Every student data privacy agreement read clause by clause, checked against your own logs, decided and co-signed by your people
Teachers get approved apps in days, and every vendor has a signed, checked agreement.
See one case, screen by screen ↓A student data privacy agreement is the signed contract that lets an app vendor hold a district's student records, under FERPA, COPPA and the state student privacy law. Student Data Privacy Agreement Review puts seven agents on that work: they read each app's terms, privacy policy and agreement against the district's requirements, quote the clause behind every verdict, draft the missing terms and re-read every signed vendor each month. The privacy officer decides, and the Director of Technology co-signs any app beyond directory information.
AI in education: a buyer's guide to agentic AI for colleges, universities and school districts →
Updated
A student data privacy agreement is the signed promise that lets an app vendor hold a district's student records, and before a teacher can use the app, someone has to read the vendor's terms of service, privacy policy and national data privacy agreement against FERPA, COPPA and the state student privacy law. FERPA lets a vendor receive records only as a school official, for the district's purpose and under its direct control; the amended COPPA Rule, with a compliance date of April 22, 2026, tightens consent and retention for children under 13; and most state laws require a signed agreement and a public list of vendors.
Today that reading is done by hand, from an email with a link. The privacy officer downloads 40 pages, checks them against a checklist in a document, emails the vendor about the missing terms and updates the public list in a batch. Nobody re-reads the vendor's policy after signing, and the sign-on and network logs show far more apps in use than were ever requested. Student Data Privacy Agreement Review puts seven agents on the reading, the checking and the drafting, so the privacy officer spends her time deciding.
Estimated split of a typical request's school days by email, against the 23-day median in the sample district last year, and with the agents against the 4-day target; our arithmetic, kept modest.
Seven agents read, check, watch and draft every app's terms; the privacy officer decides and the Director of Technology co-signs.
Ben Albright teaches grade 7 science at Seacliff Middle School in Marlow Bay Unified School District, and he wants a virtual lab for his 142 students. Here is what happens to request REQ-26-118, screen by screen, in the working solution.
Ben types "Can I use Cellscape for my 7th grade labs?" The Intake agent names the vendor, Lumen Labs, lists the nine kinds of data the app wants, confirms five sections and 142 students, and offers two apps the district already approved. It explains that this app needs two signatures and a decision within 10 school days, and files the request.
The Terms agent read the vendor's agreement with its exhibits, the privacy policy, the terms of service, the SOC 2 Type II report and the district's network log from the pilot. Every one of the 18 requirements has a verdict, the exact clause it relied on, a citation that opens the passage, and a confidence score.
14 met · 1 partly met · 2 missing · 1 needs you
Nothing bans training AI models on student data: privacy policy §5.3 allows de-identified data for "our machine learning models". The terms of service say deletion within 90 days and the agreement says 60, and the screen says why 60 controls: the agreement's priority clause. The district's own network log shows the help widget sending the student's display name and class to Helpline Desk, Inc., a support service missing from the vendor's list of four subprocessors.
Requests from Cellscape student pages: 0 to advertising or tracking domains, across 2,116 pilot sessions.
The COPPA consent basis scored 0.68, below the 0.80 threshold, because privacy policy §3.2 lets teachers create student accounts outside district sign-on. Lumen Labs wrote on October 2 that students will sign in only through the district's single sign-on, so Noor marks the item met with the reason "Vendor confirmed in writing". Approve on its own is disabled while required items are open; she chooses Approve with an addendum, the option the Terms agent recommends.
Four clauses, each tied to the item it closes: §H.3 no training of AI models, including de-identified data; §H.7 a subprocessor schedule that names Helpline Desk, Inc. with 30 days' notice before any new one; the state's Exhibit G terms; and §H.9, student accounts only through district sign-on. Noor accepts them one by one and sends the decision for co-signature.
Cellscape holds more than directory information, so Martin co-signs. He sees the decision, the data the app would hold, the sign-on permissions it asks for (openid, profile, email, roster.read), the security evidence and the behavior checked in the logs. The person who decides can never co-sign, and the app turns on in sign-on only when Lumen Labs signs the addendum.
The October re-read covered 610 vendors: 14 changed their terms and 3 conflict with what they signed. On October 3, Brightleaf Learning posted a new policy for ReadSpring, used by 1,940 students in grades 2–5 at 14 elementary schools, allowing de-identified reading recordings to improve its AI models. The Change agent puts the signed clause, the policy before and the policy now side by side.
"We may use de-identified content, such as reading recordings and responses, to improve our AI models."
Noor opens a re-review, which takes one signature because it protects students; returning the app to approved takes two. The Addendum agent drafts the notice of conflict, citing Exhibit H §H.3 and the new §6, and Noor edits and sends it, asking Brightleaf to confirm in writing by October 19, 2026.
The approved-app list on the district website shows Cellscape Virtual Lab as approved with an addendum and ReadSpring as under review: "The company changed its privacy policy; the district is checking it." Four apps still waiting for signatures are not shown to families.
Every person and agent action is on the audit trail with its reason and evidence. For a state audit, the pack holds 98 decided requests, 610 agreements, 1,846 requirement verdicts with their clauses, 14 policy changes and 3 notices, with student names redacted: 2,214 files and 9,380 pages, sealed with a SHA-256 hash.
The same request, seen by the people who carry it, from the teacher who asks to the auditor who checks it later.
Seven agents read, check, watch and draft every app's terms; the privacy officer decides and the Director of Technology co-signs.
Turns a teacher's plain request into a complete one, with the vendor, the data the app wants, the students and the sign-on permissions, and offers approved apps that already do the job.
Matches sign-on, network and browser extension logs to the app inventory every night, and finds apps in use without approval, with user counts per school.
Reads the terms of service, privacy policy and agreement against the district's 18 requirements, quotes the clause behind each verdict, settles conflicts by the agreement's priority clause and checks the vendor's promises against the district's logs.
Re-reads every approved vendor's documents each month, compares each change with the clause the vendor signed, and watches agreement expiry.
Drafts the missing clauses and the notices of conflict from the district's clause library, each tied to the gap it closes and cited to both texts.
Updates the family-facing approved-app list on the district website, with each app's status and the data it holds in plain words.
Builds a sealed, redacted export pack for a state audit or a breach inquiry from the audit trail and the signed documents.
Decide and co-sign. The agents propose; a named person decides.
Ask in plain words about any request, vendor or app in the logs. Every answer cites the clause, the policy or the log it came from.
Which apps hold student data without a signed agreement?
None of the 1,163 approved apps. But 27 apps are new to the logs this week, and 19 show signs of student data: FlashForge Quiz (212 students, name and school email), NoteNest (88 students, reads every page) and StoryKite (64 students, birth date, so under 13). Blocking needs Martin Szabo's co-signature.
What changed in ReadSpring's privacy policy?
On October 3, Brightleaf added to §6: "We may use de-identified content, such as reading recordings and responses, to improve our AI models." Before, it said it does not use student content to train AI. The agreement signed on Aug 12, 2025 forbids it, including de-identified data. 1,940 students in grades 2–5 are affected, and the change takes effect November 2.
Why does Cellscape need an addendum?
Three gaps, each with a drafted clause: item 4, its privacy policy allows de-identified data for "our machine learning models"; item 7, the help widget sends student names to an unlisted support service; item 11, Exhibit G is not signed for this state. Item 8, the COPPA consent basis, needs you: Lumen Labs wrote that accounts will be sign-on only.
Build the breach inquiry pack for ReadSpring
The pack holds the agreement with Exhibits G and H, the data the app holds, the 14 schools and 1,940 students as counts, every review, change and notice since Aug 12, 2025, and the audit trail. Student names go only in a sealed annex for counsel, and the pack is logged.
13 screens from the working solution, on its sample data. Pick one to see it large.
The requirements, clocks and thresholds every request is checked against are settings. Every change makes a new version and goes on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Decide each request within | 10 school days | From the moment the request is complete |
| Escalate to the Director of Technology | On school day 8 | With the reason the request is waiting |
| Vendor answer window | 10 business days | For missing documents, addenda and notices |
| Re-read every approved vendor | Monthly, first Saturday | Every two weeks · Weekly · also when a vendor emails a change |
| Each of the 18 requirements | Required, counsel may waive | Required, no waiver · Recommended |
| Terms agent acts only above | 0.80 confidence | 0.80 to 1.00; below it, the item goes to a person |
| Keep agreements and reviews | 6 years after the agreement ends | 5 years · 7 years; log extracts 13 months |
| Publish on the public list | After both signatures | After both signatures and the vendor's |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
Sources: 34 CFR Part 99 (FERPA), 99.31(a)(1)(i)(B), 99.33 and 99.37 · COPPA Rule amendments, 16 CFR Part 312, Federal Register, April 22, 2025 (compliance date April 22, 2026) · published counts of state student privacy laws (130+ laws in 43 states) · "target" = design goal, measured in the live solution · "demo" = seen in the working solution, on its sample data · "typical" = published figures · "estimated" = our arithmetic from the sample district's request log, kept modest. Marlow Bay Unified School District, its schools, the vendors and apps, and the people named on this page are fictional: characters and sample data in the working solution.
A student data privacy agreement is the signed contract that lets an app vendor hold a district's student records, under FERPA, COPPA and the state student privacy law. Student Data Privacy Agreement Review puts seven agents on that work: they read each app's terms, privacy policy and agreement against the district's requirements, quote the clause behind every verdict, draft the missing terms and re-read every signed vendor each month. The privacy officer decides, and the Director of Technology co-signs any app beyond directory information.
The NDPA is a national data privacy agreement template for schools, with standard clauses, a schedule of the data a vendor holds, a general offer other districts can accept, state terms (Exhibit G) and the district's own terms (Exhibit H). The Terms agent reads a vendor's signed NDPA alongside its terms and privacy policy, and when they disagree it says which text controls under the agreement's priority clause.
Under FERPA's school-official exception, 34 CFR 99.31(a)(1)(i)(B), a vendor may receive education records when it performs a service the district would otherwise do itself, under the district's direct control, and uses the data only for that purpose; 99.33 limits redisclosure. Requirement 1 checks the agreement for exactly that, and requirement 14 checks that nothing is redisclosed without the district's written approval.
Federal guidance lets a school authorize an operator to collect a child's information for school use only. The amended COPPA Rule, with a compliance date of April 22, 2026, also requires separate consent for disclosure to third parties and limits on retention. When an app lets teachers create student accounts outside district sign-on, the Terms agent sends the consent question to the privacy officer instead of deciding it.
The Change agent re-reads every approved vendor's documents each month and compares each change with the clause the vendor signed. A conflict is shown with the signed clause, the old text and the new text side by side; the privacy officer can reopen the review with one signature, and the Addendum agent drafts the notice to the vendor.
The Inventory agent matches the sign-on, network and browser extension logs to the app inventory every night and shows new apps with user counts per school and the data signals the logs show. Reviewers see counts, never a student's browsing, and blocking an app needs the Director of Technology's co-signature.
Yes. The agents read, draft and propose; they never approve, sign, send to a vendor, publish or block. The privacy officer decides every request with a reason code, any item below the confidence threshold goes to a person, and the person who decides can never co-sign.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your requirement set, your clause library and a sample of past requests and agreements, and it goes live once every quality gate has passed. We will walk you through it on your own app requests first.
Every notice and deadline held to the rule; investigator and decision-maker kept apart.
1-min demoStudent Conduct Case ManagementEvery sanction checked against three years of like cases, with a complete hearing record.
1-min demoClery Act ComplianceEvery published number tied to its source reports, ready for a program review.
1-min demoWe'll run Student Data Privacy Agreement Review on a sample of your own app requests and vendor agreements.