Student Data Addendum

This addendum is the data-processing agreement between the school or teacher who submits student personal data (“Institution”) and Best School Tools (“Processor”). It applies whenever the Institution uses classrooms, interactive lessons, marking, or any tool in a way that includes student personal data. It is incorporated into the Terms of Service.

This is a working processor addendum you can point a school at. It is not a certification that we are “FERPA compliant” or “COPPA certified”. Those labels depend on how the Institution uses the product and on a lawyer’s review of this text.

1. Roles

The Institution is the controller of student personal data (and, where FERPA applies, the school remains responsible for education records). Best School Tools processes that data only to provide the features the Institution uses.

2. What we process

Depending on the feature: student name or identifier the Institution or student enters, class or cohort labels, answers, scores, uploaded work, generated feedback, and technical logs tied to that activity.

We do not require students under 13 to create a personal consumer account. The Institution must not configure the product in a way that forces that.

3. Instructions

We will process student data only on the Institution’s documented instructions: using the product as configured (creating a class, assigning a lesson, running a tool, exporting or deleting records). We will not sell student data, use it for advertising, or use it to train our own AI models.

4. AI subprocessors

If the Institution runs a tool that calls an AI model, the relevant text is sent to OpenAI as a subprocessor so the feature can return a result. Hosted lesson files may be stored on Amazon S3. The Institution instructs us to use those subprocessors by using those features. A current list is in the Privacy Policy.

5. Security

We use HTTPS, access-controlled servers, hashed account passwords, and HTTP-only session cookies. The Institution must use strong passwords, keep join codes reasonably private, and review AI output before it is shown as a grade or official record.

6. Personnel

Only personnel who need access to operate or debug the service may see student data, and they are under confidentiality duties.

7. Assistance

We will reasonably assist the Institution with data-subject requests, security incidents, and DPIAs, via [email protected]. If a student or parent contacts us directly about Institution-controlled data, we will redirect them to the Institution unless the law requires us to act.

8. Breach notice

If we become aware of a personal-data breach affecting the Institution’s student data, we will notify the Institution without undue delay and provide the facts we have (nature, likely consequences, measures taken).

9. Deletion and export

The Institution can delete classes, lessons, and related records in the product where those controls exist, or can email us to request deletion or an export. After the Institution’s account is closed we will delete or anonymise student data within 90 days, except data we must keep for legal claims or backups that rotate out on a normal cycle.

10. FERPA (US schools)

If the Institution is a US school or district subject to FERPA, it appoints us as a school official with a legitimate educational interest solely to provide the service, and we will not redisclose education records except as FERPA allows or the Institution instructs. This section is an offer of those terms; the Institution should confirm they match its own FERPA policy before sending education records.

11. COPPA (children under 13 in the US)

We do not provide a general COPPA parental-consent flow for consumer sign-up. If the Institution wants under-13 students in the US to use a feature that collects personal information, the Institution is responsible for obtaining verifiable parental consent or using an exception that applies to it (for example, as a school collecting data for a school-authorised educational purpose), and for configuring the product accordingly. Do not create personal Best School Tools accounts for children under 13.

12. International transfers

Subprocessors may process data in the United States. The Privacy Policy describes this. By using the service the Institution instructs us to make those transfers for the features it uses.

13. Governing text

If this addendum conflicts with the Terms of Service on student-data processing, this addendum controls. Contact [email protected] if a district needs a signed copy or additional clauses.