Privacy Policy

Effective Date: January 1, 2026  |  Last Reviewed: November 2026

GFPS SafeMail is committed to protecting the privacy of students, staff, and community members. This policy describes how data is collected, used, secured, and retained within this platform.

Scope & Applicability

This privacy policy applies to all data processed by GFPS SafeMail, including DMARC aggregate reports (RUA), TLS-RPT reports, and associated system logs. It governs use by:

  • District IT administrators and security personnel who access the dashboard
  • Automated systems that submit reports to the ingest API endpoints
  • Any third-party mail providers generating reports for the gfps.k12.mt.us domain
Data Collection

We collect aggregate DMARC and TLS-RPT reports sent strictly for the purpose of email authentication analysis. These reports contain metadata about email traffic, including:

  • Source IP addresses of sending mail servers
  • SPF, DKIM, and DMARC authentication results
  • TLS negotiation outcomes (success/failure) and policy types
  • Reporting organization names and contact information
No email content is collected. Reports contain only authentication metadata and transport-level information — never message bodies, subject lines, or recipient addresses.
Data Usage

The data collected is used solely for the following purposes:

  • Monitoring email authentication compliance across the district domain
  • Identifying unauthorized senders and potential spoofing attempts
  • Detecting TLS delivery failures and enforcing encrypted transport
  • Generating trend reports to guide policy enforcement decisions

We do not sell, share, or distribute report data to third parties unless required by law or legal process.

Data Security

We employ industry-standard technical and organizational measures to protect the data within this platform:

  • All web traffic is encrypted via TLS (HTTPS)
  • Authentication is enforced via OpenID Connect (OIDC) with optional FIDO2 passkey support
  • Role-based access control (RBAC) restricts dashboard access to authorized administrators
  • Database access is restricted to the application service account
  • API endpoints validate content types and reject malformed payloads
  • System logs capture access and error events for audit purposes
Logging & Monitoring

GFPS SafeMail maintains system logs for operational diagnostics and security auditing. Log entries may include:

  • Timestamps, log levels, and event categories
  • Error messages and exception stack traces
  • Authentication events and session metadata

Logs do not contain email content, user passwords, or personally identifiable information (PII) beyond authenticated usernames. Log retention follows the same data retention schedule described below.

Data Retention

Report data and system logs are retained for a configurable period to allow for trend analysis and historical review. After the retention period expires, data is automatically and permanently deleted. The default retention periods are reviewed periodically and may be adjusted based on operational requirements and applicable regulations.

User Rights

Authorized users and data subjects have the following rights regarding their data:

  • Right to Access: Request a summary of data collected about email traffic originating from or reporting on your domain.
  • Right to Correction: Request correction of inaccurate records where applicable.
  • Right to Deletion: Request removal of specific report data, subject to retention obligations.
  • Right to Inquire: Ask questions about how your data is processed at any time by contacting the IT Department.
Regulatory Compliance

As a public school district platform, GFPS SafeMail adheres to applicable federal and state regulations, including:

  • FERPA (Family Educational Rights and Privacy Act) — No student education records are collected or stored by this platform.
  • COPPA (Children's Online Privacy Protection Act) — This platform does not collect personal information from children under 13. Dashboard access is restricted to authorized district employees.
  • Montana State Privacy Laws — Data handling complies with applicable state data protection requirements.
Third-Party Services

GFPS SafeMail receives aggregate reports generated by third-party email providers (e.g., Google, Microsoft, Yahoo) as part of standard DMARC and TLS-RPT mechanisms. These providers generate reports independently under their own privacy policies. GFPS SafeMail does not transmit data back to these providers. The platform uses Bootstrap Icons (served via CDN) for the user interface; no user data is shared with the CDN provider.

Policy Updates

This privacy policy may be updated periodically to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to authorized users through the platform. The effective date at the top of this page indicates when the policy was last reviewed.

Contact Us

If you have questions, concerns, or requests related to this privacy policy or data handling practices, please contact:

Great Falls Public Schools — IT Department
Cybersecurity Operations & Infrastructure