This Privacy Policy explains how OfficePort LLC (“OfficePort,” “we,” or “us”) collects, uses, and protects personal information through the DocuGrad service at docugrad.com (the “Service”).
1. Overview
DocuGrad is a business-to-business platform used by colleges and universities to generate diploma PDFs from a graduate roster. We handle two kinds of personal information:
- Customer information. The people at your institution who use the Service: their name, work email, role, and account activity.
- Graduate information. The personal data your institution uploads into its tenant about the graduates whose diplomas you are printing.
For graduate information, your institution is the data controller and we are the data processor: you decide what to upload and what to do with the output. We process it only on your instructions.
2. What we collect
From customers (account holders)
- Name and work email address used to create an account.
- Hashed password (we never store passwords in plain text).
- Role and tenant membership.
- Institution name, mailing address, and billing contact.
- Login activity, IP address, and browser information used to keep the Service secure.
- Messages you send through our contact and support forms.
From graduate rosters you upload
Whatever is in your CSV. A typical roster includes the graduate’s name, degree, major, conferral date, and honors. Some institutions add identifiers (student ID, program code) or signature filenames. We treat every column in your CSV as confidential Customer Data.
Automatic information
- Server logs: IP address, request path, response code, timestamp.
- Session cookies needed to keep you signed in.
- Anonymous usage counts (number of templates, number of generations) so we can size the system.
3. How we use it
We use the information we collect to:
- Provide, maintain, and improve the Service.
- Generate the diploma PDFs you ask us to generate.
- Authenticate you and protect your account from unauthorized access.
- Send transactional email: password resets, quotes, invoices, and replies to support requests.
- Investigate and prevent abuse of the Service.
- Comply with legal obligations.
We do not use Customer Data to train machine-learning models, sell it to data brokers, or share it with advertisers.
4. Sharing & disclosure
We share personal information only in these limited circumstances:
- Service providers. We use a small number of vendors to operate the Service: a hosting provider, an SMTP provider for outbound email, and standard payment processing for invoices. Each is contractually bound to use Customer Data only to provide its service to us.
- At your direction. When you generate a PDF and choose to email it from within the Service, we transmit that PDF to the addresses you specify.
- Legal requests. We may disclose information if required by law, subpoena, court order, or to protect the rights, safety, or property of OfficePort, our customers, or the public.
- Business transfer. If OfficePort is involved in a merger, acquisition, or sale of assets, we will provide notice before any personal information becomes subject to a different privacy policy.
We do not sell personal information.
5. Data security
We protect personal information with reasonable administrative, technical, and physical safeguards:
- HTTPS in transit, encrypted at rest by our hosting provider.
- Passwords stored as one-way hashes; we cannot read your password.
- Tenant isolation enforced at the database query level.
- CSRF protection, honeypot fields, rate limits, and other anti-abuse measures on public forms.
- Principle of least privilege for OfficePort staff with access to production data.
No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you without undue delay and as required by applicable law.
6. Cookies & tracking
DocuGrad uses cookies only for essential purposes:
- A session cookie to keep you signed in during your visit.
- A “remember me” cookie, set only if you check that box at sign-in, to keep you signed in for up to 30 days.
- A CSRF token to protect form submissions.
We do not use third-party analytics, advertising, or social-media tracking cookies.
7. Data retention
Graduate rosters. Each CSV import replaces the prior roster for that tenant, so older graduate data does not persist indefinitely. Whatever is in your current roster is what we have.
Customer accounts. We retain customer account information for the life of the subscription plus a reasonable period thereafter for billing, audit, and dispute-resolution purposes.
Contact submissions. Messages you send through our public contact form or in-app support form are retained for as long as needed to handle the conversation and our internal records.
On cancellation. We retain Customer Data for thirty (30) days after termination to allow you to request an export, after which we may permanently delete it from active systems. Backups may retain it for an additional 30 to 90 days before rolling off.
8. Your rights
Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or receive a copy of your data, and the right to object to certain uses.
If you are a graduate whose information appears in an institution’s roster, please contact your institution first. They control your data, and we will support any reasonable request the institution makes on your behalf.
If you are a customer, you can update your own account information from the Service, and you can request export or deletion by emailing support@docugrad.com.
9. Children & FERPA
The Service is intended for use by educational institutions, not directly by students. We do not knowingly collect personal information directly from anyone under 13.
To the extent your use of the Service involves “education records” covered by the United States Family Educational Rights and Privacy Act (FERPA), we will act as your “school official” with a legitimate educational interest, will use the records only to provide the Service, and will not redisclose them except as you direct or as required by law.
10. International users
DocuGrad is operated from the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may have different data-protection rules than your home country.
11. Changes
We may update this Privacy Policy from time to time. The effective date at the top of this page shows the latest revision. If we make a material change, we will notify you by email or by posting a notice in the Service.
12. Contact
Questions about this Privacy Policy, or want to exercise a right you have under it?
OfficePort LLC
5409 S Nashville Ave
Chicago, IL 60638
support@docugrad.com