BehaviorLog Pro

← Back to BehaviorLog Pro

Effective Date: April 10, 2026  |  Material update effective: July 10, 2026  |  Last Updated: July 5, 2026

1. Introduction

BehaviorLog Pro is a web-based behavior tracking and analysis application developed by Sure Step Education for use by special education professionals in K–12 school settings. The application enables teachers to record student behavioral data (frequency, duration, intensity) during classroom observations, and enables licensed behaviorists and school psychologists to conduct structured behavioral observations, administer functional assessment screening tools (QABF, FAST), score assessment results, manage behavioral goals, and generate Behavior Intervention Plans (BIP) and Functional Behavior Assessments (FBA). Access is organized by school district and by user role (teacher, behaviorist, school psychologist, district administrator, and Sure Step administrator), as described in §7.5–§7.6.

BehaviorLog Pro is accessible at blp.surestepeducation.com and is designed exclusively for educational purposes.

This Privacy Policy describes how Sure Step Education collects, uses, stores, and protects information in connection with BehaviorLog Pro. This policy is designed to comply with:

• The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g
• The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506
• The Student Online Personal Information Protection Act (SOPIPA), Cal. Bus. & Prof. Code § 22584
• California Education Code § 49073.1 (AB 1584)

2. Definitions

Local Educational Agency (LEA): A school district, county office of education, or charter school that contracts with or authorizes the use of BehaviorLog Pro.

Pupil Records: Any information directly related to a student that is maintained by the LEA or by a party acting for the LEA, as defined under FERPA and California Education Code § 49061.

Personally Identifiable Information (PII): Information that can be used to distinguish or trace an individual student's identity, including but not limited to: name, date of birth, student identification number, behavioral records, and assessment data.

Operator: Sure Step Education, the entity that operates BehaviorLog Pro and processes pupil records on behalf of the LEA.

Third Party / Provider: Any external service that processes data on behalf of the Operator in connection with BehaviorLog Pro, as referenced in Education Code § 49073.1.

3. Information We Collect

3.1 Student / Pupil Records

• Student first name, last name
• Date of birth
• Student identification number
• Grade level
• School and district name
• Behavioral observation data: frequency counts, duration measurements, intensity ratings, latency measurements
• Antecedent-Behavior-Consequence (ABC) data
• Session notes and observational summaries
• Functional assessment responses (QABF and FAST instruments)
• Assessment scoring results and identified behavioral function categories
• Behavioral goals and progress data
• Linked behaviorist / shared-specialist assignment, and specialist-defined behavior targets and operational definitions
• Where an LEA uses both BehaviorLog Pro and DailyWins (another Sure Step Education product), a student's first name, last name, grade level, and DailyWins record identifier may be received automatically from DailyWins at single sign-on (see §7.7)

3.2 Teacher / Staff Information

• Full name and profile avatar (from Google sign-in, where used)
• Email address (from Google sign-in, or entered at email/password registration)
• Account password — applicable only to email/password accounts, and stored solely as a salted bcrypt hash by our authentication provider; never in plaintext and never accessible to Sure Step Education staff (see §7.2)
• User role (teacher, behaviorist, school psychologist, district administrator, or Sure Step administrator)
• Assigned school district and, where configured, site/school
• Where single sign-on from DailyWins is used, the educator's email address, role, and school are received from DailyWins to sign them in and place them in the correct district (see §7.7)

3.3 Technical Information

• Authentication session tokens
• Browser type and version (standard HTTP headers)
• A local copy of the signed-in user's own authorized data is cached in the browser's local storage to support offline use and faster loading; it remains on that device only and is removed when the user signs out
• No IP addresses, device identifiers, or tracking cookies are collected or stored by BehaviorLog Pro

4. How We Use Information

All information collected through BehaviorLog Pro is used exclusively for the following educational purposes:

• Recording and analyzing student behavioral data during classroom observations
• Conducting functional behavioral assessments and screening
• Scoring assessment instruments (QABF, FAST) to identify behavioral functions
• Generating Behavior Intervention Plans, Functional Behavior Assessments, and behavioral goals, using AI-assisted drafting on de-identified data as described in §7.3
• Allowing district administrators to upload standardized BIP, FBA, and goal document templates — containing formatting and section structure only, not student data — to guide AI-assisted document generation for specialists within their district
• Providing behaviorists with aggregated data visualizations and analytics
• Facilitating collaboration between teachers and specialists: a teacher may grant a behaviorist or school psychologist read access to a specific student, and those specialists may define behavior targets and operational definitions that the connected teacher then uses for that student
• Sending assessment forms to respondents (parents, teachers, staff) via email
• Managing user accounts, roles, and access permissions, and organizing access by school district (including district-administrator management of users within their own district)
• Providing single sign-on from DailyWins for LEAs that use both Sure Step products — signing the educator in, associating them with the correct district, and creating or updating the handed-off student's name and grade in that teacher's roster (see §7.7)

5. Prohibited Uses

Sure Step Education will NOT:

1. Use any student PII for targeted advertising or marketing purposes
2. Create or build non-educational profiles of students
3. Sell, rent, trade, or otherwise transfer student PII to any third party
4. Disclose student PII to unauthorized parties
5. Use student data for any purpose unrelated to the educational services provided
6. Use student data for commercial purposes of any kind
7. Retain student data beyond the period required to fulfill educational purposes or as required by applicable law

6. Ownership and Control of Pupil Records

All pupil records collected, maintained, or generated through BehaviorLog Pro remain the property of and under the control of the Local Educational Agency, in accordance with California Education Code § 49073.1.

Sure Step Education acts solely as a custodian of pupil records and operates as a School Official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)). Sure Step Education does not claim ownership of any student data processed through BehaviorLog Pro.

The LEA retains full authority to access, review, correct, and request deletion of any pupil records maintained by BehaviorLog Pro.

7. Data Storage and Security

7.1 Data Storage

All data processed by BehaviorLog Pro is stored on servers located within the United States:

• Database and authentication: Supabase (AWS infrastructure, US regions)
• Application hosting and serverless functions: Vercel (US regions)
• A local copy of the signed-in user's own authorized data may be cached in browser local storage to enable offline use and faster loading; this cache is limited to that user's authorized data, remains on that device, and is removed when the user signs out
• District document templates: a district administrator may upload the district's standardized BIP, FBA, and goal document templates, which are stored as structure guides (section headings and formatting) shared with that district's specialists. Uploaded template files (.txt, .pdf, or .docx) are converted to plain text within the user's browser before storage; these templates are not pupil records and are not intended to contain student personally identifiable information
• Assessment responses submitted via emailed links: when a behavior specialist emails a QABF or FAST assessment form to a respondent (parent, teacher, or staff member), the emailed link contains a single-use, randomly generated token. The respondent's completed responses are transmitted over HTTPS to our database and are readable only by the specialist who sent that link (enforced by Row-Level Security); the token cannot be reused after one submission. If the form is opened without a valid link token (for example, completed together in person on the specialist's device), responses are saved only in that device's browser storage and are not transmitted

7.2 Security Measures

• TLS 1.2+ encryption for all data in transit (HTTPS enforced)
• AES-256 encryption for data at rest (provided by Supabase/AWS)
• Authentication via Google OAuth 2.0 or email/password. For email/password accounts, credentials are stored only as salted bcrypt hashes by our authentication provider (Supabase) — never in plaintext and never accessible to Sure Step Education staff
• Row-Level Security (RLS) policies on database tables restricting each user to their authorized data — their own records, plus the specific district-scoped or shared-student data an administrator or specialist is authorized to access
• Role-based access control (teacher, behaviorist, school psychologist, district administrator, Sure Step administrator) enforced at both the application and database levels
• API keys stored exclusively as server-side environment variables, never exposed to the browser
• Serverless proxy architecture for all third-party API calls
• Invite-based registration system preventing unauthorized account creation

7.3 AI-Powered Features

BehaviorLog Pro uses the Anthropic API (Claude) to generate draft Behavior Intervention Plan (BIP), Functional Behavior Assessment (FBA), and behavioral goal documents from the behaviorist's own structured observation data for a student.

Before any data is transmitted, BehaviorLog Pro de-identifies it within the user's browser: the student's name, the names of other students on the user's roster, and staff names known to the application are removed and replaced with neutral placeholders (for example, "[STUDENT]" and "[BEHAVIORIST]"). Only this de-identified text is sent to the Anthropic API through a secure server-side proxy. The real names are re-inserted locally, on the user's own device, after the draft is returned — they are not part of the transmitted request. The de-identified text is presented to the user for review and requires the user's explicit confirmation before any transmission occurs, and the user may edit that text to remove additional details at that point.

This de-identification operates on the names known to the application and is not a guarantee that every possible identifier has been removed. Names of individuals who are not on the user's roster, or other identifying details typed into free-text notes, may remain unless the user removes them at the review step. Users are instructed to review the de-identified text and remove any remaining identifying details before sending.

Anthropic does not train its models on, or retain, data submitted through its API for these requests. All generated documents are drafts that must be reviewed, edited, and approved by a licensed behaviorist before use in any official record.

7.4 Designated Responsible Individual

Name: Nicholas Crabtree
Title: Co-Founder, Sure Step Education
Email: nicholas@surestepeducation.com

7.5 User Roles and District Organization

Access is organized by school district, and each user holds a role that determines what they can see and do:

• Teacher — records behavioral data for their own students.
• Behaviorist / School Psychologist — conduct assessments, define behavior targets and operational definitions, manage goals, and generate BIP/FBA documents; may be granted read access to a specific student by that student's teacher.
• District Administrator — manages users and invitations within their own district, and for oversight and recordkeeping can read (and, on request, delete) the student records and behavioral data held by any user in their own district. A district administrator never sees data from another district.
• Sure Step Administrator (Founder) — Sure Step personnel who provision districts and oversee organization-level information such as per-district user counts and contract/billing details. In the ordinary course they see only this organization-level information and do not view student or staff records, except via the audited support access described in §7.6.

7.6 Administrative Access, Support ("Break-Glass") Access, and Audit Logging

To provide technical support and troubleshooting, authorized Sure Step personnel may temporarily sign in to and view the application as a specific user ("break-glass" access). Consistent with Sure Step Education's role as a School Official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)), such access is limited to legitimate support and educational purposes. During break-glass access the application presents a read-only support view: record changes are disabled in the interface for the duration of the session, and the session itself is audit-logged as described below.

BehaviorLog Pro maintains an audit log of sensitive administrative actions — including break-glass access, data export, data deletion, and changes to a user's role or district assignment — recording who performed the action, the affected account, and the time it occurred. Audit records are available to Sure Step Administrators and, for actions scoped to a single district, to that District Administrator.

7.7 Connection with DailyWins (Sure Step Single Sign-On)

BehaviorLog Pro and DailyWins are both products of Sure Step Education. Where an LEA uses both, an authorized DailyWins user may open BehaviorLog Pro directly from DailyWins through a secure single sign-on (SSO) link. When this occurs, DailyWins transmits to BehaviorLog Pro a short-lived, cryptographically signed token containing: the educator's email address and role, the school's DailyWins identifier and name, and — when a teacher opens a specific student — that student's DailyWins identifier, first and last name, and grade level.

BehaviorLog Pro uses this information solely to sign the educator in, associate them with the correct district, and create or update the corresponding student's name and grade in that teacher's roster (kept in sync with DailyWins at each sign-on). No behavioral observation data, assessment responses, goals, or generated reports are transmitted through this connection. Each SSO sign-in is recorded in the audit log described in §7.6.

Because DailyWins is a Sure Step Education product and not a third party, this is an internal transfer between systems operated by Sure Step Education on behalf of the same LEA; the data remains subject to this policy and the LEA's agreements. Data collected within DailyWins itself is governed by the DailyWins privacy policy.

8. Breach Notification

In the event of an unauthorized disclosure of, or access to, pupil records, Sure Step Education will:

• Notify the affected LEA within seventy-two (72) hours of discovering the breach
• Provide a detailed description of the nature and scope of the breach
• Identify the types of information involved
• Describe the steps being taken to investigate and remediate the breach
• Describe measures being implemented to prevent future occurrences
• Notify affected parents and guardians as directed by the LEA and in accordance with applicable law

9. Parental Rights

Parents and guardians of students whose data is maintained in BehaviorLog Pro have the right to:

• Review their child's pupil records maintained in the system
• Request correction of inaccurate records
• Request deletion of their child's records

All parental requests should be directed to the student's school or LEA. Sure Step Education will cooperate promptly with any LEA request to facilitate parental rights under FERPA and California Education Code § 49061 et seq.

10. Pupil-Generated Content

BehaviorLog Pro does not collect content directly generated by students. All data in the system is entered by authorized school personnel (teachers, behaviorists, administrators) or by assessment respondents (parents, teachers, staff) completing functional assessment screening tools.

If future features introduce pupil-generated content, this policy will be updated to describe how students retain possession and control of such content and how it may be transferred to personal accounts.

11. Data Retention and Deletion

Sure Step Education retains pupil records only for as long as necessary to fulfill the educational purposes described in this policy, or as required by the LEA or applicable law.

Upon termination of the agreement with an LEA, or upon request by the LEA:

• User access to the organization's account is disabled promptly upon termination; pupil records are securely retained (but no longer accessible to users) during the return-and-deletion window below
• All pupil records will be returned to the LEA in a machine-readable format (JSON export)
• All pupil records will be deleted from BehaviorLog Pro systems within sixty (60) days
• Sure Step Education will provide written certification of deletion to the LEA
• Backup copies will be purged according to standard data lifecycle procedures, not to exceed ninety (90) days

12. FERPA Compliance

Sure Step Education operates as a School Official with a legitimate educational interest under 34 CFR § 99.31(a)(1). In this capacity:

• We perform institutional services or functions that the LEA would otherwise perform itself
• We are under the direct control of the LEA with respect to the use and maintenance of education records
• We use education records only for authorized educational purposes
• We meet the criteria set forth in the LEA's annual notification of FERPA rights
• We maintain jointly with the LEA all records and compliance documentation required under FERPA

13. SOPIPA Compliance

In compliance with the Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584), Sure Step Education:

• Does not use student information for targeted advertising
• Does not use student information to create advertising profiles
• Does not sell student information
• Does not disclose student information except as described in this policy for educational purposes
• Implements and maintains reasonable security procedures
• Deletes student information upon request or when no longer needed for educational purposes
• Does not make material changes to this privacy policy without prior notice

14. COPPA Compliance

BehaviorLog Pro is a teacher-facing and staff-facing application. Students do not directly interact with or input data into BehaviorLog Pro. All student behavioral data is entered by authorized school personnel.

The QABF and FAST assessment forms are completed by adult respondents (parents, teachers, staff) and do not collect information directly from children under 13.

Accordingly, COPPA's parental consent requirements for direct collection from children do not apply. If future features introduce student-facing functionality, Sure Step Education will obtain verifiable parental consent or rely on the school consent exception under 16 CFR § 312.5(c)(1).

15. Third-Party Services and Subprocessors

Service	Purpose	Data Processed
Supabase	Database hosting, user authentication, cloud storage	All user and student data, authentication tokens
Google OAuth	Optional user sign-in (email/password, handled by Supabase Auth, is the alternative)	Email address, display name, profile avatar
Vercel	Application hosting and serverless function execution	HTTP requests, environment variables (API keys)
Resend	Transactional email delivery (assessment links, share notifications, invites, password resets)	Recipient email address and email content. Because some of these messages identify the student they concern (for example, an assessment request or a "student shared with you" notice), a student's name may appear in the subject line or body of those emails. No other student records (behavioral data, assessments, goals) are sent through Resend. Unlike the Anthropic transmission, these emails are not de-identified.
Anthropic (Claude API)	AI-assisted report generation (BIP, FBA, Goals)	De-identified behavioral data — student, peer, and staff names are removed and replaced with placeholders before transmission (see §7.3)

Sure Step Education ensures that all third-party subprocessors maintain security practices consistent with the obligations described in this policy. No subprocessor is authorized to use student data for any purpose other than providing the specific service described above.

16. Changes to This Privacy Policy

Sure Step Education will provide at least thirty (30) days written notice to all affected LEAs before making material changes to this privacy policy. The updated policy will be posted at the BehaviorLog Pro website with a revised effective date.

Non-material changes (typographical corrections, formatting) may be made without advance notice.

17. Data Processing Agreements

Sure Step Education is prepared to enter into Data Processing Agreements with LEAs to formalize data protection obligations. We support:

• The California Student Data Privacy Agreement (CSDPA) template, developed by CITE (California IT in Education, formerly CETPA)
• The National Student Data Privacy Agreement template, developed by the Student Data Privacy Consortium (SDPC)
• Custom district-specific data privacy agreements as required

18. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or BehaviorLog Pro's data practices, please contact:

Organization: Sure Step Education
Contact: Nicholas Crabtree, Co-Founder
Email: nicholas@surestepeducation.com
Product URL: https://blp.surestepeducation.com