Data Processing Agreement

Overview

This page summarizes our Data Processing Agreement (DPA) — the terms under which Elementari, LLC processes student personal data on behalf of a school or district. It's written to help administrators and procurement teams understand our commitments at a glance. The signed DPA is the binding document; this overview doesn't replace it. To request a copy for signature, see Request a signed DPA below.

Roles & responsibilities

The school or district is the data controller — you decide what student data is collected and why, and you provide consent on behalf of parents and guardians (as permitted under COPPA for school use). Elementari is the data processor — we handle that data only on your documented instructions and only to provide the service. We never use student data for our own purposes, advertising, or profiling.

Scope of processing

We process the minimum data needed to run Elementari for your students: usernames, optional first name and last initial, country, chosen avatars, and the projects and work students create. The categories of data, purposes, and retention periods are described in our Privacy Policy and itemized in the signed DPA.

Sub-processors

We use a small set of vetted sub-processors (such as hosting and email providers) to deliver the service, each contractually bound to protect the data to the standards in our DPA. The current list — what each handles, why, and their safeguards — is on our third-party services page. We give notice of material changes so you can object.

Security

Student data is encrypted in transit (SSL/TLS) and stored on Amazon Web Services in the USA, accessible only to a limited number of authorized staff. Payments run through Stripe, with no card details on our servers. We maintain physical and technical safeguards appropriate to the data we handle. See our Privacy Policy for more.

Assisting with data requests

We help you respond to requests from students, parents, and guardians to access, correct, export, or delete personal data. Teachers and administrators can review, correct, and delete student information directly from Account Settings, or we'll assist on request at support@elementari.com.

Breach notification

If we become aware of a personal-data breach affecting your students, we'll notify you without undue delay, share the information you need to meet your own legal obligations, and cooperate on remediation.

Return & deletion

You can ask us to return or permanently delete your students' personal data at any time, and we'll do so when your agreement with us ends. Removing a student or deleting an account permanently removes that student's personal data, projects, and activity from our servers, subject to the short retention windows described in our Privacy Policy.

Compliance

• FERPA — we act as a "school official" with a legitimate educational interest, using student education records only as you direct.
• COPPA — we rely on your school consent for students under 13 and collect only what's reasonably needed.
• SOPIPA — no targeted advertising to students, no advertising profiles, and no selling of student information.
• GDPR — for EU/EEA students, we process data under privacy-by-design principles and the terms of the DPA.