Student data privacy agreement
These are the terms NoteGrade signs with schools and districts. They follow the Student Data Privacy Consortium’s National Data Privacy Agreement (NDPA). We will also sign the NDPA itself, with your state’s supplemental terms, or your district’s own agreement.
Article I. Purpose and scope
1.1 Purpose. This agreement (“DPA”) sets out how NoteGrade (“Provider”) protects Student Data it receives from the school or district (“LEA”) in providing the services in Exhibit A, consistent with FERPA, the Protection of Pupil Rights Amendment, COPPA and applicable state law. For FERPA, Provider is a school official with a legitimate educational interest, under the LEA’s direct control over the use and maintenance of Student Data.
1.2 Student Data. The Student Data Provider may receive is listed in Exhibit B. Provider will tell the LEA before collecting any new category of Student Data.
1.3 Definitions. Terms in this DPA have the meanings in Exhibit C. If this DPA conflicts with any other terms of service or privacy policy, this DPA controls for Student Data.
Article II. Data ownership and access
2.1 Ownership. Student Data, and all copies of it, remain the property and under the control of the LEA. Provider obtains no rights to Student Data except to provide the services.
2.2 Parent and student access. Provider will help the LEA let parents, legal guardians and eligible students review and correct Student Data, within 30 days of the LEA’s request or sooner if state law requires. Provider will refer any request it receives directly to the LEA.
2.3 Student-generated content. Provider will help the LEA give students a copy of essays they wrote, on request.
2.4 Third-party requests. Provider will refer any request from a third party for Student Data, including law enforcement, to the LEA and notify the LEA unless the law forbids it.
2.5 Subprocessors. Provider will bind every subprocessor that handles Student Data to written terms at least as protective as this DPA, including a ban on selling Student Data. Current subprocessors are listed in Exhibit B. Provider will notify the LEA at least 30 days before adding one.
Article III. Duties of the LEA
The LEA will provide Student Data in line with applicable law; include school officials such as Provider in its annual FERPA notice if it relies on that exception; keep its staff’s account credentials secure; and tell Provider promptly of any unauthorized access it learns of.
Article IV. Duties of Provider
4.1 Compliance. Provider will comply with all applicable state and federal laws on student data privacy and security.
4.2 Authorized use. Provider will use Student Data only to provide the services in Exhibit A and as the LEA directs. Student Data will never be used to train artificial intelligence models.
4.3 Personnel. Everyone at Provider with access to Student Data will be bound by confidentiality obligations and this DPA, and access will be limited to those who need it to provide the services.
4.4 No sale or disclosure. Provider will not sell, rent or trade Student Data, and will not disclose it except to the LEA, to subprocessors under 2.5, as the LEA directs in writing, or as required by law.
4.5 De-identified data. Provider may use de-identified data, from which no student, teacher or school can be identified, only to improve its services. Provider will not attempt to re-identify it and will not share it with any third party without the LEA’s written permission.
4.6 Deletion and return. Provider will delete or return Student Data within 60 days of the LEA’s written request, and within 60 days after the services end, and will certify the deletion in writing. Teachers can also delete a student or class themselves at any time.
4.7 Advertising. Provider will not use Student Data for targeted advertising, to build a profile of a student for any purpose other than the services, or to market products to students or parents.
Article V. Data security and breach
5.1 Storage. Student Data is stored and processed in the United States.
5.2 Security. Provider will maintain administrative, technical and physical safeguards to protect Student Data, including encryption in transit and at rest, access limited to authorized users, multi-factor authentication for Provider staff, logging of changes and exports, and a written incident response plan. Provider will review its security at least once a year and will share a summary with the LEA on request.
5.3 Breach notice. Provider will notify the LEA within 72 hours of confirming unauthorized access to Student Data, or sooner if state law requires. The notice will say what happened, when, what Student Data was involved, and what Provider is doing about it. Provider will cooperate with the LEA’s investigation and help the LEA notify families.
General terms
Term. This DPA lasts as long as Provider holds Student Data from the LEA. Either party may end it if the other materially breaches it. Successors. If Provider is acquired or merges, the successor must agree to this DPA, and Provider will notify the LEA within 60 days; the LEA may then end the services and have its data deleted. Governing law. The law of the LEA’s state governs this DPA. Priority. This DPA controls over any conflicting terms on Student Data. Amendments. Changes must be in writing and signed by both parties.
Exhibit A. Services
NoteGrade: in-class essay writing sessions for students, draft rubric scores and comments for teacher review, the writing record and teacher-only integrity notes, returning grades and comments to students, department norming, and gradebook export.
Exhibit B. Student data and subprocessors
| Category | Elements |
|---|---|
| Identity | Student name; school email address; local student number (optional) |
| Special services | Accommodations set by the teacher, such as extended time, dictation, read aloud, spell check and a hidden timer (optional) |
| Student work | Essays and saved drafts; notes a student adds to a returned comment |
| Assessment | Rubric scores, deductions and comments; final grades; missing and excused marks |
| Writing record | Time spent writing; amount typed and deleted; paste attempts; large insertions; teacher-only integrity notes and classmate passage matches |
| Sign-in | Verified school email and name from Google sign-in, or a school email and password |
Not collected: birth date, address, location, photos, audio, video, browsing activity, or anything outside the NoteGrade writing page.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, accounts, and access to the AI model that drafts scores | United States |
| Anthropic | Developer of the AI model, run inside Provider’s AWS account; does not receive or retain Student Data | United States |
| Student sign-in with school Google accounts | United States |
Exhibit C. Definitions
Student Data: any information that identifies or is linked to a student, provided by the LEA or created by students or teachers in the services, including education records under FERPA. De-identified data: data from which all direct and indirect identifiers have been removed so that no student, teacher or school can reasonably be identified. Subprocessor: a company other than Provider that handles Student Data to help provide the services. Targeted advertising: ads selected based on a student’s information or activity over time.
Exhibit D. Deletion request
The LEA may request deletion of all or part of its Student Data by writing to matt@notegrade.com from an authorized account, naming the schools, classes or students. Provider deletes within 60 days and sends a written certificate of deletion.
Exhibit E. General offer
Provider offers these same terms to any other school or district that signs and returns them, without changes.