Student Data Privacy Agreement

1.Parties, purpose and definitions

1.1 Parties. This DPA is between the School and Havra LLC, a Florida limited liability company that operates Corvano and Corvano Prep (the "Service") ("Havra", "we", "us"). It supplements the Partner Program Terms (the "Partner Terms") and any Order Form. Where they conflict about the protection, use, security or deletion of Student Data, this DPA controls; sections 14, 15, 17 and 18 of the Partner Terms apply to this DPA as section 1.2 of the Partner Terms provides.

1.2 Purpose. To let the School give students SAT and ACT practice, study tools and AI tutoring, and to let the School's authorized staff see students' progress and set work, while keeping Student Data protected as the law requires.

1.3 Definitions.

• "School-managed Account" means an Account created through a join link of a School that accepts only email addresses from that School's own email domain. Section 11 explains what happens to it when a Seat or the Plan ends.
• "Personal Account" means any other Account a student holds: the student's own consumer account under the Corvano Terms of Service, created and controlled by the student.
• "Student Data" means: (a) personal information about students that Havra receives from the School (such as invited email addresses and group names); (b) all personal information in School-managed Accounts; and (c) the School-facing records about any student who holds or asks for one of the School's Seats: the Seat and its history, the group, the assignments and Exam Studio exams the School sets and the student's attempts and results on them, the progress information shown to the School's staff under section 6.1, the weekly staff email summaries as we hold them (copies already delivered to staff mailboxes are the School's to manage), and the School's Console activity log. Student Data includes information that is part of an education record under FERPA.
• "De-identified Data" means data that cannot reasonably be used to identify a student, directly or indirectly.
• Other capitalized words have the meanings given in the Partner Terms or the Terms of Service.

1.4 Personal Accounts. Practice and content in a Personal Account are collected by Havra directly from the student under our Terms of Service and Privacy Policy. The School's view of a Personal Account student's progress is a disclosure the student authorizes on the join screen, and the School-facing records it produces are Student Data under this DPA.

2.Roles under FERPA and other laws

2.1 School official. For Student Data that is part of an education record, Havra acts as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. § 99.31(a)(1)). Havra performs a service the School would otherwise use its own employees for, is under the School's direct control with respect to the use and maintenance of that data, and uses it only for the purposes in this DPA. Havra will not re-disclose it except as this DPA and FERPA allow.

2.2 The School's responsibilities. The School remains responsible for deciding that providing the Service meets its own obligations, including listing school officials in its annual FERPA notice, any notice to or consent from families, and any approvals its board or state requires.

2.3 Ages. The Service is for students aged 13 and older. The School will not invite or seat any student under 13.

2.4 Ownership and control. As between the School and Havra, the School owns and controls Student Data, and Havra holds it only to provide the Service under this DPA. Students keep ownership of the study sets, notes and other content they create (pupil-generated content). A student can export their own sets and data from their account page at any time, and, where the School allows, a student with a School-managed Account can have the content they created copied into a Personal Account of their own, as section 11 explains.

3.Student Data we receive

• From the School: student email addresses the School invites (by email or uploaded list), group or class names, and an allowed email domain for the School's join links.
• From students using the Service: name and email address, sign-in details, practice answers and results, practice-exam answers and scores, assignment and Exam Studio attempts, study sets and notes they create, AI tutor conversations, and basic technical data such as IP address and browser type, as described in our Privacy Policy.
• We don't ask the School for, and the School should not send us, Social Security numbers, disability, health or disciplinary records, or any data about students under 13.

4.How we use Student Data

4.1 Purposes. We use Student Data only to provide, secure, support and improve the Service for the School and its students: to run students' Accounts and practice, to show the School's authorized staff the progress information in section 6, to provide AI Features students choose to use, to prevent abuse and enforce our Community Guidelines, and to comply with the law.

4.2 Safety, enforcement and legally required disclosures. We may remove content, suspend or close an Account under our Terms of Service and Community Guidelines, and make reports or disclosures that the law requires (including reports of apparent child sexual exploitation to the National Center for Missing & Exploited Children) or that a health or safety emergency requires, as FERPA allows. For a School-managed Account, we tell the School's account owners promptly when we close it or make such a disclosure about it, unless the law or law enforcement asks us not to, or we reasonably believe that telling the School would put a student at risk or compromise an investigation; in that case we tell the School when it is safe to do so, or not at all. A School-managed Account that we close is not deleted on our usual schedule for closed accounts: it stays in the waiting period in section 11 and is handled under that section at the School's direction, and the School may ask for an export first.

5.What we never do

• We never sell or rent Student Data, and never share it for anyone else's marketing.
• We never show ads to students while they hold one of the School's Seats or have a School-managed Account (including while it waits for deletion), and never use Student Data for targeted advertising anywhere.
• We never use Student Data, or the fact that a student held one of the School's Seats, to market products or offers to the student.
• We never build a profile of a student for any purpose other than supporting their own learning in the Service and the School's view of it.
• We never use Student Data to train or develop AI systems. De-identified Data may be used only as section 12 allows, and never to train, tune or develop AI systems, including the models that write questions. For students who hold one of the School's Seats or have a School-managed Account, we look at AI results only to support and fix that student's or the School's service, never to build evaluation or training sets or to tune prompts or models. AI tutoring and generation requests go only to providers that don't keep the content or train on it. We never attach a student's name, email address or account ID to an AI request; text a student types is sent as written (some features hide email addresses, phone numbers and street addresses first, but not names). Some automated checks are performed by a provider, TypeSafe, that is not covered by that zero-retention setting; for students who hold one of the School's Seats or have a School-managed Account, we send text to TypeSafe only under written terms that bar it from keeping or training on it, and where those terms aren't in place those checks don't use that text, as section 7 explains.
• We don't run analytics tools for students while they hold one of the School's Seats or have a School-managed Account (including while it waits for deletion).
• We never change how we use Student Data in a way that is materially less protective without the School's written consent.

6.Who can see Student Data

6.1 The School's staff

Staff the School authorizes in the Partner Console see, for a student who has asked to join and is waiting for approval, only the student's name, email address and the group they asked to join. For a student who holds one of the School's Seats, they see: name and email, group, when the student was last active, practice questions answered since the student joined (up to the last 90 days) with accuracy by section, domain and skill, latest practice-exam scores and estimates since joining, weakest skill, streaks, assignments and Exam Studio results, and Pool Credits used. Everything in this list is calculated only from activity since the student joined; the streak counts only days since joining. Owners, admins and tutors (shown as teachers in a School) may receive a weekly email summary of this information. Teachers see only the groups they lead. Staff never see a student's own study sets and folders, conversations with Corbie and the other AI tutors, notes or files the student uploads, study guides, payment details, or anything not in the list above. The School controls which staff have access and is responsible for removing them.

6.2 Our people

Within Havra, only people who need access to run, support or secure the Service can reach Student Data, and they are bound by confidentiality. Outside Havra, only the subprocessors in section 7 can, under written confidentiality and data terms.

6.3 What students choose to share

A student can share their own sets by link, publicly or with a Class, play study games with other users, and join a Class, as section 9 of our Privacy Policy explains. Other users then see what the student shared and the student's display name. These are the student's own choices, not disclosures by Havra. Unless the School allows more, a School-managed Account can't make sets public or join a Class created by someone outside the School's staff. Copies that other users made of a shared set are theirs, carry no student name, and are not deleted under section 11.

7.Subprocessors

We use the service providers listed on our Subprocessors page to host and run the Service. Each is bound by written terms to protect personal information and use it to provide its service, except as the sentences below describe: a written agreement with us or, for the model hosts OpenRouter selects, OpenRouter's terms and the zero-retention requirement we set on every request. Google and Stripe receive no Student Data from us, other than Google learning that a student chose Google sign-in where it is offered: we don't load Google analytics or ads for these students, School-managed Accounts can't buy plans, and a student with a Personal Account who buys a plan does so under our Privacy Policy. Cloudflare's bot check on the sign-in, sign-up and password-reset forms processes the IP address and browser details of that check; Cloudflare may also use them for its own security and fraud prevention, as its privacy notice explains, and receives nothing else. One provider (TypeSafe, for automated checks) is not covered by our zero-retention setting, as the Subprocessors page states. For students who hold one of the School's Seats or have a School-managed Account, we send text to TypeSafe only under written terms that bar it from keeping the text or training on it; where those terms aren't in place, those checks don't use that text. Our AI routing service, OpenRouter, chooses among hosts of the models we use that meet our zero-retention requirement; those hosts may be in the United States or other countries, and a host OpenRouter selects within those limits is not a new subprocessor for this section. We will give the School at least 30 days' notice (by email to its account owners) before adding a subprocessor that will receive Student Data, replacing OpenRouter, or adding a new AI model company. The School may object; if we can't reasonably address the objection, the School may end its Plan and we will refund prepaid fees for the rest of the Term.

8.Security

We maintain administrative, technical and physical safeguards appropriate to Student Data, including:

• encryption of data in transit (TLS) and at rest by our hosting providers;
• database access rules that keep each student's data to that student, and partner data reachable only through checked server routes;
• two-step verification for the School's owners, admins, billing contacts and Exam Studio users, and multi-factor authentication for Havra's own administrative access to the Service and its hosting providers;
• least-privilege access, logging of partner staff actions, and an activity log the School can read;
• regular review of these safeguards and prompt fixes when we find a weakness; and
• a named person at Havra responsible for the security and confidentiality of Student Data, and privacy and security training for everyone at Havra with access to Student Data before they get access and every year after.

9.Breach notification

If we confirm unauthorized access to or disclosure of the School's Student Data, we will notify the School without unreasonable delay, and no later than 72 hours after confirming it, with what we know: what happened, when, what data was involved, what we are doing, and a contact. We will cooperate with the School's investigation, take reasonable steps to contain and remedy it, and, if the School asks or the law requires, help notify affected families. If the breach resulted from our failure to meet this DPA, we will pay the reasonable costs of notices the law requires, subject to the Partner Terms' limitation of liability, which applies to every claim under this DPA. Breach notices go to the School's account owners and billing contact. Reports to us go to partners@corvano.app and legal@corvano.app.

10.Parent and student requests

Parents and eligible students exercise FERPA rights to review and correct education records through the School. If a parent or student contacts us about records the School controls, we will refer them to the School and help the School respond within the time the law requires. Where the law gives a parent or former student the right to ask us directly to delete Student Data, we honor it and tell the School. Students can also download their own data from their account page at any time.

11.Return, deletion and certification

• School-managed Accounts. When the School's Plan ends, we delete the School's School-managed Accounts within 60 days. At any time the School asks (including when it tells us that a student has left the School), we delete the School-managed Accounts it identifies within 60 days. If the School removes a student's Seat without telling us what to do with a School-managed Account, we ask the School in writing; if it hasn't answered within 60 days of our request, we email the student and delete the Account 14 days later. A School-managed Account never becomes a Personal Account, and removing a Seat doesn't end the School's rights over the Student Data in it.
• When a Plan ends; renewals and suspensions. A Plan ends for this section when its Term expires without a renewal or a new Order Form, or when either of us ends it. If, before the deletion date, the School tells us in writing that it intends to renew, or to buy a Plan after a pilot, we keep its School-managed Accounts and School-facing records in the waiting period until a new Plan starts or until 120 days after the Term ended, whichever comes first; if no Plan has started by then, we delete them at that point, having emailed the students at least 14 days earlier. If a hold applies, everything this section deletes at the end of a Plan is deleted when the hold ends, and no later than 120 days after the Term ended. For a School in Florida, the hold is available only if the School confirms in writing that the course or program continues into the new Term, and it never delays deletion for a student the School tells us has left. While a Plan is suspended, ads, analytics and offers stay off for the students who hold its Seats and for its School-managed Accounts; the rest of the Plan's terms continue unless the Partner Terms say otherwise.
• Waiting period. While we wait for the School's answer, and after the School's Plan ends until deletion, a School-managed Account is limited: the student can sign in, study their own sets and download their data, but it shows no ads, loads no analytics, receives no offers, and the School's staff can't see it.
• Copying a student's own content. If the School allows it, a student can ask us, before their School-managed Account is deleted, to copy the sets, cards, folders, notes and study guides they created into a Personal Account that uses a personal email address (a new Account or one they already have). Nothing is copied unless the student asks. Where the law or the School's policy requires a parent's consent (including for a School in Florida), for a student the School has not told us is 18 or older, the School first confirms to us in writing that the student's parent or guardian has expressly consented, and we record that confirmation. We rely on the School's confirmation, and the School is responsible for its accuracy. Practice answers, practice-exam results, assignment and Exam Studio records and AI tutor conversations are never copied; they are deleted with the School-managed Account.
• Notice to students. Before deleting a School-managed Account, we email the student at least 14 days in advance so that they can export their own sets and data (and we send them, on request, anything the export doesn't include) and, where the School allows, ask us to copy their own content as described above, unless the School asks us to act faster for a student's safety, the Account belongs to a child under 13, or the law requires faster deletion; we then delete it as soon as we reasonably can. The School may ask for an export of its students' progress and scores.
• A student deleting their own Account. Students can delete their own Accounts at any time. When a student who holds or held one of the School's Seats deletes their Account, we delete the Account and its data, but we keep the School-facing records about that student (section 1.3(c)) for the School, separated from the deleted Account, and handle them under this section.
• School-facing records. Within 60 days after the Plan ends, and within 60 days after the School tells us that a student has left the School, we delete or de-identify the School-facing records described in section 1.3(c) for the students concerned, including students with Personal Accounts and students who also hold a Seat from another organization, except billing records that contain no student practice data.
• Information the School gave us. Invited email addresses, uploaded lists and group names are deleted within 60 days after the Plan ends, and an invitation nobody accepted is deleted 90 days after it expires or is revoked.
• Personal Accounts. When the Plan ends or the student leaves, the School's access to that student ends at once. Apart from the School-facing records above, the Account stays the student's own under our Privacy Policy, and the student can delete it at any time.
• Certification. When we finish the deletion under this section, we confirm it to the School in writing.
• Backups. Backups are overwritten on their normal cycle, and deleted data is not restored from them except to recover the Service, in which case we delete it again.
• Legally required records. We may keep records the law requires (such as billing records, which contain no student practice data), and Student Data that a law, court order, preservation request or legal hold requires us to keep, used only for that purpose and deleted when the duty ends; we tell the School as section 4.2 describes, including its exceptions.

12.De-identified Data

We may use De-identified Data (for example, how often a question is answered correctly and how long it takes) only to calibrate question difficulty and score scales, to operate and improve the Service, and to measure its effectiveness (including in our marketing, without naming the School unless it agrees), and never to train, tune or develop AI systems. We will not try to re-identify it, and we will not share it with anyone who is not bound to the same promise.

13.State laws and other agreements

We comply with the student privacy laws that apply to the Service in the School's state, including laws that limit how operators of school services may use student information (for example, Florida's Student Online Personal Information Protection Act, section 1006.1494 of the Florida Statutes, and California's Student Online Personal Information Protection Act and Education Code section 49073.1). In particular, we don't use Student Data for targeted advertising, to build profiles except for the School's educational purposes, or to train or develop AI systems, and we don't sell it. If the law that governs the School requires a state addendum or a state or district standard agreement that the School had not asked for when the Plan began, we will review it promptly and in good faith; if we can't agree on its terms, either of us may end the Plan, and we will refund prepaid fees for the rest of the Term. An agreement we do sign controls where it is more protective of Student Data than this DPA.

For California local educational agencies, these sections are the terms Education Code section 49073.1 requires: section 2.4 (the School's ownership and control of pupil records, and how pupils keep pupil-generated content); sections 4 and 5 (no use of pupil information beyond this DPA, and no targeted advertising); section 10 (review and correction through the School); section 8 (security and confidentiality, including the designation and training of responsible individuals); section 9 (notice to the School of unauthorized disclosure, and help notifying affected parents and pupils); section 11 (certification that pupil records are not kept after the contract ends, other than pupil-generated content a pupil asks us to copy into a Personal Account, and how deletion is done); and section 2.1 (how the School and Havra together ensure FERPA compliance).

For Florida schools, section 11 is how we delete covered information at the end of the program, as section 1006.1494(3)(c) of the Florida Statutes requires. A copy a student asks for under section 11 is a transfer of the student's own documents (section 1006.1494(6)(h)), made, for a student the School hasn't told us is 18 or older, with a parent's express consent that the School confirms to us in writing.

14.Term and signing

This DPA starts when the School signs it (on a copy we send, by electronic signature or on paper; we then record it in the School's account) and lasts as long as the School has a Plan or a pilot, plus the time needed to complete section 11. Sections 14 (limitation of liability), 15 (indemnity), 17 (governing law and disputes) and 18 (general terms) of the Partner Terms apply to this DPA. If Havra merges or transfers the business that provides the Service, Student Data may move only to a successor that agrees in writing to be bound by this DPA for that data. We will tell the School's account owners no later than 30 days after the transfer. If the School objects to the successor, it may end its Plan within 60 days after our notice, with a refund of prepaid fees for the rest of the Term, and ask for its Student Data to be deleted under section 11. A change in who owns Havra is not a transfer.

THE LIMITATION OF LIABILITY IN SECTION 14 OF THE PARTNER TERMS, INCLUDING THE LIMIT FOR BREACH OF THE DPA IN SECTION 14(C), APPLIES TO EVERY CLAIM UNDER THIS DPA. Disputes between Havra and a student or parent about the student's own account are resolved under the Corvano Terms of Service, not under this DPA. Sections 5, 9, 11 and 12 survive for as long as we hold any Student Data. The person signing confirms that they are authorized to sign for the School. To sign, ask a question, or send your own agreement, write to partners@corvano.app.

15.Contact

Questions about this DPA, student data or a request from a family: partners@corvano.app. Security reports: partners@corvano.app and legal@corvano.app.

Havra LLC · partners@corvano.app