School Data Addendum
This School Data Addendum (“Addendum”) describes how ArcAngel Academics handles student records on behalf of a School and forms part of the Terms of Service. It is intended to support Schools’ obligations under the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), and applicable state student-privacy laws.
1. Roles
The School controls its student records and determines the purposes for which they are processed. ArcAngel Academics is the School’s service provider and processes those records only to provide the Service, under the School’s instructions.
2. School official designation (FERPA)
To the extent the School is subject to FERPA, the School designates ArcAngel Academics as a “school official” with a “legitimate educational interest” in the education records processed through the Service, performing an institutional service the School would otherwise perform itself. ArcAngel Academics:
- uses education records only to provide the Service to that School;
- is under the direct control of the School with respect to the use and maintenance of those records; and
- will not re-disclose education records except as the School directs or as law requires, and will not use them for any independent purpose.
3. Ownership and use of Student Data
Student Data remains the property of the School. ArcAngel Academics claims no ownership and will not sell it, use it for targeted advertising, or build advertising or commercial profiles of students. We do not use Student Data to train third-party models or for any purpose beyond operating the Service for the School.
4. Confidentiality and access
Access to Student Data is limited to personnel who need it to operate or support the Service, who are bound by confidentiality obligations. Within the Service, access is governed by the roles the School assigns.
5. Security
ArcAngel Academics maintains reasonable administrative, technical, and physical safeguards, including encryption of identifying data at rest, encryption in transit (TLS), role-based access controls, tenant isolation between Schools, and audit logging of sensitive actions. Social Security numbers are not stored.
6. Subprocessors
We use a limited set of vendors to deliver the Service, each bound to protect Student Data and to process it only for us:
- Cloud hosting — DigitalOcean, LLC (United States, New York City region).
- Payment processing — Stripe (billing only; no student records).
We will maintain a current list and provide reasonable notice of new subprocessors that handle Student Data before they begin processing, by email to the School’s account contact and by updating this page. A School that objects to a new subprocessor may notify us; if we cannot reasonably accommodate the objection, the School may terminate and receive an export of its data.
7. Data incident notification
If we become aware of a confirmed unauthorized acquisition or disclosure of Student Data, we will notify the affected School without undue delay, and in any event within 72 hours of confirming the incident, and cooperate in its response and any legally required notifications.
8. Parent and student rights
Because the School controls the records, requests by parents or eligible students to inspect, correct, or delete education records are directed to the School. ArcAngel Academics will assist the School in fulfilling such requests, including by providing access, correction, export, and deletion tools.
9. Return and deletion on termination
On termination or at the School’s request, ArcAngel Academics will make Student Data available for export and then delete or return it within 60 days, except where retention is required by law. Backup copies are purged on a rolling schedule.
10. State student-privacy laws
ArcAngel Academics will process Student Data in a manner consistent with applicable state student-data-privacy laws, and provides the security and privacy protections described in this Addendum and in our Privacy Policy to every School.
Your responsibility for your state’s requirements. Student-privacy and homeschool-recordkeeping requirements vary from state to state and change over time. Each School and parent-educator is responsible for understanding the requirements that apply where they operate and for following them when using the Service — including any rules about what records to keep, how long to keep them, notice and consent, and reporting. ArcAngel Academics is a recordkeeping tool and does not provide legal or compliance advice.
If you have any questions or concerns about the security and privacy of your data — or about how the Service can support your state’s requirements — please contact us at [email protected] and we will be glad to help.
11. Contact
For questions about this Addendum or to request a signed copy, contact [email protected].
Questions about this document? Contact [email protected].