Data Processing Addendum

1. Parties

This Data Processing Addendum (“DPA”) is entered into between:

• “Institution” — the school, school board, or educational organization agreeing to these terms.
• “Argraide” — Argraide Inc., the provider of the educational technology platform.

2. Definitions

• “Student Data” means any information relating to a student that is collected, stored, or processed through the Platform.
• “Personal Information” has the meaning given under MFIPPA, FIPPA, PIPEDA, and other applicable privacy legislation.
• “Platform” means the Argraide educational technology service.
• “Processing” means any operation performed on Student Data.

3. Scope of Processing

Argraide processes the following categories of data:

4. Data Location

All Student Data is stored exclusively in Canada, specifically in AWS's Montreal data center (ca-central-1).

Two kinds of requests are processed outside Canada, by the subprocessors listed in Section 7, and neither carries a student name, username, email or account identifier:

• AI model requests (United States): activity generation and translation use teacher-authored content only. The optional in-activity helper sends the student's typed question, the text visible on their screen and their progress in that activity. The Institution's teachers can switch the helper off for any activity, and the Institution's administrator can switch it off for every activity its teachers assign or host.
• Application delivery: pages are served through a global content delivery network that stores no Student Data.

Product analytics receives no Student Data. On student-facing pages it is limited to anonymous page counts with no identifier, no IP address and no session recording.

5. Security Measures

• Encryption in transit (TLS 1.2 or higher, 1.3 where supported)
• Encryption at rest (AES-256)
• Row-level security policies on all database tables
• Student emoji codes and teacher passwords stored as bcrypt hashes
• Teacher-defined nicknames encrypted in the teacher's browser (AES-256-GCM) with a device-generated key that never reaches Argraide
• Continuous dependency and access monitoring; an independent penetration test is planned and its summary is available to the Institution once complete
• Student activity records (progress, per-question results, helper summaries) are stored only against the anonymous account and deleted with it

6. Data Retention & Deletion

• Student Data is retained while the student account exists. A student can delete their own account at any time from their dashboard, which removes their progress records and helper summaries immediately.
• Names typed into live sessions are replaced by “Player 1”, “Player 2” and so on 7 days after the session closes (a classroom link stays open for at most 24 hours); typed responses, drawings, device tokens and any helper summaries for those participants are deleted automatically 30 days after the session; the anonymous per-Player results (answers marked right or wrong, attempts, scores) are deleted one year after the session. Sessions held before this version keep the rule they started under: everything deleted 30 days after the session.
• Institution may request deletion of any student, class or account at any time by contacting support@argraide.com.
• Deletion requests are processed within 72 hours.

7. Subprocessors

Argraide holds evaluation API keys for two further model providers (DeepSeek, Moonshot AI). Neither is enabled for any task, neither can receive Student Data (the in-activity helper is restricted in code to Google, OpenAI and Anthropic), and the Institution is notified before either is used for activity generation.

8. Institution Rights

The Institution has the right to:

• Request a copy of all Student Data associated with their account
• Request deletion of all Student Data at any time
• Conduct or request a security audit (with 30 days notice)
• Receive breach notification within 72 hours of discovery

9. Liability & Indemnification

Argraide shall indemnify and hold harmless the Institution from any claims, damages, or expenses arising from Argraide's breach of this DPA or applicable privacy laws, including but not limited to MFIPPA, FIPPA, PIPEDA, and Ontario Bill 194.

10. Term & Termination

This DPA remains in effect for the duration of the service agreement. Upon termination,Argraide will delete all Student Data within 30 days unless legally required to retain it.