Student Data Privacy Agreement

1.Parties and purpose

This agreement is between the School and HAVRA LLC, a Florida limited liability company that operates Corvano and Corvano Prep (the “Service”). It supplements the Partner Program Terms and any order form. Where they conflict about student data, this agreement controls. Its purpose is to let the School give students SAT and ACT practice, study tools and AI tutoring, and to let the School’s staff see students’ progress and set work, while keeping student data protected as the law requires.

2.Roles under FERPA

In short: We act as a school official, under the School’s direct control, and use student data only for the School’s purposes.

For student data that is part of an education record, HAVRA LLC acts as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g, and 34 C.F.R. § 99.31(a)(1)). We perform a service the School would otherwise use its own staff for, we are under the School’s direct control with respect to the use and maintenance of that data, and we use it only for the purposes in this agreement. We will not re-disclose it except as this agreement and FERPA allow. The School remains responsible for deciding that providing the Service meets its own obligations, including any notice to families it gives.

3.Student data we receive

• From the School: student email addresses the School invites (by email or roster file), group or class names, and an allowed email domain for the School’s join links.
• From students using the Service: name and email address, the account’s sign-in details, practice answers and results, practice-exam answers and scores, study sets and notes they create, AI tutor conversations, and basic technical data such as IP address and browser type, as described in our Privacy Policy.
• We don’t ask the School for, and the School should not send us, Social Security numbers, disability, health or disciplinary records, or any data about students under 13.

4.How we use it

We use student data only to provide, secure, support and improve the Service for the School and its students: to run students’ accounts and practice, to show the School’s authorized staff the progress information in section 6, to provide AI features students choose to use, to prevent abuse, and to comply with the law.

5.What we never do

In short: No ads, no sale, no profiles for anything but the student’s own learning, and no AI training on student data.

• We never sell student data or rent it, and never share it for anyone else’s marketing.
• We never show ads to students seated through a School, and never use student data for targeted advertising anywhere.
• We never build a profile of a student for any purpose other than supporting their own learning in the Service and the School’s view of it.
• We never use student data to train AI models, and never let our AI providers do so. AI requests go only to providers that don’t keep the content or train on it, and carry no student name, email address or account ID.
• We don’t run analytics tools on students seated through a School.
• We never change how we use student data in a way that is materially less protective without the School’s written consent.

6.Who can see it

The School’s staff

Staff the School authorizes in the Partner Console see, for students who have joined the School: name and email, group, when they were last active, practice answers and accuracy by section, domain and skill, practice-exam scores and estimates, streaks, assignments and Exam Studio results, and AI credits used. Teachers see only the groups they lead. Staff never see a student’s own study sets, tutor conversations, uploaded notes or study guides. The School controls which staff have access and is responsible for removing them.

Our people

Within HAVRA LLC, only people who need access to run, support or secure the Service can reach student data, and they are bound by confidentiality.

7.Subprocessors

We use the service providers listed on our subprocessors page to host and run the Service. Each is bound by a written agreement to protect data and use it only to provide its service to us. We’ll give the School at least 30 days’ notice (by email to its account owners) before adding a subprocessor that will receive student data, and the School may object and end its plan if it reasonably can’t accept the change.

8.Security

We maintain administrative, technical and physical safeguards appropriate to student data, including:

• encryption of data in transit (TLS) and at rest by our hosting providers;
• database access rules that keep each student’s data to that student, and partner data reachable only through checked server routes;
• two-step verification for the School’s owners, admins and Exam Studio users, and for our own administrative access;
• least-privilege access, logging of partner staff actions, and an audit log the School can read; and
• regular review of these safeguards and prompt fixes when we find a weakness.

9.Breach notification

If we confirm unauthorized access to or disclosure of the School’s student data, we will notify the School without unreasonable delay, and no later than 72 hours after confirming it, with what we know: what happened, when, what data was involved, what we are doing, and a contact. We will cooperate with the School’s investigation, take reasonable steps to contain and remedy it, and, if the School asks or the law requires, help notify affected families. Breach notices go to the School’s account owners and billing contact; reports to us go to legal@corvano.app.

10.Parent and student requests

Parents and eligible students exercise FERPA rights to review and correct education records through the School. If a parent or student contacts us about records the School controls, we’ll refer them to the School and help the School respond within the time the law requires. Students can also download their own data from their account page at any time.

11.Return and deletion

In short: At the end of the contract, or when the School asks, we delete the accounts the School manages within 60 days.

• School-managed accounts are accounts that joined through a School link requiring the School’s email domain. When the School’s plan ends, or at any time the School asks, we delete those accounts and their data within 60 days, and confirm in writing. Before deletion, the School may ask for an export of its students’ progress and scores.
• Personal accounts are accounts a student created or controls with their own email address. When the plan ends or the student leaves, the School’s access to that student’s data ends at once; the account stays the student’s own, under our Privacy Policy, and the student can delete it at any time.
• Backups are overwritten on their normal cycle, and deleted data is not restored from them except to recover the Service, in which case we delete it again.
• We may keep records the law requires (such as billing records), which contain no student practice data.

12.De-identified data

We may use de-identified, aggregated data (for example, how often a question is answered correctly) to improve the Service and its questions. We will not try to re-identify it or share it with anyone who is not bound to the same promise.

13.State laws and other agreements

We comply with the student privacy laws that apply to the Service in the School’s state, such as laws limiting the use of student data by operators of school services. If a state addendum or a state or district standard agreement is required, we will sign it, and it controls where it is more protective than this agreement.

14.Term and signing

This agreement starts when the School signs it (in the Partner Console, or by signing a copy we send) and lasts as long as the School has a plan or a pilot, plus the time needed to complete section 11. The person signing confirms they are authorized to sign for the School. To sign, ask a question, or send your own agreement, write to partners@corvano.app.