A DPA your district can sign as written

This Data Privacy Agreement ("Agreement") is entered into between:

The District: ("District"), an Illinois public school district or school, with its designated contact for this Agreement: , (name, email);

and the Operator: Architecture of Grace, James Anthony Ramsden, sole proprietor ("Operator"), operator of the website architectureofgrace.org and its associated learning materials and tools.

Effective date of this Agreement: .

• "SOPPA" means the Illinois Student Online Personal Protection Act, 105 ILCS 85, as amended.
• "Covered Information" has the meaning given in SOPPA: personally identifiable information or information linked to it, created or gathered through the operator's site or service, that relates to a student.
• "The Service" means the Operator's website architectureofgrace.org, its learning activities and reflection instruments, the educator dashboard, and the published Apps Script sync code the District may deploy in its own Google Workspace.
• "District Sheet" means a Google Sheet owned and controlled by the District within the District's own Google Workspace account, together with the Apps Script deployment bound to it, set up by the District using the Operator's published instructions.
• "Local-Only Mode" means the Service's default operation, in which all student activity remains in the browser of the device used and is transmitted nowhere.
• "Sync Mode" means operation in which the District has deployed a District Sheet and completed instruments transmit one row per completion from the student's device directly to that District Sheet.

In Local-Only Mode, no Covered Information is transmitted to anyone, including the Operator. In Sync Mode, the following categories — and no others — are transmitted, from the student's device directly to the District Sheet:

The Service transmits no student names, free-text writing, journal entries, contact information, photographs, audio, location data, or persistent tracking identifiers in any mode. In all modes and at all times, the Operator receives no Covered Information whatsoever.

Covered Information is collected and used solely for K–12 school purposes: administering the District's chosen instruments, reporting results to the District's authorized staff, and informing instruction and student support. The Operator makes no use of Covered Information for any purpose, having none.

The Operator shall not, and the Service is designed so that the Operator cannot:

• engage in targeted advertising of any kind, on the Service or elsewhere, based on Covered Information — the Service carries no advertising at all;
• sell, rent, lease, or trade Covered Information;
• build a profile of a student for any purpose other than the instrument scoring the District itself administers, which occurs on the student's device and is disclosed only to the District;
• use or disclose Covered Information except as this Agreement and SOPPA permit.

• Architecture. The data plane lives entirely in the District's own Google Workspace: transmission is a direct HTTPS request from the student's device to the District's Apps Script deployment, and storage is the District Sheet. The Operator operates no server that receives, stores, relays, or can access Covered Information.
• Access control. Write access to the District Sheet requires a write key held in the District's Script properties; read access requires a separate pull key. Both keys are created by, held by, and rotatable by the District. The Operator does not possess them.
• Operator-side security. The Operator maintains the integrity of the published site and sync code, and will address reported vulnerabilities in them with reasonable promptness.
• District responsibilities. The District secures its Google Workspace account, Sheet sharing settings, and key distribution in accordance with its own policies; the Operator's published Data Governance document describes recommended practices, including key rotation and link handling.

None. The Operator engages no subprocessors and shares Covered Information with no third parties, having no Covered Information to share. Google LLC acts as the District's own service provider under the District's existing Google Workspace agreement, not as a subprocessor of the Operator.

The Operator holds no Covered Information, so a breach of Covered Information at the Operator is not structurally possible. However, if the Operator becomes aware of a security flaw in the published Service or sync code that could result in unauthorized acquisition of Covered Information from a District Sheet, the Operator shall notify the District's designated contact (Section 1) within 72 hours of determining the flaw exists, describing the nature of the flaw, the categories of information potentially affected, and the corrective measures taken or recommended. Breaches arising within the District's own Google Workspace (e.g., compromised District credentials or Sheet sharing) are governed by the District's own incident procedures and its agreement with Google; the Operator shall reasonably cooperate with any District investigation on request.

All Covered Information resides in the District Sheet and on District-used devices, both under the District's direct control. The District may delete any or all of it at any time without the Operator's involvement or permission. Upon any request for deletion directed to the Operator, or upon termination of this Agreement, the Operator shall confirm in writing that it holds no Covered Information — which shall constitute full compliance, there being nothing further to delete. The Operator's published documentation describes the deletion procedures the District performs in its own systems.

The Operator shall not use de-identified or aggregated Covered Information for commercial purposes, including product marketing or sale to third parties. (The Operator receives neither identified nor de-identified student data; this section forecloses the possibility as a matter of commitment, not only of architecture.)

This Agreement takes effect on the date in Section 1 and continues until terminated by either party on thirty (30) days' written notice, or immediately by the District at any time. Because the District holds all data and all keys, termination requires no data return or destruction by the Operator; the District may disable Sync Mode at any moment by rotating or removing its own keys or undeploying its own script. Sections 5, 8, and 10 survive termination.

This Agreement is governed by Illinois law. It constitutes the parties' entire agreement concerning student data privacy for the Service and controls over any conflicting term in the Operator's general Terms of Use. Amendments must be in writing and signed by both parties. If any provision is unenforceable, the remainder stands.