1. Definitions
1.1 "Applicable Privacy Laws" means all federal, state, and local laws, rules, and regulations applicable to the processing of Student Data under this Agreement, including without limitation the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g and 34 C.F.R. Part 99 ("FERPA"); the Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h ("PPRA"); the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501--6506 and 16 C.F.R. Part 312 ("COPPA"); and all applicable state student data privacy and data breach notification statutes.
1.2 "De-Identified Data" means data from which all direct and indirect personal identifiers have been removed such that there is no reasonable basis to believe the information can be used to identify an individual student, and which KinderPath has committed not to attempt to re-identify.
1.3 "Education Records" has the meaning given in FERPA.
1.4 "Personnel" means KinderPath's employees, officers, contractors, and agents.
1.5 "School Personnel Data" means personal information relating to School's teachers, administrators, and staff processed in connection with the Services, including name, work email address, role, and classroom assignment.
1.6 "Security Incident" means any confirmed unauthorized access to, acquisition of, disclosure of, alteration of, loss of, or destruction of Student Data in KinderPath's possession or control, or in the possession or control of a Subprocessor.
1.7 "Services" means the KinderPath Pro platform and related services provided under the School Agreement, as further described in Schedule A.
1.8 "Student Data" means any information, in any form, relating to a student enrolled in School's program that is provided to, entered into, or generated by the Services by or on behalf of School, including the categories described in Schedule A. Student Data includes Education Records where the School is subject to FERPA. Student Data does not include De-Identified Data.
1.9 "Subprocessor" means any third party engaged by KinderPath that processes Student Data in connection with the Services.
1.10 "Targeted Advertising" means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred from that student's use of the Services or from Student Data. It does not include advertising to a School's adult personnel in a general business context outside the Services.
2. Roles of the Parties
2.1 Direction and Control. As between the Parties, School determines the purposes for which Student Data is processed and retains ownership of and control over Student Data. KinderPath processes Student Data solely on School's behalf and solely as directed under this Agreement and the School Agreement. KinderPath does not own Student Data and acquires no rights in it beyond the limited license necessary to deliver the Services.
2.2 School Official Designation. Where School is an educational agency or institution subject to FERPA, School designates KinderPath as a "school official" with a "legitimate educational interest" in Education Records within the meaning of 34 C.F.R. § 99.31(a)(1). KinderPath acknowledges that it: (a) performs an institutional service or function for which School would otherwise use its own employees; (b) is under School's direct control with respect to the use and maintenance of Education Records; (c) will use Education Records only for the authorized purposes set forth in this Agreement; and (d) will not re-disclose Education Records to any third party except as expressly permitted by this Agreement or as required by law.
2.3 COPPA. School represents that, where required, it has provided notice to and obtained any consent from parents or legal guardians necessary for KinderPath to collect and process Student Data through the Services, and that it does so in its capacity as agent of the parent to the extent permitted under COPPA and applicable Federal Trade Commission guidance. KinderPath acknowledges that it collects Student Data only at School's direction and for the use and benefit of School, and for no commercial purpose.
2.4 Non-FERPA Programs. Where School is a private preschool, childcare center, or other program not subject to FERPA, Sections 2.1 and 2.3 apply in full and Section 2.2 applies only to the extent School is subject to FERPA. All remaining obligations of this Agreement apply regardless of School's FERPA status.
2.5 School Responsibilities. School is responsible for: (a) the accuracy and lawfulness of Student Data it enters or authorizes others to enter; (b) determining and meeting its own obligations regarding student records under Applicable Privacy Laws; (c) provisioning, managing, and promptly deprovisioning user accounts and access rights for its personnel; and (d) any required notice to parents concerning School's use of the Services.
3. Scope and Purpose of Processing
3.1 Documented Instructions. KinderPath will process Student Data only (a) as necessary to provide, maintain, secure, and support the Services; (b) in accordance with School's documented instructions, of which this Agreement and the School Agreement constitute the complete set as of the Effective Date; and (c) as otherwise required by law.
3.2 Description of Processing. The subject matter, duration, nature and purpose of the processing, the categories of Student Data, and the categories of data subjects are set out in Schedule A.
3.3 Legally Compelled Disclosure. If KinderPath receives a subpoena, court order, or other legally compelled request for Student Data, KinderPath will, unless legally prohibited, promptly notify School before disclosure and provide School a reasonable opportunity to seek a protective order or otherwise object. KinderPath will disclose only the minimum Student Data legally required.
3.4 Unlawful Instructions. KinderPath will notify School promptly if it reasonably believes an instruction from School would violate Applicable Privacy Laws, and may suspend performance of that instruction pending resolution.
4. Prohibited Uses of Student Data
KinderPath will not, and will not permit any Subprocessor to:
- sell, rent, trade, or otherwise commercially transfer Student Data;
- use Student Data for Targeted Advertising, or disclose Student Data to any third party for that purpose;
- build or amend a personal profile of a student for any purpose other than supporting the educational purposes authorized by School;
- use Student Data to train, fine-tune, or otherwise improve any general-purpose artificial intelligence or machine learning model;
- use Student Data in identifiable form for product development, research, or marketing; or
- disclose Student Data to any third party except to Subprocessors under Section 7, to School or persons School authorizes, or as required by law under Section 3.3.
These restrictions survive termination of the School Agreement and this Agreement.
5. De-Identified Data
5.1 KinderPath may generate and use De-Identified Data for the limited purposes of improving the Services, developing product features, conducting internal research on educational effectiveness, and demonstrating the efficacy of the Services in aggregate form.
5.2 KinderPath will not attempt to re-identify De-Identified Data and will not disclose De-Identified Data to any third party unless that party is contractually bound not to attempt re-identification. KinderPath will not disclose De-Identified Data in a manner that permits identification of School or of any individual student without School's prior written consent.
6. Artificial Intelligence Features
6.1 Use of AI. Certain features of the Services generate narrative summaries and instructional suggestions using a third-party artificial intelligence model provider, identified in Schedule D, with which KinderPath contracts directly under an executed data processing agreement. Such processing is performed solely to deliver the requested feature to School. The features that use AI processing are listed in Schedule D.
6.2 Names Removed Before Transmission. Before any text is sent to the AI service, KinderPath removes the names of children and staff on record at the school. Teachers are asked not to include other personal names in notes. Photographs and audio are never sent. Where a narrative would refer to a child by name, KinderPath substitutes a placeholder token before transmission and replaces that token with the child's first name only after the generated text is returned, within the Services. The name a School sees in a narrative is inserted by KinderPath, not by the model provider. This behavior is not a configurable setting.
6.3 Minimization Before Transmission. Before any content is submitted for AI processing, KinderPath removes school and classroom identifiers, dates of birth, student identification numbers, internal record identifiers, contact information, and the names of other children. Content submitted is limited to developmental and instructional information in minimized form: skill and domain names, proficiency levels, assessment dates and counts, progress trends, and filtered teacher observations.
6.4 Media Excluded. Photographs, audio recordings, and other media evidence uploaded to the Services are never transmitted for AI processing. This exclusion is enforced by a technical control within the Services and is verified by test coverage.
6.5 Model Provider Commitments. The model provider is contractually prohibited from using content submitted by KinderPath to train or improve its models. Content submitted is deleted by the model provider within thirty (30) days, except content the provider identifies as violating its usage policy and content it is required by law to keep, which it may keep longer under its published terms; the provider has access to submitted content only for safety, security and legal-compliance purposes. The provider acts as KinderPath's processor, is contractually prohibited from selling or sharing submitted content, from retaining or using it outside the direct business relationship, and from combining it with data received from any other source.
6.6 No Training by KinderPath. KinderPath does not use Student Data to train, fine-tune, or otherwise improve any artificial intelligence model.
6.7 Free Text. Teacher-authored observations and notes submitted for AI processing are filtered using automated pattern matching, which replaces the subject child's name and the names of other children with placeholder tokens. KinderPath does not warrant that such filtering removes every identifier that an author may have entered into a free text field.
6.8 Human Decision-Making. Outputs generated by AI features are provided to educators as informational support only. The Services do not make automated determinations regarding student placement, grouping, eligibility, or evaluation. All instructional and grouping decisions remain the decision of School's educators, who review and may edit any generated text before it is approved or shared.
7. Subprocessors
7.1 Authorization. School authorizes KinderPath to engage the Subprocessors listed in Schedule D. KinderPath will not engage any additional Subprocessor to process Student Data except in accordance with this Section 7.
7.2 Flow-Down Obligations. Before permitting any Subprocessor to process Student Data, KinderPath will enter into a written agreement with that Subprocessor imposing data protection obligations no less protective than those in this Agreement, including the restrictions in Section 4 and security obligations substantially equivalent to Section 8.
7.3 Subprocessor Obligations. KinderPath requires every Subprocessor to be bound by data protection obligations at least as protective as those in this Agreement. KinderPath does not guarantee the operations or work of any Subprocessor.
7.4 Change Notice. KinderPath will notify School by email to the administrator email address on file for School's KinderPath Pro account, and by updating Schedule D, before adding or replacing a Subprocessor that will process Student Data. The notice period depends on the layer at which the Subprocessor operates: (a) for a Subprocessor that stores Student Data at rest, at least thirty (30) days; and (b) for any other Subprocessor, at least ten (10) days, or such longer period as KinderPath in fact receives from the affected provider. KinderPath gives School the full notice period it receives and does not shorten it. The current list of Subprocessors is set out in Schedule D.
7.5 Objection. School may object in writing to a proposed new Subprocessor on reasonable data protection grounds within fifteen (15) days of notice. The Parties will confer in good faith. If KinderPath is unable to make available a commercially reasonable alternative, School may terminate the School Agreement as to the affected Services without penalty and receive a pro-rata refund of prepaid, unused fees.
8. Information Security
8.1 Security Program. KinderPath will implement and maintain administrative, technical, and physical safeguards designed to protect Student Data against unauthorized access, acquisition, disclosure, alteration, loss, and destruction, appropriate to the nature and sensitivity of the data. The measures in effect as of the Effective Date are described in Schedule B.
8.2 Access Limitation. KinderPath will limit access to Student Data to those Personnel who require access to perform the Services, and will maintain role-based access controls within the Services consistent with the roles described in Schedule A. Administrative actions affecting Student Data, including deletions, authentication resets, and the use of any administrative override, are recorded in an audit log that School's administrators can read for their own school but cannot change.
8.3 Personnel. KinderPath requires all Personnel with access to Student Data to execute a written confidentiality and data protection agreement before access is granted, and to complete privacy and security training appropriate to their role before access is granted and at least annually thereafter. KinderPath maintains a register recording execution and completion for each individual, which is available to School under Section 13.1.
8.4 No Diminution. KinderPath will not materially diminish the protections described in Schedule B during the term of the School Agreement.
9. Security Incident Response
9.1 Notification. KinderPath will notify School of a Security Incident affecting School's Student Data without unreasonable delay and in any event within seventy-two (72) hours after KinderPath confirms the incident. Notice will be given by email to School's administrator email address on file, or to another security contact School has designated in writing, and, where circumstances warrant, by telephone.
9.2 Content of Notice. To the extent known at the time and subject to supplementation as the investigation proceeds, the notice will describe: the nature of the incident; the categories and approximate number of students and records affected; the date or date range of the incident and of discovery; the steps taken to contain and remediate; and a contact point for further information.
9.3 Cooperation. KinderPath will investigate the incident, take reasonable steps to contain and remediate it, preserve relevant evidence, and cooperate with School's reasonable requests for information necessary for School to meet its own notification obligations under Applicable Privacy Laws.
9.4 Notification to Parents and Regulators. As between the Parties, School determines whether and how to notify affected parents, guardians, regulators, and other third parties, except where KinderPath is independently required by law to notify. KinderPath will not notify any affected individual or regulator regarding an incident affecting School's Student Data without prior consultation with School, unless legally required to do so.
9.5 Costs. KinderPath will bear the reasonable and documented costs of notification and remediation to the extent the Security Incident arises from KinderPath's breach of this Agreement, its own negligence, or its failure to impose the obligations required by Section 7.2.
9.6 Statutory Timelines. Where Applicable Privacy Laws impose a shorter notification period than Section 9.1, that shorter period controls.
10. Parent and Data Subject Requests
10.1 Routing. Parents and guardians hold rights of access to and correction of their child's education records under Applicable Privacy Laws, exercised through School as the custodian of those records rather than directly against KinderPath. If KinderPath receives a request from a parent, guardian, eligible student, or other individual to access, correct, delete, or restrict the processing of Student Data, KinderPath will not respond substantively but will promptly refer the requester to School and notify School of the request.
10.2 Assistance. KinderPath will provide reasonable assistance to School, at no additional charge, to enable School to respond to such requests within the timeframes required by Applicable Privacy Laws, including by making Student Data available for review, correcting or deleting records at School's direction, and confirming completion. KinderPath will act on School's written instruction within ten (10) business days.
11. Data Retention
11.1 Retention Period. KinderPath will retain Student Data only for as long as necessary to provide the Services, and thereafter only as permitted under Sections 11.2 and 11.3 or as required by law.
11.2 Post-Termination Retention. The expiration or termination of the School Agreement, or the lapse, cancellation or non-payment of a subscription, does not itself delete Student Data and does not authorize KinderPath to delete it. After the School Agreement ends, KinderPath continues to hold School's Student Data, and School may continue to export it through the Services, until it is deleted under Section 12. Student Data is deleted only (a) on School's written request, or (b) on a closure carried out under Section 12, which may follow the dormancy process in Section 11.3. Every closure begins with a period during which School may retrieve its Student Data and before which no Student Data is deleted (the "Retrieval Period"). The Retrieval Period begins when the closure is approved and is ninety (90) days. It is not shorter than thirty (30) days unless School instructs KinderPath in writing to end it earlier after School has exported its Student Data or has waived the export in writing. KinderPath records that instruction, and, if KinderPath approves the request, the Retrieval Period ends no sooner than seventy-two (72) hours after approval.
11.3 Dormant Accounts. Where School's subscription has lapsed, been canceled, or expired without conversion, AND there has been no activity by School's own personnel in the account for six (6) consecutive months, KinderPath will flag the account for closure and notify School's Primary Administrator. Further notice is given at seven (7) and eight (8) months. The account becomes eligible for closure at nine (9) months from the last recorded activity. Eligibility does not itself delete anything: closure proceeds only through the reviewed workflow described in Section 12, which includes an export of School's Student Data before any deletion.
11.4 Activity and Reset. For the purposes of Section 11.3, activity means an action taken within the Services by School's own personnel. Actions initiated by KinderPath, scheduled processes, billing events, and automated communications do not constitute activity. Any qualifying activity, or resumption of a subscription, clears the flag and resets the period in full.
11.5 Undeliverable Notice. Where a notice under Section 11.3 is undeliverable, the account is held at its current stage and does not become eligible for closure until KinderPath has been able to give notice. KinderPath will not delete Student Data on the basis of dormancy without having notified School.
12. Return and Deletion of Student Data
12.1 Export. During the term and throughout the Retrieval Period, School may retrieve its Student Data through the export functionality of the Services, at no additional charge. The export is provided as an archive containing structured, machine-readable files covering students, enrollment history, assessments and skill checks, teacher notes, portfolio items and reflections, report data, classroom and instructional group structure, and School's staff roster, together with all evidence files in their original form and a manifest describing them. The archive is delivered by a signed link that expires twenty-four (24) hours after generation. No school closure may proceed under this Section 12 unless an export has been produced or School has recorded a written instruction waiving it.
12.2 Deletion. Upon written request from School, KinderPath will begin a closure under this Section 12, and upon expiration of the Retrieval Period of a closure so approved, KinderPath will delete School's Student Data from its active production systems within thirty (30) days, except to the extent retention is required by law or permitted under Section 12.5. Deletion of all of School's Student Data on closure is performed through a reviewed workflow in which the request and its approval are separated (the approval rule for deleting an individual student's records outside a closure is set out in Section 12.4), an inventory of the affected records is produced and reviewed before execution, each student record is deleted through KinderPath's governed per-student deletion process, evidence storage is swept and verified empty, and a set of reconciliation checks must return clean before the deletion is recorded as complete.
12.3 Backups. Student Data may persist in backup and disaster-recovery systems administered by KinderPath's infrastructure Subprocessor after deletion from active systems. KinderPath does not administer those backups. KinderPath will not restore deleted Student Data from backups except as part of a system-wide recovery event, and any Student Data so restored is re-deleted promptly. Deleted records expire with the backup rather than being individually excised; there is no process for purging an individual record from a backup. The infrastructure Subprocessor keeps daily database backups for seven (7) days. Deleted records may remain in database backups until they expire after seven (7) days. Files (photos, audio, documents) are not included in backups and are removed when deleted. KinderPath holds a student's birth month and year only; student dates of birth were previously stored with the day, and the day was removed from active systems when that change took effect. Backup copies made before then retain the exact date until they expire under the cycle above, and a data export delivered to School before then is School's own copy and still contains it.
12.4 Certification. On completion of a school closure, KinderPath issues a certificate of deletion generated from the deletion actually performed, and delivers it to School's Primary Administrator at the address held immediately before staff access is removed. KinderPath retains the certificate and can reproduce it on request thereafter, reprinted as issued and bearing its original issue date. The form of certification is attached as Schedule C. When an individual student's records are permanently deleted at School's request through the per-student deletion process (as distinct from the deletion of every student record in a school closure, which is covered by the closure certificate), KinderPath likewise issues a certificate of deletion on completion, notifies by email the Primary School Administrator who requested the deletion (the email carries the certificate in full and a link to download it as a PDF; the email and the certificate identify the student record by its identifier only, state what was deleted as counts of records and may identify another child's record by identifier where a file was kept because that child's records still refer to it, and contain no name, date of birth, written reason or educational content of the child), and makes the certificate available to School's administrators in the Services for as long as School's account exists; the certificate is then retained as described in Section 12.5. School's administrators may request, approve and carry out a per-student deletion themselves in the Services: where School has another active administrator, the administrator who requested it may not approve it; where School has only one, that administrator may. In either case the administrator carrying it out reviews an inventory of what will be removed and confirms the child by typing the child's full name and a fresh authenticator code, any of School's administrators may withdraw the request before it starts running, KinderPath is notified, and the certificate records which way the deletion was authorized. KinderPath may also carry out a per-student deletion at School's written request.
12.5 Retained Records. The following survive deletion of School's account and are retained as legal, financial or audit evidence, with School's identifying reference cleared and School's name preserved in text: audit log entries; School's agreement acceptances and authority affirmations; billing and subscription history; deletion requests and their approvals; the deletion record itself; records of any whole-school data export generated for School, not the exported data itself, which expires as described in Section 12.1; in-app feedback School submitted through the Services, which may include free text entered by School's personnel; and the record of School's initial trial signup. KinderPath also retains, for each deleted student, a content-free record of that student, from which name, date of birth and all other identifying detail have been removed, together with that student's own deletion record (and its individual certificate where one was issued: a student whose deletion was requested and approved individually receives one; a student deleted as part of a school closure is covered by the closure's certificate), as evidence that the deletion occurred. Where an evidence file is referenced by the records of more than one student, deletion of one student retains the file while another student's records still reference it; the retention and its reason are recorded on the deletion record and stated in the certificate.
13. Verification and Audit
13.1 Documentation. Upon School's reasonable written request, and no more than once per twelve (12) month period absent a Security Incident or a requirement of Applicable Privacy Laws, KinderPath will provide documentation reasonably sufficient to demonstrate compliance with this Agreement, which may include completed security questionnaires, summaries of security policies, architecture descriptions, and any then-current third-party assessment reports. KinderPath may satisfy an audit request by providing its security overview and its providers' security reports.
13.2 On-Site Audit. The Parties agree that the documentation described in Section 13.1 will ordinarily satisfy School's verification needs in lieu of an on-site audit. Where Applicable Privacy Laws grant School a non-waivable right of on-site inspection, KinderPath will accommodate that right upon thirty (30) days' written notice, during normal business hours, no more than once annually absent a Security Incident, subject to reasonable confidentiality and safety requirements, and at School's expense.
13.3 Confidentiality. Information disclosed under this Section 13 is KinderPath's confidential information and may be used by School solely to verify compliance with this Agreement.
14. School Personnel Data
KinderPath processes School Personnel Data to authenticate users, administer accounts and permissions, deliver transactional communications, provide support, and secure the Services. The protections in Sections 4, 7, 8, 9, and 12 apply to School Personnel Data as they apply to Student Data, except that KinderPath may contact School Personnel directly regarding account, billing, security, and service matters.
15. State-Specific Requirements
15.1 Compliance. KinderPath will comply with the student data privacy laws of the state in which School is located to the extent those laws impose obligations on KinderPath as a service provider, operator, or contractor.
15.2 State Exhibits. Where Applicable Privacy Laws require specific contractual provisions, those provisions are set out in a state-specific exhibit attached to this Agreement and incorporated by reference. In the event of a conflict between such an exhibit and the body of this Agreement, the exhibit controls with respect to School.
16. Reserved
This section is intentionally left blank, so that the numbering of the sections that follow does not change.
17. Liability
17.1 Cap. Each Party's total aggregate liability arising out of or related to this Agreement, including liability for a Security Incident affecting Student Data, is limited to the amounts paid by School to KinderPath in the twelve (12) months preceding the event giving rise to the claim. This limitation states the rule for both this Agreement and the School Agreement, and is not subject to a separate or differing limitation in the School Agreement.
17.2 No Separate Carve-Out. As of the Effective Date, KinderPath does not maintain cyber liability or technology errors and omissions insurance, and no separate or higher cap applies to liability for a Security Incident affecting Student Data. KinderPath states this plainly rather than agreeing to a limit it could not meet.
17.3 Indemnification. Indemnification with respect to Student Data is addressed in Section 14 of the School Agreement.
17.4 Negotiated Agreements. Where School and KinderPath enter into a separately negotiated written agreement signed by both Parties that addresses liability for Student Data, that agreement controls over this Section 17. KinderPath expects to procure cyber liability and technology errors and omissions coverage before entering into agreements with school districts and other public entities, and the limitation in Section 17.1 is open to negotiation at that point.
18. General Provisions
18.1 Order of Precedence. In the event of a conflict between this Agreement and the School Agreement with respect to the processing of Student Data, this Agreement controls. In all other respects the School Agreement remains in full force and effect.
18.2 Term. This Agreement takes effect on the Effective Date and continues for so long as KinderPath processes Student Data on School's behalf. Sections 4, 9, 12, 13, 17, and 18 survive termination.
18.3 Governing Law. This Agreement is governed by the laws of the State of Georgia, without regard to its conflict of laws principles. Where School is a public entity prohibited by law from agreeing to the governing law of another state, the law of School's state controls.
18.4 Notices. Notices under this Agreement will be given in writing to School's administrator email address on file for its KinderPath Pro account, or as otherwise designated in the School Agreement. Notices to KinderPath regarding privacy matters may be sent to privacy@mykinderpath.com and regarding security matters to security@mykinderpath.com.
18.5 Amendment. This Agreement may be amended only by a written instrument signed by both Parties, except that KinderPath may update Schedule D in accordance with Section 7.4.
18.6 Severability. If any provision of this Agreement is held unenforceable, the remaining provisions remain in full force and effect.
18.7 Counterparts. This Agreement may be executed in counterparts and by electronic signature, each of which is an original and all of which together constitute one instrument.
Schedule A — Description of Processing
A.1 Subject Matter, Nature, and Purpose
KinderPath processes Student Data to deliver the KinderPath Pro platform, which enables School's educators to record developmental and school readiness assessments, document classroom observations and learning evidence, organize small-group instruction, monitor skill progress over time, and generate reports for educators, administrators, and families.
A.2 Duration
For the term of the School Agreement, plus the Retrieval Period under Section 11.2 and the deletion window under Section 12.2.
A.3 Categories of Data Subjects
| Category | Description |
|---|---|
| Students | Children enrolled in School's early learning programs, generally ages three (3) to five (5) |
| Educators | Teachers and instructional staff authorized by School |
| Administrators | School and program administrators authorized by School |
| Billing contacts | Adults responsible for subscription and licensing administration |
A.4 Categories of Student Data
| Category | Data Elements |
|---|---|
| Identifiers | Student name; birth month and year where collected (the day is not held); student identification number assigned by School |
| Enrollment | School, program, and classroom assignment |
| Assessment | School readiness assessment results; domain- and skill-level proficiency ratings; quick skill check results; assessment history including date, assessor, and assessment type |
| Instructional | Instructional profile of strengths and needs; small-group membership and focus skill |
| Narrative | Teacher observations, notes, and reflections |
| Evidence | Photographs, audio recordings, and files uploaded by educators as documentation of learning |
| Derived | Progress and growth information generated by the Services; reports and portfolio compilations |
A.5 Categories of School Personnel Data
Name; work email address; account role; classroom assignment; authentication and session information; subscription and licensing information.
A.6 Technical Data
Device and browser information; log data; authentication and session records; error and diagnostic information; security event records. Technical data is processed to operate, secure, and troubleshoot the Services.
A.7 Access Model
| Role | Scope of Access |
|---|---|
| Teacher | Students and classrooms to which the teacher is assigned by School |
| School Administrator | All classrooms, students, staff, and reporting within the administrator's authorized school |
| KinderPath platform administration | Access on a need-to-know basis for support, security, and system administration only |
Schedule B — Technical and Organizational Security Measures
The measures below describe KinderPath's security posture as of the Effective Date.
| Control | Description | Status |
|---|---|---|
| Encryption in transit | All application traffic is transmitted over HTTPS/TLS. | Implemented |
| Encryption at rest | Stored data, including backup copies, is encrypted at rest using AES-256, with encryption keys protected by FIPS 140-2 compliant hardware security modules. | Implemented — contractually committed in the infrastructure provider's data processing agreement |
| Authentication | User authentication is managed through the platform's managed authentication service. Accounts are created and administered by adults; children do not hold accounts. | Implemented |
| Multi-factor authentication | Required for all KinderPath administrative accounts and all School Administrator accounts. TOTP only; phone and SMS factors are refused at the authentication service. Enforced in server-side middleware and at the database through row-level security on administrative access to Student Data. Available to all users, and a School may require it of its own staff. | Implemented |
| Access control | Role-based access control restricts users to the students, classrooms, and schools they are authorized for. | Implemented |
| Internal access | KinderPath platform administration access to Student Data is limited to support, security, and system administration purposes. Administrative overrides and authentication resets are recorded in the audit log described under Logging and monitoring. | Implemented |
| Database | Managed PostgreSQL infrastructure operated by KinderPath's infrastructure Subprocessor. | Implemented |
| Backups | Daily database backups, encrypted in transit and at rest, kept by the infrastructure provider for seven (7) days and stored on a system independent of the production project. Point-in-time recovery is available as a paid add-on and is not presently purchased. Deleted records may remain in database backups until they expire after seven (7) days. Files (photos, audio, documents) are not included in backups and are removed when deleted. | Implemented |
| Logging and monitoring | Errors reported by the application and its server are recorded in an error log that is deleted automatically after 90 days. KinderPath's platform operator is emailed a digest of new kinds of errors, at most once an hour, and is emailed when a message fails to send, when a closed school is waiting for deletion, and when billing records disagree with the payment processor. Significant actions (deletions, authentication resets, administrative overrides, school closure steps and billing changes) are recorded in an audit log. School administrators can read their own school's entries but cannot change them; only KinderPath's platform operator can change the audit log, and audit log entries are not deleted automatically. Authentication reset records are append-only: the database refuses to change or delete them. The hosting and database providers keep their own logs under their own retention periods. | Implemented |
| Authentication rate limiting | Repeated incorrect authenticator codes are limited by KinderPath: five consecutive failures pause further attempts for fifteen minutes, applied to sign-in and to both administrator-assisted reset paths, and enforced server-side. | Implemented |
| Account recovery | A locked-out staff member is reset by their School's Primary Administrator, who must hold an authenticator themselves, or by KinderPath. Every reset requires a fresh authenticator code, a documented identity verification, and notifies the affected user. Reset records are immutable. | Implemented |
| Incident response | Written incident response procedure maintained by KinderPath. | Implemented |
| Personnel access and training | Access to Student Data is limited to authorized personnel who need it to provide the service. Authorized personnel complete KinderPath's Security Training Program annually. | Implemented |
| Vulnerability management | KinderPath does not run an automated vulnerability scanner. Software dependencies are pinned by a lockfile. Before code is pushed for release, an automated check runs the package manager's security audit and stops the push on any high or critical finding in a dependency that ships to production; findings in development-only tools are reported and tracked separately. Every change is also checked by an automated test suite and a production build before release. The hosting and database providers apply their own platform patches. | Implemented as described; no automated scanner |
| Independent assessment | KinderPath has not yet completed its own third-party certification or penetration test. Its hosting, database, email, payment and AI providers each hold independent security certifications (available on request). | Not yet completed |
| Payment data | Payment card processing is performed by Stripe. KinderPath does not store complete payment card numbers. | Implemented |
Schedule C — Certificate of Data Deletion
Issued under Section 12.4. The certificate is generated from the deletion actually performed and is delivered to School's Primary Administrator on completion. The content below reflects the form in use.
KinderPath LLC certifies to ____________________________________ ("School"), reference ______________, that:
1. Pursuant to Section 12 of the Data Processing Addendum between the Parties, KinderPath has deleted School's Student Data from its active production systems. Deletion was completed on ______________ and this certificate was issued on ______________.
2. The deletion was performed through KinderPath's reviewed closure workflow. The request and its approval were separated, an inventory was produced and reviewed before execution, and the deletion was verified on completion.
3. The following were deleted:
- student records, each through KinderPath's governed per-student deletion process: ______
- assessment records and skill checks: ______
- enrollment records: ______
- evidence files, with the school's evidence storage swept and verified empty: ______
- staff memberships unlinked: ______. No staff account was deleted.
- the school account itself.
4. The following reconciliation checks were performed on completion and returned clean: no school record remains; no record anywhere references the school; every student in scope was reduced to a content-free record; no staff membership, family link or legacy photograph record remains; and the school's evidence storage is empty.
5. The following were retained, with School's identifying reference cleared and School's name preserved in text, as legal, financial or audit evidence: audit log entries; agreement acceptances and authority affirmations; billing and subscription history; the closure request and its approval; records of any whole-school data export generated for School, not the exported data itself, which expires as described in Section 12.1; in-app feedback School submitted through the Services, which may include free text entered by School's personnel; the record of School's initial trial signup, if any; and, for each deleted student, a content-free record of that student together with that student's own deletion record (and its individual certificate where one was issued), each with name, date of birth and all other identifying detail removed, retained as evidence that the deletion occurred.
6. Evidence files retained because the records of another student still reference them: ______. The reason for each retention is recorded on the deletion record.
7. Before deletion, School's Student Data was made available to School as a data export produced on ______________ (completed only if an export was produced), or School recorded a written instruction waiving the export on ______________ (completed only if the export was waived).
8. Residual copies of Student Data may remain in database backups until they expire, no later than seven (7) days after the deletion date. KinderPath does not administer those backups. No copy is restored except as part of a system-wide recovery event, and any copy so restored is re-deleted promptly. Files (photos, audio, documents) are not included in backups and are removed when deleted.
Schedule D — Subprocessors
This Schedule identifies the third parties that may process Student Data or School Personnel Data in connection with the Services. Changes are governed by Section 7.4.
D.1 Subprocessors
| Subprocessor | Function | Where data is stored and processed | Data processed |
|---|---|---|---|
| Supabase Pte. Ltd 65 Chulia Street, Singapore | Database, authentication and file storage | Stored in US East (N. Virginia), selected by KinderPath. The provider's agreement commits it to store and primarily process that data in the selected region. | All Student Data at rest, including assessment records, teacher observations, and uploaded photographs and audio recordings; School Personnel Data |
| Render Services, Inc. San Francisco, California | Application hosting | Hosted in US East (Virginia), selected by KinderPath | Student Data and School Personnel Data in transit. No Student Data is stored |
| Anthropic PBC San Francisco, California | Generation of narrative summaries and instructional suggestions | Stored in the United States, per the provider. Requests that contain Student Data are processed in the United States: KinderPath sets the provider's United States setting on each such request. The provider may access content from other countries for safety, support or incident response. | Minimized developmental and instructional content only, as described in Section 6. The names of children and staff on record at the school are removed before text is sent; no school or classroom identifiers, no media, no record identifiers. Deleted by the provider within thirty (30) days of receipt, except content the provider identifies as violating its usage policy, and content it is required by law to keep, which it may keep longer under its published terms. Not used to train its models. |
| Resend transactional email | Delivery of account, billing, security and notice emails, and authentication emails | Stored in the United States (North Virginia, us-east-1). Primary processing in the United States, per the provider's addendum, which also permits transfers elsewhere. | School Personnel Data: name and email address. No Student Data |
| Stripe, Inc. | Payment and subscription processing | Processed globally, per the provider's addendum: in the United States and in other countries | Billing contact and payment information. No Student Data |
D.2 Notes
1. Website analytics and tracking. KinderPath does not use third-party website analytics, advertising, or behavioral-tracking services on its public website or within the authenticated KinderPath Pro application, and no analytics or advertising provider receives Student Data or any information about a visit to either. KinderPath keeps its own count of how many times each public page of its website is opened: for each page and day, the number of views, the domain name of the referring website, and an optional reference code from the link followed. The count is kept in KinderPath's own database, holds no IP address, device or browser details, cookie, or other identifier, contains no Student Data or School Personnel Data, is not collected inside the authenticated application, and is deleted automatically once it is more than twenty-four (24) months old. KinderPath also keeps, for each day and reference code, the number of free trials started after a link with that code. That count holds only the day, the code, and a number, is kept in KinderPath's own database, is not linked to any person, School, or account, and is deleted automatically once it is more than twenty-four (24) months old. The visitor's own browser keeps the code, and nothing else about the link, for up to seven (7) days or until the trial starts, whichever is first, and the code is never saved to the School's account. KinderPath's pages are served with their fonts and scripts from KinderPath's own hosting. KinderPath sets no cookies of its own; its use of browser storage is limited to maintaining a signed-in session, remembering display preferences, and remembering a reference code (for up to seven (7) days, removed when a free trial starts) or a special pricing offer (for up to thirty (30) days, removed when the School's account is created) from a link the visitor followed. Where a School Administrator opens a payment screen, the payment processor listed in D.1 loads its own script and sets its own cookies for fraud prevention; no Student Data is provided to it.
2. AI features. The KinderPath Pro features that submit content for AI processing are: skill narratives, domain narratives, growth narratives, learning and development narratives, school readiness narratives, quick skill check narratives, small group narratives, classroom growth narratives, school-level readiness narratives, portfolio narratives, and instructional resource suggestions.
3. Infrastructure subprocessors. KinderPath's infrastructure provider engages its own subprocessors in support of the hosted database, authentication and storage services, and publishes a current list. KinderPath subscribes to change notifications from that list and requires every subprocessor to be bound by data protection obligations at least as protective as this Agreement. KinderPath does not guarantee the operations or work of those parties.
4. Subprocessor changes. KinderPath will send notice by email to the administrator email address on file for School's KinderPath Pro account before adding or replacing any Subprocessor that will process Student Data, and will provide an updated Schedule D. The notice period is at least thirty (30) days for a Subprocessor that stores Student Data at rest, and at least ten (10) days for any other Subprocessor, in accordance with Section 7.4. School may object in accordance with Section 7.5.
5. Infrastructure provider contracting entity. KinderPath contracts with its infrastructure provider, Supabase, through Supabase Pte. Ltd. (Singapore). KinderPath's data is stored in the United States, in the US East (N. Virginia) region KinderPath selected.