Student Data Privacy Addendum

Purpose and how to sign

This Student Data Privacy Addendum (the “Addendum”) explains how Pondra handles student data for a school (the “School”). Together with the order form, it is part of the school agreement described in our Terms of Service.

To get a countersigned copy for your records, email privacy@pondra.ai with the School’s name and the name and title of the person who will sign. If your school or state prefers its own paperwork, Pondra will also sign the Student Data Privacy Consortium’s National Data Privacy Agreement, or your school’s or district’s state or district agreement, instead of this Addendum.

Definitions

• Student Data means information that is directly related to a student and that Pondra collects or receives through the School. It includes conversations, account and roster information, usage and safety records, and anything a student writes. It includes Education Records. It does not include De-identified Data.
• Education Records has the meaning given in the Family Educational Rights and Privacy Act (FERPA).
• De-identified Data means data from which personal information has been removed so that no student can reasonably be identified, alone or in combination with other information.
• Subprocessor means any third party that handles Student Data on Pondra’s behalf, such as a hosting company or an AI model provider.
• Security Incident means confirmed unauthorized access to, or acquisition, disclosure, loss or use of, Student Data held by Pondra or its Subprocessors.

Roles and ownership

• The School owns and controls Student Data. Pondra gets no ownership of it. Students and schools keep ownership of what students write.
• Pondra acts as a “school official” under FERPA. It performs a service the School would otherwise do itself, has a legitimate educational interest in the data, and is under the School’s direct control for how it uses and maintains Student Data.
• Under the Children’s Online Privacy Protection Act (COPPA), the School consents on parents’ behalf for educational use only. Parents make requests through the School. If Pondra receives a request directly, we forward it to the School promptly.
• Pondra follows the School’s written instructions about Student Data.

Permitted use

Pondra uses Student Data only to provide the service to the School. That means running the assistant, keeping accounts and chat history, producing usage and safety reports, giving support when the School asks, and keeping the service secure and working.

We disclose Student Data only:

• to the Subprocessors listed on our trust page, under written contract;
• at the School’s direction; or
• when the law requires. Where the law allows, we tell the School first.

If Pondra merges with or is acquired by another company, Student Data may pass only to a successor that agrees to this Addendum. We tell the School in advance, and the School may have its data deleted first.

Prohibited uses

Pondra will never:

• sell Student Data;
• use Student Data for advertising or targeted advertising;
• use Student Data to build profiles of students for any non-educational purpose;
• use Student Data to train AI models, whether ours or any provider’s; or
• re-identify De-identified Data, or try to.

Parent, student and school rights

When the School asks Pondra to access, correct, export or delete the Student Data of a student or group of students, we complete the request within 10 business days.

Parents and students make these requests through the School, and the School decides them. If a parent or student asks us directly, we pass the request to the School and tell them to contact their school.

A student’s own written content can be exported to the student. At the School’s request, Pondra exports it in a common format, either to the School for the student or to a personal account that the student or parent chooses.

Subprocessors

• Our current Subprocessors are listed at pondra.ai/trust.
• We give the School 30 days’ notice before a new Subprocessor handles Student Data. If the School objects for a reasonable data protection reason, we work with it to resolve the concern. If we can’t, the School may stop using Pondra and ask for deletion under this Addendum.
• Every Subprocessor is bound by written terms at least as protective as this Addendum. Pondra remains responsible for how its Subprocessors handle Student Data.
• AI model providers must contractually prohibit training on Pondra data. They must keep no data, or keep it for no more than 30 days and only for abuse monitoring.

Security safeguards

Pondra maintains these safeguards, aligned to the NIST Cybersecurity Framework:

• TLS 1.2 or higher for data in transit, and AES-256 encryption for data at rest.
• Student Data stored in the United States.
• Multi-factor authentication and least-privilege access for staff, with access logging.
• Background checks, signed confidentiality agreements and annual training for staff who have access to Student Data.
• A risk assessment and a penetration test before launch, and again every year.

Security incidents

• Pondra notifies the affected School without undue delay, and no later than 72 hours after confirming a Security Incident or 7 calendar days after discovering it, whichever comes first. The notice says what we know and what we are doing, and we update it as we learn more.
• We cooperate with the School’s notices to families and regulators, and we agree the wording with the School first unless the law requires otherwise.
• When Pondra or one of its Subprocessors causes the incident, Pondra pays the reasonable costs of notifying affected families and regulators.

To report a possible incident to us, email security@pondra.ai.

Retention and deletion

• On request. If the School asks us to delete all of its Student Data, or a whole category of it, we finish within 30 days.
• At the end of the agreement. We offer the School an export, then delete all Student Data within 60 days after the agreement ends.
• Backups. Deleted data is purged from backups within 90 days.
• Certification. On request, we give the School written certification that the data has been deleted.

If the law requires us to keep something, we tell the School and keep only what the law requires.

De-identified data

Pondra may use only aggregate, de-identified statistics to operate, secure and improve the service. We never re-identify De-identified Data, never sell it and never use it to train AI models.

AI-specific terms

• Students are always told they are talking to an AI.
• Student Data, including conversations, is never used to train any AI model, by Pondra or by any provider.
• Pondra staff read student conversations only for support or safety at the School’s request, or when the law requires.

State-specific terms

These terms apply on top of the rest of this Addendum when the School is in the state named, or when that state’s law applies to the School.

California

These statements are made under Education Code section 49073.1 (AB 1584) and the Student Online Personal Information Protection Act (SOPIPA).

• Pupil records remain the School’s property and under its control.
• Students can keep and transfer their own content, as described in “Parent, student and school rights” above.
• Pondra uses information in pupil records only for the purposes this Addendum permits.
• Parents, guardians and students review and correct records through the School. Pondra completes the School’s requests within 10 business days.
• Pondra’s security actions are the safeguards listed above, including training for staff who have access to Student Data.
• Pondra notifies the School of a Security Incident within 72 hours of confirming it, and cooperates with the School’s notice to affected parents.
• Pondra deletes Student Data when the agreement ends and certifies the deletion in writing on request.
• Pondra and the School work together to comply with FERPA.
• Pondra does not use Student Data for targeted advertising, does not build non-educational profiles, does not sell Student Data and does not use it, even de-identified, to train or develop AI models, as SOPIPA and AB 1159 require.

New York

Pondra complies with the School’s Parents’ Bill of Rights for Data Privacy and Security, which is part of this Addendum, and with Education Law section 2-d. On request, Pondra completes the School’s data security and privacy plan paperwork consistent with this Addendum. The supplemental information is:

• Exclusive purposes. Student Data is used only to provide the service to the School, as described in “Permitted use.”
• Subcontractors. Every Subprocessor is bound by written terms at least as protective as this Addendum, and Pondra remains responsible for it.
• When the agreement ends. We offer an export, then delete the data and certify the deletion, as described in “Retention and deletion.”
• Challenging accuracy. A parent, student, teacher or principal can challenge the accuracy of data by contacting the School, which sends the request to Pondra.
• Storage and security. Student Data is stored in the United States and protected by the safeguards listed above.
• Encryption. Student Data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest.

Illinois

These statements are made under the Student Online Personal Protection Act (SOPPA).

• Pondra notifies the School of a breach within 72 hours of confirming it, well within the 30-day window the statute allows.
• Our list of Subprocessors is available at pondra.ai/trust, so the School can meet any posting duties it has.
• Pondra uses covered information only for K–12 school purposes.

Other states

Where a state law gives the School or its students more protection than this Addendum, that law controls and Pondra will follow it. If the School tells us about a state requirement we have not listed, we will work with it in good faith to add written terms that meet it.

Term and survival

This Addendum applies for as long as the school agreement is in effect, and afterward until Pondra has deleted all Student Data and given any certification the School has asked for. The sections on prohibited uses, de-identified data, security, incidents, deletion and governing law continue after that.

This page shows the version of the Addendum on the date at the top. A School is bound by the version in effect when it signed. We may update this page for future signers. A change reaches a School that has already signed only if the School agrees in writing, unless the change gives Student Data stronger protection.

Order of precedence

If this Addendum conflicts with our Terms of Service or our privacy policy, this Addendum controls for Student Data.

Governing law

For a public school, the law of the School’s state governs this Addendum. For any other school, Delaware law governs, as it does under our Terms of Service.

Contact

For questions, requests or a countersigned copy, email privacy@pondra.ai. For security concerns, email security@pondra.ai. You can also read our privacy policy and our trust page.