SplatWorks District Data Privacy Addendum

1. Parties

2. Approved Educational Purpose

The SplatWorks components listed below will be used only for the following school-authorized educational purpose:^TM will be used only for the following school-authorized educational purpose:

______________________________________________________________________________

______________________________________________________________________________

3. Approved Deployment Configuration

4. Data Use Commitments

These commitments bind the parties within the agreed scope. Optional third-party services may be enabled only after the district approves their data use, retention, security, and contractual terms; an ecosystem name does not impose these terms on an uncontracted external provider.

• Student data will be used only for the school-authorized educational purpose.
• Student data will not be sold, leased, rented, or shared as defined by applicable state student privacy laws.
• Student data will not be used for targeted advertising, behavioral profiling, cross-context advertising, data mining except for authorized educational purposes, or AI model training.
• De-identified or aggregate data will not be re-identified or used to identify students.

5. Retention, Return, and Destruction

6. Security and Breach Notification

• Production deployments must use HTTPS and encrypted transport.
• Hosted, MySQL, and standalone deployments must use encryption at rest for databases, disks, object storage, and backups.
• Least-privilege access, MFA where available, secure backups, patching, and audit logging are required for backend/admin systems.
• Security review is required before student use and at least annually for hosted, MySQL, SSO-enabled, or managed deployments.
• Confirmed breaches involving student personal information must be reported through the breach notice contact method without unreasonable delay and no later than 72 hours after confirmation.

7. FERPA/COPPA and Student Personal Information

For this addendum, student personal information includes information that identifies, relates to, describes, or can reasonably be linked to a student or student household, including student names, account identifiers, student-created board content, uploaded media, audio recordings, submissions, comments, room participation data, and logs tied to a student.

When DrawSplat^TM is used for the approved educational purpose, the deployment owner or service operator may be treated as a school official or authorized service provider under FERPA and similar student privacy laws, acting under the direct control of the school. For COPPA-covered students, the school or district may provide consent on behalf of parents when permitted by law and when DrawSplat^TM is used solely for the approved educational purpose.

8. Subprocessors

Approved subprocessors and service providers:

Material new subprocessors for student-data processing require at least 30 calendar days’ notice and a reasonable opportunity to object, disable the affected integration, or terminate the affected hosted service.

9. Signatures

Compliance Features Available to the District

The deployment owner configures the following controls through the internal Compliance Console. The District Privacy Packet download bundles the live configuration, the last 90 days of Activity Records, and the parent-request log in a single ZIP for review.

1. Activity Records (audit log) — operator-controlled Apps Script audit Sheet recording supported compliance actions.
2. Safety Review — text keyword filter and link allowlist, server-enforced on every save. Board / room freeze blocks further writes.
3. Student Age Band Lock — under_13 / 13_to_17 / 18_plus / unknown_minor. Server-locked, admin-only changes, reason required, audited. Aligned with Texas SCOPE Act age-registration provisions.
4. Family Access Tools — parent request form, teacher-issued one-time verification code, admin Approve / Deny / Done queue.
5. Student data rights — one-click ZIP export of a student’s boards and turn-ins; one-click data deletion of the same.
6. Retention policy — archive boards after N days, delete after M days, prune Activity Records after K days. Daily Apps Script trigger or manual run.
7. Time limits — daily seconds, session seconds, allowed hours, weekend toggle. Browser locks; server gate on save.
8. District Privacy Packet — one-click ZIP for reviewers.

Configuration is server-side via the COMPLIANCE_CONFIG Script Property and cascades to every classroom on the deployment. See docs/COMPLIANCE.md for the operator guide.