Student Data Protection Addendum

Version 1.4, October 31, 2026. Template: it takes effect on the date the Order Form is signed.

This Student Data Protection Addendum (the "DPA") forms part of the School Services Agreement between [Owner's full legal name], carrying on business as Writeroom, an individual whose notice address is the [Writeroom notice address] stated in the Order Form ("Writeroom", "we", "us"), and the School named in the Order Form (the "School"). It sets out how Writeroom handles personal information when it provides the Service to the School. If this DPA conflicts with the School Services Agreement or the Terms of Use on any matter concerning personal information, this DPA prevails. An Order Form prevails over this DPA only where it expressly names the clause of this DPA that it varies.

1. Definitions and interpretation

1.1 Capitalised terms have the meanings given in the School Services Agreement (the "SSA") unless defined here. In particular, "Writeroom", "School", "Authorized User", "Service", "Customer Data", "Student Data", "Integrity Signals", "Order Form", "Agreement", "Documentation", "Subprocessor", "Export Window", "End of the Agreement", "Professional Services Rate" and "Data Protection Claims" have the meanings given in SSA clauses 1.1, 10.2 and 16.3, and are used in the same sense in every Writeroom document.

1.2 The following definitions apply to this DPA:

• "Applicable Privacy Law": every law that governs the handling of Personal Information under this DPA, including, as applicable to the School, the Municipal Freedom of Information and Protection of Privacy Act (Ontario), the Education Act (Ontario) and regulations made under the Enhancing Digital Security and Trust Act, 2024 (Ontario), the Act respecting Access to documents held by public bodies and the Protection of personal information (Quebec), the Freedom of Information and Protection of Privacy Act (British Columbia), the Protection of Privacy Act (Alberta), the public sector privacy law of any other province or territory where the School is located and, as applicable to Writeroom, the Personal Information Protection and Electronic Documents Act (Canada) and any successor, and, for a School located in the United States, the laws listed in Schedule US.
• "Personal Information": information about an identifiable individual, in any form, that is part of Customer Data. It includes Student Data and information about teachers and administrators.
• "Process" or "Processing": any operation performed on Personal Information, including collection, recording, storage, use, analysis, disclosure, transfer, return and deletion.
• "Instructions": the School's documented directions to Writeroom on Processing, which consist of the Agreement, the settings and actions the School's administrators and teachers choose within the Service, and written directions given under clause 2.4.
• "Security Incident": a confirmed breach of Writeroom's security safeguards that results in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or unauthorized access to, Personal Information in the custody of Writeroom or a Subprocessor. It does not include unsuccessful attempts or events that do not compromise Personal Information, such as blocked connection attempts, port scans or failed sign-ins.
• "De-identified Data": data derived from Customer Data from which all direct identifiers have been removed and that cannot reasonably be used, alone or in combination with other information reasonably available to Writeroom, to identify an individual, a School or an Authorized User.
• "Data Subject Request": a request by an individual, or a parent or guardian acting for a student, to access, correct, or delete Personal Information, or to exercise another right under Applicable Privacy Law.
• "School Privacy Contact": the person the School names in the Order Form (section 2) to receive notices under this DPA, including Security Incident notices.
• "Platform Administrator": Writeroom personnel with administrative access to the production Service.

1.3 "Including" means including without limitation. Headings are for convenience only. References to days are calendar days unless business days are stated.

2. Roles, authority and Instructions

2.1 Roles. The School determines the purposes for which Personal Information is Processed through the Service and has custody or control of it under Applicable Privacy Law. Writeroom is the School's service provider and Processes Personal Information only on the School's behalf and in accordance with the Instructions. Nothing in this DPA transfers ownership of Customer Data to Writeroom. As between the parties, Customer Data belongs to the School and, where Applicable Privacy Law so provides, to the students and their parents or guardians.

2.2 Authority. The School represents that it has the legal authority under Applicable Privacy Law to collect the Personal Information described in Annex 1, to disclose it to Writeroom for the purposes in Annex 1, and to instruct Writeroom as this DPA permits. Writeroom relies on this representation and does not independently assess the School's authority.

2.3 Notices and consents are the School's responsibility. The School is responsible for giving every notice and obtaining every consent or authorization that Applicable Privacy Law requires before Authorized Users use the Service, including notices to parents, guardians and students. Writeroom provides the Student Privacy Notice, the Privacy Policy, this DPA and the information in Annex 1 to help the School prepare those notices (see clause 9.4). The School decides whether and how to use them.

2.4 Instructions. Writeroom will Process Personal Information only (a) to provide, maintain, secure and support the Service as described in the Documentation, (b) as the School's administrators and teachers direct through the Service's settings and features, (c) as the School Privacy Contact directs in writing, and (d) as Applicable Privacy Law requires of Writeroom. If Writeroom believes an Instruction would breach Applicable Privacy Law, it will tell the School promptly and may suspend the affected Processing until the matter is resolved. Writeroom is not obliged to provide legal advice.

2.5 Settings are Instructions. Several features of the Service collect more Personal Information or send Personal Information to third parties only while they are on. External AI features (AI marking, Translate, Dictionary and the teacher assistant), the outside-clipboard check and the sharing of integrity decisions between teachers are on when a School starts; a School administrator can turn each off, and on again, at any time. External AI is covered by the School's Agreement: the Order Form records whether the School may use external AI, and if it may not, Writeroom locks it off. Screen supervision rules are set per assignment. The Service shows what each feature collects or sends, to whom and where, and records who changed a setting and when. Leaving a feature on, or turning it on, is an Instruction from the School to Process Personal Information in that way.

2.6 Teacher actions are the School's actions. Teachers and administrators act for the School when they create assignments, set rules, review writing records, make decisions about student work, download or copy information from the Service, or share information outside the Service. Writeroom is not responsible for how the School and its staff use the Service's outputs.

3. Purpose limitation and prohibited uses

3.1 Writeroom will Process Personal Information only for the purposes in Annex 1 and will not Process it for any other purpose.

3.2 Writeroom will not:

(a) sell, rent or trade Personal Information;

(b) use Personal Information for advertising, marketing to students, or building marketing profiles of any Authorized User;

(c) use Personal Information, including student writing and writing-process records, to train, fine-tune or improve any artificial intelligence or machine-learning model, whether Writeroom's own or a third party's, in identifiable or de-identified form;

(d) permit any Subprocessor to do so (see clause 7.3);

(e) combine Personal Information with information from other sources except as needed to provide the Service to the School;

(f) use Personal Information to make any decision about a student, including a grade, a finding of academic dishonesty or a sanction (see clause 13);

(g) disclose Personal Information to any third party except Subprocessors under clause 6, as the School directs, or as clause 9.6 permits; or

(h) use Personal Information to contact students, parents or guardians, except for Service messages that the School's use of the Service requires (for example, an email verification or a password reset the person requested).

3.3 Writeroom may create and use De-identified Data only as clause 12 permits.

4. Confidentiality and access by Writeroom personnel

4.1 Writeroom will limit access to Personal Information to personnel who need it to provide, support or secure the Service. Every such person is bound by a written confidentiality obligation that survives the end of their engagement and has received training on the handling of student information appropriate to their role.

4.2 No routine access to student work. Platform Administrators cannot open a student's documents, writing records, screen clips or Integrity Signals in the production Service by default. A School administrator may grant Writeroom time-limited support access (for example 24 hours) from the School's audit page. Every view during that period is written to the School's audit log. Writeroom does not sign in as, or impersonate, any Authorized User.

4.3 Writeroom will not disclose Personal Information to its personnel's personal devices or accounts, and will handle any Personal Information it receives through support channels (for example a screenshot a teacher sends) with the same protections as this DPA requires.

5. Security

5.1 Writeroom will implement and maintain the technical and organizational measures described in Annex 2, and will not reduce the overall level of protection they provide during the term of the Agreement. Writeroom may update Annex 2 as technology changes, provided the updated measures are at least as protective.

5.2 The measures in Annex 2 are designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, having regard to the sensitivity of student information. No set of measures can guarantee security. Writeroom's obligations are to maintain the measures described, to respond to Security Incidents as clause 8 requires, and to remedy its breaches of this DPA.

5.3 The School is responsible for the security of its own systems, networks and devices, for its Authorized Users' credentials, for the access rights it grants within the Service, and for information its staff download, copy or share outside the Service.

6. Subprocessors

6.1 The School authorizes Writeroom to engage the Subprocessors listed in Annex 3 (also published at writeroom.org/subprocessors) for the purposes stated there.

6.2 Before a new Subprocessor Processes Personal Information, or an existing Subprocessor's role materially changes, Writeroom will update the published list and give the School Privacy Contact at least 30 days' written notice by email. Writeroom will give shorter notice only where a change is urgently needed to protect the security or availability of the Service, in which case it will explain why.

6.3 The School may object to a new Subprocessor on reasonable grounds relating to the protection of Personal Information by writing to the Writeroom contact email stated in the Order Form within the notice period. The parties will discuss the objection in good faith. If Writeroom cannot resolve the objection within 30 days (for example by offering a configuration that avoids the Subprocessor), the School may terminate the affected Order Form on written notice and Writeroom will refund any prepaid fees for the period after termination. This is the School's sole remedy for an objection.

6.4 Writeroom will engage every Subprocessor with which it contracts directly under a written agreement that imposes data protection obligations no less protective of Personal Information than those in this DPA, so far as they apply to the services the Subprocessor provides. Writeroom remains responsible to the School for the acts and omissions of its Subprocessors as if they were its own, subject to clause 15.2(g).

6.5 Model vendors that receive student text under the School's external AI setting are Subprocessors engaged through OpenRouter, not under a direct contract with Writeroom. Writeroom's protections for them are the request settings in clause 7.3, which allow routing only to endpoints the vendor has designated to OpenRouter as zero data retention and no training, OpenRouter's own agreements with those vendors, and the allowlist. Writeroom will list each vendor by name in Annex 3.

7. Data location and transfers

7.1 Stored in Canada. Writeroom stores Customer Data, including all student writing, writing-process records, files, screen clips, the database and backups, in Google Cloud facilities in the Toronto region (northamerica-northeast2), Canada. Cloud Logging for the production Service uses a log bucket in the Toronto region.

7.2 Processed outside Canada. The following Processing involves Personal Information outside Canada. Each item is either necessary to provide the Service as described in the Documentation or occurs only when the School turns the feature on:

(a) Sign-in. Firebase Authentication (Google LLC) holds account records (name, email address, Google account identifier where Google sign-in is used, hashed password where email sign-in is used, and sign-in timestamps) in the United States. This is necessary to provide the Service.

(b) Account emails. Firebase Authentication (Google LLC, United States) sends the Service's account emails: email verification, password reset and sign-in emails. They contain only the recipient's email address, a link and the Writeroom name, and never student writing, grades, Integrity Signals or analytics. The Service sends no other email: invitations are shared as links by a School administrator, and alerts and contact-form messages appear inside the Service only. If Writeroom later uses an email delivery service, it will be added to Annex 3 with notice under clause 6.2.

(c) External AI features. While external AI is on for the School (it is on when a School starts, unless the Order Form says the School may not use it; a School administrator can turn it off), text is sent to OpenRouter, Inc. (United States) and through it to the model vendor that serves the request, as described in Annex 1 Part C. The Service shows the School's administrators these destinations in Settings.

(d) Website delivery. The public website writeroom.org is served by Firebase Hosting, a global content delivery network. The website does not hold Customer Data. Contact-form submissions are stored in Toronto.

(e) Spam protection. The contact form on the public website is protected by checks on Writeroom's own server only (a hidden field, a minimum fill time and rate limits). No third-party spam service is used.

7.3 Conditions for external AI. Writeroom will: (a) send every request to OpenRouter with the provider settings data_collection: "deny" and zdr: true (zero data retention) so that requests are routed only to endpoints that do not retain or train on request content; (b) offer teachers only the models on an allowlist that Platform Administrators maintain and that contains only models served under those conditions; (c) not include any user identifier in requests; (d) replace student names with placeholders such as "Student 1" in requests from the teacher assistant and never send student email addresses to a model vendor; and (e) fail the request with a plain message, rather than fall back to a non-compliant provider, if no compliant endpoint is available. Writeroom does not control the model vendors' independent legal obligations, such as responding to a lawful demand of their own government.

7.4 Foreign law. Writeroom's hosting provider, Google Cloud, is operated by Google LLC, a company incorporated in the United States, and its Canadian affiliate. Information held by a provider that is subject to the laws of another country may, in some circumstances, be accessible to the authorities of that country under those laws, even where the information is stored in Canada. Writeroom will handle any such demand as clause 9.6 requires.

7.5 School decisions on transfers. The School confirms that it has considered the Processing in clause 7.2 under its Applicable Privacy Law (for example, under British Columbia FIPPA section 33.1 and its regulation, Nova Scotia's Personal Information International Disclosure Protection Act, or Quebec's requirement for a privacy impact assessment before information is communicated outside Quebec) and that this Processing is permitted for the School. Writeroom will provide the information the School reasonably needs for that assessment (clause 9.3). Where the School's Applicable Privacy Law does not permit one of the optional transfers in clause 7.2(c), the School must keep the external AI setting off.

7.6 Writeroom will not move Customer Data to a storage location outside Canada without the School's prior written consent, and will not add a new category of Processing outside Canada without following the notice and objection process in clause 6.

8. Security Incidents

8.1 Notice to the School. Writeroom will notify the School Privacy Contact of a Security Incident affecting the School's Personal Information without undue delay, and in any event within 48 hours after Writeroom confirms the Security Incident, so that a School that must itself report within 72 hours (for example an Ontario school board under Ontario Regulation 51/26) has time to do so. Writeroom may give an initial notice that is incomplete and will supplement it as information becomes available. "Confirms" means the point at which Writeroom has reasonable grounds to conclude that a Security Incident has occurred, after the preliminary checks needed to rule out a false alarm.

8.2 Content of notice. Each notice will describe, to the extent known at the time: (a) the nature of the Security Incident and when it occurred and was discovered; (b) the categories of Personal Information and the approximate number of records and individuals affected, including whether students are affected; (c) the likely consequences; (d) the measures Writeroom has taken or proposes to take to contain the incident and reduce its effects; and (e) a contact point at Writeroom. Writeroom will provide a written final report within 30 days after containment, or explain why more time is needed.

8.3 What Writeroom does. Writeroom will contain the Security Incident, preserve relevant logs and evidence, investigate its cause, take reasonable steps to prevent a recurrence, keep the School informed of material developments, and co-operate with the School's own investigation and with any regulator the School must report to. Writeroom will keep a record of every Security Incident, whether or not it is reportable, for at least 24 months.

8.4 What the School does. The School is responsible for deciding whether the Security Incident must be reported to a privacy commissioner, a ministry or another authority, and whether affected individuals must be notified, and for making those reports and notifications, because those duties rest with the body that has custody or control of the information. Writeroom will give the School the information it reasonably needs for those decisions and notifications, including draft facts for a notice if asked.

8.5 Writeroom does not notify the School's users directly. Writeroom will not notify the School's Authorized Users, parents, guardians, regulators or the public about a Security Incident affecting the School's Personal Information unless (a) the School asks it to in writing, or (b) Applicable Privacy Law imposes a direct notification duty on Writeroom, in which case Writeroom will tell the School before giving the notice where the law allows, and will co-ordinate its content with the School where time permits.

8.6 Costs. Where a Security Incident was caused by Writeroom's breach of this DPA, Writeroom will reimburse the School's reasonable and documented out-of-pocket costs of (a) notifying affected individuals as Applicable Privacy Law requires, and (b) credit or identity monitoring where Applicable Privacy Law requires it or a privacy commissioner directs it. This reimbursement is a Data Protection Claim and is subject to clause 15 and to the cap in SSA clause 16.3. Writeroom has no obligation to reimburse costs of a Security Incident caused by the School, its Authorized Users, their credentials or devices, or by information the School's staff took outside the Service.

8.7 No admission. A notice under this clause is not an admission of fault or liability.

9. Assistance to the School

9.1 Data Subject Requests. Because the School has custody or control of the Personal Information, Data Subject Requests from students, parents, guardians, teachers or administrators are the School's to decide and answer. If Writeroom receives a Data Subject Request about the School's Personal Information, it will forward it to the School Privacy Contact within 5 business days and will not respond on the substance except to say that the request has been passed to the School, unless Applicable Privacy Law requires otherwise.

9.2 Tools and help. The Service gives School administrators self-service tools to export one student's data (including the student's documents, writing-process record, Integrity Signals with the evidence behind them, integrity decisions and notes, and any screen clips still retained), delete one student's data, export the whole School's data, and view the audit log of who accessed a student's records. These tools are how the School answers a student's or parent's request for access, correction, deletion, or a review of a decision. Where those tools do not meet a request, Writeroom will provide reasonable assistance within 10 business days of a written request from the School Privacy Contact, or faster where the School's statutory deadline requires it and the School has given Writeroom reasonable notice. Writeroom corrects Personal Information only as the School directs; teachers and administrators can correct most information directly within the Service.

9.3 Privacy impact assessments. Writeroom will provide the School with the information it reasonably needs to complete a privacy impact assessment, threat and risk assessment or similar review of the Service required by Applicable Privacy Law, including the Security Overview, this DPA and its Annexes, the Subprocessor list and written answers to reasonable questions. This assistance is included at no charge for up to [eight] hours in each 12-month period (which Writeroom expects to cover one standard security and privacy questionnaire), as SSA clause 4.3 provides, and beyond that at the Professional Services Rate stated in the Order Form.

9.4 Information for the School's notices. Annex 1 lists the Personal Information Writeroom receives, the purposes and the vendors involved, in a form intended to support the notices the School must give under Applicable Privacy Law, for example notices to parents and to students aged 16 and 17 under Ontario Regulation 52/26, and the School's software inventory. On request Writeroom will provide a one-page summary of Annex 1 for that purpose. Writeroom will keep Annex 1 current and will tell the School Privacy Contact of material changes under clause 6.2.

9.5 Transparency documents. Writeroom will make its Privacy Policy, Student Privacy Notice, Security Overview and Subprocessor list publicly available on writeroom.org and will keep a link to the Student Privacy Notice in the student editor menu.

9.6 Compelled disclosure. If Writeroom or a Subprocessor receives a subpoena, warrant, court order or other legally binding demand for the School's Personal Information from a court, government or law enforcement body, Writeroom will (a) tell the School Privacy Contact promptly and before disclosing, unless legally prohibited from doing so; (b) disclose only the minimum the demand lawfully requires; (c) where reasonable, ask the requesting body to seek the information from the School instead; and (d) co-operate with the School if the School chooses to challenge the demand at its own cost. Writeroom will not voluntarily disclose Personal Information to a government body.

9.7 Regulators. Writeroom will co-operate with a privacy commissioner's review or investigation concerning the School's Personal Information to the extent Applicable Privacy Law requires and will tell the School of any such contact unless prohibited.

10. Retention, return and deletion

10.1 Retention defaults. The Service applies the following default retention periods, which the School may shorten or lengthen in its settings, subject to any minimum the School's Applicable Privacy Law requires of the School:

(a) writing-process records (edit steps, events, keystroke records, pastes, copies, focus changes, extension reports) and the Integrity Signals computed from them: 12 months after the document was last edited;

(b) screen clips, stills and the text read from them: 30 days after capture;

(c) documents, comments, grades, feedback, teacher decisions, honesty scores with their history, and marking reports: until the School deletes them or the Agreement ends.

Deleted records are removed from live systems promptly and from backups within 35 days.

10.2 Deletion during the term. A School administrator may delete an individual student's Personal Information (documents, writing-process records, screen clips, Integrity Signals, alerts and account) at any time using the Service, and may remove any member, which revokes that person's sessions. Writeroom will carry out deletions the School Privacy Contact requests in writing within 30 days.

10.3 End of the Agreement. When the Agreement ends for any reason:

(a) Export Window. For 30 days after the End of the Agreement, the School's administrators and Authorized Users can sign in to read and export their data (whole-School export in a documented, machine-readable format; documents in common formats). Nobody can write new data. Writeroom will help with the export on request.

(b) Deletion. Writeroom will delete all Customer Data from live systems within 60 days after the End of the Agreement. Copies in backups age out within 35 days after that deletion. The School may ask in writing, during the Export Window, for Writeroom to retain Customer Data for a longer stated period; Writeroom may agree at the Professional Services Rate (SSA clause 10.3(a)), and the retained data remains protected by this DPA until deleted.

(c) Certificate. On written request, Writeroom will certify in writing that deletion is complete.

10.4 Exceptions. Writeroom may keep (a) records that law requires it to keep, for the period required; (b) billing records and audit logs (who did what in the Service; no student writing, writing-process records or screen clips) for [12 months] after the End of the Agreement, to establish compliance with the Agreement, after which they are deleted; (c) data under a legal hold notified in writing by the School or required by law; and (d) De-identified Data under clause 12. It will continue to protect retained Personal Information under this DPA until deleted.

10.5 Copies outside the Service. Information the School's staff download (for example keystroke tables or exports) or copy out of the Service, and documents students export, are outside Writeroom's control and these retention rules. The Service shows a one-line reminder of this on each teacher export. The School is responsible for those copies.

10.6 Information on students' devices. Unsent writing kept in the browser so that no work is lost is cleared on sign-out and after 14 days. The School is responsible for the configuration of devices it manages.

11. Audits and verification

11.1 Documentation first. Writeroom will demonstrate compliance with this DPA by making available (a) the Security Overview and this DPA, (b) written answers to the School's reasonable questions and standard questionnaires under clause 9.3, (c) summaries of any third-party security assessments or penetration tests Writeroom has commissioned, where they exist, and (d) the School's own audit log within the Service.

11.2 On-site or remote audit. If the School reasonably concludes that the information under clause 11.1 is insufficient to meet an obligation under Applicable Privacy Law, or a privacy commissioner requires it, the School (or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Writeroom) may audit Writeroom's compliance with this DPA, subject to the following: (a) at most once in any 12-month period, except after a Security Incident affecting the School; (b) at least 30 days' written notice stating the scope; (c) during normal business hours, without unreasonable disruption, and in a manner that does not give access to other schools' data or to Writeroom's Subprocessors' facilities; (d) at the School's cost, including Writeroom's reasonable time at the Professional Services Rate stated in the Order Form for anything beyond two business days of staff time; and (e) findings are confidential and shared with Writeroom. Writeroom will remedy material non-compliance an audit shows within a reasonable time at its own cost.

11.3 Audits of Subprocessors are satisfied by the Subprocessor's own published audit reports or certifications, where available.

12. De-identified Data

12.1 Writeroom may create De-identified Data from Customer Data and use it only to operate, maintain, secure and improve the Service, for example to measure performance, detect faults and abuse, calculate aggregate usage, and test the accuracy of the Service's features. For clarity, this never includes using the content of student writing, pastes, clipboard text, screen clips or writing-process records, in identifiable or de-identified form, to train, fine-tune or improve any model, which clause 3.2(c) prohibits.

12.2 Writeroom will not (a) attempt to re-identify De-identified Data, (b) disclose De-identified Data to any third party except Subprocessors that process it only for Writeroom under clause 12.1, (c) sell De-identified Data or use it for advertising, or (d) provide it to any AI vendor for training. Writeroom will contractually prohibit any recipient from attempting re-identification.

12.3 De-identified Data may be kept after the Agreement ends. Writeroom will publicly commit, in its Privacy Policy, not to re-identify De-identified Data.

13. Integrity Signals, automated processing and decisions

13.1 What the Service does. The Service records how a document was written and computes Integrity Signals from that record, including flags with severity levels, a per-document integrity score, an AI-detector score for English writing of sufficient length (and for copied text of 40 or more words), a writing-path summary and a per-student summary built only from the viewing teacher's own integrity decisions (clause 14.4). It also raises alerts to teachers. These are automated evaluations of a student's writing behaviour within an assignment and are described in the Documentation.

13.1A Honesty score. The Service keeps one long-term honesty score for each student (5 to 99, starting at 80). It is worked out from what teachers record: it rises slowly when a teacher hands back finished work that looks typical, falls by 20 to 30 points by the severity a teacher chooses for "Integrity concern confirmed by teacher" (more for repeats) and by 3 to 5 points for "Discussed with student". Automated flags and scores alone never move it. Every change is recorded with its reason. It is an indicator, not a decision. Teachers of the student and School administrators see it; a School administrator can change or reset it with a written reason, which is logged, so a person can always correct it. It is Customer Data, is included in a student's export and is deleted with the student's data. Students and parents reach it through the School's access process (clause 13.5).

13.2 No automated decisions. The Service does not make any decision about a student by automated means. No grade, finding of academic dishonesty, sanction or report to a parent is produced or applied by the Service without a teacher's action. Integrity Signals are shown only to the School's teachers and administrators who are permitted to see the student's work, never to students, and every Integrity Signal is labelled in the Service as a reason to look, not proof. Rule enforcement the teacher configures (for example locking a document at its due date, limiting pastes or blocking listed AI sites during an assignment) applies automatically as the teacher set it.

13.3 The School decides and is responsible. Any decision about a student's work, conduct or grade is made by the School through its teachers and administrators, who are responsible for considering context, speaking with the student, applying the School's own academic-integrity and accommodation policies, and offering the review or appeal process the School provides. Writeroom is not party to those decisions and is not responsible for them. The School will not treat an Integrity Signal, on its own, as a finding of misconduct.

13.4 Known limits. Writeroom's Documentation describes the known limits of Integrity Signals, including that the AI detector is not applied to writing that is not in English, that dictation and non-keyboard input are recorded as such, and that signals can be raised by ordinary behaviour. The School will make the "How to read Writeroom's signals" guidance available to its teachers.

13.5 Students' rights. Students and parents ask the School, not Writeroom, for access to or correction or deletion of the student's information, and to have a decision reviewed. Where Applicable Privacy Law gives a student or parent such a right, the School is responsible for honouring it, and Writeroom will assist under clause 9. The School may export a student's writing record, the Integrity Signals attached to it and the evidence behind each signal, and the decisions and notes recorded about it, for that purpose.

13.6 AI credits. AI credits are counted per School and, where a platform or School administrator sets a limit, per teacher. For that, the Service keeps each teacher's limit, credits used this month and any extra credits, with no student information. Teachers see only the credits left for them. Every change is logged.

14. Specific features and the School's choices

14.1 Recording only in school work. The writing-process record runs only in documents that belong to an assignment the School's teacher created. Documents a student creates on their own are not recorded and are not visible to teachers unless the student shares one, in which case the teacher sees its text and not a process record.

14.2 Screen supervision. Screen clips are captured only when the teacher's assignment rules ask for screen supervision and the student starts sharing after an in-app notice that says short clips of the whole screen are saved when the student leaves the document. A whole-screen clip can show notifications, other windows and personal content. The School is responsible for deciding whether, when and for which students screen supervision is appropriate under its policies and Applicable Privacy Law, including whether to give parents or guardians specific notice before supervised assignments, and including for students who use accommodations or devices that cannot share a screen.

14.3 Extension. The Chrome extension records only while an assignment document is open, records the domain of a visited site (full address only for listed AI tool sites), a count of open tabs and the AI tool domains among them, copies made on listed AI tool sites, and, in supervised assignments, screenshots of an AI tool tab. The School is responsible for its decision to deploy the extension to managed devices or to ask students to install it.

14.4 Who sees what. Teachers see the documents, records and Integrity Signals of students in assignments they own or co-teach, and documents a student shares with them. School administrators can see everything in the School, and every such view is written to the School's audit log. Alerts go only to teachers who can see the document. A teacher records an integrity decision on a document with one of three outcomes, "No concern", "Discussed with student" or "Integrity concern confirmed by teacher", and must write their own note before saving; the Service does not draft the note. Decisions and notes are visible to the deciding teacher and School administrators, and the per-student summary a teacher sees is built only from that teacher's own decisions on documents that teacher can see. Sharing decisions with other teachers is a School setting that is on when a School starts and that a School administrator can turn off; when it is on, the summary may include other teachers' decisions.

15. Liability

15.1 Each party's liability arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is subject to the exclusions and limitations of liability in SSA clause 16, including the separate cap for Data Protection Claims in SSA clause 16.3 (two times the Fees paid and payable by the School under the Agreement in the 12 months immediately before the event giving rise to the claim, not cumulative with the general cap, and subject to the deemed minimum in SSA clause 16.6). Writeroom's liability under clause 8.6 counts toward that cap. Nothing in this DPA creates an uncapped liability except as SSA clause 16.4 provides.

15.2 Writeroom is not liable for loss or damage to the extent it results from: (a) the School's Instructions, settings or configuration, including turning on external AI features or screen supervision; (b) decisions the School or its staff make about students, whether or not they relied on Integrity Signals; (c) the School's failure to give a notice, obtain a consent or authorization, or complete an assessment that Applicable Privacy Law requires of the School; (d) information the School's staff or students take outside the Service; (e) the School's or its Authorized Users' credentials, devices, networks or systems; (f) content loaded by a student's or teacher's browser from a third-party website at an Authorized User's direction (for example an image inserted by URL); or (g) the acts or omissions of a model vendor acting outside Writeroom's Instructions, provided Writeroom complied with clause 7.3.

15.3 Nothing in this DPA excludes or limits a party's liability where exclusion or limitation is not permitted by law.

15.4 To the extent Applicable Privacy Law deems Writeroom to be an agent, employee or part of the School for the purposes of that law (for example under Alberta's Protection of Privacy Act), that deeming does not expand Writeroom's contractual liability to the School beyond this clause 15 and the School Services Agreement.

16. General

16.1 Term. This DPA takes effect on the effective date of the first Order Form and continues for as long as Writeroom holds any of the School's Personal Information. Clauses 3, 4, 8, 9.6, 10, 12, 13.3, 15 and 16 survive termination.

16.2 Precedence. The order of precedence is as SSA clause 1.3 states: the Order Form (only where it expressly names the clause it varies), then this DPA for anything concerning Personal Information, then the School Services Agreement, then the Terms of Use, then the Privacy Policy. The Privacy Policy and the Student Privacy Notice are descriptive documents for individuals and do not create obligations toward the School beyond those in this DPA.

16.3 Changes in law. If Applicable Privacy Law changes so that this DPA no longer meets a requirement that applies to the School, the parties will negotiate in good faith an amendment that does, within 60 days of a written request. Writeroom may publish an updated DPA to meet new legal requirements across all Schools and will give the School Privacy Contact at least 30 days' notice; the updated DPA applies to the School when it countersigns or, at the latest, from the next renewal of its Order Form, and this version applies until then.

16.4 Jurisdiction-specific terms. Annex 4 applies to Schools in Canada according to the province or territory named in the Order Form. Schedule US applies only to a School located in the United States and prevails over the main body of this DPA to the extent of any conflict for that School.

16.5 Governing law. This DPA is governed by the laws of [Ontario] and the federal laws of Canada applicable there, and the dispute provisions of the School Services Agreement apply, except that for a School that is a public body, nothing in this DPA requires the School to submit to a jurisdiction or process its enabling law prohibits.

16.6 Entire agreement on personal information. This DPA, with its Annexes, Schedule US (where applicable) and the Order Form, is the parties' complete agreement on the Processing of Personal Information. It supersedes any earlier data protection terms between them. Changes must be in writing and signed by both parties, except as clause 16.3 allows.

Annex 1: Description of Processing

Part A: Subjects, categories and purposes

Not collected: camera images or video, except a photo a student chooses to take with Insert, Image, Camera, which is stored only as an image in that student's document like any uploaded image (the camera is never turned on by the Service itself and is never used for supervision); audio (voice typing uses the browser's speech recognition and the Service stores only the resulting text), location, keystrokes outside the Writeroom editor, browsing outside an assignment document, date of birth, age, grade level or parent and guardian details (the School holds these; Writeroom does not ask for them).

Part B: Processing details

• Nature: hosting, storage, display, replay, automated analysis to produce Integrity Signals, transmission to Subprocessors listed in Annex 3, export, deletion.
• Duration: the term of the Agreement plus the periods in clause 10.
• Retention defaults: clause 10.1.
• Location: clause 7.

Part C: What external AI features send (only when the School turns them on)

Part D: School-specific details (completed in the Order Form)

• School Privacy Contact (name, title, email, phone): Order Form section 2.
• Province or territory, or US state, for Annex 4 or Schedule US: Order Form section 1.
• Whether the School may use external AI (if yes, it is on when the School starts and a School administrator can turn it off; if no, Writeroom locks it off): Order Form section 6.
• Any School-specific retention periods that differ from clause 10.1: Order Form section 6.
• Professional Services Rate: Order Form section 4.

Annex 2: Security measures

This Annex describes the measures in place for the production Service. They are factual descriptions, not warranties beyond clause 5.

Hosting and infrastructure

• Google Cloud, Toronto region (northamerica-northeast2): Cloud Run (application), Firestore (database), Cloud Storage (files), Secret Manager (secrets), Cloud Logging and Monitoring. Separate staging and production environments with separate databases and buckets.
• Google Cloud encrypts data at rest and in transit between Google facilities by default. Connections between users' browsers and the Service use HTTPS with HSTS.
• Firestore and Cloud Storage rules deny all direct client access; only the application server reads and writes data. Files are streamed by the server or served through short-lived signed URLs.
• Secrets are held only in Secret Manager. The service account has least-privilege permissions. No keys are stored in the code repository, container images or logs.

Identity and access

• Sign-in with Google or with email and password through Firebase Authentication; email accounts must verify their address. Sessions are httpOnly, Secure, SameSite cookies: 5 days for students and teachers, 12 hours for platform administrators; sign out everywhere; removing a member revokes sessions. No session tokens in URLs.
• Multi-factor authentication is required for Platform Administrators and recommended for School administrators.
• Every request is scoped to the user's School on the server. Automated tests exercise every route as a user of another School and must receive 403 or 404.
• Every route declares who may call it (platform administrator, School administrator, teacher, student, owner), enforced in one authorization layer. Students can edit only their own documents; only the document owner's browser can record writing-process events.
• Platform Administrators have no default access to student work; time-limited support access is granted by a School administrator and every view is logged. No impersonation.

Application security

• Input validation schemas for every request body and query. Strict Content-Security-Policy without inline scripts, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame-ancestors none.
• CSRF protection: SameSite cookies, Origin checks and a token on every state-changing request.
• Rate limits on sign-in, sign-up, invitations, the contact form, AI features and expensive analytics routes, per IP address and per user.
• Uploads are limited to images, checked by content, re-encoded on the server and served with a sandbox policy from a separate path. Server-side fetches of image URLs allow only http and https, block private and metadata addresses, and have size caps and timeouts.
• A prompt-injection guard wraps student text in a random boundary, removes invisible and hidden text, strips text aimed at an AI marker, requires structured answers, totals scores on the server and never pre-fills a grade from a compromised answer.
• Error responses never include stack traces. Logs contain no student text, document content, clipboard contents or tokens; request identifiers support troubleshooting.
• Dependencies are pinned, checked weekly by automated tooling, and npm audit findings are resolved or documented. A threat model (SECURITY.md) lists threats, mitigations and tests. An automated vulnerability scan (OWASP ZAP baseline) runs against staging in the release pipeline.

Monitoring, logging and audit

• Platform audit log of every platform action. School audit log of who viewed which student's replay, clips and analytics, decisions, hand-backs, settings changes and support access.
• Health and readiness probes, uptime checks, and alerts on error rate, latency, alert delay and spend.
• Cloud Logging in a Toronto log bucket with 30-day retention. IP addresses are kept only there and only for security.

Backup and recovery

• Firestore point-in-time recovery and delete protection; daily export to a Toronto bucket kept 30 days; Cloud Storage object versioning; backups age out within 35 days; restore procedure documented and rehearsed on staging.

Release process

• Every release is built by Cloud Build, deployed to staging, run through the automated end-to-end suite, then promoted to production with the same image. Rollback is a single command.

Extension

• The extension trusts only app.writeroom.org and staging, carries host permissions only for Writeroom and the listed AI tool sites, and reports only while an assignment document is open.

Personnel

• Confidentiality obligations and role-appropriate training for anyone with production access.

Not claimed. Writeroom does not currently hold SOC 2, ISO 27001 or similar certifications and does not claim them. Writeroom will tell the School if that changes.

Annex 3: Subprocessors

The current list is published at writeroom.org/subprocessors and reproduced in SUBPROCESSORS.md. At the effective date it comprises:

Writeroom uses no email delivery service; if it later uses one, it will be added to this Annex with notice under clause 6.2.

Not Subprocessors: Hugging Face (the AI-detector model is downloaded once at setup; no user data is sent), Google Classroom and Google Drive (accessed in the teacher's own browser with the teacher's own Google account; Writeroom's servers make no calls to them), third-party websites from which a browser loads an image a user inserted by URL.

Annex 4: Canadian jurisdiction-specific terms

A4.1 All provinces. Writeroom acknowledges that the School, as a public body or institution, remains accountable for Personal Information in its custody or under its control, and that this DPA is intended to be the written agreement under which Writeroom holds and processes that information for the School.

A4.2 Ontario. (a) Writeroom acknowledges that the School is an institution under the Municipal Freedom of Information and Protection of Privacy Act and that the School's collection of Personal Information through the Service is for the purpose of its educational programs under the Education Act. (b) Writeroom will provide and keep current the information in Annex 1 so that the School can give the notices to parents and to students aged 16 and 17 required by Ontario Regulation 52/26 under the Enhancing Digital Security and Trust Act, 2024, and can maintain its software inventory. (c) Writeroom will co-operate with the School's privacy impact assessment and breach reporting obligations under the amendments to MFIPPA in force on January 1, 2027. (d) Writeroom will support the School's reporting of a critical cyber security incident to the Ministry under Ontario Regulation 51/26 by meeting the timeline in clause 8.1.

A4.3 Quebec. (a) The parties acknowledge that the Service stores Personal Information outside Quebec (in Ontario) and that the School must carry out a privacy impact assessment before communicating Personal Information outside Quebec; Writeroom will supply the information the School needs. (b) This DPA is intended to serve as the written agreement that must accompany such a communication, and Writeroom agrees to the measures in it to protect the Personal Information. (c) Writeroom will tell the School Privacy Contact promptly of any confidentiality incident involving the School's Personal Information so that the School can assess the risk of serious injury and meet its register and notification duties. (d) The Service does not render decisions based exclusively on automated processing; clause 13 applies. (e) Writeroom will provide the Student Privacy Notice and Privacy Policy in French on request, [and the French version will prevail for a School in Quebec where the law so requires]. (f) The parties acknowledge that Integrity Signals are automated analysis of a student's writing behaviour within an assignment (a form of profiling), that the optional functions (outside-clipboard check, extension, screen supervision, external AI) are deactivated by default, that recording in assignments is disclosed to the student before it starts and acknowledged once per assignment, and that the School is responsible for the notice its law requires about these functions and the means to activate them; Writeroom supplies the information in Annex 1 and the Documentation for that notice.

A4.4 British Columbia. (a) Writeroom acknowledges the School's duty under section 30 of the Freedom of Information and Protection of Privacy Act to protect Personal Information by reasonable security arrangements, and Annex 2 describes Writeroom's measures in support of that duty. (b) Disclosures outside Canada under clause 7.2 are made by the School under section 33.1 and the Personal Information Disclosure for Storage Outside of Canada Regulation; Writeroom will support the School's privacy impact assessment. (c) Writeroom will notify the School of any unauthorized disclosure of Personal Information as clause 8 provides, and of any foreign demand as clause 9.6 provides.

A4.5 Alberta. (a) Writeroom acknowledges that, when it performs services for the School involving Personal Information, it is treated as an employee of the School under the Protection of Privacy Act and is bound by that Act in respect of those services. (b) Writeroom will co-operate with the Information and Privacy Commissioner of Alberta in any review or investigation concerning the School's Personal Information. (c) Writeroom will help the School meet its obligations to notify affected individuals, the Commissioner and the Minister of a privacy breach involving a real risk of significant harm, and to maintain its privacy management program, by providing the information in clause 8 and Annex 1.

A4.6 Nova Scotia. The parties acknowledge that the School's head may need to authorize, and report, storage or access outside Canada under the Personal Information International Disclosure Protection Act for the Processing in clause 7.2. Writeroom will provide the information the School needs for that decision.

A4.7 Other provinces and territories. Writeroom will provide reasonable assistance so that the School can meet the requirements of its public sector privacy law (for example Manitoba's Freedom of Information and Protection of Privacy Act, Saskatchewan's Local Authority Freedom of Information and Protection of Privacy Act, New Brunswick's Right to Information and Protection of Privacy Act, Newfoundland and Labrador's Access to Information and Protection of Privacy Act, 2015, or Prince Edward Island's Freedom of Information and Protection of Privacy Act), including information management service provider rules, before using the Service.

Schedule US: Terms for Schools in the United States

This Schedule applies only where the Order Form names a School located in the United States. Terms defined in the main body apply. Where this Schedule conflicts with the main body for a US School, this Schedule prevails.

US1. FERPA. (a) Writeroom acknowledges that Student Data includes "education records" and "personally identifiable information" under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99). (b) The School discloses Student Data to Writeroom under the school official exception (34 C.F.R. § 99.31(a)(1)(i)(B)). Writeroom performs an institutional service or function for which the School would otherwise use its own employees; is under the direct control of the School with respect to the use and maintenance of education records through this DPA; uses education records only for the purposes in Annex 1 and for no other purpose; and will not redisclose personally identifiable information from education records except to Subprocessors under clause 6, as the School directs, or as 34 C.F.R. § 99.33 permits. (c) The School is responsible for including Writeroom in its annual FERPA notification of the criteria for school officials and legitimate educational interests, where it relies on that exception. (d) Writeroom will not change its Processing or the Documentation in a way that affects the School's direct control without notice under clause 6.2 or 16.3.

US2. COPPA. (a) Writeroom provides the Service only to Schools and not to children directly. The School represents that it is authorized to provide consent on behalf of parents to Writeroom's collection of personal information from students under 13, for the use and benefit of the School and for no other commercial purpose, consistent with the Federal Trade Commission's guidance on the Children's Online Privacy Protection Act and its Rule (16 C.F.R. Part 312, as amended in 2025). (b) Writeroom will use personal information from students under 13 only to provide the Service to the School, will not use it for any commercial purpose unrelated to the Service, will not disclose it except as this DPA permits, and will delete it as clause 10 provides. (c) On the School's request, Writeroom will provide a description of the personal information collected from students under 13, and the School may review and request deletion of it. The School is responsible for giving parents the notice of its use of the Service that its policies and state law require. (d) Writeroom does not use persistent identifiers for behavioural advertising and does not disclose personal information to third parties for that purpose.

US3. State student privacy laws. Writeroom is an "operator" (or equivalent) under state student privacy laws to the extent they apply, and will: (a) not engage in targeted advertising on the Service or elsewhere based on information acquired through the Service; (b) not use Student Data to build a profile of a student except in furtherance of school purposes; (c) not sell or rent Student Data; (d) not disclose Student Data except as permitted by this DPA and law; (e) maintain reasonable security procedures and practices appropriate to the nature of Student Data (Annex 2); (f) delete Student Data at the School's request as clause 10 provides; (g) use De-identified Data only as clause 12 permits and only for school purposes, product improvement and demonstrations of effectiveness; and (h) provide the School with the Security Incident notices in clause 8.

US4. State-specific terms.

(a) California. For a School subject to Education Code § 49073.1, the parties agree that: pupil records remain the property of and under the control of the School; the School and pupils may access pupil-generated content through the Service and export it as clause 10 provides; the School may request Writeroom's help to review and correct pupil records under clause 9; Annex 2 describes the actions Writeroom takes to ensure the security and confidentiality of pupil records; clause 8 sets the procedure for notifying affected parents, pupils or students of an unauthorized disclosure; clause 10.3 governs return and deletion when the Agreement ends; Writeroom will not use personally identifiable information in pupil records to engage in targeted advertising; and Writeroom complies with the Student Online Personal Information Protection Act (Business and Professions Code § 22584) as stated in US3.

(b) New York. For an educational agency subject to Education Law § 2-d and 8 NYCRR Part 121: Writeroom will comply with the School's Parents' Bill of Rights for Data Privacy and Security and the supplemental information the School develops under § 121.3, which the School will attach to the Order Form; Writeroom will notify the School of a breach or unauthorized release of Student Data in the most expedient way possible and without unreasonable delay, and no later than 7 calendar days after discovery (this shorter period replaces clause 8.1 for that School); Writeroom's safeguards (Annex 2) are intended to align with the NIST Cybersecurity Framework; Writeroom limits internal access to Student Data to personnel who need it and trains them; Writeroom will not use Student Data for any purpose other than those in the Agreement; Writeroom will not disclose Student Data to any other party without prior written consent of the parent or eligible student except as required by law or as the Agreement permits, and will bind Subprocessors to the same obligations; Writeroom maintains Student Data in encrypted form using encryption technology that meets the standard in Part 121 (Google Cloud default encryption at rest and TLS in transit); and Writeroom will reimburse the School for the costs of notifications the School must make under § 2-d as a result of Writeroom's breach, subject to clause 15.

(c) Illinois. For a School subject to the Student Online Personal Protection Act (105 ILCS 85): Writeroom will notify the School of a breach of covered information no later than 30 calendar days after determining that a breach occurred (clause 8.1's 48-hour commitment also applies); Writeroom will provide the School, for publication, a list of the categories of covered information it receives and a description of how it is used (Annex 1 serves this purpose); and the School may use the Illinois form of the Student Data Privacy Consortium National Data Privacy Agreement, in which case the parties will attach it to the Order Form and this Schedule will be read consistently with it.

(d) Other states. Where a School's state law requires terms not in this DPA, the parties will set them out in the Order Form, or the School may ask Writeroom to sign the Student Data Privacy Consortium National Data Privacy Agreement (current version) with the state exhibit, and the parties will agree in the Order Form which document prevails on any conflict.

US5. Data location. The School acknowledges that Customer Data is stored in Canada and processed as clause 7 describes, and confirms that its state law and policies permit this. Writeroom will give notice under clause 6.2 before any change.

US6. Access by parents and eligible students. The School answers requests by parents and eligible students to inspect, review and correct education records. Writeroom assists under clause 9.

US7. Directory information and surveys. Writeroom does not collect or disclose directory information and does not administer surveys of students.

Signed for the School and for Writeroom as part of the Order Form.

Questions about this document? Use the contact form. All legal documents