Data Processing Agreement

The School designates CultivatEd as a "school official" under FERPA with a legitimate educational interest in accessing Education Records solely for the School Purpose. CultivatEd agrees to act under the direct control of the School with respect to the use and maintenance of Education Records.

CultivatEd shall not use Education Records for any purpose other than the School Purpose. CultivatEd shall not use Covered Information to amass a profile on a student beyond what is needed for the School Purpose, engage in targeted advertising directed at students, or sell or rent Covered Information to any third party.

CultivatEd shall not use Education Records from one school or district to create benchmarking products or aggregate analyses that identify or are attributable to individual schools or districts without prior written consent.

Education Records are encrypted in transit (TLS 1.2 or higher) and at rest using industry-standard encryption provided by CultivatEd's database hosting provider.

Access to Education Records is limited to (a) the teacher who created the relevant class, and (b) CultivatEd personnel who require access to provide the service. CultivatEd maintains role-based access controls and audit logging for access to student records.

CultivatEd may engage the Subprocessors listed at cultivated.app/legal/subprocessors. CultivatEd will provide the School with at least 30 days' notice of any material change to the Subprocessor list. Schools may object to a new Subprocessor in writing within that notice period.

When AI features are enabled, a narrowly scoped, allowlisted subset of student context may be sent to Anthropic's commercial API for inference. The full list of fields that may be included is published at cultivated.app/settings (AI features section) and in the Subprocessor Register. Demographic data, disability status, family contact information, and student last names are never included in AI requests. Schools may disable AI features at any time from their settings.

In the event of a confirmed breach involving Education Records, CultivatEd will notify the School within 72 hours of becoming aware of the breach, to the extent permitted by law and applicable investigation requirements. The notification will include the nature of the breach, the categories of data involved, and the steps CultivatEd is taking to address it.

Education Records are retained for the duration of the School's active use of CultivatEd.

When a teacher deletes a student record, the record enters a 60-day soft-delete period before permanent removal. This provides a recovery window in case of accidental deletion.

Upon termination of the School's account, CultivatEd will retain Education Records for 60 days to allow data export, after which records will be permanently deleted. The School may request immediate deletion in writing.

Audit logs recording AI invocation events (which fields were included, when, and by which teacher) are purged after 90 days. CultivatEd does not store the full content of AI prompts sent to Anthropic.

The School may request a full export of all Education Records at any time. CultivatEd provides self-service export tools within the platform and will fulfill requests for bulk exports within 5 business days.

The School retains the right to review, correct, and delete Education Records through the CultivatEd platform at any time.

Upon reasonable written request, CultivatEd will provide information sufficient to demonstrate compliance with this DPA, including relevant audit log summaries and security certifications held by Subprocessors.

Either party may terminate this DPA upon 30 days' written notice. The School may terminate immediately if CultivatEd materially breaches this DPA and fails to cure the breach within 10 days of written notice.

CultivatEd agrees to comply with FERPA and to limit use of Education Records to the School Purpose for which they were disclosed.

CultivatEd does not knowingly collect personal information directly from children under 13 for its own purposes. Student data is collected under the direction of the School, which is responsible for obtaining any required parental consents under COPPA for the use of this platform.

To the extent CultivatEd is an "operator" under California Education Code § 49073.1, CultivatEd agrees not to engage in targeted advertising using Covered Information, not to sell Covered Information, and not to use Covered Information to amass a profile on a student except in furtherance of the School Purpose.

CultivatEd will work in good faith with Schools to address requirements of applicable state student privacy laws. Schools with specific state law requirements should contact privacy@cultivated.app to discuss compliance needs.