District agreement map
Last updated September 23, 2026
For a district privacy officer and for procurement. Each article of the California Student Data Privacy Agreement, the CITE template built on the SDPC National Data Privacy Agreement, is set beside what this product actually does. Rows this product does not meet stay in the table and say so.
Read this as a mapping written by the vendor, not as a legal opinion and not as a certification, which nobody has issued. No agreement has been signed. Where your own copy of the agreement numbers its articles differently, your copy governs and this page is only a reading aid.
What the four words mean
- Met. Built, in the product today, and checkable by a reviewer.
- Partial. Built in part. The row says which part is missing.
- Not met. Not built or not obtained. Stated plainly so it can count against us.
- By contract. A promise in a signed agreement, not a control in code.
- District action. Work the district does, listed here so nobody is surprised by it in week one.
Article I. Purpose and scope
| Obligation | What this product does | Status |
|---|---|---|
| The agreement covers the service described in Exhibit A and the data listed in Exhibit B. | The service is one thing. A teacher scores standards, and the app writes a report card comment from those scores on the teacher's own device. The data is listed in the schedule below. | By contract |
| The provider is bound by the agreement for as long as it holds student data. | No agreement has been signed as of September 23, 2026. Signing in creates an account and a workspace before any agreement is signed, so the agreement governs the student records kept there rather than whether an account exists. Nothing on this page has been reviewed by an attorney. | By contract |
Article II. Data ownership and authorized access
| Obligation | What this product does | Status |
|---|---|---|
| Student data is the property of and under the control of the district. Education records under FERPA, 20 U.S.C. section 1232g and 34 C.F.R. Part 99, and pupil records under California Education Code section 49060 and following. | No ownership is claimed over any record. The vendor acts as a school official under district direction, which is a contract term and not a code control. | Met |
| The district can get its data back in a usable format. California Education Code section 49073.1, added by Assembly Bill 1584 (2014), requires the contract to say how. | A teacher exports the class to CSV or XLSX from inside the app at any time. There is no export queue and no waiting on the vendor. | Met |
| A parent or eligible student can inspect, review, and correct the records held about them. | Requests go to the district, which holds the records. This product has no parent facing portal and none is planned for this release. A district that needs one should not count on this product to provide it. | Not met |
| Access is limited to authorized staff, and one district cannot reach another district's data. | In a school account, every row is stamped with its school and the database refuses a cross school read. The rule lives in row level security in Postgres, not in the screen. A recorded suite of 13 attempts to cross the boundary is kept in db/tenant-isolation.sql. | Met |
| Third parties with access to student data are disclosed. | Vercel hosts the site, and Supabase stores the data for accounts and runs sign-in. Google, Resend and Stripe see teacher details only, for sign-in, support email and card payments, and Resend and Stripe only when they are set up. Google Classroom and MasterAlp receive student names and comment text when a teacher or district connects them. Canva is optional, and the server refuses to send it report text unless a district allows outside processing. Which optional integrations are switched on for the hosted service is not published here, so a district has to ask. A new company that will handle student data gets 30 days of notice before it is added. | Partial |
Article III. Duties of the provider
| Obligation | What this product does | Status |
|---|---|---|
| Use student data only for the purpose in the agreement. No secondary use. | Records are used to write and store report card comments and to line up one trimester against another. There is no other feature that reads them. | Met |
| No sale of student information, no targeted advertising, no advertising profile. Student Online Personal Information Protection Act, California Business and Professions Code section 22584. | There is no advertising code and no third-party analytics. The hosted service has an optional first-party usage measurement of teacher activity, off until a teacher turns it on, which records whether a page was open and in use, a section from a fixed list, counts of finished steps, and random tab and device codes. It collects nothing about students and no teacher text, and it is stored per teacher and school. The school build leaves it out. Student data leaves the service only through an integration a teacher or district connects, listed under Article II. | Met |
| No survey or collection of the protected categories under the Protection of Pupil Rights Amendment, 20 U.S.C. section 1232h and 34 C.F.R. Part 98. | The product runs no survey. Political affiliation, religion, mental health, sex behavior, family income, and legally privileged relationships have no field anywhere in the schema. They cannot be entered because they do not exist. | Met |
| Children under 13 are handled under the Children's Online Privacy Protection Act, 15 U.S.C. sections 6501 to 6506 and 16 C.F.R. Part 312. The school may give consent for school purposes. | No student ever signs in. There is no student account, no student login screen, and no way for a child to give this product anything directly. The only person who types is the teacher, under the school's direction. | Met |
| Student data is not used to train an artificial intelligence model. | No AI provider is in the data path. Comments are assembled by a deterministic template engine from the scores the teacher picked, which is also why the app cannot invent a rating it was not given. | Met |
| Reasonable security procedures and practices. SOPIPA, Business and Professions Code section 22584, subdivision (d). | TLS in transit, encryption at rest, deny by default row level security, an audit line that each class push tries to write, which the app cannot edit or delete and an operator can remove only during deliberate maintenance, rate limiting, and a strict Content Security Policy. On the device, the roster is encrypted with AES-GCM-256 under a key stretched from the teacher's passphrase with PBKDF2, SHA-256, 310,000 iterations. No outside firm has tested any of this. | Partial |
| Notify the district of an unauthorized disclosure. California Civil Code section 1798.82, and section 1798.29 for an agency. | The process is written down in docs/INCIDENT-RESPONSE.md and the security address is answered by one person. The notification deadline for a given district and jurisdiction is a term for the agreement, not something this product can set on its own. | By contract |
| Where student data is shared or published in de-identified form, keep it de-identified. | Nothing is published or shared in any form. What the server holds under a school account is pseudonymous rather than anonymous, and this product does not claim otherwise. A comment can still describe a child that a person who knows the class would recognize. | Met |
Article IV. Duties of the district
| Obligation | What this product does | Status |
|---|---|---|
| The district signs the agreement and names the person who administers it. | Signing in does not wait for the agreement, so the district decides whether its teachers keep student records in the hosted service before one is signed. The district names the contact who can request an export or a deletion. | District action |
| The district decides retention, and tells families what it has agreed to. California Education Code section 49073.1. | The retention period is the district's to set. This product does not delete anything on a schedule, so the period the district chooses has to be enforced by asking for the deletion. | District action |
| The district decides who gets an account and removes staff who leave. | Any teacher who signs in gets an account and a workspace of their own. Removing an account is a request to the support address. There is no district administration console in this release. | District action |
| The district provides a monitored mailbox for privacy and security notices. | Notices go to the address the district names in the agreement. There is no other channel, and this product sends no automated notice to families. | District action |
Article V. Data provisions
| Obligation | What this product does | Status |
|---|---|---|
| Say where the data rests. | United States. Vercel serves the application, Supabase holds the database in AWS us-west-1. As of September 5, 2026 every table in the vendor project holds zero rows. | Met |
| An independent audit or security review of the provider's controls. | None has been performed. There is no SOC 2 report, no third party penetration test, and no independent code audit to show a district. | Not met |
| Delete student data on the district's directive. Exhibit E, the directive for disposition of data. | A district emails the support address and a person performs the deletion, which cascades through the database, and confirms it within 30 days. There is no self service console, no deletion report a district can pull for itself, and the vendor's database provider keeps its own backups on its own schedule, which this code does not control. | Partial |
| Enforce the retention period automatically. | Nothing expires on its own. There is no scheduled job that deletes records when a retention period ends. A record stays until somebody asks for it to go. | Not met |
| Carry cyber liability or errors and omissions insurance, where the district requires it. | No policy is in force. A district with an insurance requirement will not be able to satisfy it from this vendor today. | Not met |
Article VI. General offer of privacy terms
| Obligation | What this product does | Status |
|---|---|---|
| The provider offers the same privacy terms to any other district that countersigns, through Exhibit D. | Not offered. Each district's agreement is negotiated on its own until counsel has reviewed a standard form. A district that expects to piggyback on another district's signed agreement cannot do that here yet. | Not met |
Article VII. Miscellaneous
| Obligation | What this product does | Status |
|---|---|---|
| Term, termination, and the return or destruction of data at the end of it. | Export works today and can be run before termination. The destruction timeline and the evidence a district gets afterwards are terms of the agreement, which is unsigned. | By contract |
| Consumer rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California Civil Code section 1798.100 and following, to the extent they apply. | Student records held for a school are education records under FERPA and are handled through the district. Teacher account data is an email address, the basic profile Google shares at sign-in, a scrambled password if one was set, the workspace membership made at sign-in, and, only for a teacher who turns it on, the optional first-party usage measurement. A teacher can have it deleted by writing to the support address. | By contract |
Exhibit B, the schedule of data
The complete list of fields this product touches, split by where they rest. Nothing else is collected or inferred. There is no home address, phone number, date of birth, photograph, health record, family contact, immigration status, or demographic field anywhere in the schema.
STAYS ON THE TEACHER'S DEVICE
- Student name
- SIS identifier, if the teacher enters one
- The mapping from a name or a classroom identifier to the random token
- Imported column headings from a school export
REACHES THE SERVER IN A SCHOOL ACCOUNT
- A random 52 character token, generated on the device
- Grade level
- Pronoun
- Fluency measurements with their dates
- Skill scores on the district's performance scale
- The generated comment, with the student's own name removed
- Reporting term and the engine version that wrote the comment
- A timestamp for each save
How the token is made, what is hashed, and what somebody holding the server could still work out is set out at the tokenization record.
What the district has to do
- Sign a data privacy agreement before your teachers keep student records in the hosted service. Signing in does not wait for one.
- Name the administrator who may request an export or a deletion, and the mailbox that receives privacy and security notices.
- Set the retention period, and plan to request the deletion yourselves, because nothing here expires on a schedule.
- Decide who gets an account and tell the vendor when staff leave.
- Read the two rows this page marks Not met that touch your own policy, which are the parent access portal and the independent audit, and decide whether you can proceed without them.
- Have your counsel review the draft agreement. Nothing here has been through one.
What this product does not do
The same list a district would otherwise have to extract from us during a review. It is here so the review starts from facts.
- No data privacy agreement has been signed as of September 23, 2026.
- No outside firm has security tested this product. There is no SOC 2 report and no penetration test.
- No cyber or errors and omissions insurance is in force.
- There is no district console. Export is in the app, but deletion and account removal are requests a person carries out. Any teacher who signs in gets an account and a workspace.
- No retention job runs. Nothing is deleted because time passed.
- There is no parent or eligible student portal, and no general offer of privacy terms other districts can countersign.
- Accounts made before August 30, 2026 synced student names the old way. Those records are being deleted before school accounts open.
Laws named on this page
- Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. section 1232g, 34 C.F.R. Part 99
- Protection of Pupil Rights Amendment (PPRA), 20 U.S.C. section 1232h, 34 C.F.R. Part 98
- Children's Online Privacy Protection Act (COPPA), 15 U.S.C. sections 6501 to 6506, 16 C.F.R. Part 312
- Student Online Personal Information Protection Act (SOPIPA), California Business and Professions Code section 22584
- California Education Code section 49073.1, added by Assembly Bill 1584 (2014)
- California Education Code section 49060 and following, pupil records
- California Consumer Privacy Act as amended by the California Privacy Rights Act, California Civil Code section 1798.100 and following
- California breach notification, California Civil Code section 1798.82 and section 1798.29
Citations are given so a reviewer can go read the statute rather than take the row's word for it. A citation is not a claim that a lawyer has blessed the row above it.
Questions from a privacy officer or a procurement reviewer go to support@papalotledu.com. If a row here is wrong, say so and it gets corrected on this page.