Effective date: October 28, 2026 | Last updated: October 28, 2026
1. Overview/Purpose
DAPORA™ is a general-market, cloud-based software service that colleges and universities use to generate and manage their own NCAA and Equity in Athletics Disclosure Act (EADA) athletics-compliance reports. This notice explains how James Moore & Co., P.L. ("James Moore," "we," "us") handles information in connection with the DAPORA service. The purpose of this notice is to describe what data DAPORA collects and processes, how that data is used, protected, retained, and deleted, and the commitments James Moore makes to its customers with respect to that data.
In plain terms:
- DAPORA processes institutional athletics-reporting data on behalf of the institution. Most of this data is aggregate (for example, scholarship and aid figures are typically provided at the sport and gender level). However, some source files — particularly athletics payroll files — may include employee names used to apply the institution's own salary classifications (e.g., head coach, assistant coach, support staff), and those names may belong to student employees or graduate assistants.
- Where DAPORA processes student education-record information, James Moore acts as a "school official" with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)(i)(B)), under the institution's direction and only to provide the contracted service.
- All DAPORA production data is stored in the United States (primary AWS region us-east-2, with encrypted disaster-recovery backups of the DAPORA platform in a second US region, us-west-2).
- The institution remains the system of record for its data. DAPORA works from extracts the institution generates from its own systems and delivers to the service. DAPORA does not post entries, is not used in the institution's financial close, sends nothing back to the institution's general ledger or financial statements, and produces compliance and management reports, not financial statements. The institution keeps the originals of its records in its own systems; DAPORA is not the institution's system of record or sole repository, and James Moore is not the institution's host, custodian, or backup, archival, disaster-recovery, or business-continuity provider.
- We do not sell Customer Data or use it for advertising, and we do not use Customer Data, or aggregated data derived from it, to train artificial-intelligence models.
- Customers control the data they submit. They may export their data, mapping rules, mapped data, and reports at any time through the service, and may request deletion of their Customer Data, subject to the backup and retention practices described in this notice.
- EADA report outputs support reporting that institutions themselves review, approve, and publish or submit to regulators; this notice governs the Customer Data processed within DAPORA, not the public report values themselves.
2. Definitions
For purposes of this notice:
"Customer" means the college, university, or other institution, or an entity affiliated with such an institution, that has entered into an agreement with James Moore for the DAPORA service.
"Customer Data" means the institutional athletics-reporting data a Customer submits to the DAPORA service, consisting of extracts the Customer generates from its own systems, which remain the Customer's system of record. Customer Data may include limited identifiable student information contained in customer source files (see Section 5), including information that constitutes a student education record under FERPA. Customer Data corresponds to "Client Data" in the customer agreement.
"FERPA" means the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) and its implementing regulations (34 CFR Part 99).
"School official" describes a contractor to whom an institution has outsourced institutional services or functions under the conditions of 34 CFR 99.31(a)(1)(i)(B). For DAPORA, the institutional service James Moore provides is limited to making available and supporting a software service that the institution itself operates; the institution retains all management responsibilities, and James Moore does not perform the institution's reporting function or make decisions on its behalf.
"Student Data" means any information within Customer Data that identifies an individual student, such as the names of student employees or graduate assistants in athletics payroll source files.
"Subprocessor" means a third-party service provider James Moore uses to process Customer Data to provide the DAPORA service.
3. Scope of This Notice
This notice applies to: institutional customers of DAPORA; authorized customer administrators and users; support contacts; and visitors to the DAPORA service. It does not cover James Moore & Co.'s broader advisory, accounting, or consulting services, employment/applicant data, or client engagement files maintained outside the DAPORA service, which are governed by the firm's separate policies and engagement agreements.
4. Data We Collect and Process
The categories below describe the data collected and processed within DAPORA. "Customer Data" is the institutional reporting data a customer submits to the service, and may include limited identifiable student information (see Section 5).
| Data category | Examples |
|---|---|
| Customer Data (institutional reporting data) | Aggregate athletics aid totals; participation counts by sport/team/gender; expense and revenue totals by sport/team/category; aggregate coach counts and salary data; employee names where included in athletics payroll source files (see Section 5); NCAA/EADA reporting fields |
| Account Data | Name, work email, role, institution, login credentials |
| Usage & Security Data | IP address, login timestamps, browser/device, audit logs |
| Support Data | Support requests and related configuration details |
| Billing & Business-Contact Data | Contact information, contracts, invoices |
5. Limited Student Data DAPORA May Receive
DAPORA is designed around aggregate and team-level athletics-reporting data and applies data minimization. Some source files a customer submits do, however, include limited identifiable student information:
- Employee names — Athletics payroll source files may include employee names so that salaries can be classified for reporting according to the position classifications the Customer determines and approves (e.g., head coach, assistant coach, support staff). These names may belong to student employees or graduate assistants. Where included, because the name is required to apply the Customer's salary classifications, DAPORA receives it, stores it in the application database, and uses it in applying those classifications. (Student-level data is not written to application or security logs.)
- Scholarship / aid amounts — These are typically provided at the aggregate sport and gender level. Individual student-level scholarship detail is atypical; where a general ledger lacks sufficient detail, an institution may supply a supplemental report or enter a top-side adjustment, which is also generally maintained at the aggregate level.
DAPORA does not request or solicit identifiable student information; however, some source files provided by customers may contain it. Where identifiable student information is present, it may constitute a student education record, and James Moore processes it solely as a school official with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)(i)(B)), under the institution's direction and only to provide the contracted service.
DAPORA does not knowingly collect, and customers should not submit: Social Security numbers; dates of birth; student health, medical, disability, immigration, disciplinary, or academic-status records; or other sensitive personal information beyond what is necessary for athletics-compliance reporting. Where customer source data includes fields containing sensitive information of this kind (for example, Social Security numbers or dates of birth), DAPORA can be configured, at the Customer's direction, to automatically exclude those fields or to mask them so that sensitive values are not stored in readable form.
6. Customer Responsibilities
Customers are responsible for: submitting only data necessary for athletics-compliance reporting; minimizing or de-identifying source data where feasible before upload; ensuring they have authority, as the data controller, to submit the Customer Data (including any FERPA-covered information) to James Moore as a school official; including contractors such as James Moore within the criteria for school officials in the Customer's annual FERPA notification; not submitting sensitive data outside the scope described in Section 5; determining and approving all mappings, classifications, rules, and assumptions applied to Customer Data; establishing and maintaining their own internal controls, including over the data they provide and their review of results; retaining the originals of their records in their own systems; and preparing, reviewing, approving, and submitting their own reports to the NCAA, under EADA, or to any other body. James Moore records the Customer's decisions in the service, makes no decisions on the Customer's behalf, and does not prepare, file, or submit any Customer report. James Moore will handle any FERPA-covered information received under the access, use, and redisclosure limitations of the school-official exception and the applicable customer agreement.
7. How We Use Data
We use the data described above to: provide the DAPORA service, which Customers use to generate their reports and calculations; create and administer user accounts; secure and monitor the service; provide customer support; troubleshoot and maintain reliability; meet legal and contractual obligations; and maintain audit logs. We use Usage & Security Data and aggregated, de-identified operational data to maintain and improve service reliability and security. Our support and maintenance relate solely to the DAPORA platform; James Moore does not operate, monitor, maintain, or provide help desk services for any Customer's systems or network.
We may also create de-identified, aggregated statistics from Customer Data for statistical, analytical, and research purposes, and to develop and improve our products and services. These statistics combine data from at least [five] customers, report no figure for a group of fewer than [five] individuals or at a level that could identify an individual or customer (such as a single sport's coaching salary), and are never re-identified or sold. Customer Data containing student education-record information is used for these purposes only after it has been de-identified in accordance with 34 CFR 99.31(b)(1).
8. How We Do Not Use Data
- We do not sell Customer Data.
- We do not use Customer Data for advertising, behavioral targeting, or marketing profiles.
- We do not use Customer Data, or aggregated data derived from it, to train artificial-intelligence models.
- We do not use Customer Data for our own statistical or analytical purposes except in de-identified, aggregated form as described in Section 7.
- We do not disclose Customer Data except as described in this notice or the applicable customer agreement.
9. Sharing and Subprocessors
We share data only as needed to operate DAPORA: with our cloud infrastructure provider; with users the customer designates; with professional advisers; as required by law or valid legal process; and in connection with a corporate transaction, subject to this notice. We do not otherwise disclose Customer Data. Current subprocessors:
| Subprocessor | Function |
|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure for the DAPORA platform |
We will notify customers at least 30 days before adding a subprocessor that processes Customer Data.
10. Data Location
DAPORA production Customer Data is stored in United States AWS regions. The primary production environment operates in AWS us-east-2, and encrypted disaster-recovery backups of the DAPORA platform database are copied to AWS us-west-2. Customer Data may be transferred or copied between AWS availability zones and servers within these US regions for redundancy and backup purposes. DAPORA may use AWS global or edge services to route, secure, and deliver the service; those services may process network, security, or routing metadata as part of service delivery, but DAPORA stores production Customer Data in the U.S. AWS regions described above.
Administrative access. Access to Customer Data and uploaded source files is restricted to authorized James Moore personnel and contractors bound by written confidentiality and data-protection obligations with a legitimate business need, using role-based, least-privilege access controls and strong authentication, and is recorded in audit logs. Production access is limited; routine internal access is generally read-limited, and elevated access required for support, security, or troubleshooting is approved through an internal support/change process, limited to the purpose and duration of the task where practicable, and logged for auditability.
11. Security
DAPORA uses a defense-in-depth security model, including: encryption in transit (TLS 1.2+) and at rest (AWS KMS); role-based, least-privilege access controls; multi-tenant isolation with database row-level security and per-tenant storage; audit logging; automated backups of the DAPORA platform; vulnerability management and security scanning in the development pipeline; incident-response procedures; and subprocessor review. No method of transmission or storage is completely secure, and we do not guarantee absolute security.
12. Retention and Deletion
| Data type | Retention |
|---|---|
| Customer Data | Stored in the DAPORA platform for the subscription term and any post-term reporting period as a copy of data the Customer keeps in its own systems; on termination, exported and/or deleted per the customer agreement |
| Backups | Daily production database backups and DR copies retained for 35 days; weekly production backups and DR copies retained for up to 90 days. Backups are stored in US AWS regions (primary us-east-2; DR copies in us-west-2) |
| Security logs | Security, audit, and production service logs retained for at least 365 days, unless a longer period is required by law, contract, litigation hold, or security investigation; access-controlled and protected against unauthorized access or alteration |
| Support tickets | Retained for support history unless deletion is requested |
| Billing records | Retained as required for accounting and legal purposes |
Deletion scope. Upon verified customer request or contract termination, Customer Data is deleted from active production systems within 90 days after the applicable export window closes, after delivery of a requested export, or after verification of the deletion request, as applicable, unless retention is required by law, a litigation hold, or an active security investigation. Customer Data contained in encrypted backups and snapshots is removed on the applicable backup-expiration cycle rather than by immediate targeted deletion, because targeted deletion from historical backups and snapshots may compromise backup integrity and recoverability; backup data remains encrypted and access-controlled until expiration. Under the current production backup schedule, daily production database backups and their disaster-recovery copies are retained for 35 days, and weekly production backups and their disaster-recovery copies are retained for up to 90 days.
Purpose of backups. DAPORA backups and disaster-recovery copies exist solely to maintain the availability and integrity of the DAPORA platform. They are not a backup, archival, disaster-recovery, or business-continuity service for the Customer's records, and James Moore does not act as host or custodian of the Customer's records. The Customer retains the originals of its records in its own systems and remains responsible for its own backup and record retention.
13. Termination of Services
Upon expiration or termination of a Customer's subscription, the export, deletion, and handling of Customer Data are governed by the applicable customer agreement. The Customer may export its data, mapping rules, mapped data, and reports at any time during the subscription. If a subscription expires without renewal, the Customer may continue to access the service for its licensed fiscal years through 30 days after the applicable NCAA reporting deadline, to complete and export its reporting; no new fiscal year is opened during this period. A 30-day export window follows. Customer Data is then deleted from active production systems within 90 days, and backup copies expire within a further 90 days, subject to the exceptions described in Section 12. The Customer is responsible for exporting and retaining any records it needs, including for audits or agreed-upon procedures engagements.
14. Handling of Student Education-Record Data
Because some source data may include limited student education-record information (see Section 5), James Moore handles it as follows: it is processed only as a school official under FERPA, at the institution's direction and only to provide the contracted service; it is protected by the security controls in Section 11 (encryption, role-based least-privilege access, multi-tenant isolation, audit logging); it is not redisclosed except as permitted by the customer agreement and FERPA; and it is retained and deleted per Section 12 and the customer agreement. James Moore applies data minimization to limit identifiable student information to what is necessary. If a customer submits sensitive data outside the scope of Section 5, we may notify the customer, restrict access, or delete the data, and may ask the customer to resubmit it within scope. The institution retains ownership and control of its education records and other Customer Data at all times. The institution may export its Customer Data at any time through the service and, after termination, may request one export in a commonly used format through a secure transfer process, as provided in the customer agreement.
15. Customer and User Rights
Institutional customers may access, export, correct, or delete their Customer Data through the service or by request. Individual users may update their account information. Because the institution controls its Customer Data, requests from individuals about that data may be routed to the institution. We respond in accordance with the customer agreement and applicable law.
16. Changes to This Notice and Contact
We will update this notice when our practices change and will provide notice of material changes. Questions or requests: digitalsupport@jmco.com.