Data Privacy Agreement

1. Parties and Purpose

This Data Privacy Agreement ("Agreement") is entered into between Ereading Worksheets Inc., an Illinois S corporation, incorporated in 2010, doing business as Ereading.AI (the "Provider"), and the school or school district that signs below (the "School"). It governs the Provider's handling of Student Data in connection with the School's use of the Ereading.AI service (the "Service").

The purpose of this Agreement is to describe the parties' respective obligations and the privacy and security protections that apply to Student Data, consistent with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Illinois Student Online Personal Protection Act (SOPPA, 105 ILCS 85), and comparable state student-privacy laws.

2. Definitions

• Student Data means personally identifiable information from education records, and other information that identifies a student, that the Provider receives or generates in providing the Service.
• De-Identified Data means information from which all direct and indirect personal identifiers have been removed, such that it cannot reasonably be used to identify a student.
• Subprocessor means a third party engaged by the Provider that may process Student Data to help deliver the Service.
• School Official has the meaning given under FERPA and its implementing regulations.

3. Ownership and Control of Student Data

Student Data belongs to the School and, as applicable, to the student and the student's parent or guardian. The Provider does not acquire any ownership interest in Student Data. The Provider acts as a School Official performing an institutional service under the direct control of the School with respect to the use and maintenance of education records, and processes Student Data only on the School's behalf and under this Agreement.

4. Permitted Use

The Provider uses Student Data only to provide and support the Service, which includes delivering activities, grading responses, returning scores and result documents to the School's systems, and providing optional AI-assisted feedback. The Provider does not use Student Data for any purpose other than those authorized by the School in this Agreement.

The Provider does not send any student-identifying information to its AI providers. Content sent for AI-assisted grading is limited to the activity context, the question, the student's response text, and the rubric, with no name, email, or account identifier.

5. Prohibited Uses

The Provider will not:

• sell, rent, or trade Student Data;
• use or disclose Student Data for targeted advertising;
• build a profile of a student except in furtherance of the School's educational purposes;
• use Student Data to train generalized artificial intelligence or machine-learning models;
• re-disclose Student Data except as directed by the School or as required by law.

6. Subprocessors

The Provider engages the Subprocessors listed below to deliver the Service. The Provider requires each Subprocessor that processes Student Data to provide a comparable level of protection, and remains responsible for their performance under this Agreement. The current list is maintained at ereading.ai/student-privacy.

• OpenAI (primary AI grading and feedback). Passage context, the question, the student response text, and the rubric. No name, email, or account identifier is sent.
• Google (Gemini API) (AI grading and feedback (fallback)). Same de-identified payload as above. Distinct from Google Workspace and Classroom APIs.
• Anthropic (AI grading and feedback (fallback)). Same de-identified payload as above.
• xAI (Grok) (AI grading and feedback (fallback)). Same de-identified payload as above.
• Google (Sign-in and Classroom) (teacher and student sign-in, assignment creation, and grade passback). Verified email, name, and Google id; course and coursework identifiers; submission ids and scores. Use of Google data follows the Google API Services User Data Policy, including Limited Use.
• Stripe (subscription payment processing), which does not receive Student Data. Billing identifiers only. Card details are entered on Stripe-hosted checkout and never touch our servers.
• SparkPost (Bird) (transactional and report email delivery). Recipient email and message content. Result-delivery emails may include a student result PDF.
• ElevenLabs (text-to-speech generation for lesson audio), which does not receive Student Data. Lesson and passage text only. Used in our authoring tools; students never contact this service, and generated audio is stored on our own servers.
• Vultr (The Constant Company) (cloud hosting and infrastructure). All service data resides on hosting located in the United States (Chicago, Illinois).
• Google AdSense (advertising to free, not-signed-in users), which does not receive Student Data. Standard ad requests. Never loaded for signed-in members with a paid plan, and never based on a student's responses, scores, or learning activity. Planned. Advertising is not currently served anywhere on the site.

When a lesson includes an embedded video, the student's browser loads that video from the provider (for example YouTube through youtube-nocookie, or Vimeo), which lets that provider see the request. The Provider uses privacy-enhanced embedding where available.

7. Data Security

The Provider maintains reasonable administrative, technical, and physical safeguards designed to protect Student Data, including:

• All connections use HTTPS and TLS encryption in transit.
• Authentication is passwordless (Google sign-in or one-time email links). We never create or store passwords.
• Session and sign-in tokens are stored only as SHA-256 hashes, never in the clear.
• Class code IP addresses are stored only as SHA-256 hashes.
• LMS refresh tokens, access tokens, and LTI signing keys are encrypted at rest with AES-256-GCM.
• Session cookies are set with the HttpOnly, Secure, and SameSite flags.
• Cross-site request forgery protection is enforced on state-changing requests using timing-safe comparison.
• All database access uses prepared statements with bound parameters.
• Result PDFs are reachable only through a unique, expiring, access-controlled link, with no-referrer and no-index protections and a locked storage directory.
• For signed-in members with a paid plan, advertising code is never loaded or executed, so no ad request, script, or cookie is emitted.
• We use no third-party analytics services, behavioral tracking tools, or advertising pixels.

8. Data Breach Notification

If the Provider determines that a breach has resulted in the unauthorized acquisition, access, use, or disclosure of Student Data, the Provider will notify the School without unreasonable delay and no later than 30 days after that determination. The notice will describe, to the extent known, the nature of the breach, the Student Data involved, and the measures the Provider is taking, so the School can meet its own notification obligations to parents and to any state agency. The Provider will cooperate reasonably with the School's investigation and response.

9. Retention, Return, and Deletion

The Provider retains Student Data only as long as needed to provide the Service, on the schedule published at ereading.ai/student-privacy, and removes expired data through automated processes. Account holders can delete their own account and associated data from account settings.

Upon the School's written request, or upon termination of this Agreement, the Provider will delete or return Student Data in its possession within a reasonable period, except where retention is required by law. The Provider will confirm completion of a deletion request to the School.

10. Rights of Parents and Students

The Provider will support the School in responding to requests from parents, guardians, or eligible students to review, correct, or delete Student Data. Such requests are directed through the School, consistent with FERPA. Requests may be sent to [email protected].

11. Compliance Acknowledgment

The Provider acknowledges its obligations as an operator under the Illinois Student Online Personal Protection Act (105 ILCS 85) and as a School Official under FERPA, and it supports the School's compliance with COPPA for students under 13 through the School's authority to consent on behalf of parents for educational purposes.

12. Term and Termination

This Agreement takes effect on the date of the last signature below and remains in effect while the School uses the Service. Either party may terminate on written notice. Sections concerning ownership, prohibited uses, security, breach notification, and deletion survive termination with respect to Student Data the Provider still holds.

13. General

This Agreement is governed by the laws of the State of Illinois, without regard to conflict-of-laws rules. If any provision is held unenforceable, the remaining provisions stay in effect. This Agreement, together with the Ereading.AI Privacy Policy and Terms of Service, is the entire agreement between the parties regarding Student Data privacy, and may be amended only in writing signed by both parties. Where this Agreement conflicts with the Terms of Service regarding Student Data, this Agreement controls.

14. Signatures