School data processing agreement

These are the terms SpeedGrade signs with schools and districts about student data. Districts that use the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA v2) can sign that instead: write to [email protected] and we will complete and sign its exhibits.

Student data we handle

Data	Collected	Purpose
Student work: answers, documents, images of written work	Yes	Grading
Assessment results: scores, feedback, rubric results	Yes	Grading and teacher review
Pseudonymous student id (derived from the Classroom id)	Yes	Linking work to the right student
Student name	Displayed only, fetched live from Classroom, not stored. Exception: a name the teacher types in for a student who isn't on the Classroom class list is stored, encrypted, with that one assignment	Showing the teacher whose work it is
Class / course enrollment	Yes	Organising work by class
Student email, phone, address, date of birth	No
Demographics, special education, health, discipline	No
Biometric data	No (scans are of paper, not of students)
Device, location, or behavioural tracking of students	No (students do not use the app)
Teacher name and email	Yes (staff data, not student data)	Account and sign-in

Subprocessors

Subprocessor	Purpose	Student data
[Cloud host]	Hosting and storage	Yes, encrypted
Anthropic	Reading handwriting, suggesting scores, reading the name on a scanned paper	Answer text and answer images (name line blanked out); for matching a scanned paper to a student, an image of its name area only
Stripe	Payments	No

SpeedGrade Student Data Processing Terms

These terms are between [School or district legal name] ("School") and [Company legal name] ("SpeedGrade") and form part of SpeedGrade's Terms of Service. If they conflict, these terms win for Student Data.

1. Definitions. "Student Data" means any information about a student that SpeedGrade receives from the School, its teachers, or Google Classroom, or creates while providing the service, including student work, images of student work, transcriptions, scores, and feedback. "Subprocessor" means a third party SpeedGrade uses to process Student Data.

2. Ownership and control. Student Data belongs to the School. SpeedGrade processes it only on the School's behalf and under its direction. For FERPA purposes, SpeedGrade acts as a school official with a legitimate educational interest and is under the School's direct control regarding the use and maintenance of Student Data.

3. Permitted use. SpeedGrade uses Student Data only to provide the grading service to the School's teachers: importing work, reading it, scoring it, suggesting feedback, supporting teacher review, and returning approved grades. SpeedGrade will not:

1. sell, rent, or trade Student Data;
2. use it for targeted advertising or to market to students or parents;
3. build a profile of a student except as needed for the teacher's grading;
4. use it to create, train, or improve artificial intelligence or machine-learning models, or permit any Subprocessor to do so;
5. release a grade to Google Classroom that a teacher has not approved.

4. Artificial intelligence. SpeedGrade uses AI to transcribe handwriting and suggest scores. Suggestions are reviewed and approved by a teacher before use. SpeedGrade sends its AI Subprocessor only the minimum needed: answer text or images of the answers with the name line blanked out, the question, the answer key, and the rubric; and, when a teacher scans a paper without choosing the student, an image of the paper's name area so the handwritten name or student ID can be read and matched to the class list. Names read this way are not stored. SpeedGrade never sends student contact details. On request, SpeedGrade will give the School its accuracy measurements for the subjects the School uses.

5. Subprocessors. SpeedGrade's current Subprocessors are listed in the Subprocessors table above. Each is bound by written terms at least as protective as these. SpeedGrade gives the School [30] days' notice of a new Subprocessor that will process Student Data; the School may object and, if the objection cannot be resolved, terminate without penalty.

6. Security. SpeedGrade maintains a written information security program with administrative, technical, and physical safeguards suited to the sensitivity of Student Data, including encryption in transit and at rest, per-school data isolation, least-privilege staff access with logging, regular testing, and an annual independent security assessment.

7. Data breach. SpeedGrade will notify the School without undue delay and in any event within [72 hours] of confirming unauthorised access to Student Data, describing what happened, the data involved, and the steps taken. SpeedGrade will cooperate with the School's investigation and with any notices to parents the law requires, and will bear the reasonable costs of notices caused by its breach.

8. Access, correction, and deletion. SpeedGrade will help the School respond to requests from parents and eligible students to review, correct, or delete Student Data within [10 business days] of the School's request. If a parent or student contacts SpeedGrade directly, SpeedGrade will refer them to the School.

9. Retention and disposition. SpeedGrade keeps Student Data only as long as needed for the service: by default until one year after the class ends, or a different period the School sets in the app. On expiry, account closure, or the School's written request, SpeedGrade deletes Student Data (including from backups within [35] days) and confirms deletion in writing. The School may first export its data.

10. Legal requests. If SpeedGrade receives a subpoena or other legal demand for Student Data, it will notify the School (unless the law forbids it) so the School can respond.

11. Children under 13. The School authorises SpeedGrade to process Student Data of students under 13 solely for the School's educational purposes, and confirms it has given any notices to parents that the School's policies or the law require.

12. State law. SpeedGrade will comply with the student-privacy laws of the School's state. Any state-specific terms are in Attachment 1.

13. Term. These terms last as long as SpeedGrade holds Student Data, even after the main agreement ends.

Signatures

	School	SpeedGrade
Name
Title
Signature
Date

To sign, print this page or write to [email protected] for a copy to sign electronically.