HOMEROOM: STUDENT DATA PRIVACY AGREEMENT SUMMARY
References the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA): https://privacy.a4l.org/national-dpa/
The signed agreement governs; this summary is not legal advice.

AGREEMENT
We sign the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA), with your state's Exhibit if needed, on request for school and district customers.

ROLE UNDER FERPA
Under a school agreement, Homeroom acts as a school official with a legitimate educational interest, under the school's direct control for student records.

DATA MINIMIZATION
Student and parent names, emails, and phone numbers are replaced with placeholders before text reaches an AI model. There are no student accounts.

NO SECONDARY USE
We never sell data, never use it for advertising, and never use customer content to train AI models.

RETENTION AND DELETION
Email content and drafts are deleted automatically after 30 days. Teachers can delete everything instantly; schools can request deletion at any time, completed within 30 days.

SECURITY
Encryption in transit (TLS) and at rest (AES-256-GCM application-level encryption for teacher content and inbox tokens). Inbox access is limited to reading recent mail and creating drafts; Homeroom never sends email.

SUBPROCESSORS
Cloudflare (hosting, storage, and Workers AI model inference on tokenized text only). Payment processing by Stripe for paid plans. We'll notify schools before adding subprocessors.

BREACH NOTIFICATION
We notify affected schools without unreasonable delay and within the timeframe the NDPA or state law requires.

Request a signed DPA: https://homeroom.k49v585hcs.workers.dev/schools
Deletion requests: https://homeroom.k49v585hcs.workers.dev/data-deletion