Available on request

We sign a data processing agreement (DPA) with every subscribing school. Ask for ours, or send us the agreement your school or state uses and we will review it.

[Planned: adopt the Student Data Privacy Consortium National DPA and the California NDPA as standard templates.]

What the DPA will cover

• The school as owner and controller of its data; Timothy Roe Computer Services, LLC, which provides Shepherd Filter, as processor acting on the school’s instructions.
• The categories of data processed and the purposes, as listed on the security and privacy page.
• The outside services (subprocessors) we use: DigitalOcean, Google, Cloudflare, Resend and Stripe, and notice to schools before any is added.
• Storage in the United States.
• Security measures, breach notification and timelines.
• Access, correction, export and deletion on request, and deletion at the end of the contract.
• No sale of data, no targeted advertising, no use outside the service.

[Breach notification period, retention schedule and audit rights to be set by counsel.]