Student Data Privacy Agreement (DPA)

ARTICLE I:PURPOSE OF DATA COLLECTION

Provider shall utilize student data solely and exclusively for educational purposes as authorized by the LEA, specifically: execution of student Python programs, validation of computer science unit test suites, algorithmic code tracing, and real-time concept mastery scoring. Provider shall not use student records to target advertising or conduct behavioral profiling.

ARTICLE II:DATA OWNERSHIP & DIRECT CONTROL

The LEA retains absolute and exclusive ownership of all student records, student work products, code submissions, and performance evaluations. Provider claims no intellectual property interest in student-authored software. The LEA exercises direct administrative control over all stored data at all times.

ARTICLE III:PROHIBITION ON DATA COMMERCIALIZATION

Provider is strictly prohibited from leasing, renting, selling, licensing, or disclosing student data to any third party for commercial purposes, including targeted advertising, behavioral marketing, or the training of general-purpose commercial artificial intelligence models.

ARTICLE IV:DATA SECURITY & ENCRYPTION STANDARDS

Provider warrants that:

• All application data residing in storage is sealed using industry-standard AES-256-GCM authenticated encryption.
• Teacher command controls and student roster CSV imports operate strictly local-to-device.
• Network transmission, where explicitly requested by district administrators, requires TLS 1.3 encryption.
• Curriculum updates are validated via asymmetric Ed25519 digital signatures prior to execution.

ARTICLE V:BREACH NOTIFICATION & INCIDENT RESPONSE

In accordance with C.G.S. § 10-234dd, in the unlikely event of any unauthorized disclosure or security incident involving student data, Provider shall notify the affected LEA in writing within seventy-two (72) hours of confirmed discovery, detailing the scope, affected records, and remedial actions taken.

ARTICLE VI:DATA DESTRUCTION & RIGHT OF SHREDDING

Upon termination of the pilot agreement, expiration of the institutional license, or receipt of written demand from the LEA, Provider guarantees certified, irreversible data deletion within thirty (30) days using the application's built-in cryptographic Student Data Shredder.