Privacy notice

What this notice covers

starflow is an internal STAR Education system for preparing monthly site operating budgets. This notice describes the personal information it holds, why, who can see it, and how long it is kept.

Information about children

starflow holds children's names alongside the payments their families have made, imported from the STAR payment collection reports, and daily attendance counts — how many children attended each site each day, split by grade band. Attendance is held as numbers per site per day; it does not name individual children. Payment records do name them, because that is how the report identifies a payment.

Information about staff

Names, job titles, working hours, hire dates, site, and — where it has been entered — hourly pay rates. Also the email address of anybody who can sign in, their role, and a record of their sign-ins.

Where it comes from

The district's attendance tracker (through STAR Counts), STAR portal payment and enrolment exports, site personnel reports uploaded by STAR staff, and figures typed in directly. starflow does not collect anything from families or staff directly, and it has no public-facing pages.

Why it is held

To prepare and check site budgets, to work out grant income from attendance, to compare staffing against the ratios the programs require, and to keep a record of what was filed and when. It is not used for marketing, is not sold, and is not shared with anybody outside STAR except where STAR is required to report it (for example to the district or a funder).

Who can see it

Access is by role. Administrators see everything. Cluster leaders see only their own cluster's sites. A no-money role sees people, hours, rooms and counts but not one pay rate or budget figure. A site role sees only their own site's daily count form and staff list, and no pay rates at all. These limits are enforced by the application on every request, not by hiding links.

How it is protected

Sign-in is restricted to STAR Google Workspace accounts, and a Google account alone is not enough — the person must also have been given a role. Failed sign-ins are rate-limited. Traffic is encrypted. Saves, deletions and restores are recorded with who performed them. Honestly stated: a shared password also currently grants administrator access as a fallback. That is a known weakness, it is intended to be retired, and until it is, anyone holding it can reach everything described above.

Where it is stored, and backups

On a hosted server in the United States (Railway), on storage that persists separately from the application. A backup is written automatically every six hours and the most recent thirty are kept, so information can survive a mistake or a failure. Backups contain the same information as the system itself, except that payment reports are summarised rather than included in the downloadable backup.

How long it is kept

Budgets, attendance and staff records are kept for as long as they are needed for budgeting, reporting and audit. Attendance is kept indefinitely and deliberately: the district's tracker only shows about twelve school days, so a day not kept here cannot be recovered anywhere. A deleted budget goes to a bin and can be restored; permanent deletion is available to named administrators only and cannot be undone.

Questions, corrections and concerns

If you believe information here is wrong, should not be held, or has been seen by somebody who should not have seen it, tell a STAR administrator straight away. Corrections are made in the system itself so the record stays accurate rather than being worked around.