Data Processing Agreement

"School" or "District" means the educational institution entering into this agreement.

"ShortHand" means Lebed Digital LLC, the operator of the ShortHand application.

"Student Data" means any personally identifiable information (PII) related to students that is entered into ShortHand by school personnel, including but not limited to: student names, behavioral notes, parent contact information, and class assignments.

"Authorized Users" means teachers and school staff who have been granted access to ShortHand by the School.

ShortHand processes Student Data solely to provide the services described in the ShortHand application: classroom note-taking, behavior tracking, AI-assisted features (automatic note tagging, report and message drafting, summaries, and roster and calendar imports), and related teacher productivity features.

ShortHand acts as a "School Official" under FERPA with a legitimate educational interest, processing Student Data only on behalf of and under the instructions of the School.

ShortHand agrees to:

• Not sell Student Data to any third party for any purpose.

• Not use Student Data for advertising or to build profiles on students outside the School's educational context.

• Not share Student Data with third parties except subprocessors necessary to operate the service (listed in Section 6).

• Implement appropriate security measures including encryption at rest (AES-256), encryption in transit (TLS), and row-level access controls.

• Notify the School within 72 hours of becoming aware of a data breach affecting Student Data.

• Delete or return Student Data upon request or termination of the agreement within 30 days.

• Allow audit rights: provide documentation upon reasonable request to demonstrate compliance with this agreement.

The School agrees to:

• Ensure that Authorized Users have appropriate authorization to enter Student Data into ShortHand.

• Obtain any consents required by applicable law before entering Student Data into the system.

• Notify ShortHand promptly if it becomes aware of any unauthorized access to Student Data.

Student Data is retained only as long as the Authorized User's account is active.

Teachers can delete all Student Data at any time from within the app (Settings → Danger Zone → Factory Wipe).

Teachers can permanently delete their account and all Student Data (Settings → Danger Zone → Delete My Account).

Upon written request from the School, ShortHand will delete all Student Data associated with the School's Authorized Users within 30 days.

ShortHand uses the following subprocessors to process Student Data:

Supabase: database and authentication. Data stored in AWS us-east-1 (Virginia, USA). SOC 2 Type II certified. Schools in provinces with data residency requirements (such as British Columbia or Nova Scotia) should contact us to discuss options before signing up.

OpenAI: primary AI language model processing for all AI features. This includes automatic tagging of saved notes, report and parent message drafting, summaries, questions a teacher asks about their notes, and roster, birthday, and calendar imports. Depending on the feature, OpenAI may receive note text, student first names, and, for imports, full student names and parent or guardian names, email addresses, and phone numbers as pasted by the teacher. ShortHand uses the OpenAI API under the OpenAI Services Agreement, which incorporates OpenAI's Data Processing Addendum. OpenAI does not use API data to train its models by default, and ShortHand has turned off all optional data sharing with OpenAI. Standard API inputs and outputs may be retained by OpenAI for up to 30 days under its published data controls, primarily for abuse monitoring.

Groq: fallback AI language model processing. If an OpenAI request fails, is rate limited, or times out, the same request is sent to Groq instead, so Groq can receive the same categories of data as OpenAI. Groq does not use customer data to train models and offers a DPA. ShortHand configures Groq with Zero Data Retention, so student-derived inputs and outputs are not retained by Groq after processing.

Vercel: application hosting. SOC 2 Type II certified.

Google: optional Google Classroom integration only. Used solely to import class rosters when the teacher explicitly connects their account.

Other service providers. ShortHand also uses Stripe (payments), Resend (transactional email to teachers), Upstash (rate limiting by IP address), Google Analytics and Vercel Analytics (usage analytics), PostHog (public website only), Apple (Sign in with Apple), and RevenueCat (managing Apple in-app subscriptions, purchase verification, and subscription entitlements for the native iOS app, using the teacher's ShortHand account ID and Apple purchase details). These support operating the service and are not used to store or process student records.

Sentry: crash reporting for the web app. ShortHand does not send notes, reports, or other student records to Sentry. An error report includes a short technical log of recent activity in the app, and that log can incidentally contain a limited label or request detail, such as a student, parent, or class name. Sentry is not used in the native iOS app.

These providers are also listed in our Privacy Policy.

ShortHand acknowledges that Student Data shared by a School may be subject to FERPA (20 U.S.C. § 1232g).

ShortHand agrees to use Student Data only for the purposes for which it was disclosed (providing classroom management services to Authorized Users) and for no other purpose.

ShortHand will not re-disclose Student Data to any party other than the School or its Authorized Users without prior written consent from the School.

ShortHand is used by teachers across Canada. Canadian privacy law (PIPEDA and provincial equivalents such as BC's FIPPA and Quebec's Law 25) imposes stricter requirements than US federal law in some areas.

Key points for Canadian schools:

• Data location: Student data is stored on US servers (AWS us-east-1). Schools in provinces with strict data residency rules should review this with their IT department before using ShortHand. Contact us to discuss options.

• AI processing: Note text is sent to OpenAI (a US-based provider) when a note is saved without manually chosen tags, and when a teacher uses an AI feature such as a report, summary, or import. Imports can include full student names and parent or guardian contact details. Groq (also US-based) is an approved fallback if an OpenAI request fails. No student PII is used to train AI models.

• Data minimization: ShortHand collects only the information a teacher actively enters. Nothing is collected passively beyond what is necessary to operate the service.

Questions about Canadian compliance? Email info@getshorthandapp.com.

ShortHand is a teacher-facing tool. Teachers, not students, create accounts and enter data.

Students do not create accounts, log in, or directly interact with ShortHand.

ShortHand does not knowingly collect personal information directly from children under 13. Any student information in the system was entered by a teacher on behalf of the School.

This agreement is effective upon the School's first use of ShortHand and remains in effect until terminated.

Either party may terminate this agreement with 30 days written notice.

Upon termination, ShortHand will delete all Student Data associated with the School's accounts within 30 days, unless retention is required by law.

To request a countersigned DPA, report a concern, or ask questions about this agreement:

info@getshorthandapp.com

ShortHand / Lebed Digital LLC