Privacy Policy

The Six Shifts, LLC ("Six Shifts," "DIG," "we," "us," or "our") is a Minnesota limited liability company that provides DIG (Decoding Inventory for Growth), an educator-operated literacy assessment and progress-monitoring service, together with related websites, account services, customer support, and business communications (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through the Services.

DIG is designed for adult educators and other adult account holders. Students do not create DIG accounts, log in, or interact directly with the online assessment platform. Authorized adults enter and manage student information for educational purposes.

1. Scope and Relationship to School Agreements

This Policy applies to TheSixShifts.com, DecodingInventory.com, my.decodinginventory.com, the DIG assessment platform, customer-support and business communications, and related online services controlled by Six Shifts. It does not replace a school or district privacy notice or the school’s own legal obligations.

When DIG processes Student Data for a school, district, charter operator, private school, or other educational organization under a written agreement, the applicable institutional agreement and Student Data Privacy Addendum control over this Policy to the extent of any conflict concerning Student Data.

2. Information We Collect

2.1 Adult account, customer, and business information

Name, email address, telephone number, role, school or organization, and account/authentication information.

Subscription, purchase-order, invoice, transaction, and payment-related information. Payment card data is processed by our payment processor; we do not need to store full payment card numbers in DIG.

Contact-form, newsletter, demo, pricing, professional-development, customer-support, and other communications.

Information contained in recorded webinars or training sessions when recording is disclosed to participants. DIG’s stated practice is not to display participant faces or voices in those recordings and not to display or attribute participant chat directly.

2.2 Student Data entered or generated by authorized adults

Depending on the account type and enabled features, DIG may process:

Student first name and, for institutional accounts where enabled, full last name. Individual educator accounts may be limited to first name and last initial.

Grade level, class, school, and assigned educator.

Assessment dates, skills and subskills assessed, responses/results, scores, points, performance classifications, and longitudinal progress history.

Internal identifiers and relationship fields needed to associate a student with the correct educator, class, school, and assessment history.

DIG is not intended to collect student email addresses, telephone numbers, home addresses, dates of birth, Social Security numbers, government/student identifiers, photographs, parent contact information, health information, disability or IEP information, disciplinary information, or other sensitive student information unless a future feature is separately reviewed and our applicable notices and agreements are updated.

If a notes or other free-text field is made available, it is intended only for limited instructional information relevant to the assessment. Users should not enter health information, disability or IEP information, disciplinary information, parent contact information, government identifiers, or other sensitive student information unless DIG expressly enables a field for that purpose and the applicable notices and agreements have been updated.

2.3 Website and technical information

When adults visit our public websites or use adult-facing portions of the Services, we and our service providers may collect IP address, browser and device information, operating system, referring and exit pages, timestamps, cookie or similar identifiers, and usage or diagnostic information. Our public marketing website may use Google Analytics, Google Tag Manager, Meta/Facebook Pixel, advertising cookies, and retargeting or remarketing technologies.

We do not intend to place advertising or retargeting technologies on authenticated DIG assessment pages that contain or expose Student Data.

3. How We Use Information

Provide, administer, secure, maintain, troubleshoot, and improve the Services.

Create and manage adult accounts, institutional seats, subscriptions, billing, purchase orders, and customer support.

Administer educator-operated literacy assessments and provide authorized users with assessment results, reports, instructional information, and progress history.

Send service, security, transactional, billing, and administrative communications.

Send promotional communications to adults who sign up for marketing or otherwise may lawfully receive them, subject to opt-out rights.

Analyze use of the public marketing website and adult-facing features, measure advertising effectiveness, and improve marketing, subject to applicable law and available privacy choices.

Prevent fraud, investigate security or misuse, enforce agreements, protect rights and safety, and comply with law.

4. Special Rules for Student Data

We treat identifiable Student Data differently from ordinary website and adult-user information. When DIG processes Student Data for an educational institution, DIG acts as a service provider to that institution and, where applicable, may be designated as a school official under FERPA subject to the institution’s control and the governing agreement.

We use identifiable Student Data only to provide, secure, maintain, support, and administer the educational Services, or as otherwise expressly authorized by the controlling educational customer or applicable law.

We do not sell or rent identifiable Student Data.

We do not use identifiable Student Data for targeted advertising, unrelated commercial profiling, marketing to students or parents, or general-purpose AI/model training.

We do not disclose identifiable Student Data to third parties for their own marketing or independent commercial purposes.

We limit access to authorized personnel and service providers with a legitimate operational need and appropriate confidentiality/data-protection obligations.

Schools and districts are responsible for determining and documenting their authority to provide Student Data to DIG and for providing required notices or obtaining required consents.

5. Deidentified and Aggregated Information

We may create information that has been aggregated or deidentified so that it cannot reasonably be linked to an identified student or other individual. Subject to applicable law and our customer agreements, we may use such information internally for service maintenance, analytics, product improvement, and assessment validation. We do not attempt to reidentify deidentified Student Data. We will not externally publish, license, sell, provide for research, benchmark, norm, or otherwise share student-derived deidentified datasets except as permitted by applicable law and any required customer authorization or agreement.

6. How We Disclose Information

Service providers and subprocessors. We use vendors for hosting, server-side compute, databases, authentication, payments, email, customer support, analytics, and other business functions. They may process information only as needed for their services and subject to applicable contractual and legal restrictions.

Educational customers. Student Data may be made available to authorized teachers, school/district administrators, and other authorized personnel of the institution controlling the records.

Legal and safety. We may disclose information when required by law, court order, or legal process, or when reasonably necessary to protect security, rights, or safety.

Business transactions. Information may be transferred in a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable Student Data restrictions and contractual obligations.

Direction or authorization. We may disclose information when an authorized customer directs us to do so or where valid authorization has been provided.

7. Core Infrastructure and Data Location

For institutional production use, DIG uses cloud infrastructure providers for application hosting, server-side compute, databases, authentication, and related infrastructure. Our institutional production configuration is designed so that primary Student Data storage and server-side compute that intentionally processes Student Data are located in United States regions.

Our infrastructure providers may use global network routing, support systems, service-generated logs, or subprocessors in other locations. Accordingly, we do not represent that every network-routing event, support activity, or subprocessor activity occurs exclusively in the United States unless a customer-specific agreement expressly provides otherwise. We configure the Services so that identifiable Student Data is not intentionally used for advertising analytics or stored in unnecessary application logs or public content-delivery caches.

8. Public Website Analytics, Advertising, and Cookies

Our public marketing website may use cookies and similar technologies for functionality, analytics, advertising measurement, and retargeting. These providers may receive online identifiers and activity information from the public website.

We do not sell personal information for money. Depending on the law that applies and the configuration of advertising technologies, disclosures for cross-context behavioral advertising or targeted advertising may be treated as a "sale," "sharing," or targeted advertising even when no money is exchanged. To the extent applicable law requires it, we provide or honor applicable opt-out rights, including recognized browser-based universal opt-out signals.

Advertising and retargeting technologies are not intended to use identifiable Student Data or authenticated assessment activity.

9. Marketing Communications

Adult users may receive promotional email where permitted by law. Promotional email includes an unsubscribe method, and we will honor valid opt-out requests. We may continue to send non-promotional service, security, billing, or account communications.

If a school administrator creates an educator account for another person, we use that account for service and administrative communications. We do not automatically enroll that educator in unrelated promotional marketing unless the educator separately signs up or another lawful basis applies.

10. Student and Parent Requests

For Student Data controlled by a school or district, access, correction, export, or deletion requests should ordinarily be made to the school or district. If a parent, guardian, or student contacts DIG directly, we may verify the requester’s identity or authority and coordinate the request with the controlling educational customer before acting, unless applicable law requires a different process.

For Student Data entered through an individual educator account, we may coordinate a request with the account holder, employing school, parent/guardian, or other appropriate controller depending on the circumstances and applicable law.

11. Data Retention and Deletion

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, our agreements, or applicable law.

For institutional Student Data, our standard contractual approach is to keep data available during the active subscription unless the institution directs deletion, make remaining Student Data available for export for 60 days after expiration or termination, and then delete it from active systems. Applicable Student Data law may require earlier or event-based deletion even while an account or subscription remains active, and those requirements control. Routine backup copies may remain until they are overwritten through the standard backup lifecycle, targeted not to exceed 30 additional days after active-system deletion unless applicable law, a customer agreement, or a legal hold requires a different period. If a backup containing previously deleted Student Data is restored for disaster recovery, we reapply the deletion as reasonably practicable.

For an individual educator account that is canceled, our standard approach is the same 60-day post-termination period before active Student Data deletion, unless the data remains subject to an authorized school account, a lawful transfer, a customer direction, or another legal requirement.

Payment, tax, accounting, fraud-prevention, dispute, and similar business records may be retained as reasonably necessary, but we do not retain Student Data merely for those business-record purposes.

12. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include role-based and least-privilege access controls, secure credential handling, encrypted network connections, infrastructure-provider encryption at rest, protected development environments, and restrictions on the use of real Student Data in development and AI-assisted tooling. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Additional safeguards for institutional production use are addressed through our contracts, technical configuration, and internal security procedures. We do not represent that any particular certification applies to Six Shifts unless we expressly state so.

13. Children and Educational Use

DIG adult accounts are for persons 18 years of age or older. DIG is not designed for children to create accounts, log in, or submit personal information directly online. Student information is entered by authorized adults for educational purposes.

If DIG introduces a future student-facing feature or otherwise begins collecting personal information online directly from children, we will review the feature for COPPA and other child-privacy requirements before launch and update applicable notices and consent/authorization processes as necessary.

14. State Privacy Rights

Depending on where you live and whether a particular law applies to Six Shifts, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, and to opt out of certain targeted advertising, sale, or sharing. Applicable thresholds, exemptions, and verification requirements vary by state. To submit a privacy request, contact customersupport@thesixshifts.com. We may need to verify your identity and authority before acting.

Student Data rights may belong to or be administered through a school or district rather than directly through DIG. Section 10 explains how we handle those requests.

15. International Users

The Services are operated from the United States and are primarily designed for U.S. educational and professional users. Information may be processed in the United States and in other locations used by our service providers. Schools or organizations outside the United States may be subject to additional local requirements. We may require a separate agreement or additional review before accepting or continuing an institutional relationship in another country.

16. Changes to this Policy

We may update this Policy from time to time. We will post the revised Policy with a new effective date and provide additional notice where required by law or contract. Material changes affecting institutional Student Data will be handled consistently with applicable customer agreements.

17. Contact Us

Privacy and data-rights requests: customersupport@thesixshifts.com

Legal notices and security/data-incident communications: hello@thesixshifts.com

Mailing address: The Six Shifts, LLC, 36781 S. Silver Lake Road, Battle Lake, MN 56515