Privacy

Bellwork is a school-intelligence platform operated by Bellwork, Inc. When this policy says "Bellwork", "we", "us", or "our", that's who we mean.

If you need to reach us about anything in this policy — questions, requests, complaints — write to [email protected].

This policy describes the data we collect when you use Bellwork's website, web application, API, and AI assistant (together, the Service), what we do with that data, who we share it with, and the choices you have about it.

It applies to data about you — your account, your activity, your billing. It does not govern Bellwork's reference dataset about public schools and districts, which is described separately in section 5.

We collect only what we need to run the Service:

• Account data. Email address, name, and (if you sign in with Google) your Google profile basics. We use Supabase Auth for sign-in and session management.
• Organization data. If you create or join an organization, the org name, your role, and (for invited users) who invited you.
• Billing data. Stripe customer ID, subscription status, plan allowances, and transaction history. We do not see or store card numbers — Stripe handles them.
• Usage data. The actions you take in the app (searches, filters, exports, AI chat prompts and responses, contact reveals), timestamps, and basic device/browser info (IP address, user-agent, viewport size) used for security, rate-limiting, debugging, and product analytics, and recordings of sessions with their text and form inputs masked (section 7).
• Communications. Anything you send to us — emails, support requests, feedback.

We use your data to:

• Provide, secure, and maintain the Service.
• Authenticate you, control access, and prevent fraud and abuse.
• Process payments and manage your subscription.
• Respond to support requests and notify you about important account or service events.
• Improve Bellwork — fix bugs, prioritize features, monitor performance, and understand how the product is used in aggregate.

We do not sell your personal data. We don't run ad networks on Bellwork and we don't share your data with advertisers.

Bellwork compiles and analyzes public information about U.S. K-12 schools and districts — directory data published by the National Center for Education Statistics (NCES) and state education agencies, state assessment results, district websites, public board minutes, public staff directories, and similar publicly available sources.

This dataset is not student data. We do not collect, store, or process student personally identifiable information (PII) and Bellwork is not a FERPA-regulated service. Where staff contact information appears in the Service, it is professional contact information published by the district for the purpose of being contacted.

If you are a school staff member and want your professional contact information removed from Bellwork, email [email protected] from a verifiable district email address and we will remove it.

We use the subprocessors below to run the Service. Each receives only the data it needs for its part:

• Hosting and storage. Supabase (database, authentication, and file storage, hosted on AWS in the U.S. region us-east-1) holds your account and application data. Vercel hosts the application and handles every request. Cloudflare R2 stores the public board-meeting and RFP documents we collect. Redis Cloud keeps rate-limiting counters.
• AI models.When you use an AI feature — the assistant, research columns, briefs, meeting summaries, drafted emails, or reading a document — the prompt and the context it needs (your instructions, the records involved, and public documents) are sent to a model provider to produce the result. We use a combination of open-weight models hosted in the United States, with Anthropic's Claude and Google's Gemini for the assistant and for drafting. Requests reach these models through OpenRouter or the Vercel AI Gateway, which pass them on to the company hosting the model.
• AI tracing. LangSmith records the prompts, outputs, and tool calls of AI requests so we can debug them and check their quality and cost.
• Web research. Tavily, or Firecrawl when we use it instead, receives the searches and page addresses the AI uses to research the open web.
• Email verification. Hunter receives the published work email addresses of school staff (section 5) to check that they still deliver.
• Connected mailboxes and LinkedIn. Unipile, only if you connect an account. See section 6A.
• Payments. Stripe handles all card data and produces invoices and receipts. See Stripe's own privacy policy for details.
• Product analytics. PostHog and Mixpanel receive page views and feature usage, and Vercel Analytics receives page views. PostHog records signed-in sessions and Mixpanel a sample of all sessions, with every piece of text and every form input masked. PostHog also receives the errors your browser runs into. See section 7.
• Sign-in. Google, only if you choose Google sign-in. Google receives the authentication request and returns your profile basics.
• Internal notifications. Resend and Slack carry notices to our own team, such as a request to talk to sales.
• CRMs you connect. If you connect Attio, Salesforce, Freshsales, HubSpot, or a webhook of your own, it receives what you choose to send it.

We also share data when we're legally required to (court order, subpoena, lawful regulatory request), or when necessary to protect the rights, property, or safety of Bellwork, our users, or the public.

If you connect an email account (Gmail, Outlook, or IMAP) or a LinkedIn account to send outreach, you sign in on the provider's own page through Unipile, our messaging integration provider. Bellwork never receives your password. Unipile holds the provider token; we hold an account identifier and call through it.

What we read. To show replies and file your correspondence with districts, we read recent messages from the connected mailbox. We keep only messages that are with a person or organization Bellwork tracks: a contact in your workspace, a contact in our education database, an address at a district or school's own domain, or a reply on a thread we started for you. Personal mail, newsletters, and mail with anyone else are not stored. If you ask us to import your history, the same rule applies to the older messages we read.

What we send. Messages you approve or schedule go out from your own account, in your name. If your organization has chosen to add its postal address or an opt-out line under every message, those are appended as written in your settings. A person you mark as do-not-contact is never written to again.

Disconnecting. You can disconnect an account at any time from Sending accounts; this revokes Unipile's access. Messages already filed against a district stay on that district's timeline unless you delete them.

Google user data received through a connected Google account is used only to provide these features and is never used for advertising or sold. Our use complies with the Google API Services User Data Policy, including its Limited Use requirements.

Bellwork uses cookies and similar browser storage for two purposes:

• Essential — keep you signed in (session cookies), remember your preferences, and protect against cross-site request forgery. The Service does not work without these.
• Product analytics — PostHog and Mixpanel measure page views and feature usage and record sessions with their text and form inputs masked; Vercel Analytics counts page views. These are third-party services; PostHog's requests go through our own domain. No advertising trackers.

You can clear cookies in your browser at any time; doing so will sign you out.

We keep account and usage data for as long as your account is active. When you ask us to delete your account, we remove personally identifiable data from active systems within 30 days of the request, and from encrypted operational backups within 90 days.

We may keep transactional billing records longer if required for tax, accounting, or legal compliance.

You can, at any time:

• Access and update your account information from settings.
• Export your data on request.
• Delete your account by emailing [email protected]. There is no self-serve deletion in settings; we handle each request ourselves, as described in section 8.
• Opt out of non-essential product emails from the unsubscribe link in any such email.

Depending on where you live, you may have additional rights under laws like the GDPR (EU/UK) or CCPA/CPRA (California) — including the right to request access, correction, deletion, portability, or to object to or restrict certain processing. Email [email protected] and we'll handle the request.

Bellwork is a business-to-business tool. It is not directed to children and we don't knowingly create accounts for anyone under 18, or collect personal data about anyone under 13. If you believe a child has signed up, email us and we'll remove the account.

Every connection uses HTTPS. Your browser never queries the database directly: our servers do, on your behalf. Each request is checked for who you are and which organization you belong to, and every query it makes is limited to that organization's data. That server-side check is the main control. The database roles a browser could use have no access to its tables at all, and row-level security policies remain on customer tables as a second layer.

Data is encrypted at rest by Supabase, our database host. The credentials for CRMs you connect are also sealed with AES-256-GCM before they are stored, and API keys are stored only as hashes. Supabase keeps regular backups.

No system is perfectly secure. If you spot a vulnerability, please report it to [email protected] with the subject line "Security report" before disclosing publicly.

Bellwork is operated from the United States. Your account and application data is stored by Supabase in the U.S. (AWS us-east-1). The other subprocessors in section 6 primarily process data in the U.S. but may transfer it to other regions for service availability. By using Bellwork, you understand your data will be processed in the United States and in any other country where our subprocessors operate.

If we make material changes to this policy, we'll update the "last updated" date at the top and — for changes that affect how we use existing user data — we'll email you. Continuing to use the Service after the update means you accept the revised policy.

Questions, requests, or anything else — [email protected].