Skip to main content

Data privacy agreements

Growing Standard is ready to sign Student Data Privacy Agreements with districts. Here's what we support, expected turnaround times, and what to expect from the process.

Agreements we support

SDPC Universal DPA
3 days
Student Data Privacy Consortium's standard national DPA. Fastest path — usually signed within 3 business days.
State DPAs
5 days
CA, NY, CO, IL, TX, MA, NJ, WA, CT state-specific DPAs. Based on SDPC or state-issued templates.
District DPAs
10 days
District-drafted DPAs. We redline, counter-propose, and work with your counsel. Expect 1–2 rounds.
Clever Universal DSA
In progress
Clever's Data Sharing Agreement governs roster import from Clever districts. Signed upon Clever Library certification.

What a standard Growing Standard DPA includes

Purpose
K-12 math + reading instruction, assessment, and teacher reporting
Data elements
First name (or display name), grade, school/class, roster ID, learning progress, assessment results
Not collected
Home address, phone, DOB, SSN, biometric data, health data
Subprocessors
Google Cloud (Firebase Auth + Firestore), Cloudflare (Workers — SSO token exchange only), Vercel (static hosting), Clever (optional SSO)
Data retention
Learning data active through contract term + 90 days, then exported and deleted on district request.
Data export
CSV/JSON export within 14 days of written request
Data deletion
Complete PII deletion within 30 days of written termination notice
Breach notification
Written notice within 72 hours of discovery
Audit rights
Annual SOC 2 attestation available; on-site audit on reasonable notice
No secondary use
No advertising, no selling, no AI training on student data

How to start a DPA review

  1. Email privacy@potatoclass.com with your district name, state, and preferred DPA (SDPC, state, or district template).
  2. Attach the template you want us to review, or let us send our standard SDPC-based DPA.
  3. We return a signed copy or a redlined counter-proposal within the SLA above.
  4. After signing, we exchange the DPA with your procurement/legal team and move to contract.

What we typically redline

We expect to sign most district DPAs as-written. Common clauses we may ask to adjust:

  • Liability caps: we accept caps at 2x annual contract value (industry standard)
  • Audit scope: we offer SOC 2 report in lieu of on-site audit where possible
  • Indemnification: mutual indemnity rather than one-way
  • Data export format: we provide CSV/JSON; proprietary district formats may need scoping

Start a review

Send your DPA template (or request ours) to privacy@potatoclass.com. We reply within 1 business day with next steps.