Data Processing Agreement

How this agreement is entered into

This Data Processing Agreement ("DPA") is part of Ezergrade's Terms of Service. By agreeing to the Terms and using the Service, a school, co-op, or other educational organization accepts this DPA — there is nothing further to sign, and no need to request it before you are covered.

If your procurement process requires a separately signed copy, or you need us to sign your own agreement or a district NDPA instead, email support@ezergrade.com and we will send an executable version.

1. Parties and purpose

This DPA supplements and forms part of the agreement between Ezergrade LLC, a California limited liability company ("Ezergrade," "Processor," or "Service Provider"), operator of the Ezergrade spelling assessment platform, and the account holder and the educational organization on whose behalf the account is used — a homeschool co-op, microschool, private school, or other educational organization ("Customer," "School," or "Controller").

It governs Ezergrade's processing of Personal Data, including student education records, on the Customer's behalf. Where this DPA conflicts with the general Terms of Service or Privacy Policy on a data-protection matter, this DPA controls for the data it covers.

2. Definitions

• Personal Data — information relating to an identified or identifiable individual that Ezergrade processes on the Customer's behalf under this DPA.
• Student Data — Personal Data about the Customer's students collected or generated through the Service: first/last name, teacher-assigned student number, grade level, class/group membership, test responses, per-word and overall results, session metadata, practice-game participation, integrity-log data, and technical data collected when a student uses the Service (IP address, browser type, and device type). Student Data does not include student email addresses, dates of birth, home addresses, phone numbers, government identifiers, or biometric data, because Ezergrade does not collect these from students.
• Education Record — has the meaning given under the U.S. Family Educational Rights and Privacy Act ("FERPA"), to the extent applicable to the Customer.
• Controller / Processor and Sub-processor — carry their meaning under applicable data protection law (e.g. GDPR); where the Customer is a School, the Customer is the Controller (or the party that controls the Education Records) and Ezergrade is the Processor / service provider.

3. Roles of the parties

3.1. As between the parties, the Customer is the Controller of Student Data (or the party that controls the Education Records) and Ezergrade is the Processor / service provider, processing Student Data only on the Customer's documented instructions — which include the Customer's configuration and use of the Service.

3.2. For Ezergrade's own operational data — Customer/teacher account details, billing data, website usage data, and support communications — Ezergrade may act as a controller or business, as described in its Privacy Policy.

4. FERPA “school official” designation

4.1. To the extent the Customer is subject to FERPA, the Customer designates Ezergrade as a "school official" with a "legitimate educational interest" in the Education Records disclosed to it, under the FERPA school-official exception (34 C.F.R. § 99.31(a)(1)), for the sole purpose of performing the assessment services the Customer has requested.

4.2. Ezergrade will: (a) use Education Records only to provide the Service; (b) remain under the Customer's direct control with respect to the use and maintenance of Education Records; and (c) not re-disclose Education Records except as permitted by this DPA or FERPA, or as directed by the Customer.

4.3. No standalone certification. Ezergrade has not received, and does not claim to hold, any official FERPA or COPPA certification — no federal body issues a FERPA certification, and Ezergrade has not yet pursued FTC-sanctioned COPPA Safe Harbor certification. To the extent FERPA applies to the Customer, Ezergrade processes Education Records as a school service provider under the Customer's direct control and only for the educational purposes described above. Ezergrade is designed to support the Customer's FERPA and COPPA obligations; the Customer remains responsible for its own notices, consents, policies, and regulatory compliance.

4.4. COPPA — school-authorized educational use. Where the Customer uses the Service with children under 13 in an educational context, Ezergrade will use Student Data collected from those students only for the school-authorized educational purposes described in this DPA — and not for advertising, behavioral profiling, or any unrelated commercial purpose — consistent with the school-consent basis recognized under COPPA in the educational technology context.

5. Scope and purpose of processing

5.1. Permitted purpose. Ezergrade processes Student Data only to deliver spelling assessments and grade them, and to maintain the resulting unified grade record for the Customer — specifically: test creation and word-list handling; delivery of Class Test, Self-Paced, At-Home Practice, and Paper modes; automated exact-match grading (and OCR reading of handwritten answers for Paper mode); assessment-integrity enforcement in supervised modes; results storage, CSV export, and optional Google Classroom grade passback at the teacher's direction. Ezergrade also processes Student Data to deliver practice games assigned by the Customer's teachers and to show the teacher whether a student took part; practice games are not graded and produce no score, points, or ranking.

5.2. No secondary use. Ezergrade will not:

• sell, rent, or trade Student Data;
• use Student Data for advertising, ad targeting, or building advertising/behavioral profiles;
• use Student Data to train AI or machine-learning models;
• re-disclose Student Data to third parties except to the sub-processors in Section 6, as directed by the Customer, or as required by law; or
• use Student Data for any purpose beyond providing and supporting the Service.

5.3. AI boundaries. Core assessment and grading do not use AI; objective grading is an exact string match, not an AI judgment. Where a teacher enables optional AI written feedback, what is sent to the AI provider is, for each student, the list of words with what the student typed and whether it was correct. Ezergrade adds no student names, student numbers, rosters, class information, grades, or test titles — students are distinguished only by their position within the request. Because an answer box accepts free text, any answer that is not a plausible single spelling word is replaced with a placeholder before the request is sent.

5.4. Ezergrade will notify the Customer if it believes an instruction infringes applicable data protection law (without obligation to provide legal advice).

6. Sub-processors

6.1. The Customer authorizes Ezergrade to engage sub-processors to process Personal Data as needed to operate the Service, in the following functions:

• Database hosting, authentication, and real-time delivery (United States) — all stored account and Student Data.
• Application hosting, content delivery, and security (global edge network) — traffic and usage data.
• Payment and subscription processing — Customer billing data. Ezergrade holds no full card numbers.
• AI text processing, for optional AI features only — teacher-provided content, and for student feedback the data described in Section 5.3, which contains no student identifiers.
• OCR text extraction, for Paper Mode only — scanned answer-sheet images.
• Google Classroom APIs, only where the teacher authorizes the integration — roster names, course information, and grades.
• Transactional email delivery — teacher email addresses. No Student Data.

The current list of named sub-processors, including each provider's identity and location, is available to any Customer on request at support@ezergrade.com.

6.2. Changes. Ezergrade may add or replace sub-processors and will notify the Customer of material changes by email, in-account notice, or another direct method a reasonable time in advance, giving the Customer an opportunity to object on reasonable data-protection grounds.

6.3. Ezergrade will impose data-protection obligations on each sub-processor substantially consistent with this DPA and remains responsible to the Customer for its sub-processors' performance.

7. Security

Ezergrade maintains reasonable technical and organizational measures appropriate to the risk, including: encryption in transit (TLS/HTTPS); encryption at rest at the database provider; hashed teacher passwords and secure session management; Row Level Security policies isolating each teacher's data; no student login credentials (students join by class code, minimizing attack surface); and hosting on providers that maintain their own security practices. No method of storage or transmission is 100% secure, and Ezergrade does not guarantee absolute security. Further detail is in the Privacy Policy's Data Security section, and a fuller security overview mapped to the NIST Cybersecurity Framework is available to schools on request.

8. Breach notification

8.1. Where Ezergrade reasonably suspects a security incident may have affected the Customer's Student Data but has not yet confirmed its scope, Ezergrade will provide an initial notice to the Customer as soon as practicable and will update the Customer as more information becomes available. Once a Personal Data breach is confirmed, Ezergrade will notify the Customer without unreasonable delay — and in any event no later than thirty (30) calendar days after confirming the breach, unless a shorter period is required by applicable law — consistent with state requirements such as Illinois's Student Online Personal Protection Act (SOPPA). Notification will include the nature of the breach, the data affected, and corrective actions taken, to the extent known.

8.2. Where the Customer must notify a supervisory authority (e.g. GDPR within 72 hours), affected individuals, or parents/students, Ezergrade will cooperate with and assist the Customer and, where applicable, will itself notify the relevant authority or Australia's OAIC under the Notifiable Data Breaches scheme as required by law.

8.3. Ezergrade's internal breach-handling process is governed by its documented incident-response procedure, which details containment, credential rotation, scoping, notification decisions, and logging. A summary is available to the Customer on request.

8.4. Cost allocation. Where a confirmed Personal Data breach is directly attributable to Ezergrade's acts or omissions (or those of its sub-processors), the parties will work in good faith to allocate the Customer's reasonable, documented costs of legally required breach response (such as notifying affected individuals), taking into account the nature and scale of the incident. Ezergrade's aggregate liability arising from this DPA is limited to the fees paid by the Customer to Ezergrade in the twelve (12) months preceding the event giving rise to the claim, except where a higher or different limit is required by applicable law or separately agreed in writing. This section addresses the breach-cost-allocation term required by applicable state operator-contract laws, such as Illinois's SOPPA.

9. Data retention, return, and deletion

9.1. Ezergrade retains Student Data only as long as needed to provide the Service to the Customer, or as the Customer directs. Teachers can delete individual students, classes, tests, and results in the Service at any time.

9.2. On termination of the agreement, or on the Customer's valid request, Ezergrade will delete or return the Customer's Student Data within sixty (60) days of the later of (a) the termination date or (b) Ezergrade being made aware the Student Data is no longer needed for the purpose for which it was obtained, using industry-standard methods, subject to any legal retention requirement. Except as provided in §9.4, Ezergrade will not unilaterally delete Education Records held on the Customer's behalf without the Customer's authorization.

9.3. Specifically: raw paper-scan images are never stored on Ezergrade's servers and are discarded when the scan session ends; AI requests are not retained by Ezergrade once the response is received; the integrity log from supervised tests is kept up to 12 months; network request logs are not retained (only aggregated traffic totals at our hosting provider, up to 30 days); and Chat with Ezer conversations are deleted after 30 days. Further operational detail is published in Ezergrade's Privacy Policy.

9.4. Dormancy limit. Independently of Customer instruction, Ezergrade does not retain Student Data indefinitely. Where an account has not been covered by an active paid subscription and has had no authorised sign-in for twenty-four (24) months, Ezergrade will give the account holder at least thirty (30) days'written notice, and will then delete the account and the Student Data it holds if it remains dormant at the end of that notice period. A complimentary or beta subscription is not a paid subscription for this purpose; a teacher within a Customer that holds an active paid subscription is covered by it. This limit does not apply while this agreement is in force and the account is actively maintained; §9.2 governs disposition on termination.

10. Data subject and parental requests

Ezergrade will, taking into account the nature of the processing, assist the Customer in responding to requests from parents, guardians, eligible students, or other data subjects to access, correct, or delete data, and will direct such requests it receives directly to the Customer where the Customer controls the data.

11. International transfers

Personal Data is stored in the United States. Ezergrade's hosting provider uses a global edge network, so traffic may pass through locations outside the United States in transit.

Where a transfer from the EEA requires a safeguard, the parties apply the European Commission's Standard Contractual Clauses. For transfers from the United Kingdom, the parties apply those Clauses together with the UK International Data Transfer Addendum, which the Information Commissioner's Office requires alongside them.

12. Audits and cooperation

On reasonable written request, and no more than once per year absent a specific concern or legal requirement, Ezergrade will make available the information reasonably necessary to demonstrate compliance with this DPA. This is satisfied through documentation — this DPA, the Privacy Policy, the security overview, and summaries of the retention and incident-response procedures — rather than on-site audits, unless required by law.

13. Term and termination

13.1. This DPA takes effect when the Customer accepts Ezergrade's Terms of Service (or, where a separately signed copy is used, when both parties sign) and continues for as long as Ezergrade processes Personal Data on the Customer's behalf.

13.2. Either party may terminate as provided in the underlying agreement. On termination, Section 9 governs the disposition of Student Data, and the obligations that by their nature should survive — confidentiality, no secondary use, deletion, and breach cooperation — survive termination.

14. Miscellaneous

14.1. If any provision is unenforceable, the remainder stays in effect.

14.2. The governing law and venue are those stated in the underlying agreement and Terms of Service, except where mandatory local law requires otherwise.

Questions, or need this signed?

Email support@ezergrade.com. We can provide a signable copy of this agreement, the current named sub-processor list, our security overview, or review your school's own data privacy agreement.

See also our Privacy Policy, Student Privacy page, Terms of Service, and Trust Center.