US Student Data Privacy Addendum

US schools and districts that use Propiler’s school module sign our Student Data Privacy Addendum with Arctiv AB. Email support@crdbag.com with your school or district name and state, and we send it to you. This page summarizes it; the signed addendum governs. State-specific exhibits are available on request.

Student data stays the school’s property and under its control. We process it only to provide Propiler to the school — keeping track of school equipment lent to students — and for no other commercial purpose. For students, the addendum prevails over our terms of service.

• The school designates Arctiv AB as a school official with a legitimate educational interest: we perform a service the school would otherwise use its own staff for.
• We are under the school’s direct control for how education records are used and kept: we follow the addendum and the settings the school’s administrators choose.
• We do not re-disclose personally identifiable information from education records, except to our subprocessors as needed to run the service, as the school directs, or where the law requires it — and then we tell the school first unless the law forbids it.
• Parents and eligible students exercise their rights through the school. Requests we receive go to the school within five business days.

• The school’s authorized official authorizes our collection and use of personal information of students under 13 on behalf of their parents — solely for the use and benefit of the school, and for no other commercial purpose.
• Our notice to the school is the addendum, our privacy policy and our student privacy notice; the school makes them available to parents.
• Propiler still requires the school to record a guardian’s approval before a student gets a login or an email address. The school decides what that approval rests on.
• Parents can review their child’s information, have it deleted and refuse further collection — through the school, which can do this in Propiler, or by contacting us; we confirm with the school, then act.

• No advertising of any kind, including targeted or behavioral advertising.
• No profiles of students beyond what the service needs (a student’s own list of loans).
• No selling, renting or trading — and no disclosure for anyone else’s commercial purposes.
• No training of AI or machine-learning models.
• No marketing to students or parents, and no attempt to re-identify de-identified data.

We count active students only to apply the school’s price band. If the service ever passes to another company, student data goes with it only if the successor is bound by the addendum, and we tell the school first.

A name and class, the status of the guardian’s approval, loans of school equipment, and — if the school gives them — login codes (verified against a hash) and an email address. When a student signs in we also keep technical data such as the IP address. We do not collect Social Security numbers, dates of birth, grades, attendance, health or disciplinary information, biometric data, or the location of a student’s device. Schools start with AI photo analysis, AI assistant/API access and location capture switched off.

We comply with the state laws that apply to us as a school’s operator or vendor — for example California’s Student Online Personal Information Protection Act and Education Code §49073.1, New York Education Law §2-d, and Illinois’ Student Online Personal Protection Act. Where a state requires its own contract terms, we sign a state-specific exhibit.

• A written information security program: encryption at rest and in transit, server-side access control on every request, data separated per organization, individual staff access grants, rate-limited student logins, 35-day backups, logging and monitoring. See the security page.
• If student data is breached, we tell the school without undue delay — aiming for 24 hours and no later than 48 hours after we become aware — and help with the notices the school must give.

We use only the subprocessors on our subprocessor list, bound by written contracts, and we notify the school at least 30 days before adding one. Student data is stored in the European Union (Amazon Web Services, Stockholm, Sweden); some subprocessors process data in the United States.

• The school can erase a student at any time: the name, email address, login codes and login account are deleted, and the loan history stays without the name.
• When the agreement ends, the school can export its data for 30 days; we then delete all student data within 30 days, and backups roll off within a further 35 days. We confirm deletion in writing on request.

The addendum is governed by the laws of the state in which the school is located, and disputes about it are resolved in the courts of that state. Everything the addendum does not cover follows our main agreement.