School Data Privacy Agreement

This agreement governs how we receive, use, protect and delete Student Data and School Data when the School’s teachers use Co-Teacher with student names or other identifying information (“named use”). Before the School signs, teachers at the School may use Co-Teacher only with work that carries no student name or identifier (“no-names use,” Section 4.4).

The School accepts this agreement by electronic signature through the link we send to the signer’s email address. The person signing represents that they are the School’s principal, head of school, or another person authorized to bind the School to agreements about student data. We record the signer’s name, title and email, the date and time, and the version signed, and we send the School a copy signed by both parties. Simovia’s signature is applied to the agreement before it is sent, so the School’s signature completes it.

Order of precedence. If the School and Simovia sign a separate data privacy agreement (including a Student Data Privacy Consortium National Data Privacy Agreement), that agreement controls over this one where they conflict. This agreement controls over the Co-Teacher Terms of Service, the Privacy Policy and any order form for everything concerning Student Data and School Data.

This agreement covers every Co-Teacher account associated with the School, including teachers who sign up after the signature date and any work those teachers uploaded before it. The School identifies its accounts by email domain or by a list it gives us.

To the extent the Family Educational Rights and Privacy Act (FERPA) applies to the School, we act as a “school official” with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1), performing a service the School would otherwise perform itself, under the School’s direct control with respect to the use and maintenance of education records, and subject to the use and re-disclosure limits of 34 C.F.R. § 99.33.

The School owns all Student Data and School Data. We acquire no rights in it beyond the limited license in Section 5.1.

Students do not create accounts in, log in to, or provide information to the School’s Co-Teacher accounts. Teachers use them. Where the Children’s Online Privacy Protection Act applies to a student under 13, the School provides the consent the Act requires on the parent’s behalf for this educational purpose, as the Federal Trade Commission’s guidance for schools permits, and we use the data for no other purpose.

We will comply with the state student privacy laws that apply to the School and to us as an operator of a service designed for school use, including those named in Section 14.

For a private or religious school to which FERPA does not apply, this agreement applies in full as a matter of contract.

We collect only the data needed to provide the Services. The data elements are listed in Schedule 1.

What not to upload. Co-Teacher does not need, and the School and its teachers should not provide, a student’s date of birth, home address, contact information, government or student ID numbers, Individualized Education Program or Section 504 documents, or any health, disability or disciplinary information. If an uploaded image happens to contain such information, we treat the image as Student Data, store nothing from it as a separate field, and delete it on the same schedule as everything else.

The School may use coded identifiers in place of student names at any time.

No-names use. Co-Teacher can analyze work that carries no student name: a code the teacher assigns, a made-up name, or nothing. Until the School signs this agreement, each teacher at the School confirms at their first scan that they will upload work only in this form. We rely on that confirmation. Handwriting and content can in some cases be identifying, so we protect all uploaded work with the same security whether or not it carries a name. When the School signs, this agreement applies to everything the School’s teachers have uploaded.

The School grants us a limited, non-exclusive, revocable license to process Student Data and School Data solely to provide, maintain, secure and support the Services for the School.

We will not:

• sell, rent, trade or otherwise monetize Student Data or School Data;
• use Student Data or School Data for advertising of any kind, or to build a profile of a student for any purpose other than the Services;
• use Student Data, School Data, teacher prompts or generated outputs to train or fine-tune any artificial intelligence model, ours or anyone else’s, or permit any Subprocessor to;
• disclose Student Data to anyone other than Subprocessors bound by Section 7, the School’s Authorized Users, or as Section 11.8 provides for legal process;
• attempt to re-identify De-identified Data, or permit anyone else to;
• contact the School’s students or their families directly;
• use Student Data or School Data for any purpose other than the Services.

Improving accuracy. We may keep copies of student work from which the student’s name and every other direct identifier have been removed, including the original handwriting, and use them inside Simovia to check and improve the accuracy of our prompts, analysis and materials. We use these samples for no other purpose: never to train a model, ours or a provider’s; never outside the company; never in marketing, sales or investor materials. We protect them with the same security as Student Data. The School may ask us at any time to exclude its samples by writing to privacy@co-teacher.com, and we will.

We may use De-identified Data in aggregate for product improvement, security, operations and statistical reporting. We will not disclose aggregate data externally in any form from which a student, teacher or the School could reasonably be identified.

The teacher decides. Co-Teacher’s scores, flags, groupings and materials are instructional analysis for the teacher. They are not grades of record, and Co-Teacher does not enter anything in a gradebook, student record or report card. The teacher decides what to do with them. Our analysis can be wrong, and we make no automated decision that has a legal or similarly significant effect on a student.

Co-Teacher sends student work to AI Providers to generate analysis, materials and translations. Each AI Provider that receives Student Data is listed in Schedule 3 with what it receives and its retention terms.

For every AI Provider that receives Student Data, we maintain a configuration or contract under which the provider does not store inputs or outputs after the response is returned and does not use them to train or improve its models. As of the effective date, model calls run through Vercel AI Gateway with zero data retention enabled for our account, which stores nothing and routes only to providers that have agreed to zero-retention terms with Vercel. Translation runs through Google Cloud Translation under our own account, which holds text in memory only while translating it and does not store it or use it for training.

We do not use provider features that would store Student Data, such as prompt caching or provider-hosted evaluation tools. Our own accuracy checks run on our systems.

All AI processing of Student Data takes place in the United States.

We will not send Student Data to any AI Provider that does not meet this Section, and adding or replacing an AI Provider follows the notice and objection process in Section 7.3.

Our current Subprocessors are listed at co-teacher.com/legal/subprocessors, reproduced in Schedule 3 as of the version date of this agreement, with the function each performs, whether it receives Student Data, where it processes, and how long it keeps anything.

We bind each Subprocessor in writing to obligations at least as protective of Student Data as this agreement, including use limits, confidentiality, security, no training, deletion and breach notice. We remain responsible for our Subprocessors’ acts and omissions as if they were our own.

We will give the School at least 30 days’ notice by email before adding or replacing a Subprocessor that will process Student Data. The School may object in writing on reasonable grounds. If we cannot resolve the objection, the School may terminate this agreement and we will delete its data under Section 11.

Nothing from the School’s accounts is shared with a parent or guardian. Co-Teacher offers no family access feature.

A parent or guardian may create their own Co-Teacher account and upload their own child’s work to it. That account is separate from the School’s accounts, is governed by our Terms of Service and Privacy Policy rather than this agreement, and shows nothing from the School.

A student aged 13 or older may likewise create their own Co-Teacher account for their own work. That account is separate from the School’s accounts, is governed by our Terms of Service and Privacy Policy rather than this agreement, and shows nothing from the School.

If we later make a family access feature available, we will tell the School before we do, and it will be off unless the School turns it on in writing or in its account.

We maintain a written security program aligned to the NIST Cybersecurity Framework, summarized in Schedule 2. At minimum we:

• encrypt Student Data in transit (TLS 1.2 or higher) and at rest (AES-256);
• limit access to Student Data to personnel who need it to operate the Services, under role-based permissions and unique accounts, with multi-factor authentication required for administrative and production access;
• log administrative activity in our cloud infrastructure and retain that record for at least 90 days; our server logs do not record student names and are kept for 30 days;
• store and process Student Data only in the United States, including at our AI Providers;
• train every employee and contractor with access to Student Data on federal and state student privacy requirements before access is granted and at least annually after that;
• follow secure development practices, including review of changes that affect security or privacy;
• maintain backups and disaster recovery procedures, with backup copies containing Student Data purged within 30 days after deletion of the live data;

On the School’s reasonable request, we will provide a summary of our current security practices and any third-party security reports we hold.

Anyone may report a suspected vulnerability to security@co-teacher.com. We acknowledge reports within two business days.

We maintain cyber and data risk insurance with limits of $1,000,000 for each claim and $1,000,000 in the aggregate. We provide a certificate of insurance on the School’s request, and we will tell the School if the coverage lapses or is cancelled.

If we become aware of any unauthorized access to, acquisition, disclosure, loss or misuse of Student Data or School Data (a “Data Incident”), we will notify the School by email, and by phone where we have a number, without undue delay and no later than 72 hours after becoming aware.

Our notice will include, to the extent known: what happened, when, which data and approximately how many students or users are affected, what we have done to contain it, what we recommend the School do, and a named contact. We will update the School as we learn more.

We will cooperate with the School’s investigation and with law enforcement, and will not notify families, students, regulators or the public about a Data Incident involving the School without the School’s prior approval unless the law requires us to, in which case we will give the School as much notice as the law allows.

Where a Data Incident is caused by our breach of this agreement or our negligence, we will bear the reasonable costs of notification and remediation required by law.

Access and correction. The School can view, correct and delete Student Data within the Services at any time, and we will assist with any correction or deletion the School requests in writing.

Parent and student requests. We will promptly assist the School in responding to a parent’s or eligible student’s request to inspect, challenge or correct records, and we will not respond directly to such a request except as the School directs.

Export. On request, and before deletion at the end of this agreement, we will provide the School a reasonably usable export of its Student Data and generated materials in a common electronic format.

Deletion on request. The School may direct us to delete specific Student Data, or all of it, at any time, including mid-year. We will complete the deletion within 30 days of the request, including at our Subprocessors, and backup copies are purged within 30 days after that. We will provide a written Certificate of Deletion signed by an officer of Simovia on request.

Deletion at the end. Within 30 days after this agreement ends, we will delete all Student Data and School Data in our possession and that of our Subprocessors, subject to the same backup rule, and will provide a written Certificate of Deletion signed by an officer of Simovia on request.

Retention while active. While this agreement is in force we retain Student Data for as long as the School’s accounts are active, so teachers never lose work unexpectedly. An individual account that has been inactive for 12 months is deleted, with notice to the account holder.

Non-payment. We will never delete Student Data because an invoice is unpaid. If fees are overdue we may suspend access after 14 days’ written notice, and we will keep the School’s data available for export for at least 60 days after suspension before any deletion under this Section.

Legal process. If we receive a subpoena, court order or other legal demand for Student Data, we will notify the School before responding unless the law prohibits it, cooperate with the School’s efforts to limit or contest the demand, and disclose only the minimum the demand requires.

This agreement takes effect on the date the School signs it and continues until either party terminates it on 30 days’ written notice, or until a separate signed agreement between the parties replaces it.

Either party may terminate immediately on written notice if the other materially breaches this agreement and does not cure within 10 business days of notice. The School may terminate immediately if we breach Section 5, 6, 7, 9 or 10.

Sections 2, 5.2, 10, 11, 15 and 16, and any obligation that by its nature should survive, survive termination for as long as we or our Subprocessors hold any Student Data.

Our personnel will not have unsupervised contact with students. If any Simovia personnel visit the School, they will follow the School’s visitor, conduct and background-check policies.

We will not use the School’s name, logo, student work or staff names in marketing, case studies or investor materials without the School’s prior written approval.

Florida. For a Florida school or school board, we will comply with FERPA and its regulations and with section 1002.22, Florida Statutes; the Student Data disclosed to us is limited to what the Services require; and we will not re-disclose Student Data except as 34 C.F.R. § 99.31 permits, as the School’s directory information policy permits, or with the written consent of a parent or eligible student. As an operator under section 1006.1494, Florida Statutes, we do not engage in targeted advertising, do not amass a profile of any student except for school purposes, do not sell or rent student information, collect no more than is reasonably necessary, maintain reasonable security, and delete covered information on the School’s request within the periods in Section 11, which are shorter than the statute requires.

Texas. As an operator under Texas Education Code Chapter 32, Subchapter D, we do not engage in targeted advertising based on information acquired through the Services, do not use covered information to profile a student except for school purposes, do not sell or rent covered information, maintain reasonable security, and delete covered information at the School’s request within the periods in Section 11, which are shorter than the 60 days the statute allows.

New York. For a New York educational agency subject to Education Law § 2-d, the New York Attachment to this agreement applies and is incorporated here. It contains the additional commitments 8 NYCRR Part 121 requires of third-party contractors, our Data Security and Privacy Plan (Schedule 2), and the supplemental information for the School’s Parents’ Bill of Rights for Data Privacy and Security.

Other states. We will comply with the student privacy laws of the School’s state as they apply to us, and will sign the state-specific terms the School reasonably requires.

Except as Section 15.2 provides, each party’s total liability arising out of this agreement is limited to the greater of two times the fees the School paid us in the 12 months before the claim or $50,000, and neither party is liable to the other for indirect, consequential or punitive damages.

“Data Claims” are claims arising from our breach of Section 5, 6, 7, 9 or 10, a Data Incident caused by our breach or negligence, and our indemnity in Section 15.3. Our total liability for Data Claims is limited to $1,000,000, and is not subject to Section 15.1. Neither limit applies to a party’s willful misconduct or to amounts a statute requires us to pay, such as breach-notification costs under New York Education Law 2-d.

We will defend and indemnify the School and its board, officers and employees against third-party claims, including regulatory penalties, to the extent they arise from our breach of this agreement or a Data Incident we cause, and will pay the resulting damages, costs and reasonable attorneys’ fees.

For a public school, nothing in this agreement waives any immunity, defense or protection the School has under its state’s law, and nothing requires the School to indemnify us where its state’s law does not permit it.

Governing law. For a public school, this agreement is governed by the law of the School’s state, and venue is as that state’s law requires. For any other school, the law of the State of Florida governs and venue is Miami-Dade County, Florida. This agreement contains no arbitration clause.

Notices. To Simovia: privacy@co-teacher.com, with a copy to Ian Bravo, Co-Founder, at the address above. To the School: leader email. Either party may update its contact by email.

Changes to this agreement. We may publish a new version of this agreement. A new version does not apply to the School until the School signs it, except that we may make changes that are more protective of Student Data, or that are required by law, on 30 days’ notice by email. The version the School signed is always available to the School on request.

Change of control and assignment. If Simovia is acquired or sells substantially all of its assets, we will give the School written notice, the successor is bound by this agreement, and the transaction is not a sale of Student Data. We will not otherwise assign this agreement or transfer Student Data without the School’s consent. The School may terminate this agreement on receiving notice of a change of control, and Section 11 then applies.

Entire agreement. This agreement, its Schedules and, for a New York school, the New York Attachment are the entire agreement between the parties about Student Data and School Data. If any provision is unenforceable, the rest remains in effect, and a party’s failure to enforce a provision is not a waiver of it.

Counterparts and electronic signatures. This agreement may be signed electronically and in counterparts.

No third-party beneficiaries. This agreement is for the benefit of the School and Simovia only. Nothing in it gives any other person, including a parent or student, a right to enforce it; parents and students keep the rights their school and the law give them.