Student Data Privacy Addendum

Our Commitments to Schools

Kuliso adheres to the principles of the Student Privacy Pledge. These are non-negotiable commitments, not marketing copy.

Data Inventory — What We Collect

The following table enumerates every category of student data Kuliso collects, why we collect it, and whether it is stored as personally identifiable information (PII), anonymized, or not collected at all.

Section 1 — Definitions

Section 2 — Scope & Purpose

2.1 This DPA applies to all Student Data provided to Kuliso by the School in connection with the Kuliso tutoring service.

2.2 Kuliso processes Student Data solely for the Authorized Purpose — providing AI-assisted tutoring to Covered Students. All other uses of Student Data are prohibited unless expressly agreed to in writing by the School.

2.3 The School authorizes Kuliso to process Student Data as a "school official" under FERPA, 34 CFR § 99.31(a)(1), with a legitimate educational interest in the performance of the tutoring service.

2.4 This DPA does not authorize Kuliso to: (a) sell or rent Student Data; (b) use Student Data for any commercial purpose unrelated to the Authorized Purpose; (c) disclose Student Data to third parties except Subprocessors listed in Section 7; or (d) use Student Data to build advertising profiles.

Section 3 — Kuliso's Obligations

Kuliso agrees to:

• Use limitation: Process Student Data only for the Authorized Purpose and not re-disclose it to any third party without the School's prior written consent, except to Subprocessors bound by equivalent obligations or as required by law.
• No selling: Never sell, rent, trade, or otherwise monetize Student Data.
• No behavioral advertising: Never use Student Data to build advertising profiles or serve behavioral advertising.
• No AI training: Never use Student Data, session transcripts, or any personally identifiable Student Data to train AI or machine learning models.
• Encryption at rest: Store all Student Data using AES-256 encryption at rest. Database credentials are rotated regularly and access is limited to least-privilege service accounts.
• Encryption in transit: Transmit all Student Data over TLS 1.2 or higher. Unencrypted HTTP connections are rejected.
• Access controls: Limit access to Student Data to authorized Kuliso personnel with a demonstrated need. Role-based access controls prevent teachers from accessing data outside their classroom and students from accessing other students' data.
• Audit logging: Maintain a tamper-evident Privacy Audit Log recording every access to Student Data, including actor identity, action type, resource accessed, and timestamp. See Section 10.
• Subprocessor management: Ensure all Subprocessors that handle Student Data are bound by contractual obligations at least as protective as this DPA. See Section 7.
• Employee training: Ensure that Kuliso personnel with access to Student Data are trained on data privacy obligations and FERPA requirements.
• Breach notification: Notify the School within 72 hours of discovering a confirmed Breach involving Student Data. See Section 5.
• Deletion on request: Delete or return all Student Data within 30 days of written request by the School or termination of services. See Section 6.
• Cooperation: Cooperate with the School's reasonable requests to demonstrate compliance with this DPA, including providing audit log excerpts upon written request.

Section 4 — School's Obligations

The School agrees to:

• Comply with FERPA and applicable state student data privacy laws when sharing Student Data with Kuliso.
• Include Kuliso in the School's annual FERPA notification to parents/guardians as a "school official" or equivalent disclosure.
• Obtain and maintain any required parental consent for Under-13 Students where the school operator exception under 16 CFR § 312.5(b)(1) does not apply.
• Provide Student Data only as necessary for the Authorized Purpose.
• Promptly notify Kuliso of any known unauthorized access to or misuse of Student Data by School personnel.
• Ensure that teachers and administrators who configure student access have read and understood their responsibilities under this DPA and the Kuliso Terms of Service.
• Designate a privacy contact for Breach notifications and data requests.

Section 5 — Breach Notification & Response

5.1 Detection: Kuliso maintains monitoring systems to detect unauthorized access or anomalous activity involving Student Data.

5.2 Initial notification: Upon discovering a confirmed or reasonably suspected Breach affecting Student Data, Kuliso will notify the School's designated privacy contact within 72 hours via email.

5.3 Notification content: The initial notification will include, to the extent known: (a) the nature of the Breach; (b) the categories and approximate number of affected students; (c) the likely consequences; (d) the measures taken or proposed to address the Breach.

5.4 Remediation: Kuliso will take prompt steps to contain the Breach, prevent further unauthorized access, and restore service integrity. Kuliso will cooperate with the School's incident response team and provide updated information as the investigation progresses.

5.5 School notification obligations: The School is responsible for notifying parents, guardians, and applicable state authorities as required by law. Kuliso will provide reasonable assistance in preparing such notifications upon request.

Section 6 — Data Retention & Deletion

6.1 Kuliso retains Student Data for the duration of the active service agreement, plus up to 90 days following termination (to allow data export).

6.2 Upon written request from an authorized School representative or verified parent/guardian (for COPPA-covered students), Kuliso will:

• Begin deletion of Student Data within 10 business days of the verified request
• Complete deletion from all active systems within 30 days
• Purge Student Data from all backups within 90 days
• Provide written confirmation of deletion upon completion

6.3 Kuliso may retain anonymized, aggregated statistics (with no personally identifiable information) after deletion for service improvement research.

6.4 Privacy Audit Logs (Section 10) are retained for a minimum of 5 years as required for FERPA compliance, even after student account deletion. These logs contain no personal tutoring content.

6.5 To submit a deletion request, use the Privacy Request Center or contact support@kuliso.org with "Data Deletion Request — [School Name]" in the subject line.

Section 7 — Subprocessors

Kuliso uses the following Subprocessors that may access or process Student Data in the course of providing the service:

Kuliso will provide at least 30 days' written notice before adding or replacing Subprocessors that have access to Student Data, allowing Schools to object. If a School reasonably objects to a new Subprocessor, Kuliso will use commercially reasonable efforts to accommodate the objection.

Section 8 — FERPA School Official Designation

8.1 The School hereby designates Kuliso as a "school official" under FERPA, 34 CFR § 99.31(a)(1), with a legitimate educational interest in accessing Student Data for the Authorized Purpose.

8.2 Kuliso acknowledges this designation and agrees to be subject to FERPA's requirements applicable to school officials, including:

• Using Student Data only for the Authorized Purpose
• Maintaining direct control of Student Data as required by the School
• Not re-disclosing Student Data without authorization
• Allowing the School to audit Kuliso's use of Student Data upon reasonable notice

8.3 The School acknowledges its responsibility under FERPA to identify Kuliso as a school official in its annual FERPA notice or equivalent parental notification procedures.

8.4 Parent/Eligible Student Rights: Parents of minor students (and Eligible Students on their own behalf) retain the right to: (a) inspect and review their child's education records maintained by Kuliso; (b) request amendment of inaccurate records; (c) request deletion of records; and (d) receive a copy of their child's data. Requests should be directed to the Privacy Request Center or emailed to support@kuliso.org.

Section 9 — COPPA & Under-13 Students

9.1 Direct Signup (Outside School Context)

For Under-13 Students who access Kuliso outside of a school enrollment — for example, via a direct family subscription — Kuliso requires verifiable parental consent before the student account becomes active:

• A parent or legal guardian must provide their name, email address, and relationship to the student
• Kuliso sends an email verification link to the parent. The account is not activated until the parent clicks the confirmation link
• The verification link expires after 72 hours. A new link may be requested at any time
• Consent is recorded with a timestamp, IP address, and a hash of the exact consent notice text shown at the time of consent
• Parents may withdraw consent at any time, which immediately suspends the student's account pending data deletion

9.2 Data Minimization for Under-13 Students

For Under-13 Students, Kuliso applies additional data minimization:

• No marketing emails are sent to Under-13 Students
• Session transcripts for Under-13 Students are subject to the same deletion rights as all other student data
• Parents may request a full export or deletion of their child's data at any time via the Privacy Request Center

9.3 Age Determination

Kuliso determines student age from the grade level and date of birth (if provided) at account creation. If a student is identified as under 13, additional consent verification steps are applied as described in Section 9.1. Schools using the school operator exception are responsible for representing that students in their roster meet applicable age requirements or that appropriate parental consent has been obtained.

Section 10 — Audit Logging & Access Controls

10.1 Privacy Audit Log

Kuliso maintains a Privacy Audit Log that records every access to Student PII, including:

• Identity and role of the person or system accessing data
• Action performed (e.g., read, update, export, delete, AI session)
• Resource accessed (e.g., student profile, session transcript, classroom record)
• IP address and user-agent of the request
• Timestamp of access

Audit logs are retained for a minimum of 5 years. Schools may request a log excerpt for specific students or date ranges by emailing support@kuliso.org.

10.2 Role-Based Access Controls

Kuliso enforces the following access control boundaries:

• Students can only access their own data. They cannot view other students' sessions, messages, or assessment records
• Teachers can access data for students currently enrolled in their classrooms only. They cannot access data for students in other teachers' classrooms
• Parents can access and request deletion of their own child's data after identity verification
• Kuliso administrators have read access to all Student Data for support and compliance purposes. All admin accesses are logged
• The Kuliso AI engine (Google Gemini API) receives only the current student's session context. No cross-student data is included in prompts. All processing occurs on US servers.

10.3 Audit Access for Schools

Authorized school district administrators may request an audit report for any subset of their enrolled students by submitting a written request to support@kuliso.org. Reports will be provided within 10 business days.

Section 11 — Parent & Student Rights

The following rights are available to parents of minor Covered Students, and to Eligible Students (age 18+) on their own behalf. All requests are processed through the Privacy Request Center or by emailing support@kuliso.org.

Section 12 — State Law Compliance

In addition to FERPA and COPPA, Kuliso is designed to comply with the following state student privacy laws. Districts in states not listed may contact us to discuss specific requirements.

For districts in states with specific DPA template requirements (e.g., New York's standard template), Kuliso can execute the state-specific template in addition to this DPA. Contact support@kuliso.org.

Section 13 — Term & Termination

13.1 This DPA is effective upon the date the School first uses Kuliso services and remains in effect for the duration of the service relationship.

13.2 This DPA terminates automatically upon termination of the School's service agreement with Kuliso.

13.3 The obligations in Section 3 (Kuliso's Obligations), Section 5 (Breach Notification), Section 6 (Data Deletion), and Section 10 (Audit Logging) survive termination of this DPA.

13.4 Upon termination, Kuliso will provide the School with a final data export (upon written request) within 30 days, after which all Student Data will be deleted per Section 6.

Section 14 — Governing Law & Amendments

14.1 This DPA shall be governed by the laws of the State of Delaware, without regard to conflict of law principles. Nothing in this DPA limits either party's compliance with applicable federal and state student privacy laws.

14.2 Kuliso may update this DPA with 30 days' written notice to the School. If a School objects to a material change, it may terminate the DPA without penalty within the notice period.

14.3 This DPA, together with the Kuliso Terms of Service and any executed school purchase agreement, constitutes the complete agreement between the Parties regarding Student Data privacy.

14.4 If any provision of this DPA is found to be unenforceable, the remaining provisions continue in full force and effect.

Signatures

By signing below (or by executing a countersigned version provided by Kuliso), both Parties agree to the terms of this Student Data Privacy Addendum.

Request a Signed Copy

Email us to receive a PDF version of this DPA pre-signed by Kuliso's authorized representative. We'll return it within 1 business day and can accommodate district-specific additions or amendments on request.