Privacy Policy

RESA HELPS is an internal IT service-management application: it provides helpdesk ticketing, asset and inventory tracking, project management, and a staff in/out availability board. SCCRESA operates it for its own staff and for the school districts, intermediate school districts, municipalities, colleges, non-profits, and other partner organizations it serves.

This policy applies to the RESA HELPS application at resahelps.org. It does not cover other SCCRESA systems or any third-party website or service that links to or from the application. Your use of RESA HELPS is also governed by our Terms of Service.

RESA HELPS is a restricted, authorization-only system, not a service offered to the general public. Its users are authorized members of SCCRESA and of the partner organizations it supports. It is not a student information system, and students are not intended users (see Section 10).

Account and identity information

When you sign in with Google, we receive from Google your email address, name, profile picture, and your Google account identifier (the OpenID “subject”). We request only the standard, non-sensitive scopes openid, email, and profile. We do not request access to Gmail, Google Drive, Calendar, Contacts, or any other Google service or data. See Section 3 for Google-specific disclosures.

Where enabled, you may instead sign in with Microsoft (Microsoft Entra ID), from which we receive comparable identity information (email, name, and account identifier), or with an email-and-password account, for which we store your email, name, and a securely hashed password (we never store passwords in plain text).

Directory information

Administrators may create and update accounts from an organizational directory export (for example, an Active Directory CSV). This can include your name, email address, department, a directory object identifier, and whether your account is enabled.

Service data you provide

• Helpdesk tickets — subject, description, comments and notes, attachments, requester and contact details (name, email, phone, building/room), CC recipients, and satisfaction-survey responses.
• Assets and inventory — device assignments to people, serial and asset tags, locations, and free-form notes.
• Projects — project records, checklists, and assignments.
• In/out board — your self-set availability status (for example, in, out, sick, or unavailable) and location.

Free-text fields and uploaded files can contain whatever information a user chooses to enter. We ask users not to include sensitive personal information beyond what is necessary to resolve a request.

Information collected automatically

• Authentication and activity logs — records of sign-ins and of actions taken in the application (who did what, and when), kept for security and audit purposes.
• Session cookies — see Section 5.
• Device inventory— where an endpoint inventory agent is deployed on an organization’s devices, it reports attributes such as hostname, operating system, hardware and installed-software inventory, domain, and the most recent logged-in username.

We do not use any third-party analytics, advertising, tracking, or session-replay technology. The application contains no advertising or marketing trackers.

Information about people who do not have an account

Because a ticket can be created on behalf of, or can reference, a person who does not have an account, the application may store that person’s name, email address, and request details — for example, the requester’s email address recorded on a ticket.

Imported historical data

RESA HELPS replaced a prior system (SolarWinds Service Desk). Historical tickets, comments, and survey responses migrated from that system are stored in RESA HELPS and may contain the kinds of information described above.

When you choose “Sign in with Google,” RESA HELPS accesses a limited set of Google account data solely to authenticate you and to operate the helpdesk on your behalf:

We request only the non-sensitive scopes openid, email, and profile. RESA HELPS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular, we do not sell this data, do not use it for advertising, and do not share it with others except as described in Section 6.

You can review and revoke RESA HELPS’s access to your Google account at any time at myaccount.google.com/permissions. Revoking access does not delete records already created in the application.

• Authenticate you and authorize your access based on your role.
• Provide and operate the helpdesk, inventory, project, and in/out board features.
• Communicate with you — including ticket and account notifications and credential emails (such as email verification and password-reset links).
• Maintain the security, integrity, and auditability of the system.
• Keep the staff directory accurate and resolve people to their request and asset history.
• Comply with applicable law and with SCCRESA policies and recordkeeping obligations.

We do not use personal information for advertising, and we do not sell personal information.

RESA HELPS uses only first-party cookies and browser storage that are necessary to operate the application:

• A session cookie (HttpOnly, Secure, and SameSite=Lax in production) keeps you signed in. The session is a signed token that, by default, expires after about 30 days of inactivity.
• An optional sign-in hint, stored in your browser’s local storage (not a cookie), may remember your email address to streamline your next sign-in. On a shared device, you can opt out of being remembered at sign-in.

We do not use advertising or cross-site tracking cookies.

We do not sell personal information and do notshare it for advertising. We share limited information with the following service providers (“sub-processors”) strictly to operate the application:

Where an optional hardware-warranty lookup is enabled, a device’s manufacturer service tag may be sent to the device’s manufacturer (for example, Dell) to retrieve warranty coverage. This transmits a device identifier, not personal information.

We may also disclose information when required by law or legal process, to protect the rights, property, or safety of SCCRESA, our users, or others, and in connection with SCCRESA’s governmental functions and public-recordkeeping obligations (see Section 13). Our service providers process data in the United States.

RESA HELPS is self-hosted on SCCRESA-controlled servers. The application database and uploaded files reside on SCCRESAinfrastructure — with the exception of the In/Out Board feature, whose data is hosted by the providers named in Section 6.

We protect information using measures including:

• Encryption of traffic in transit (TLS), terminated at a secured network edge with no public inbound port exposure on the host.
• Deny-by-default access control: only provisioned, authorized accounts may sign in.
• Role-based authorization that limits what each user can see and do.
• Passwords stored only as strong (argon2id) hashes, never in plain text.
• Regular backups of the database and uploaded files.

No system can be guaranteed perfectly secure. We work to protect your information but cannot warrant absolute security.

We retain operational records — including tickets, comments, attachments, inventory and device records, activity logs, and accounts — for as long as needed to operate the service and to meet SCCRESA’s recordkeeping and legal obligations.

Routine maintenance runs automatically each night: read in-app notifications are purged after 90 days, and expired sign-in sessions and single-use security tokens (such as password-reset and email-verification links, which by default expire within 60 minutes) are removed. Apart from that maintenance, RESA HELPS does not run a fixed deletion schedule for operational records such as tickets, comments, attachments, inventory, and accounts. Accounts that are no longer active are disabled rather than deleted, and historical imported records are retained. To request deletion of specific information, contact us as described in Section 12; we will honor such requests subject to our recordkeeping and legal obligations.

• Update your profile information within the application.
• Adjust your notification preferences to control certain emails.
• Revoke RESA HELPS’s access to your Google account at myaccount.google.com/permissions, and sign in with another available method.
• Request access to, correction of, or deletion of your personal information by contacting helpdesk@sccresa.org.

Because users are authorized members of SCCRESAor of a partner organization rather than members of the public, some requests may be coordinated with your organization’s administrator, and some information must be retained to meet legal and recordkeeping obligations.

RESA HELPS is not directed to children, and students are not intended users. Sign-in is restricted to authorized staff; the system is configured to keep students on shared school domains from gaining access. RESA HELPS is an IT service-management tool, not a student information system.

A ticket or asset record may nonetheless incidentally contain limited student-identifying information — for example, a student’s name entered in a device-repair request. To the extent any such information constitutes an “education record” under the Family Educational Rights and Privacy Act (FERPA), the applicable school district and SCCRESA remain its owners, and RESA HELPSfunctions as a “school official” / service provider acting under their direction and control. We use such information only to perform the IT services for which it was provided and for no other purpose.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and post the new version on this page. Material changes will be communicated through the application or by other appropriate means.

If you have questions about this policy or about your information, contact:

St. Clair County Regional Educational Service Agency
RESA HELPS— IT Helpdesk
St. Clair County, Michigan, USA
helpdesk@sccresa.org

SCCRESA is a Michigan public educational service agency. Information stored in RESA HELPS may constitute a public record subject to the Michigan Freedom of Information Act and applicable records-retention requirements, and may be retained, produced, or disclosed as required by those laws.