Student data privacy agreement.
A short, plain-language agreement a district or practice can sign. Print it, sign it, and email it back, or send us your district's own agreement (including the California standard agreement) and we will review it.
1. Purpose
This agreement sets out how Valentine Psychological Services, doing business as AUTOMATA ("Provider"), handles student information when the school district or practice named below ("District") uses AUTOMATA report-writing software. It applies for as long as the District uses AUTOMATA.
2. The District owns the records
All student records and information the District puts into or creates with AUTOMATA belong to the District (or to the student and parent as the law provides). Provider gets no ownership of them and no right to use them except as this agreement allows.
3. How AUTOMATA handles information
AUTOMATA is designed so that identifying student information (names, birth dates, student numbers, and similar details) stays in the District's own computers and Google accounts. Provider does not keep a database of student records.
When the District uses AI drafting, the app sends drafting text with names and identifiers removed. The text passes through Provider's server to an AI writing service and Provider's server does not save it.
If identifying student information ever reaches Provider's systems anyway, Provider treats it under every term of this agreement.
4. Limits on use
Provider uses student information only to provide AUTOMATA to the District. Provider will not sell it, use it for advertising or marketing to students or parents, build profiles of students from it, use it to train AI models, or share it with anyone except the service providers in Section 8.
5. FERPA
Provider will comply with the Family Educational Rights and Privacy Act (20 U.S.C. 1232g; 34 CFR Part 99). To the extent Provider receives personally identifiable information from education records, Provider (a) performs a service for which the District would otherwise use its own employees, (b) is under the District's direct control for how it uses and maintains the information, (c) uses it only for the purpose in Section 4, and (d) will not disclose it again without the consent FERPA requires (34 CFR 99.31(a)(1)).
6. Review and correction by parents and students
Student records are kept in the District's own files, so the District answers requests to review or correct them. If Provider receives such a request, Provider will send it to the District within five business days and will help the District respond.
7. Security and incidents
Provider uses reasonable administrative, technical, and physical safeguards for any information it holds, including encrypted connections (HTTPS), access limited to the people who need it, and encrypted storage at Google. If Provider confirms that student information in its control was accessed or disclosed without authorization, Provider will tell the District in writing within 72 hours of confirming it, say what happened and what information was involved, and work with the District on its response and any notices the law requires.
8. Service providers
Provider relies on Google (sign-in and the District's own Drive and Sheets), Cloudflare (hosting), Anthropic (AI writing service), and Stripe (payments, which never involve student information). Provider requires service providers that handle student information to protect it as this agreement requires, and will tell the District before adding one that would handle it.
9. Return and deletion
Within 30 days after the District asks in writing, or after the agreement ends, Provider will delete any District information it holds and confirm the deletion to the District in writing. Information in the District's own files and Google accounts stays under the District's control.
10. California law
Provider will comply with California Education Code section 49073.1 (contracts for digital educational software) and Business and Professions Code section 22584 (Student Online Personal Information Protection Act), as they apply to Provider, and with other student-privacy laws that apply to the District's use of AUTOMATA.
11. Term and general terms
This agreement starts on the date of the last signature below and continues while the District uses AUTOMATA. Either party may end it by written notice. California law governs it. Changes must be in writing and signed by both parties. If this agreement conflicts with Provider's Terms of Service on student information, this agreement controls.
Signatures
Valentine Psychological Services, doing business as AUTOMATA
Frazier Park, California
Name: Kevin Valentine, PhD
Title: Licensed Educational Psychologist, Founder
Signature
Date
District or practice name
Name and title of person signing
Signature
Date
This template is offered for convenience. Districts should have their own counsel review it.