Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between School Workbench, LLC, a Rhode Island limited liability company ("Provider", "we"), based in Lincoln, Rhode Island, and the school or district identified in the order ("School") for the School Workbench service ("Service"). It governs the Provider's processing of Student Data on the School's behalf. If it conflicts with the main agreement on the subject of data protection, this DPA controls. A School may request modifications to reflect its jurisdiction's requirements.

1. Definitions

• Student Data: personally identifiable information relating to a student that the Provider accesses or processes to provide the Service, including data drawn from Google Classroom, Gmail, Drive, imported calendars, any Integration the School connects, AI Coach conversations, files and photos users upload or attach, and to-dos and calendar events users add.
• Integration: a connection between the Service and another system the School uses — such as Google Classroom, a student information system (e.g. Rediker or Blackbaud), a rostering provider (e.g. ClassLink or Clever), or a learning management system (e.g. Canvas or Schoology) — as listed in Section 2a of the Provider's Privacy Policy.
• School Official / legitimate educational interest: as used in FERPA (34 CFR § 99.31(a)(1)).
• Subprocessor: a third party the Provider engages to process Student Data.

2. Roles and ownership

The School (and/or the parents/students) owns and controls all Student Data. The Provider processes Student Data solely as a School Official performing an institutional service under the School's direct control, and does not own Student Data. Under GDPR-style terminology the School is the controller and the Provider the processor.

3. Scope, purpose, and instructions

The Provider will process Student Data only to provide and maintain the Service, and only on the School's documented instructions (including this DPA and the agreement). A user's request to the AI Coach to make a change within the Service, as described in Section 4, is processing to provide the Service. The Provider will not process Student Data for any other purpose, and in particular will not: sell it; use or disclose it for advertising or targeted advertising; build a personal profile except for the authorized educational purpose; or use it to train, develop, or improve any generalized third-party AI/ML model.

4. Nature of processing

• Data subjects: students and, where applicable, teachers/staff at the School.
• Categories: identifiers (name, school email, profile image); Classroom coursework, due dates, topics, announcements; class rosters, guardian links, and gradebook assignment details and handed-in status from Integrations the School connects; Google Calendar and imported calendar events; Gmail message metadata and, on request, message content for summaries; Drive file names and referenced content; AI Coach conversation content, including the record of changes it makes at a user's request; files users upload or attach, including text read from attached photos; to-dos and calendar events users add; effort/planning data; attendance records the School creates; and service-usage telemetry — a pseudonymous account identifier, a feature name from a fixed list, and a date, recorded to operate and improve the Service. Telemetry contains no content and no IP address, device fingerprint, or location; identifiable telemetry rows are deleted within 90 days, with only identifier-free aggregate counts retained longer. Error logs (error code, feature, time, pseudonymous identifier, school domain; no content or IP address) are kept 30 days and are shown to the School only in aggregate.
• Prohibited uses: the Provider will not sell Student Data, use it for targeted advertising, build a profile of a student for any non-educational purpose, or use it to train artificial-intelligence models.
• Service communications and surveys: the Provider may send users service notices (outages, maintenance, security notices, and changes to features or terms), in the app or by email. With the School's agreement, it may also invite users, including students, to answer short, optional surveys about the Service. Students never receive advertising or marketing. Survey answers are used only to improve the Service; are shared with the School in aggregate or as the School directs; never cover the topics protected by the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h); and are deleted within 12 months or when the agreement ends, whichever is first. Teachers and School administrators may also receive occasional product updates, each with an unsubscribe link.
• AI actions within the Service: at a user's request, the AI Coach can make changes within the Service (such as to that user's plan, to-dos, calendar events, Library file names and settings), acting with that user's access and subject to the School's feature settings, so it cannot do anything that user could not do directly. Deletions and attendance records take effect only after the user confirms them. It cannot change anything in the School's systems or a user's Google account. These changes are recorded in the conversation available to the School's oversight, except changes to a user's private Library.
• Photos: a photo a user attaches to an AI Coach conversation is sent to the AI model once so its text and diagrams can be written out. The Provider retains that text as an attached file and does not retain the image.
• Read-only sources: Google data is accessed via read-only scopes; the Service cannot modify the School's Google environment. Every Integration is likewise read-only.
• Integrations are the School's choice: the School decides which Integrations to connect, and its decision to connect one is a documented instruction under Section 3. Each is independent and optional; Google Classroom is on by default and the School may turn it off. The Provider processes data from an Integration only while it is connected and only for the purposes in this DPA. When the School disconnects an Integration (or turns Google Classroom off), the Provider stops accessing it and deletes the Student Data it supplied as described in Section 2a of the Privacy Policy, except data that also came from an Integration the School still uses. From a student information system's gradebook the Provider receives assignment details and whether work is marked handed in, never scores, grades or teacher comments, except through the Blackbaud parent panel as described in the Privacy Policy. A new Integration the Provider adds is off for the School until the School turns it on.

5. FERPA

The Provider acts as a School Official with a legitimate educational interest, uses Student Data only for the authorized purpose, is under the School's direct control with respect to that data, and will not re-disclose Student Data except as permitted by FERPA and directed by the School. The Provider will assist the School in honoring parent/eligible-student rights to inspect, review, and correct data.

6. COPPA and children

For students under 13, the School provides consent on behalf of parents consistent with COPPA's school-consent provisions, and represents it is authorized to do so. The Provider will, on request, describe its data practices to the School and support the School's parental-notice obligations.

7. State student-privacy law

The Provider will comply with the student-data-privacy laws of the state(s) in which the School operates, and will execute any state-required exhibit — for example a state-specific data-privacy agreement or the SDPC National Data Privacy Agreement (NDPA) — as an attachment to this DPA at the School's request.

8. Security measures

• Encryption: Google tokens, stored third-party API keys, email text and uploaded document text are encrypted at the field level (AES-256-GCM) with keys held outside the database; data in transit is protected with HTTPS/TLS. All stored data, including database backups and disk snapshots, is also encrypted at rest with AES-256 (AWS EBS encryption).
• Access isolation: multi-tenant storage scoped per user; every query filtered by user identity.
• Authentication: least-privilege read-only Google scopes; administrator two-factor authentication; role-based access for staff.
• Operational: the AI model (Anthropic's Claude) is run by Amazon Web Services through Amazon Bedrock within the Provider's AWS account; Student Data sent to it is not used to train any model, is not shared with Anthropic, and is not stored by AWS for model training. Provider staff can open Coach content only while the School has turned on support access in its admin panel (for no more than 14 days at a time, revocable at any time) and only to support the School's oversight or to resolve a support or safety issue; each such access is logged and shown to the School's administrators. AI output may be inaccurate and is not a substitute for instruction. Access is logged; the database is backed up on a regular schedule; dependencies are monitored and patched for known vulnerabilities; and access to production systems is limited to authorized personnel on a least-privilege basis.

9. Subprocessors

The Provider may engage Subprocessors to provide the Service and will: (a) maintain a current list — presently Amazon Web Services (cloud hosting and AI inference, United States), Google (the authorized source of the data the School and its users connect), Apple Inc. (push notifications to the iPhone app; notification text only), Resend (email delivery, United States; for service emails and survey invitations it receives only the recipient's name, school email address and the message), the School's rostering provider or student information system (such as ClassLink, Clever or Rediker, only where the School connects it), and, only for Schools that enable the parent panel, Blackbaud, Inc. (United States; the School's own student-information system, read under the School's authorization and, for gradebook data only, under each parent's own authorization); (b) bind each Subprocessor to data-protection obligations no less protective than this DPA; (c) remain responsible for their performance; and (d) give the School at least 30 days' written notice of a new Subprocessor; if the School reasonably objects and the parties cannot resolve it, the School may terminate and receive a pro-rated refund of prepaid fees. The Provider also uses Tailscale to secure administrative access to its servers; Tailscale does not receive Student Data. The AI model is provided through Amazon Bedrock and is covered by the Amazon Web Services subprocessor relationship above; Anthropic does not receive Student Data and is not a subprocessor.

10. Confidentiality

The Provider limits access to Student Data to personnel who need it to deliver the Service and are bound by confidentiality obligations.

11. Assistance with requests

The Provider will, taking into account the nature of processing, reasonably assist the School in responding to requests from parents, eligible students, or regulators, and in meeting the School's security, breach-notification, and data-protection-assessment obligations.

12. Security incidents

The Provider will notify the School without undue delay and no later than 72 hours after becoming aware of a breach of security leading to unauthorized access, disclosure, or loss of Student Data, will provide known details, and will cooperate with the School's response and notification duties.

13. Return and deletion

On expiry or termination of the agreement, or on the School's request, the Provider will return and/or delete Student Data within 30 days and, on request, certify deletion, except where retention is required by law. Before deletion, the School may request an export of its Student Data in a common machine-readable format (CSV or JSON), which the Provider will deliver within 30 days. Copies in backups and disk snapshots are deleted on their normal schedule, within a further 30 days, and are never restored except to recover from data loss. Individual users may delete their own data at any time via the Service, except that conversations, attached-file text and study materials a user deletes stay available to the School's oversight as described in Section 4 of the Provider's Privacy Policy until the account is deleted or the School instructs otherwise.

14. Audit and compliance

State law. The Provider will comply with state student-privacy laws that apply to the School, including, where applicable, the California Student Online Personal Information Protection Act (SOPIPA), New York Education Law §2-d (including the Parents' Bill of Rights, provided on request), and Rhode Island student-data law, and will sign a state-specific Student Data Privacy Agreement (such as the SDPC National DPA) on request.

Order of precedence. If this DPA conflicts with the Terms of Service or the Privacy Policy, this DPA controls for Student Data.

Notices. Legal and privacy notices to the Provider go to support@schoolworkbench.com. Breach notices go to the contact the School designates in its agreement.

The Provider will make available information reasonably necessary to demonstrate compliance with this DPA and will cooperate with reasonable audits or assessments the School is entitled to conduct, on reasonable prior notice, no more than once per year (or as required following a security incident), and subject to confidentiality.

15. Term

This DPA takes effect when the parties enter the agreement and remains in effect for as long as the Provider processes Student Data. Sections that by their nature should survive (confidentiality, deletion, liability) survive termination.

16. Signatures

By signing below, each party agrees to this DPA as of the date of last signature.

Questions or to execute this DPA: support@schoolworkbench.com, School Workbench, LLC, Lincoln, Rhode Island.