Data Privacy Agreement

1. Parties & purpose

This Data Privacy Agreement (“Agreement”) is entered into by JC Design Intelligence, LLC, operator of ContactAssist (“Provider”), and the local education agency, school, or district that executes it (“LEA”). It governs the Provider's handling of Student Data in connection with the ContactAssist service, under which a teacher logs parent email communications about students into a Google Sheet the teacher controls.

2. Definitions

• Student Data — information relating to an identifiable student that is processed through the service, limited here to AI-generated summaries and metadata (parent/student name, topic, urgency, dates, and a link to the original email). Provider does not store full email bodies.
• Education Records — as defined under FERPA (20 U.S.C. § 1232g; 34 CFR Part 99).
• School Official — Provider acts as a school official with a legitimate educational interest, under the direct control of the LEA with respect to the use and maintenance of Education Records.

3. Data ownership & control

All Student Data remains the property of and under the control of the LEA. The LEA (and its teachers) direct the purpose of processing. Provider acquires no rights or licenses to Student Data other than those necessary to provide the service.

4. Permitted use & restrictions

• Provider uses Student Data solely to provide the service to the teacher.
• Provider will not sell Student Data, use it for targeted advertising, or build a profile of a student except in furtherance of the service.
• Provider will not use data obtained through Google Workspace APIs to train or improve generalized AI/ML models.
• AI-drafted replies are saved as drafts for the teacher's review; the service does not send email without the teacher's action.

5. Subprocessors

Provider uses the following subprocessors, each bound to equivalent confidentiality and security obligations: Google LLC (Gmail/Sheets/Drive APIs), Anthropic, PBC (summarization; data not used to train models per its API terms), MongoDB, Inc. and Provider's US cloud host (encrypted storage), and Stripe, Inc. (billing — teacher data only, no Student Data).

6. Security

• Encryption in transit (TLS) and encryption of Google refresh tokens at rest.
• Least-privilege OAuth scopes (per-file Drive access; draft-only Gmail composition).
• Access to production restricted to authorized personnel with multi-factor authentication.
• Data processed in the United States.

7. Data breach notification

Provider will notify the LEA without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the unauthorized disclosure of Student Data, and will cooperate with the LEA's investigation and any legally required notifications.

8. Data retention, return & destruction

Upon termination of this Agreement or at the LEA's written request, Provider will delete Student Data in its systems within 30 days. The teacher's Google Sheet remains in the teacher's own Google Drive and is not deleted by Provider. Provider will confirm destruction in writing on request.

9. Compliance with law

Provider will comply with FERPA and applicable state student-privacy laws (including, where applicable, New York Education Law § 2-d, California SOPIPA, Illinois SOPPA, and Colorado student-data protection requirements). State-specific exhibits may be attached and, where they conflict, will control.

10. Term, governing law & miscellaneous

This Agreement remains in effect while the LEA (or its teachers) use the service. It is governed by the laws of the State of Tennessee, except where a state-specific exhibit requires otherwise. If any provision is unenforceable, the remainder stays in effect.

11. Signatures