Classroom Data Agreement

1. Who this agreement is between, and what it covers

This Classroom Data Agreement is between Michael Bauman, trading as AICT Education ("AICT") and the teacher who creates a class in the Service ("you"), for that class only. It explains how information about the students in your class is handled.

It covers one class and its students. It does not bind or speak for any other class, teacher or school. Each teacher who uses the Service accepts their own agreement for their own class. It binds a school or district only if a person with authority to sign for it has accepted it for that organization. If your school later asks for a school-wide agreement, we can provide one.

2. Words used

• Student Data means information about a student that the Service collects or creates for this class: the alias, grade, extra-support setting, writing, scores and results, and flagged writing.
• The Service means the AICT website and web application.
• Safety Flag means writing the Service has detected may show a student needs support.
• Data Breach means an unauthorized release of, access to or acquisition of Student Data that compromises its security, confidentiality or integrity.
• De-identified data means information from which all personal identifiers have been removed so that it cannot reasonably identify a student, alone or combined with other information.
• Service provider means a company, listed in this agreement, that AICT uses to store or process Student Data to run the Service.
• Student-generated content means what a student writes in the Service, such as reflections, follow-up answers and exit tickets.

3. Who owns Student Data

Student Data belongs to the student, the family and the school, as the law provides. AICT does not own it. You give AICT permission to process it only to provide the Service for this class. AICT will not use Student Data for any other purpose. The writing a student creates stays theirs: AICT claims no ownership or licence over it beyond what is needed to run the Service. If your school treats AICT as a "school official" under the Family Educational Rights and Privacy Act (FERPA), AICT agrees to act under the school's direct control for Student Data and to use it only for the purposes in this agreement.

4. What AICT will not do

• sell Student Data, or share it for advertising or marketing
• show advertising to students, or build profiles of students for anything other than this class's educational use
• use Student Data to train artificial intelligence models, or allow its AI provider to do so. AICT's AI provider (Anthropic) is bound by its commercial terms not to train on it, and deletes it within 30 days except as described in the Privacy Policy
• try to identify a student by name. AICT does not ask for names, emails or birthdates
• disclose Student Data to anyone except the service providers listed in this agreement, who need it to run the Service, or when the law requires it

AICT may use combined, de-identified results to improve the Service. Groups smaller than five students are never shown and AICT will not try to re-identify anyone. A small group size is one safeguard, not a guarantee of anonymity. AICT will not publish anything that names your school or class, including case studies and testimonials, without your written approval.

5. What data is collected, why and for how long

AICT deletes Student Data when it is no longer needed for its purpose, and no later than the times shown.

6. What the teacher agrees to

• You will get any approval your school or district requires before you enter student information, and you will follow its notice rules. Accepting this agreement does not show that your school or district has approved the Service. You will let parents know the Service is used. The parent letter in your dashboard is a template and does not replace any notice or consent your school or district requires.
• You will use only aliases for students, and not enter real names or other personal details.
• You will supervise students while they use the Service. You will pause the class (class access switch) when you are away, and you will not share your login with a substitute or anyone else.
• You will read Safety Flags and respond under your school's procedures. You understand the Service is not an emergency service, does not monitor students in real time, and cannot catch everything.
• You will not use the Service's results as the only basis for a grade, placement, discipline or evaluation of a student or teacher.
• If you become aware of suspected unauthorized access to or use of Student Data, you will tell us as soon as you reasonably can. This does not replace any reporting duty that you or your school have under the law.
• You understand the Service is not counseling or professional advice, and does not replace school counselors, psychologists, threat-assessment teams or your school's emergency plans. You will not rely on it as the only safeguard for a student.

7. What AICT agrees to

• AICT will keep a written information security program, encrypt data in transit and at rest, and limit access to Student Data to those who need it to run the Service or respond to a support request. People with access are bound to confidentiality.
• AICT will notify you of a confirmed breach of Student Data without undue delay, and within 72 hours, with what happened, what data is involved and what AICT is doing. AICT will help with any notice the law requires.
• AICT will use only the service providers listed in this agreement for Student Data, will make sure each provider's terms require it to protect Student Data and use it only to provide its service to AICT, and will tell account holders in advance before adding a provider that handles Student Data.
• AICT will give you direct information about what it collects and how it uses it (the Privacy Policy and this agreement) and will describe the Student Data it holds on request.
• A breach notice will include, as far as known: who to contact at AICT, the date of the notice, when the breach happened or the likely range, a description of what happened and what Student Data is involved, whether law enforcement delayed the notice, and who is affected. AICT keeps a written breach-response plan and will give you a summary on request.
• If a court, police or another authority demands Student Data, AICT will tell you first unless the law forbids it or requires immediate disclosure, and will cooperate if you or your school are asked to produce it. AICT will also cooperate with a government audit of your use of the Service.
• AICT reviews its security at least once a year and after any breach, and will give you a summary of the review on request.

8. Parents' rights

A parent can ask to review a child's Student Data, have it corrected or deleted, and stop further collection. Because AICT knows students only by an alias, requests go through the teacher, who can find the alias in the dashboard, download everything held about the alias, or delete it. AICT will help the teacher respond within 10 business days.

9. Safety Flags

If the Service detects writing that may show a student needs support, AICT emails the teacher (the email never contains the writing) and shows the writing in the dashboard. Urgent flags that stay unopened trigger reminders after 24 hours and 72 hours. AICT does not decide whether a student is safe, does not contact the student or family itself, and the AI never acts on a flag by itself. The teacher decides what to do.

Safety Flags are a safeguard that supports adults, not a replacement for them. The Service is not a threat-assessment tool or counseling service. It cannot predict or prevent self-harm or violence, and it can miss a concern. If you are worried about a student or a school community, involve qualified counselors, psychologists and your school's safety team.

Flagged writing is deleted 3 days after the teacher opens an urgent flag, 7 days after opening any other flag, and no later than 30 days if it is never opened. A log that records only that a concern was passed on, when and its category (no writing) is kept for 12 months.

10. Keeping and deleting data

Lesson writing and scores are deleted automatically at the end of each semester (15 January and 1 July). Aliases reset once a year. If you delete your account, all Student Data for your classes is deleted from our live systems at once (copies in our database provider's backups are overwritten within 7 days) and any subscription is cancelled. If you, or your school or district, ask us to delete a class or a student's data, we do so within 30 days, even if the scheduled date has not arrived. On request AICT will confirm in writing that Student Data has been deleted.

11. Service providers that may handle Student Data

12. Security measures

• Encryption of data in transit, and encryption of student writing and flagged writing at rest
• Passwords stored only as secure hashes, with limits on repeated login attempts
• Teachers can only see their own classes, enforced on the server on every request
• Automatic deletion jobs, run daily
• No student accounts, names, emails or birthdates are held
• A written information security program, reviewed at least once a year

13. Length of this agreement

This agreement lasts for as long as the class exists. Either party can end it by deleting the class or the account. The sections about what AICT will not do, deletion and confidentiality continue after it ends for as long as AICT holds any Student Data.

14. State requirements

AICT will comply with the student-privacy laws that apply to it in the state where the class is located, including the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA), and state laws such as California's SOPIPA, Illinois's SOPPA, New York's Education Law 2-d and Colorado's student data privacy law. If a state law requires a term this agreement does not include, that term is treated as part of this agreement for classes in that state. Some states require particular contract terms or documents for school accounts. Before student information is processed under a school or district account in such a state, we will provide those terms and documents and complete them with the school or district.

15. General

This agreement, together with the Terms of Service and Privacy Policy, is the whole agreement about Student Data for this class. If they conflict, the one that protects Student Data more applies. You accept it electronically by ticking the box when you create the class, and AICT records the version and the time. Your acceptance binds you for your own class, and binds a school or district only if you have authority to sign for it. Liability and governing law are as in the Terms of Service, except that nothing in them limits AICT's duties about Student Data under the law or this agreement. Nothing here makes either party the other's agent or employee. If AICT's business is transferred to a company or a buyer, the new owner must accept this agreement and its promises in writing, and AICT will tell you. You may then end this agreement and ask for your Student Data to be deleted.