting it?

Describe what you observed and use the appropriate private channel. The responsible owner should investigate and explain the conclusion supported by the facts. A precise observation is more useful than a label that assumes either safety or wrongdoing before the relevant evidence has been examined.

13 Reading the evidence

A promise, a design, and an observation answer different questions.

A policy statement explains an intended rule or commitment. A technical design explains how a control is constructed. An observation records something examined in a particular scope and time. Each can be valuable, but they are not interchangeable. A trust-center reader should be able to identify which kind of support an answer provides and ask for the kind needed to make the actual decision. An impressive technical phrase should not obscure that distinction.

The inputs for an evidence review are the claim, the activity it concerns, the supporting material, and the decision that depends on it. Ask what the material directly establishes. A source description may support an explanation of a designed boundary without establishing a particular deployment. A loaded page may show visible content without demonstrating a successful backend operation. A policy document may identify an owner without proving that owner reviewed a specific event.

The output should be a bounded statement of support. For example: “This explanation describes the intended vendor scope; the actual inquiry still needs evidence from the relevant environment.” That sentence is more useful than treating every supporting link as a universal proof. It also makes the next step clear: ask the responsible party for the missing observation or clarification rather than rereading the same general assurance until it feels conclusive.

Use scope, date, and method as reading questions. Scope identifies which people, systems, or activities were examined. Date helps establish whether the material relates to the period under discussion. Method explains what the reviewer actually did and what the result can show. These details do not need to overwhelm a family-facing explanation, but the accountable owner should be able to provide enough context for an appropriate reviewer to assess the conclusion.

Consider a fictional administrator evaluating a statement that a support workflow records vendor access. The administrator should ask which actor scopes are covered and what happens outside that boundary. Custodia's explicit exclusion of the school's teachers, advisers, and office staff matters more to that question than an attractive general claim about auditability. A narrow, accurate explanation can support a sound decision; a broad but unsupported assurance cannot reliably substitute for it.

Fides publishes no certification badge, compliance guarantee, or independently verified assessment of every deployment. If a decision requires a particular audit, contract term, or professional interpretation, obtain the actual applicable material through the appropriate process. The guide's contribution is a method for reading evidence honestly. It helps the reader distinguish supported conclusions, reasonable questions, and facts that remain unestablished, without assuming that a lack of public detail proves either failure or success.

Does a technical explanation or successful page response prove the entire privacy workflow works?

No. Ask which part was described or observed and what result was actually established. Technical design, visible content, configured services, and completed operations are separate evidence questions. The conclusion should remain within the support the available material provides.

14 Understanding and access

The explanation must work for its reader.

Plain language is a practical control on misunderstanding. A policy explanation should help a reader identify the activity, the responsible organization, the important limits, and the next step without requiring specialist knowledge. Shorter wording is not automatically clearer if it removes the distinction the reader needs. The goal is an accurate explanation that an administrator can use and a family can question, not a simplified slogan that conceals the decision.

Bring the intended audience, the decision they face, and the terms that may be unfamiliar. A family may not know the difference between a vendor administrator and school office staff. An administrator may need to distinguish a policy owner from a technical operator. Define those relationships through the actual work they perform. Avoid assuming that a familiar platform word carries the same meaning for every reader or every school community.

A useful output is a layered explanation: a clear first statement, a concrete example, and a way to explore the important limit. The native disclosures on this page follow that pattern. Opening one reveals an answer in the page; it does not send information or record a choice. The headings and chapter links provide another route through the material, so a reader can begin with a particular concern instead of reading every topic in sequence.

Test comprehension by asking a reader to restate the decision and the next step. If the explanation says a vendor trail covers platform administrators, can the reader tell that it excludes the school's own teachers? If a paragraph describes a retention instruction, can the reader distinguish the instruction from proof of deletion? Those questions reveal whether the writing preserves the important boundary more effectively than asking whether the paragraph sounds professional.

Language access and accessibility can affect whether a person receives a meaningful explanation. The responsible organization should consider the actual audience and the available ways to communicate. This page does not promise a live translation service, an interpreter booking, or a particular accommodation outcome. It does provide semantic headings, keyboard-operable native disclosures, visible focus states, and a layout intended to remain readable across screen sizes. Those are page features, not a blanket certification of every service.

When translating or summarizing a policy, preserve the consequential distinctions. A phrase about one actor scope should not become “all staff” for convenience. A limited handling result should not become an absolute guarantee. An authorized reviewer should compare the meaning of the explanation, especially where a changed word could alter a person's understanding of purpose, audience, or choice. Good communication respects the reader by making the actual boundary easier to see.

Should a family-facing version remove all limitations to make the policy easier to read?

Keep the limits that affect the person's understanding and explain them plainly. A readable summary can omit unnecessary detail while preserving scope, responsibility, and uncertainty. Removing those distinctions may produce a shorter paragraph, but it can leave the reader with the wrong answer.

15 Current boundaries

The page says exactly what it can do.

Fides is a public policy-reading guide. It does not connect to a student's record, save a preference, submit a request, verify identity, or change a school's configuration. The native disclosure controls open explanations in the page and nothing more. There is no hidden success state that suggests a real case was created. A reader who needs an operational action must use the appropriate authorized process with the organization responsible for that action.

Money actions are off here. This surface offers no checkout, payment collection, payout, refund, or Stripe connection. A discussion of a product or school activity does not establish that a provider is configured or that a financial operation succeeded. No price display, payment promise, or activatable financial control is supplied by this guide. If a separate workflow involves money, its own authorization, configuration, and actual result need to be examined independently.

AI processing is unavailable on this surface. The page sends no student record, photograph, policy question, or private case material to an AI provider. An unconfigured or unavailable provider is a refusal to run the operation. No generated answer is automatically applied to records or treated as the decision of an accountable school official. A policy explanation should not imply an unseen assistant can resolve a request that the page has never received.

Face recognition is not wired in the shipping configuration; no face template is computed from a photo. That boundary remains relevant when a family reads about photographs or student associations. The guide does not offer recognition, identity inference, or a route to activate those operations. Ask how the actual association is supplied and validated through the permitted workflow. Do not infer a biometric capability from a label, a portrait, or a broad reference to modern technology.

Retention scheduling is specified but unavailable. This page runs no deletion calendar, creates no preservation instruction, and certifies no completed disposal. It also makes no compliance guarantee or determination about a particular legal request. Those limits do not prevent a useful conversation; they define the information the reader needs from the responsible owner. A clear refusal is preferable to an interactive-looking control whose result cannot be substantiated.

Use the boundary to choose the next step. For a family question, identify the school or service owner and the approved private channel. For a policy review, identify the applicable statement and the decision it supports. For a technical concern, seek relevant technical evidence rather than assuming this outward explanation is an architecture audit. The output of Fides is a clearer understanding and a better prepared question, with no invented claim that a backend action occurred.

Why does a trust center need to state that certain actions are unavailable?

Readers should know when a page explains an action without performing it. Clear present boundaries prevent a disclosure click or a product discussion from being mistaken for consent, a submitted request, a payment, or a completed record change. That clarity is part of the policy explanation itself.

16 A worked conversation

Turn a broad concern into an accountable answer.

Imagine a fictional family asking a school, “What happens to our child's photograph?” The question is broad because the family may be thinking about several things at once: the purpose of the image, the people who can see it, the accuracy of its association, and how long copies remain. A useful first response acknowledges the whole concern and then separates the questions so that each can reach the person able to answer it.

Begin with purpose and audience. The school explains the activity under discussion and identifies who decides the intended use. The family can then ask whether the explanation covers a particular publication, a review proof, or another output. If the audience differs between stages, the response should say so. An answer about the final publication should not silently stand in for an explanation of every intermediate copy or support handoff.

Next, identify the association and access questions. If the family believes the portrait is attached to the wrong class, the school should identify who validates the intended fact and how a correction is considered in the actual workflow. If the concern includes vendor support access, the response should preserve Custodia's platform-administrator boundary. It does not log the school's own teachers, advisers, or office staff, so a school-side question needs its own owner.

Then address retention and distributed material. Ask what information remains, why it remains, and which actual process governs any requested change. The unavailable retention scheduler cannot be presented as a running deletion service. A corrected future output does not prove that an earlier copy was recalled. The responsible explanation may establish some facts and leave others open, with a named owner for the remaining question. That is a legitimate, reviewable outcome.

The resulting answer can be concise without becoming vague: identify the activity, explain the relevant responsibility, state what the evidence supports, and name the next step. Keep personal references in the approved private process and omit unrelated students' information. The family should not need to understand database architecture to grasp the answer. An administrator should still be able to trace the explanation to the actual policy and evidence that support it.

Before closing the conversation, ask whether the response answers the concern the family actually raised. A technically correct answer about storage may leave an audience question untouched. A description of school policy may leave a disputed vendor event unexplained. Fides's reading room encourages that final check: what is answered, what remains open, and who owns the next decision? A trust center succeeds when the reader can act on that distinction without being asked to accept an unsupported general assurance.

What can an administrator and a family agree on even when part of the answer remains open?

They can agree on the specific question, the information already established, the remaining uncertainty, and the person responsible for the next response. That shared account creates a useful basis for continued review without pretending that an incomplete investigation has reached a universal conclusion.

A note to the reader

A precise open question
is useful progress.

Identify the activity, the responsible organization, and the answer you still need. Use the approved private process for actual student references. A trust center should make that next conversation clearer without pretending that reading a page has resolved the case.

Return to the orientation