School Data Handling Agreement

1. Parties

2. Purpose

This School Data Handling Agreement ("Agreement") sets out how Word Labs collects, stores, processes, and protects personal information belonging to the School's students and staff in connection with the Word Labs educational platform ("Service").

This Agreement supplements Word Labs' Privacy Policy (available at wordlabs.app/privacy) and the Terms of Service (available at wordlabs.app/terms). In the event of a conflict, this Agreement takes precedence.

This Agreement is entered into on the date of last signature below and remains in force for the duration of the School's subscription to the Service.

3. Definitions

4. What Data Is Collected

4.1 Student data

Word Labs does not collect: student surnames, email addresses, dates of birth, photos, device identifiers, location data, or any other personal information about students.

4.2 SOLO maths tracker records

The SOLO maths tracker is available only to schools that have asked for it. Word Labs switches it on for a School on request; until then the School's teachers and students see a notice and none of the records below are created. Classes that use the SOLO maths tracker also keep the records below. They are stored in the same Australian database as the rest of the student's record, linked to the student's first name and class only, and are deleted with the class (clause 8). "The student's teachers" means teachers at the School who are signed in to the Service; no teacher at another school can see them.

4.3 Teacher/staff data

5. Data Storage and Location

Student records are stored only in Australia: Supabase (PostgreSQL), hosted in the Sydney data centre (AWS ap-southeast-2). The rest of the School Data is held in the same database.

The website is served through Vercel's global CDN, which receives each visiting device's IP address and browser type, as any website host does. Schools whose networks block Vercel can use a copy of the website on GitHub Pages, which receives the same.

US processors listed in Section 7 support some features. Most are teacher-only: billing (Stripe: teacher email, school name and billing details), email (Resend: teacher email addresses), and AI features for schools that have asked for them to be switched on (Anthropic: teacher-typed words and teacher-drawn shop item images). Read-aloud audio (Google Cloud) receives only the word or lesson text being read, and a lesson video a student chooses to play in the SOLO maths tracker (YouTube) receives the device's IP address and browser details.

No student record is stored by any of them.

In transit, student records pass through Cloudflare, Supabase's hosting and CDN provider. The connections to and from Cloudflare are encrypted, and Cloudflare does not cache student records by default. For a school outside Australia, that transit may pass through a Cloudflare edge in the school's own region.

All data in transit is encrypted using TLS 1.2 or higher. All data at rest is encrypted using AES-256.

6. Data Isolation and Access Controls

The Service implements database-level Row Level Security (RLS) policies that ensure:

• Student records are only accessible to teachers on that class. A teacher on a class can add a co-teacher from the School, and each change is recorded
• No teacher can access another school's data
• Students can only access their own in-game data via their 3-character code
• In the SOLO maths tracker, the only student work another student can see is a question written for the class, shown with the author's first name after a teacher approves it. Reflections, workbook pages, answers, timings and the "right now" status are never visible to other students

Word Labs staff (Nicholas Deeney) may access School Data for the purpose of technical support, debugging, or responding to a request from the School. All such access is logged.

7. Sub-Processors

Word Labs will notify the School of any changes to sub-processors that involve Student Data with at least 30 days' notice.

8. Retention and Deletion

9. Data Breach Notification

Word Labs is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

In the event of an eligible data breach likely to result in serious harm to individuals whose information is involved, Word Labs will:

• Notify the affected School by email as soon as practicable and no later than 72 hours after becoming aware of the breach
• Notify the Office of the Australian Information Commissioner (OAIC) within 30 days of becoming aware
• Provide a written statement describing the nature of the breach, the information involved, and steps taken or proposed
• Take immediate steps to contain the breach and prevent recurrence

10. School Responsibilities

The School agrees to:

• Ensure it has appropriate authority (including any applicable parental notification or consent requirements) to enter student first names into the Service
• Keep teacher account credentials secure and not share them outside the school
• Notify Word Labs promptly of any suspected unauthorised access to School Data
• Ensure that students use the Service only under appropriate teacher supervision consistent with the School's acceptable use policies
• Not enter any sensitive information about students beyond what is required (i.e. first name only)

11. Word Labs Responsibilities

Word Labs agrees to:

• Process School Data only for the purposes described in this Agreement and the Privacy Policy
• Not sell, rent, or share Student Data with any third party for commercial purposes
• Not use Student Data for advertising, profiling, or any purpose beyond operating the Service
• Maintain appropriate technical and organisational security measures as described in Section 6
• Comply with the Australian Privacy Act 1988 and the Australian Privacy Principles
• Handle School Data in a manner consistent with the Information Protection Principles (IPPs) under the PPIP Act, enabling NSW government schools to meet their obligations under that Act
• Notify the School of material changes to this Agreement, sub-processors, or data handling practices
• Respond to data access or deletion requests within 14 days

12. Audit Rights

The School may request a written summary of Word Labs' data handling practices, security measures, and sub-processor arrangements at any time by emailing nick@wordlabs.app. Word Labs will respond within 14 days.

The School may request deletion of all its data at any time for any reason, with no penalty.

13. Governing Law

This Agreement is governed by the laws of New South Wales, Australia. The parties submit to the non-exclusive jurisdiction of the courts of New South Wales. This Agreement is consistent with and subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the School is a NSW public sector agency, this Agreement is also consistent with and subject to the Privacy and Personal Information Protection Act 1998 (NSW).

14. Amendments

Word Labs may update this Agreement from time to time. Schools will be notified by email at least 30 days before any material changes take effect. Continued use of the Service after notification constitutes acceptance of the updated Agreement. Schools may terminate without penalty if they do not accept material changes.

15. Contact for Privacy Matters

16. Schools Outside Australia

This clause applies where the School is outside Australia. The School's student records and teacher accounts are stored in Australia, as set out in Section 5. Teacher billing data is held by Stripe in the United States, as set out in Section 7. For a school outside Australia, that transit may pass through a Cloudflare edge in the school's own region.

Australian law, as set out in Section 13, and the Australian Privacy Principles govern how Word Labs handles this information.

The School is responsible for confirming that storing student data in Australia is permitted under its own law, and for obtaining any parent consent its law requires.

The Privacy Contact is Nicholas Deeney, nick@wordlabs.app.

16.1 United States schools: Children's Online Privacy Protection Act (COPPA)

For US schools, Word Labs collects from children under 13 only the items listed in Sections 3.2 to 3.4 of the Word Labs Privacy Policy. These include a device's IP address, which goes only to the recipients named in Section 3.4: Supabase and its hosting and CDN provider Cloudflare, Vercel, GitHub Pages, YouTube, whose player loads only when the student taps Watch here, and any other website a student chooses to open from a lesson link. Word Labs uses them solely to provide the service to the school, never for advertising or profiling, does not disclose them except to the sub-processors listed in Section 7 of that policy, and, on the school's request, deletes all records Word Labs holds; sub-processors' transient logs and backups expire on their own schedules, set out in Sections 3.4 and 9 of that policy. The school or teacher, by adding a student, confirms they are authorised by the school to consent on the parent's behalf for educational use, and that parents have been given the Privacy Policy.