Data processing agreement for schools

Roles

• The School is the controller of the data of its students, teachers and administrators processed as part of the service.
• AI Bootcamp, SAS, 13 chemin du Moulin de Trissepaille, 34570 Saussan, France, SIREN 994 754 802, is its processor ("we").
• The School decides how the service is used for its students and holds the authorisations required, in particular those of the holders of parental authority for students who are minors, under its rules and the applicable law. The service collects no consent from families.
• When a student keeps their account after leaving the School, we become the controller of that account, under our privacy policy.
• A teacher's or administrator's own study with Ari, including the study time the School funds for them, belongs to their own account: we are its controller, under our privacy policy. The School remains the controller of the data they process for it (classes, students, assignments).

Subject and duration

To provide the service described in the terms of sale for schools: student accounts, out-loud study with Ari, assignments, follow-up by teachers and billing. The Agreement lasts as long as the contract, then until the end of the retention periods below.

Data subjects and data

Data subjects

the School's students, minors included, its teachers and its administrators.

Identity and class

first and last name entered by the School, class, level and role; for login cards, the username and the password, kept only as a hash (scrypt); card accounts have no email address that can receive mail; the email address of teachers, administrators and students the School invites by email.

Voice and transcripts

session audio, processed in real time for speech recognition and the conversation with Ari; session transcripts, kept on the student's account and never shown to the School.

Study and assignments

assignments, their status, study time, the summary of assignment sessions, the student's answer to the teacher's question and Ari's synthesis for the class. Summaries of the student's free study are never shown to the School.

The student's study memory

what Ari remembers from one session to the next and the portrait of how the student learns, visible to the student only.

Usage and security

minutes and cost of use, sign-in dates, failed sign-in attempts, security logs, and a hash of the IP address for rate limits.

The School does not enter sensitive data (health, family situation, disciplinary assessments) in names, instructions or assignment questions.

Nature and purposes

• To let students study out loud with Ari and teachers follow assignments.
• To measure use for the study-time pool and the School's billing.
• To keep the service secure and prevent abuse.
• No sale of data, no advertising, no advertising profiling. No advertising tracker and no audience measurement in the student experience: neither on the student sign-in pages nor on any page a signed-in student of the School sees.
• No decision based solely on automated processing with legal effects on a student: there are no grades and no rankings.

The School's instructions

• We process the data only on the School's documented instructions: this Agreement, the School terms and the settings of its school space (classes, students, assignments, accounts).
• If an instruction seems to us to infringe the GDPR, we tell the School without delay.
• We do not process the School's data for our own purposes, except for the security and improvement of the service from aggregated usage data.

Confidentiality

People authorised to process the data are bound by confidentiality. Access to the School's data is limited to what the service and support need.

Security

• Encrypted connections (HTTPS) and data encrypted at rest at our database host.
• No direct access to the database from the browser; every read goes through the server after a role check (administrator, teacher). A teacher sees the School's student list, but the study and sign-in data of the students in their own classes only.
• Card passwords kept only as a hash; locking after 5 wrong attempts; per-IP rate limits.
• Secrets kept in a vault, never in the code; backups kept for 7 days.

Sub-processors

The School authorises the sub-processors below, bound by data protection obligations equivalent to those of this Agreement:

Supabase (database, authentication)

hosted in Singapore.

Vercel (application hosting)

a company established in the United States; the application's functions run in Singapore.

ElevenLabs (voice: speech recognition, synthesis, running the conversation)

audio and transcripts; United States.

OpenRouter and the model hosts it calls (Ari's reasoning)

transcripts and session context, routed only to hosts in the United States or the European Union, never to DeepSeek's API.

Anthropic (Claude: session summaries, the student's portrait, class syntheses, suggestions, translations)

United States.

Resend (emails to administrators, teachers and students invited by email)

United States.

Stripe (the School's payments and invoices)

European Union (Ireland) and United States; no student data.

Sefaria (texts)

we only request texts from it; no personal data is sent to it.

We tell administrators by email at least 30 days before adding or replacing a sub-processor. The School may object on legitimate grounds; if no solution is found, it may terminate the contract at no further cost.

Transfers outside the European Union

Some sub-processors are established or host data outside the European Union (United States, Singapore). These transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU-US Data Privacy Framework. The School can get a copy on request.

Helping the School

• Data subject rights: from its school space, the School moves a student to another class, resets their access or removes them from its space. On the School's written request, we correct a student's name within [to confirm: time to correct a name]. We pass on to the School within 5 working days any request from a student, a parent or a teacher that concerns it, and help it answer.
• We help the School with its impact assessments and its exchanges with the supervisory authority, as far as the information we hold allows.

Personal data breach

We notify the School of any personal data breach concerning it without undue delay, and no later than 48 hours after becoming aware of it, with the information available: the nature of the breach, the people and data concerned, the likely consequences and the measures taken.

Retention and end of the contract

A student removed from the School

their seat is freed and the School no longer sees their data; the account stays the student's.

A card account not kept

deleted with all its data 90 days after the end of the school year (30 June), or 90 days after the student left if that is later, by a daily automatic deletion.

An account kept by the student (email address added)

it becomes the student's personal account, of which we are the controller.

Card accounts at the end of the contract

every card account of the School can be claimed until 90 days after the contract's end date, then is deleted with all its data if it was not kept. If a deletion was already due earlier (90 days after 30 June, or 90 days after the student left if that is later), the earlier date applies. These accounts are the students' own: they follow this window, not the deletion within 30 days on the School's instruction below. Accounts linked to an email address stay with the students, on the personal service.

Pilot without an order

a free pilot not followed by an order within 30 days of its end counts as the end of the contract. Nothing is deleted during those 30 days; after them, every card account of the School can be claimed and is deleted with all its data 120 days after the pilot ends (30 days, then 90 days) if it was not kept, or on the earlier date if a deletion was already due. An order placed within the 30 days ends this window.

End of the contract

on the School's written instruction, we delete the data of its school space (classes, assignments, syntheses, names entered by the School) or return it in a readable format, within 30 days. Without an instruction it stays read-only for [to confirm: retention period after the contract ends], then is deleted.

The School's invoices

10 years (accounting obligation).

Security logs and backups

6 months and 7 days.

Audit

We make available to the School the information needed to show compliance with this Agreement. The School may have an audit carried out once a year, at its own cost, with 30 days' notice, by an independent auditor bound by confidentiality and with no access to other customers' data.

Contact

For any question about this Agreement or the School's data: contact@hevraya.com.