← Forms & Notices

Privacy Policy

October 2, 2026

1. Scope and Purpose

This Privacy Policy (the "Policy") describes how Roots Charter High School ("Roots," "the School," "we," "us," or "our") collects, uses, discloses, and protects personal information through the public website located at rootshigh.org (the "Website"). Roots is a Utah public charter high school and Local Education Agency ("LEA") serving grades 9–12, operated by a Utah nonprofit corporation and authorized under Utah Code Title 53G, Chapter 5. For purposes of Utah law, Roots is a governmental entity and political subdivision of the State of Utah.

This Policy governs only information collected through the public Website. It does not govern:

  • Student education records and student data, which are governed by the federal Family Educational Rights and Privacy Act ("FERPA"), the Utah Student Data Protection Act, and the School's separate student-data compliance instruments. See Section 9 (Children's and Student Data) for the controlling cross-references.
  • Information you submit on third-party platforms that Roots links to but does not operate (for example, the donation platform, the learning management system, or state education portals). Those platforms maintain their own privacy policies, which govern your use of them.

Where this Policy and any School student-data instrument (the Data Governance Plan, Annual FERPA Notice, Directory Information Notice, Data Collection Notice, Metadata Dictionary, or IT Security Policy) address the same subject, the student-data instrument controls as to student education records, and this Policy controls as to general Website operations.

In this Policy, "personal information" means information that identifies, relates to, or could reasonably be linked with a particular individual, as collected through the Website.

Nothing in this Policy waives, limits, or expands any immunity, defense, or limitation available to the School as a governmental entity under the Utah Governmental Immunity Act, Utah Code Title 63G, Chapter 7, or under any other applicable law.

2. Information We Collect

Roots collects the following categories of information through the Website, and no others.

2.1 Information You Provide Through Forms

We collect information only when you fill out and send one of the forms on the Website. Each form asks only for what we need to answer that request. Each form collects the following:

  • Enrollment Application: the parent or guardian's name, phone, email, and home address; each student's name, birthdate, grade, and current school status; how you heard about Roots; and your answers to the placement, lottery, and offer agreements. When a student enrolls, the application becomes part of that student's education record, and FERPA and the School's Data Governance Plan govern it (see Section 9).
  • Sensitive Material Reporting: your name and email, the student's name, the material, where the student encountered it, and your concern.
  • Tour Request: your name, phone, and email, the date and time you prefer, and the reason for your visit.
  • Contact Us: your name, email, and phone, the topic, and your message.
  • Weekend Volunteer and Group Volunteer: your name or your group contact's name, organization, email, phone, group size, availability, and what you want to help with.
  • Floral Quote: your name, email, and phone, the event type and date, pickup date, number of arrangements, style, budget, and payment preference.
  • Holiday Help (Thanksgiving meals and Sub for Santa): the contact person's name, phone, and email; the Roots student's name; the delivery address, for Thanksgiving only; and, for each child in the home who will receive gifts, the child's first name, age, gender, clothing and shoe sizes, needs, and wants. Section 3.7 explains who sees this information, and Section 5 explains when we delete it.
  • Newsletter / email signup: name and email address.

You do not have to give us personal information to read the Website. We collect information only when you choose to send a form. A form marks the fields it needs to process your request.

2.2 Information Collected Automatically (Server Logs)

When you visit the Website, our hosting provider automatically records standard technical information for security, diagnostics, and operation of the Website. This may include your Internet Protocol ("IP") address, browser type and version, device and operating system information, referring and exit pages, the pages you view, and the date and time of your visit. This information is generated by the operation of the Website and its hosting infrastructure and is not used to identify you personally except as necessary to investigate security incidents, prevent abuse, or comply with law.

2.3 Cookies and Similar Technologies

A cookie is a small text file stored on your device by your browser. The Website may use:

  • Strictly necessary cookies and similar technologies required for the Website to function, maintain security, and remember basic preferences (such as a selected site language). These are essential and cannot be disabled through the Website without impairing functionality.
  • Analytics cookies and identifiers, if and when the School enables web analytics (see Section 2.4), used to understand aggregate Website usage and improve content and navigation.

You can control or disable cookies through your browser settings. Most browsers allow you to refuse or delete cookies; doing so may affect some Website features. Where required by applicable law, the School will obtain consent or provide an opt-out mechanism before deploying non-essential cookies.

2.4 Web Analytics (If Enabled)

The School may use a web analytics service to measure aggregate, de-identified or pseudonymized usage of the Website (for example, page views, traffic sources, approximate geographic region, and device categories). The analytics provider, if enabled, is expected to be Google Analytics 4 (GA4). Analytics data is used in aggregate to evaluate and improve the Website and is not used to build advertising profiles of visitors or to sell personal information. Where an analytics provider is used, it may set cookies or process IP-derived data as a processor on the School's behalf, subject to that provider's terms. The School configures analytics to limit data collection to what is reasonably necessary for these purposes.

2.5 What We Do Not Collect on the Website

For clarity:

  • We do not process payments or donations on the Website. Donations are handled entirely off-site by a third-party provider (Give Butter) at the point of donation. Donor payment information and donor personal information are collected and processed by that provider on its own platform under its own privacy policy. Roots does not collect, transmit, or store payment-card data through the Website. See Section 3.4.
  • Except for the newsletter signup, which submits your name and email address to our email service provider (see Section 3.3), any analytics provider the School enables (see Section 2.4), and the Cloudflare spam-check script that loads on pages with forms (see Section 3.3), we do not embed third-party tracking widgets, social-media pixels, or advertising networks on the Website.
  • We do not embed the external learning, assessment, mapping, or calendar tools listed in Section 6; we link to them, and (for calendar) sync data into our own content system without embedding the third party's frame.
  • We do not knowingly collect more information than the operative form fields and automatic technical data described above.

3. How We Use Information, and Third-Party Processors

3.1 Purposes of Use

We use information collected through the Website to:

  • respond to your request or message: process an enrollment application and run the admissions lottery, review a sensitive-material report, schedule a tour, answer a question, place a volunteer, prepare a floral quote, or deliver a Thanksgiving meal and match a child with a Sub for Santa shopper;
  • send the email newsletter and related communications you request, and allow you to unsubscribe;
  • operate, secure, maintain, and improve the Website;
  • detect, prevent, and respond to security incidents, fraud, abuse, or technical problems; and
  • comply with applicable law and the School's legal obligations as a Utah governmental entity, including records-retention and public-records obligations.

We use the information for the purpose for which you provided it and for the compatible operational purposes above. We do not use Website-collected personal information for automated decision-making that produces legal or similarly significant effects.

3.2 Legal Bases / Authority

As a Utah public LEA, Roots collects and uses this information to carry out its educational mission and public functions and to operate its official Website. Information you submit through a form is used on the basis of your request and submission.

3.3 Service Providers / Processors We Actually Use

Roots uses the service providers ("processors") below to run the Website. Each one handles information only to provide its service to us.

  • Google (the School's Google Workspace account, under the School's agreement with Google). What it does: receives and stores every form you send. When you press submit, your browser sends your answers straight to a program that runs inside the School's own Google Workspace account. That program writes your answers to a Google Sheet that only named Roots staff can open. It then emails staff a count of new submissions, with no form answers in the email. Google also hosts the backup form we link to when a Website form cannot send. Information involved: everything you enter in a form listed in Section 2.1.
  • Webflow. What it does: hosts the Website, delivers its pages, and records technical data automatically when you visit (Section 2.2). Webflow does not receive or store the forms listed in Section 2.1. Information involved: technical data (Section 2.2).
  • Cloudflare (Turnstile). What it does: provides the spam-check script that loads on pages with forms. Information involved: your IP address and basic browser and device details.
  • ConvertKit. What it does: email newsletter service; manages the newsletter list and sends the newsletter. Information involved: name and email address of newsletter subscribers.
  • Google Analytics 4 (only if the School turns it on, see Section 2.4). What it does: measures Website use in aggregate. Information involved: usage data; cookies and identifiers; IP-derived data as configured.

Give Butter, our off-site donation platform, appears separately in Section 3.4. It is not a Website processor, because the donation happens on Give Butter's site and Roots never handles donor payment data.

We allow these providers to use information only to provide their services to Roots. None of them may use it for their own marketing. Each provider keeps its own privacy policy for its services.

3.4 Off-Site Donations (Give Butter)

When you choose to donate, you are directed to Give Butter, a third-party donation platform, where the donation transaction occurs off the Roots Website. Give Butter collects and processes your donation information, including payment information, under its own terms and privacy policy. Roots does not receive or store your payment-card information. Roots may receive donor name and contact details from the platform for acknowledgment and recordkeeping purposes. Review Give Butter's privacy policy before submitting information on that platform.

3.5 Disclosures Required by Law; Public Records (GRAMA)

As a Utah governmental entity, Roots is subject to the Government Records Access and Management Act ("GRAMA"), Utah Code Title 63G, Chapter 2. Information the School holds, including certain information submitted through the Website, may constitute a government record subject to GRAMA's access, classification, and retention provisions, and may be subject to disclosure, protection, or retention as GRAMA requires. Personal information submitted through the Website may be classified as private or protected under GRAMA (for example, under Utah Code §§ 63G-2-302 and 63G-2-305) and handled accordingly, and the School responds to records requests within the timeframes set by Utah Code § 63G-2-204. The School may also disclose information when required by law, subpoena, court order, or other legal process, or to protect the rights, safety, or security of the School, its community, or the public. For how to make a public-records request, and for the School's designated Records Officer, see the School's GRAMA and Records Officer notice. Nothing in this Policy enlarges or restricts any right or obligation under GRAMA.

3.6 No Sale of Personal Information

Roots does not sell personal information, and does not share it for cross-context behavioral advertising. We do not exchange personal information collected through the Website for monetary or other valuable consideration. We do not rent or trade Website visitor information to third parties for their own marketing.

3.7 Holiday Help: What Volunteers Receive

Only the Roots staff who run Thanksgiving meals and Sub for Santa can open the Holiday Help spreadsheet. When you ask for gifts, we give each child a code, such as H-001-A. Volunteer shoppers get a list that holds only that code and each child's age, gender, sizes, needs, and wants. That list never includes a child's name, the Roots student's name, or your address, phone number, or email. Before we share the list, our staff read the needs and wants and remove anything that could point to your family, such as a name typed into those boxes. Only Roots staff can match a code to a family.

We use your address only to deliver your Thanksgiving meal, and we keep it off the Sub for Santa list. The volunteer who delivers your meal receives your address and delivery notes. We tell every volunteer to destroy their shopping or delivery list when they finish.

4. Online Tracking, "Do Not Track," and Global Privacy Signals

Some browsers offer a "Do Not Track" ("DNT") setting and some support a "Global Privacy Control" ("GPC") or similar signal. There is no industry- or legal-consensus standard for how operators must respond to these signals. Because Roots does not use the Website to track visitors across third-party websites over time and does not sell or share personal information for advertising, the Website does not currently respond differently to DNT or GPC signals. Roots does not authorize third parties to collect personally identifiable information about your online activities across different websites through the Website. This disclosure is provided as a matter of best practice, consistent with the California Online Privacy Protection Act ("CalOPPA"), Cal. Bus. & Prof. Code § 22575(b).

5. How Long We Keep Information (Retention)

Roots retains personal information collected through the Website only as long as reasonably necessary for the purpose for which it was collected, and thereafter as required by the School's records-retention obligations as a Utah governmental entity under GRAMA (Utah Code Title 63G, Chapter 2) and applicable State Archives retention schedules. In general:

  • Form submissions (enrollment applications, sensitive-material reports, tour, contact, volunteer, and floral quote requests): we keep them in the School's Google Workspace while we act on your request and for as long as the School's records-retention schedule requires. After that, we dispose of them under that schedule. An enrollment application for a student who enrolls becomes part of that student's education record and follows the School's student-record retention rules.
  • Holiday Help requests: we delete them every year. On February 1, our system moves that season's Holiday Help spreadsheet to the trash, and Google permanently deletes it 30 days later. Volunteers destroy their shopping and delivery lists when they finish, as Section 3.7 describes.
  • Submissions sent before July 15, 2026: our forms went through Webflow until that date. We moved those submissions into the School's Google Workspace and deleted them from Webflow.
  • Newsletter subscription data is retained until you unsubscribe or the School discontinues the newsletter, after which it is removed from active mailing use in accordance with the provider's processes and applicable retention rules.
  • Server logs and analytics data are retained for a limited period appropriate to security and diagnostic purposes and to the analytics provider's configured retention period.

6. External Links and Synced Content

The Website provides links to third-party resources for the convenience of students, families, and the public, including the learning management system (Canvas / instructure.com), the student information / assessment systems (Aspire / aspire.k12.us and Renaissance / renaissance.com), Utah state education portals, a Google Maps location link, and similar resources. These are outbound links; the linked services are operated by third parties under their own privacy policies, and this Policy does not govern them. We encourage you to review the privacy policy of any third-party site you visit.

The Website displays School calendar events that are synced from the School's Google Calendar into the Website's content system. The School does not embed Google's calendar frame on the Website; only event data is brought into the Website's own content. Outbound links and synced calendar content do not cause Roots to collect personal information about you beyond what is described in Section 2.

7. Security

Roots maintains administrative, technical, and physical safeguards designed to protect personal information collected through the Website against unauthorized access, use, alteration, disclosure, or destruction. The Website is served over encrypted connections (HTTPS/TLS). Your browser sends each form over an encrypted connection straight to the School's Google Workspace, where only named Roots staff can open the spreadsheet that holds it. The emails our system sends staff about new submissions contain a count and a link, never your answers. Webflow handles technical data under its own security program. The School's internal information-security controls are governed by the School's IT Security Policy.

No method of transmission over the Internet or method of electronic storage is completely secure. While we use reasonable measures to protect personal information, we cannot guarantee absolute security. Please use the Contact Us form for general questions only. The Enrollment Application, Sensitive Material Reporting, and Holiday Help forms are official School channels, built for the information they ask for. For student records, use the contacts named in Section 9. Nothing in this Section waives or limits any immunity or limitation available to the School under the Utah Governmental Immunity Act (Utah Code Title 63G, Chapter 7).

8. Your Choices and Rights

You have the following choices regarding information you provide through the Website:

  • Email / newsletter: You may unsubscribe at any time using the unsubscribe link in any newsletter email, or by contacting us using the information in Section 11.
  • Form submissions: You may contact us to ask what Website-form information we hold about you, to request correction, or to request deletion, subject to the School's legal and records-retention obligations under GRAMA and applicable law.
  • Cookies: You may control cookies through your browser settings (Section 2.3).

Utah Consumer Privacy Act (UCPA). The Utah Consumer Privacy Act (Utah Code Title 13, Chapter 61) imposes obligations on certain for-profit "controllers" and "processors" doing business in Utah. The UCPA expressly excludes governmental entities from its obligations (Utah Code § 13-61-102(2)(a); "governmental entity" as defined by reference to Utah Code § 63G-2-103). As a Utah governmental entity, Roots is not a "controller" subject to the UCPA's business obligations. Accordingly, the consumer-request rights created by the UCPA do not apply to Roots. The choices described in this Section, together with your rights under GRAMA and, for student records, under FERPA and the Utah Student Data Protection Act (Section 9), are the avenues available to you.

General Data Protection Regulation (GDPR). Roots is a Utah public school serving a local Utah community and does not target its Website to individuals in the European Union or the European Economic Area. The EU General Data Protection Regulation is not applicable to the Website. If you access the Website from outside the United States, you do so on your own initiative and are responsible for compliance with local law; your information will be processed in the United States.

9. Children's and Student Data

Roots is a high school serving grades 9–12 (students typically ages 14–19). Most students are 13 or older. The public Website is general-audience and is not directed to children under 13, and Roots does not knowingly collect personal information from a child under 13 through the Website's public forms.

Two forms ask a parent or guardian about children. The Enrollment Application asks about each student applying. Holiday Help asks for the first name, age, sizes, needs, and wants of each child in the home who will receive gifts, and those children can be under 13. A parent or guardian fills out both forms; we do not collect information from children through them. Holiday Help requests name a Roots student, so we protect them as student records under the School's Data Governance Plan, and we share only the de-identified details Section 3.7 describes.

COPPA. The Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and its implementing Rule (16 C.F.R. Part 312) govern the online collection of personal information from children under 13. Because the public Website is directed to a general audience (prospective and current families, donors, and the community) and not to children under 13, the School does not knowingly collect personal information from children under 13 on the public Website. If you believe a child under 13 has provided personal information through the public Website, contact us using Section 11 and we will take reasonable steps to delete it. In the educational context, where an operator collects student personal information for a school-authorized educational purpose, the FTC's guidance permits a school to authorize that collection on a parent's behalf; this concept is FTC COPPA FAQ guidance and was not codified as a lettered subsection in the 2025 amended COPPA Rule. Any such school-authorized educational data collection is addressed through the School's student-data instruments and FERPA framework, not this Website Policy.

Student education records and student data are not governed by this Policy. Student information is governed by the following federal and Utah authorities and the School's separate, controlling compliance instruments, which this Policy incorporates by reference and does not restate or modify:

  • FERPA: Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g; 34 C.F.R. Part 99. See the School's Annual FERPA Notice and Directory Information Notice.
  • PPRA: Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h (parental rights regarding certain surveys, instructional materials, and examinations). See the School's PPRA Notice.
  • Utah Student Data Protection Act: Utah Code § 53E-9-301 et seq. (LEA data governance, student data manager, and data-sharing limitations). See the School's Data Governance Plan, Data Collection Notice, and Metadata Dictionary.
  • Information security for student data: see the School's IT Security Policy.

If anything in this Policy appears to conflict with the School's student-data instruments as to a student education record, the student-data instrument controls. Questions about student records, FERPA rights, directory-information opt-outs, or student-data privacy should be directed to the School's designated student-data and FERPA contacts identified in those instruments, not through general Website forms.

10. Changes to This Policy

Roots may update this Policy from time to time to reflect changes in our practices, technology, the Website's features, or the law. When we make a material change, we will revise the Effective Date (and the Last Updated date) above and, where appropriate, post a notice on the Website. The dated version published on the Website is the operative version as of its effective date. We encourage you to review this Policy periodically. Consistent with the School's website compliance practice, this Policy is updated before any new data-processing feature or integration goes live on the Website.

11. Contact Us

For questions about this Policy or about information collected through the Website:

Roots Charter High School

2250 South 1300 West, Suite D

West Valley City, UT 84119

Phone: (385) 715-2591

Email: office@rootshigh.org

For accessibility of this page or assistance with this notice (Section 504 Coordinator and accessibility point of contact):

Alisa Muhlestein · aamani@rootshigh.org · (385) 715-2591 ext. 121

For matters of nondiscrimination and civil rights, including Title IX, see the School's standalone Notice of Nondiscrimination, which identifies the School's designated civil-rights officials. For public-records requests (GRAMA), see the School's GRAMA and Records Officer notice and its designated Records Officer. For student-records and FERPA matters, see the contacts named in the School's Annual FERPA Notice and Data Governance Plan.

References

  • Children's Online Privacy Protection Act: 15 U.S.C. §§ 6501–6506; COPPA Rule, 16 C.F.R. Part 312 (as amended eff. June 23, 2025; general compliance date Apr. 22, 2026). Note: the 2025 amended Rule did not codify an ed-tech / school-authorization provision; school authorization for educational-purpose collection rests on FTC FAQ guidance, not a codified Rule subsection.
  • Family Educational Rights and Privacy Act (FERPA): 20 U.S.C. § 1232g; 34 C.F.R. Part 99.
  • Protection of Pupil Rights Amendment (PPRA): 20 U.S.C. § 1232h; 34 C.F.R. Part 98.
  • Utah Student Data Protection Act: Utah Code § 53E-9-301 et seq. (incl. §§ 53E-9-303, 53E-9-308).
  • Utah Consumer Privacy Act: Utah Code Title 13, Chapter 61 (governmental-entity exclusion at § 13-61-102(2)(a); "governmental entity" per §§ 13-61-101 and 63G-2-103). Not applicable to Roots.
  • Government Records Access and Management Act (GRAMA): Utah Code Title 63G, Chapter 2 (incl. §§ 63G-2-204, 63G-2-302, 63G-2-305).
  • Utah Governmental Immunity Act: Utah Code Title 63G, Chapter 7.
  • Utah charter school / LEA authorization: Utah Code Title 53G, Chapter 5.
  • California Online Privacy Protection Act (CalOPPA), "Do Not Track" disclosure: Cal. Bus. & Prof. Code § 22575(b).
  • Section 504 of the Rehabilitation Act: 34 C.F.R. § 104.7 (coordinator/grievance, 15+ employees); ADA Title II: 28 C.F.R. § 35.107 (coordinator/grievance, 50+ employees).
  • Title IX: 34 C.F.R. Part 106 (2020 Rule currently in force); Tennessee v. Cardona, No. 2:24-cv-00072 (E.D. Ky. Jan. 9, 2025) (nationwide vacatur of 2024 Title IX Rule).
  • EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: referenced as non-applicable.

This Policy governs the public rootshigh.org Website only and is subordinate to the School's student-data instruments as to student education records.

‍