Data Processing Agreement

1. Parties and purpose

This Agreement is between ____________________ (the “LEA”) and the Provider of this math diagnostic and remediation service. The Provider will process Student Data solely to provide the services described in Exhibit A for the LEA’s educational purposes.

2. Ownership and control

• All Student Data remains the property of and under the control of the LEA.
• The Provider is designated a “school official” with a legitimate educational interest under FERPA and is under the LEA’s direct control with respect to the use and maintenance of Student Data.
• Parents, legal guardians, and eligible students may review and correct Student Data through the LEA. The Provider will respond to LEA requests within 10 business days.

3. Provider obligations

• Use Student Data only for the purposes of this Agreement. No sale, rental, or targeted advertising.
• Do not use Student Data to train generalized AI models. AI sub-processors receive de-identified problem content only and are contractually barred from retaining or training on it.
• Limit access to employees and sub-processors who need it to provide the service, each bound by written confidentiality obligations at least as protective as this Agreement.
• Maintain an audit log of administrative access, data deletion, and retention changes, available to the LEA on request and in-product.

4. Data security

• Encryption in transit (TLS 1.2+) and at rest.
• Salted, hashed credentials; signed HTTP-only session cookies; least-privilege database access.
• Breach notification to the LEA within 72 hours of confirmation, including the nature of the incident, data affected, and remediation steps.

5. Retention and disposition

• The LEA selects a retention period in-product (180 days, 1 year, 2 years, or until deleted). Expired Student Data is purged on request or automatically.
• Upon written request or termination, the Provider will delete or return all Student Data within 60 days and certify disposition in writing.
• De-identified data used for research or product improvement must not be re-identified and must exclude names, student IDs, and free-text responses.

6. Sub-processors (Exhibit B)

• Vercel, Inc. — application hosting and file storage (United States).
• Neon, Inc. — managed PostgreSQL database (United States).
• AI inference providers accessed through Vercel AI Gateway — zero data retention, no training on inputs.
• Stripe, Inc. — billing for individual teacher subscriptions only; no Student Data.

7. Data elements (Exhibit C)

• Student: first and last name, school student ID, class period, answers and written work, scores, practice time, optional interests and accessibility preferences.
• Teacher-entered: accommodations (IEP/504/ELL), home language, parent contact email.
• Teacher: name, school email, sign-in method.

8. Signatures

LEA representative: ______________________________ Title: ______________ Date: __________

Provider representative: __________________________ Title: ______________ Date: __________