This is a draft and should not be signed as-is. It is built from standard EdTech templates with COPPA, FERPA, GDPR-K and PIPEDA clauses, and it has not been through counsel. Redlines are genuinely welcome.
What it says: the institution is the controller, we are the processor, we process student data only to run the service and only on instruction. Sub-processors are listed publicly and you get thirty days’ notice of a change. Data is returned or deleted on termination.
a summary, not the agreement — the clauses below are what binds
DRAFT. This document is a starting-point Data Processing Agreement based on standard EdTech templates (aligned to the ISTE Student Data Privacy Consortium and Common Sense Privacy DPA templates), plus COPPA, FERPA, GDPR-K, and PIPEDA-aware clauses. It must be reviewed and finalized by qualified counsel before signature. Redlines welcome.
1. Parties
Processor: Roan Priatel operating as Brainback (“Brainback”), a sole proprietorship registered in Ontario, Canada. Registered address supplied on execution of this agreement; request it at brainback@stratosync.solutions.
Controller: The institutional customer that has entered a subscription with Brainback (“Customer”).
2. Definitions
- Personal Data — any information relating to an identified or identifiable natural person, including a student.
- Processing — any operation performed on Personal Data.
- Sub-processor — any third party engaged by Brainback to process Personal Data on behalf of the Customer. Current list at /legal/subprocessors.
- Applicable Law — COPPA (US), FERPA (US), GDPR + GDPR-K (EU), PIPEDA (Canada), PIPA (BC/Alberta/Québec).
3. Subject matter, duration, nature, and purpose
Brainback processes Personal Data to provide an AI-based Socratic study tutor for students affiliated with the Customer. Processing continues for the duration of the subscription plus a wind-down retention period defined in §8.
4. Categories of data + data subjects
- Data subjects: students (age 13+ with parental consent where under-18); educators; administrators.
- Personal Data categories: identity (email, display name, DOB), authentication (Supabase session tokens), learning content (attempts, tutor replies, explain-backs, recall answers), aggregate metrics (Brain scores, mastery), billing metadata (institution only).
- Special categories: none intentionally processed.
5. Instructions from Controller
Brainback processes Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a third country, unless required to do so by Applicable Law.
6. Confidentiality
Brainback ensures that persons authorized to process Personal Data have committed themselves to confidentiality.
7. Security of processing
Brainback implements appropriate technical and organizational measures, including: RLS enforced at the database layer, content-blind educator/parent views, encryption in transit (TLS 1.2+) and at rest (AES-256), per-user token caps, rate limiting via Upstash Redis, circuit breaker on the Anthropic client, structured logging with automatic redaction, strict CSP + HSTS. Full detail: /legal/security.
8. Retention + deletion
- Session content: life of the account.
- Parental consent records: life of the account + 1 year (compliance requirement).
- Leak-guard events: 90 days maximum, redacted.
- Error log: 30 days maximum.
At contract termination, Customer may request return or deletion. Brainback deletes within 30 days of confirmed request, subject to any retention required by law.
9. Sub-processors
Customer authorizes the sub-processors listed at /legal/subprocessors. 30 days’ advance notice on any addition or replacement.
10. Data subject rights
Brainback assists the Customer in fulfilling requests to exercise data subject rights. Students may also file requests directly via the DSAR endpoint in the app; response within 30 days.
11. International transfers
Primary infrastructure in North America. Anthropic API invoked from the same region. Standard Contractual Clauses (or equivalent) applied where cross-jurisdictional transfers occur.
12. Breach notification
Notification to the Customer without undue delay, within 72 hours of becoming aware. Nature of the breach, categories and approximate number of data subjects, likely consequences, and remediation.
13. Audits
Information necessary to demonstrate compliance provided on request. Once-per-year audit via mutually-agreed independent third party at Customer’s expense.
14. Special provisions for minors (COPPA / GDPR-K)
- Verifiable parental consent required for users under 18.
- Consent tokens expire in 30 days (renewable); consent records retained life + 1 year as legal proof.
- Content-blind dashboards enforced at the database.
- No targeted advertising or profiling of minors.
- No training of AI models on student content: Anthropic does not train on data submitted through its API, which is their published default for API traffic. Brainback does not hold a zero-retention agreement with Anthropic, so inputs and outputs may be retained by Anthropic for a limited period for trust-and-safety purposes under their commercial terms. A Customer requiring zero retention should raise it before execution.
15. FERPA (US institutional customers)
Brainback acts as a “school official” with a “legitimate educational interest” under 34 CFR § 99.31(a)(1). Direct control by the institution; no re-disclosure.
16. PIPEDA / Loi 25
Brainback complies with PIPEDA and provincial variants. Canadian-residency requirements: contact brainback@stratosync.solutions before signing.
17. Liability
[To be set by counsel. Typical: cap at fees paid in preceding 12 months.]
18. Governing law + venue
Ontario, Canada. Institutional customers may negotiate alternative provisions.
19. Order of precedence
This DPA prevails over the general Terms of Service with respect to processing of Personal Data.
20. Contact
brainback@stratosync.solutions. Response within 5 business days.
End of DPA draft. Redlines from institutional counsel: reply to your Brainback contact directly.