This Platform Privacy Notice & SchoolAI Data Protection Addendum (DPA) applies to all Authorized Users of Institutions who use the SchoolAI Technology (as defined in our SchoolAI Terms of Service) where a separate agreement with the Institution does not exist. In the event that a separate data processing agreement is signed between SchoolAI and the Institution, that separate agreement will control. Moreover, in the event that SchoolAI has entered into a statewide data privacy agreement and the Institution countersigns Exhibit “E” to that Statewide Privacy Addendum and returns a copy to SchoolAI via email (send to: privacy@schoolai.com), then the terms of the Statewide Privacy Addendum will control over the terms of this DPA.
Check here if we have a statewide privacy agreement in your state.
This DPA covers Authorized Users of Institutions who are SchoolAI Clients using the SchoolAI Technology in the United States. Section 13.3 (Google User Data) also applies to any user, including adult Community Members, who signs in to the Product or the Community with Google. This DPA does not apply to Authorized Users of Institutions who are SchoolAI Clients using the SchoolAI Technology outside of the United States. Our applicable DPA for non-US Authorized Users can be found here.
Capitalized terms used in this DPA are defined in the SchoolAI Terms of Service or as otherwise defined herein. Some additional terms to know are as follows:
2.1. “Data Protection Laws” means the applicable federal, state, local, and municipal laws and regulations in the United States that relate to privacy, data protection or data security of PII, including but not limited to, and to the extent applicable, the Children’s Online Privacy Protection Act, 15.U.S.C. §6501, et seq., and its implementing regulations, 16 C.F.R. Part 312 (together, “COPPA”) and the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g, and its implementing regulations, 34 C.F.R. Part 99 (together, “FERPA”).
2.2. “Personally Identifiable Information” or “PII” means any information, including in an educational record, relating to an identified or identifiable individual (e.g. full name, date of birth, student ID number, or any information, which when linked to other information, could identify an individual). PII includes (a) “personally identifiable information” as defined under FERPA at 34 C.F.R. § 99.3 and (b) “Personal Information” as defined in SchoolAI’s COPPA Notice (including all categories enumerated in 16 C.F.R. § 312.2). For the avoidance of doubt, PII is a subset of Client Data. De-identified Data is not considered PII.
2.3. “Process, Processes, Processing” means the same as defined in the applicable Data Protection Laws or if no such definition is available, means SchoolAI’s collection, use, uses, stores, discloses, or transfers, storage, disclosure, or transfer of Client Data, including PII.
Each party will comply and follow all applicable Data Protection Laws in its respective Processing of PII under the Agreement.
Client shall provide all notices and obtain all consents required under applicable Data Protection Laws from the Authorized Users (or such Authorized User’s parent or guardian, as applicable) to allow SchoolAI to Process the Client PII as permitted pursuant to this DPA and in the Children’s Privacy Notice and COPPA Disclosure (collectively, the “Notices and Consents”). Client represents and warrants that it has obtained and will maintain the Notices and Consents for all Authorized Users during the Term of the Agreement. Without limiting the foregoing, where the Product makes available an AI notetaker, recording, transcription, or other audio-capture feature, Client and its Authorized Users are solely responsible for providing notice to, and obtaining any consents required under applicable Data Protection Laws (including any all-party consent required by applicable wiretap, eavesdropping, or two-party consent statutes) from, all participants whose voice, image, or contributions may be captured, including any Children, Parents, staff, or other individuals present in the session.
SchoolAI’s Children’s Privacy Notice and COPPA Disclosure (“COPPA Notice”) describes certain information about SchoolAI’s Processing of PII of Authorized Users under the age of 13. The COPPA Notice, together with this DPA, constitutes SchoolAI’s direct notice to Client as the operator of an online service relying on school authorization, as permitted by applicable law. For purposes of this DPA, the Processing activities described in the COPPA Notice apply to all Authorized Users who are students. Client agrees that SchoolAI’s COPPA Notice is subject to change from time to time to remain current. SchoolAI will not make material changes to the COPPA Notice without prior notice to the Client, and will obtain renewed authorization from Client or new verifiable parental consent (as applicable under COPPA) before any material change takes effect.
6.1. SchoolAI maintains a written, comprehensive information security program designed to protect Client PII against unauthorized access, destruction, use, modification, or disclosure. SchoolAI’s program is reviewed at least annually by a designated qualified employee. SchoolAI will implement, maintain, and use reasonable technical and organizational measures that are designed to preserve the security of all Client PII Processed by SchoolAI via the SchoolAI Product, including encryption of PII in transit and at rest, role-based access controls, written policies governing employee access, and ongoing security monitoring. SchoolAI’s technical and organizational measures, and current third-party security attestations (e.g. SOC 2 Type II), are available upon request, via our Trust Center at trust.schoolai.com. Client has reviewed such measures and agrees that the measures are appropriate taking into account the state of the art, the costs of implementation, nature, scope, context and purposes of Processing the PII hereunder.
6.2. SchoolAI shall take reasonable steps to ensure the reliability and integrity of any employees and contractors who have access to the PII and ensure that employees and contractors are under a duty of confidentiality with respect to their Processing of the PII.
6.3. SchoolAI engages certain third-parties to Process the Client Data on SchoolAI’s behalf (“Sub-Processors”). SchoolAI will enter into written agreements with each Sub-Processor containing terms that provide substantially similar levels of data protection and obligations for Client PII as those set out in this DPA. SchoolAI will be liable for all acts and omissions of any Sub-Processor to the extent SchoolAI would be if they were SchoolAI’s acts. Client consents to SchoolAI engaging the Sub-Processors for the purposes set forth in the agreement between Client and SchoolAI. Client acknowledges and agrees that the list of Sub-Processors, published in our trust center at: trust.schoolai.com, may be updated from time to time. SchoolAI shall provide Client with at least ten (10) days’ advance written notice (sent to Client’s email address on file and/or by posting on the trust center) of any new or replacement Sub-Processor that will Process Client PII, and Client may object on reasonable grounds. If SchoolAI cannot reasonably accommodate Client’s objection, Client may terminate the affected portion of the Agreement.
6.4. If SchoolAI becomes aware of a verified and/or confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client PII (a “Security Incident”), SchoolAI shall inform Client, within a reasonable amount of time (but in no event more than what is permitted pursuant to applicable law). The notice to Client will include reasonable information, cooperation, and updates of material developments necessary to allow Client to fulfill any data breach notification requirements pursuant to applicable Data Protection Laws. However, SchoolAI’s cooperation and information sharing will be at Client’s sole cost and expense to the extent the Security Incident is caused by Client or its Authorized Users. SchoolAI may take any and all reasonable measures it deems appropriate to mitigate the effects of the Security Incident.
Client shall be solely responsible for responding to and fulfilling any inquiries from Authorized Users and other data subjects (each a “Data Subject”) regarding their PII in connection with the Processing under the Agreement, including any requests to exercise their rights under applicable Data Protection Laws, and Client will handle all Data Subject’s inquiries as required by applicable Data Protection Laws. Client understands that SchoolAI is not required to take any action in response to any requests from Data Subjects except to notify such Data Subjects to contact Client. Authorized Users may review, obtain a copy of and amend their own PII by contacting Client and following Client’s procedures for amending PII. To the extent Client cannot obtain a copy of, delete, or amend the PII directly within the Product, Client may contact SchoolAI (via email at: privacy@schoolai.com) and SchoolAI will provide a copy of, delete, or amend such Data Subject’s PII in accordance with Client’s written instructions. To the extent Client is unable to effect the Data Subject’s request as permitted by the functionality of the Products, and to the extent legally permitted, Client shall be responsible for reasonable costs arising out of SchoolAI’s provision of assistance with Client’s Data Subject request. Client shall indemnify, defend, and hold harmless SchoolAI and its affiliates, subsidiaries, successors, and assigns (and the officers, directors, employees, sublicensees, customers, and agents of SchoolAI and its affiliates, subsidiaries, successors and assigns), from and against any and all losses, demands, liabilities, damages, fines, settlements, expenses, and costs (including without limitation reasonable in-house and outside attorneys’ fees and costs), arising from in connection with, SchoolAI complying with Client’s instructions under this DPA.
8.1. At the request of Client, Client acknowledges and agrees that SchoolAI may provide Client PII to Third-Party entities that Client requests SchoolAI share information with (e.g. a District Administrator or State Board of Education). Client will make such authorization either (i) in writing to privacy@schoolai.com; or (ii) as permitted by allowing sharing and viewing within the Administrator Account (to the extent the functionality exists within the Product). Client acknowledges and agrees that each Authorization will result in Client electing, in its sole discretion, to transfer the Client PII to the recipients that Client selects.
8.2. Client warrants that an individual assigned to the Administrator account will be an individual (or individuals) elected and chosen by Client to have sufficient authority to authorize the transfer of Client PII to the third party on behalf of Client.
8.3. Client acknowledges and agrees that Client Data may contain PII and may be subject to Data Protection Laws. Client will hold SchoolAI harmless, and not liable in any way for the disclosure of PII to the third parties as provided for in this DPA.
8.4. SchoolAI makes no warranty or representation (i) that the use of the Client PII by the third party is valid and in compliance with any and all applicable Data Protection Laws and Client’s organization policies; or (b) that Client PII will remain secure upon transfer to the third party and SchoolAI disclaims any responsibility for the transfer to the third party. Client acknowledges and agrees that Client Data will be provided on an “as is”, “as available” basis.
Client PII will be deleted within ninety (90) days following a written request after the data is no longer needed for the purpose for which it was collected, except that SchoolAI may keep Client PII as required by applicable law, regulation, court order, separate agreement or State Specific Agreement entered into by Client and SchoolAI, or rules applicable to the safeguarding of evidence pending litigation, or as agreed by Client. Upon termination or expiration of the Agreement, SchoolAI will securely delete all Client PII in SchoolAI’s possession or control, except where retention is required by applicable law. Upon Client’s written request, SchoolAI will provide written certification that such return or deletion has been completed.
Client acknowledges and agrees that SchoolAI may create De-Identified Data. In creating the De-Identified Data, SchoolAI will (i) take reasonable steps to ensure that such information cannot be associated with an Authorized User or a “consumer” or “household” (as defined by applicable Data Protection Laws), (ii) publicly commit to maintain and use the information in a de-identified form, and (iii) not attempt to reidentify the information, except as permitted under Data Protection Laws. When SchoolAI shares De-Identified Data with a third party, SchoolAI will contractually require the recipient to (a) not attempt to re-identify the De-Identified Data, (b) not combine it with other data sources for the purpose of identifying any individual, and (c) maintain the information only in de-identified form, consistent with applicable law. De-Identified Data is not considered Client Data. SchoolAI may use De-Identified Data and aggregated data derived from Product interactions for research and the development of published reports aimed at improving educational outcomes and understanding how AI tools support student learning.
As applicable, to the extent SchoolAI has access to “Education Records” and “Personally Identifiable Information” (as those terms are defined in FERPA) in connection with the provision of the Products, (i) Client agrees that SchoolAI is performing an institutional service or function for which Client would otherwise use employees, and Client therefore designates SchoolAI as a “School Official” with “Legitimate Educational Interests” (as those terms are defined in FERPA); (ii) SchoolAI agrees to be under the direct control of Client with respect to the use and maintenance of such Education Records and Personally Identifiable Information, including by acting in accordance with Client’s reasonable instructions; and (iii) SchoolAI agrees that such Education Records and Personally Identifiable Information will be used solely for authorized purposes as permitted by the Agreement between the parties, and it will not redisclose such Educational Records or Personally Identifiable Information except with the prior authorization of Client and where redisclosure is otherwise permitted under FERPA.
To the extent that SchoolAI collects Personal Information from a child under the age of 13 in providing access to the Products, (i) SchoolAI agrees to limit the use of the Personal Information to the purposes permitted by Client under the Agreement, and (ii) Client consents on behalf of parents or guardians to the collection, use, and disclosure of such Personal Information with respect to use of the Products as described in SchoolAI’s COPPA Notice.
13.1. Space Sharing Capabilities with other Users. To the extent permitted by the functionality of the Product, and the Client’s administrator and/or teacher Authorized Users, certain Spaces may be shared within the Product to others. In the event that a teacher Authorized User elects to share the Space (and its content) with a third party and/or make it available and searchable within the Product, the teacher Authorized User agrees and consents to the sharing of their name, institutional affiliation, and profile picture within the Product in connection with the shared Space.
13.2. AI Notetaker. The Product may make available an AI-powered notetaker feature (the “Notetaker”) that, when initiated by an Authorized User, captures audio from a meeting, lesson, or other session, transmits the audio to SchoolAI’s speech-to-text sub-processor (currently Deepgram) solely for transcription, and generates a written transcript and/or summary (collectively, the “Notes”) for the initiating Authorized User and the Institution. SchoolAI displays a visible in-product indicator to participants whenever the Notetaker is active. The Notetaker may incidentally capture the voices and statements of Children, Parents, staff, or other individuals present in the session; captured audio, transcripts, and Notes constitute Client PII and, to the extent they include information about a Child, are also subject to SchoolAI’s COPPA Notice. Audio captured by the Notetaker is processed solely to generate the corresponding transcript and Notes and is deleted following successful transcription within 30 days. Notes are processed only to provide the Notetaker feature to the Institution; are stored as Client PII subject to SchoolAI’s written information security program; are treated as “Education Records” under FERPA to the extent they contain personally identifiable information from a Child’s education records (with SchoolAI acting as a “School Official” with a “legitimate educational interest” under FERPA); are subject to the retention and termination provisions of Section 9 (Retention) of this DPA; and are not used by SchoolAI, Deepgram, or any other party to train, fine-tune, or improve any artificial intelligence or machine-learning model for any purpose outside the direct educational features of the Product. Client and its Authorized Users are responsible for configuring access to the Notetaker, restricting its use to sessions for which appropriate notices and consents have been obtained from all participants (as set forth in the Notices & Consents section above), and complying with applicable wiretap, eavesdropping, and two-party consent laws.
1. Information we receive from Google. Parts of the Product (including the SchoolAI web application, admin app, and browser extension), and the SchoolAI Community (feature for adults only), let you sign in with or link a Google account. This Section applies to anyone who does so, regardless of any exceptions to the applicability of this DPA mentioned above. Its commitments apply as a minimum even where a separate data processing agreement with an Institution controls. In this Section, “we” and “us” mean SchoolAI, “you” means the user who signs in with or links Google, and “Google User Data” means the information we receive from Google. Google asks you to approve each permission, and we receive only the personal data that permission allows:
2. How we use it. We use Google User Data only to provide the user-facing features you choose: signing you in; creating Google Docs, Forms, Slides, Classroom assignments, and course materials from SchoolAI content; importing the files you pick; giving feedback on the Google Doc you have open or shared with the product and adding that feedback to the document only when you ask; using a Google Slides deck as context for your request; matching Students to their submissions and SchoolAI accounts and marking a Student’s own work as turned in; and showing your meetings and linking them to meeting notes. We write to your Google account only when you ask us to, and we never edit existing Google Slides decks or calendar events.
3. Sharing, security, and retention. Google User Data about Authorized Users and Students is Client PII. We share, protect, retain, and delete it as described in Sections 6.1, 6.3, 8, and 9 of this DPA and, for Children, the COPPA Notice. In addition, for every user, including Community Members:
4. Limited Use. SchoolAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. SchoolAI does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.
Notwithstanding anything to the contrary in the Agreement, SchoolAI may modify this DPA from time to time. SchoolAI will provide Client with at least thirty (30) days’ prior written notice (sent to Client’s email address on file as set forth in the Order Form) of any material change to this DPA. If a material change requires Client’s consent under applicable Data Protection Laws (including COPPA), or under SchoolAI’s agreement with Client, SchoolAI will not implement the change with respect to Client until SchoolAI has obtained that consent. Non-material changes (such as clarifying language, typographical corrections, or non-substantive reorganization) take effect upon posting and do not require Client’s consent.
