FERPA Data Privacy Addendum

This Data Privacy Addendum ("DPA") forms part of the ClassHarbor Terms of Service and governs the processing of student education records and personal information by ClassHarbor ("Processor") on behalf of the teacher, school, or school district that uses the Service ("Educational Entity"). It is written to satisfy the obligations of the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations.

• "Education Records" means records directly related to a student and maintained by the Educational Entity or a party acting for it, including rosters, attendance records, behavior notes, seating assignments, schedules, and parent contact information entered into the Service.
• "Personal Information" means information that identifies an individual, including student names and parent/guardian names, email addresses, and phone numbers.
• "School Official" has the meaning given in 34 CFR § 99.7(a)(1)(iii)(B).

The Educational Entity acts as the controller of Education Records and determines the purposes and means of their processing. ClassHarbor acts as a processor and processes Education Records solely on behalf of, and under the direction of, the Educational Entity. Individual teachers who register for the Service are treated as authorized representatives of their Educational Entity.

The parties acknowledge that ClassHarbor qualifies as a "School Official" with a legitimate educational interest in the Education Records it processes. ClassHarbor performs an institutional service or function for which the Educational Entity would otherwise use its own employees, remains under the direct control of the Educational Entity with respect to the use and maintenance of Education Records, and may not disclose Education Records to any other party without the written consent of the Educational Entity or as otherwise permitted by FERPA.

The Service may process the following categories of data, all of which are entered or imported by the Educational Entity:

• Student roster information (name and class assignment).
• Attendance records and absence reasons.
• Behavior tracking records and classroom notes.
• Seating assignments and class job assignments.
• Parent/guardian contact details and communication logs.
• Parent-teacher conference scheduling information.

ClassHarbor processes Education Records only to provide, maintain, and improve the Service, and specifically agrees that it will not: (a) sell or rent Education Records; (b) use Education Records for targeted or behavioral advertising; (c) use Education Records to build profiles of students except as needed to provide the Service; or (d) disclose Education Records to third parties except as described in Section 7 or as compelled by law.

ClassHarbor relies on service providers that process data only on its written instructions under confidentiality obligations. Hosting and database services are provided by the platform on which the Service runs. Payment processing is performed by Stripe, P.C., for teacher billing information only; student Education Records are not shared with payment processors. The current list of subprocessors is maintained by the platform provider and is available upon request.

ClassHarbor implements reasonable administrative, technical, and physical safeguards to protect Education Records, including encryption of data in transit, per-account isolation enforced by row-level access controls so that one Educational Entity can never access another’s records, least-privilege access for personnel, and automatic deletion pathways described in Section 9. ClassHarbor reviews these safeguards periodically in light of the sensitivity of the data.

Education Records are retained for as long as the Educational Entity maintains its account. A teacher may export their data at any time through the Service. When a teacher requests account deletion, or an account otherwise lapses, ClassHarbor permanently deletes Education Records after a short recovery window (7 days) during which the requesting user may cancel the deletion. ClassHarbor does not retain Education Records after deletion except as required by law.

In the event of a known or suspected unauthorized acquisition, access, use, or disclosure of Education Records ("Security Breach"), ClassHarbor will promptly take reasonable steps to contain and investigate the breach and will notify affected Educational Entities without undue delay so that the Educational Entity can meet its own notification obligations under FERPA and applicable state law.

Requests by parents or eligible students to inspect, amend, or suppress Education Records are handled by the Educational Entity, which controls the records. ClassHarbor will provide reasonable assistance to the Educational Entity in responding to such requests and will comply with instructions from the Educational Entity regarding correction, export, or deletion of records.

The Service is intended for use by teachers and school staff. Students do not create accounts and do not use the Service directly. ClassHarbor does not knowingly collect personal information directly from students, and the Service is not directed at children under the age of 13 as a data-collection destination within the meaning of the Children’s Online Privacy Protection Act.

This DPA is effective as of the date the Educational Entity accepts the Terms of Service and remains in effect for the duration of use of the Service. Upon termination, Education Records are handled as described in Section 9, and any remaining copies are destroyed or de-identified.

ClassHarbor may update this DPA to reflect changes in law or the Service; material changes will be announced to registered users. Educational Entities may request a countersigned or district-specific copy of this Addendum by contacting hello@classharborapp.com.

Questions about this Addendum or requests for a signed copy may be directed to hello@classharborapp.com.