StudyWire — Data Processing Agreement (draft for counsel)
Between the educational institution identified on the signature page ("Institution") and Recovery Transparency Technologies LLC, 705 Orchard Ave, Wilmington, NC 28403, USA ("Provider"). Effective on signature. Draft generated 2026-10-25 from the Provider's policy file (version 0.121.0); a lawyer should finish it.
1. Purpose and roles
1.1 The Institution's instructors may use StudyWire to run classes in which students ask questions of course material, take quizzes and receive study reminders, and in which the instructor sees students' work in that class.
1.2 Records about students that arise from class use (enrolment, class conversations, quiz records, session reads) are education records of the Institution under FERPA (20 U.S.C. § 1232g; 34 CFR Part 99). The Provider processes them only as a school official with a legitimate educational interest, under the Institution's direct control, as 34 CFR § 99.31(a)(1)(i)(B) allows.
1.3 Material and records a student creates for their own courses outside any class belong to the student and are governed by the Provider's privacy policy, not this Agreement.
2. What the Provider may do
2.1 Use Institution data only to provide StudyWire to the Institution's instructors and students, to secure and operate it, and as the Institution directs.
2.2 Not disclose Institution data to anyone except the sub-processors in §4, each bound to the same limits.
2.3 Not use Institution data for advertising, profiling beyond the product's study features, resale, or to train or improve machine-learning models, and ensure sub-processors do not.
2.4 Not collect grades, student identification numbers or government identifiers; the product has no fields for them.
3. The Institution's control
3.1 The Institution (through the instructor who owns a class) decides who joins a class (by code), can lock, regenerate the code, remove a student, or delete the class; deleting a class deletes its session reads at once.
3.2 On written request the Provider will, within 30 days, delete or return a named student's class records, or all records of a class or of the Institution, and confirm in writing.
3.3 Students may at any time download or delete their own account data from within the product.
4. Sub-processors
| Service | Purpose | Data it receives | Terms |
|---|---|---|---|
| Render | hosting: the web server, the database and uploaded files, on an encrypted disk in the United States | everything the service stores | https://render.com/privacy |
| Anthropic (Claude) | writes answers, quiz questions and grades, the material check, and the first of the three session-read judges | the question, the retrieved excerpts of the student's own material, the quiz answer being graded, or a closed study session's transcript; never the whole library | https://www.anthropic.com/legal/commercial-terms |
| Voyage AI | turns uploaded pages into search vectors once, at upload | the text of each uploaded page, in pieces | https://www.voyageai.com/legal/privacy-policy |
| Groq | transcribes lecture recordings; runs the second and third session-read judges (open-weight models) | the audio of a recording a student uploaded; a closed class study session's transcript | https://groq.com/privacy-policy/ |
| OpenRouter (Hermes test service only) | on the separate hermes-study-guide-psy334 test service, and nowhere else, the answer engine is an open-weight model (Nous Hermes) reached through OpenRouter instead of Anthropic; the main StudyWire site never contacts it | the question and the retrieved excerpts, exactly as the answer engine above receives them; that service's own database only | https://openrouter.ai/privacy |
| Resend | sends account emails: confirmation, password reset, instructor invitations | the recipient's email address and the message | https://resend.com/legal/privacy-policy |
| Stripe | subscriptions, top-ups and refills; card details never reach StudyWire | name, email, the plan or top-up bought; Stripe's customer and subscription ids are stored on the account | https://stripe.com/privacy |
| Apple Push Notification service | delivers reminders to the iPhone app | the device token and the notification text (a count of concepts due, never material) | https://www.apple.com/legal/privacy/ |
| Off-site backup bucket (only when configured) | keeps a copy of the nightly database snapshot outside the hosting disk, so a disk failure cannot lose every account; which provider is the operator's choice (Amazon S3 by default, or any S3-compatible store set by BACKUP_S3_ENDPOINT) | a complete snapshot of the database — accounts, material text, conversations, ledger — once a day; files on the shelf are not included | https://aws.amazon.com/privacy/ |
| Google Fonts | serves the typeface the pages use (Plus Jakarta Sans); the reader's browser fetches it directly | the reader's IP address and browser headers when the font loads — nothing about the account, the material or the conversation | https://developers.google.com/fonts/faq/privacy |
| The browser's push service (Apple, Google or Mozilla, depending on the browser) | delivers reminders to the website / home-screen app | an encrypted notification only that browser can read | https://developer.mozilla.org/en-US/docs/Web/API/Push_API |
The Provider will give the Institution 30 days' notice before adding a sub-processor; the build of the product fails if the software contacts a service not listed in its policy file, which is the technical control behind this clause.
5. Retention
| Record | Retained |
|---|---|
| Class Reads | until the class is deleted, or 365 days after it was created — whichever is first; an instructor can delete a class any time |
| Notifications | 90 days |
| Activity | 30 days |
| Admin Log | 3 years |
| Backups | 7 days |
6. Security
- Passwords are stored as salted PBKDF2 hashes; sign-in and code guessing are rate limited.
- Sessions are per tab; tokens never appear in URLs; files open with ten-minute single-file tickets.
- All traffic is HTTPS; the database and uploads sit on an encrypted disk.
- Instructors see a student's work only inside their class and only from the enrolment date; every such view is logged.
- Plan and allowance changes come only from Stripe's signature-verified webhook; purchases are checked for ownership and amount before credit.
- The build fails if the code contacts a provider that is not declared in this policy, or if the public policy pages drift from it.
- Breach notice: we tell affected users and, for a class, the instructor and institution, within 72 hours of confirming an incident, with what happened and what to do.
7. Incidents
The Provider will notify the Institution without undue delay and in any case within 72 hours of confirming a breach of Institution data, describing what happened, which records and students are affected, what the Provider has done, and what the Institution should do.
8. Access requests and audits
8.1 Parents of dependent students and eligible students may ask the Institution to see education records; the Provider will supply the Institution with the relevant records within 10 business days.
8.2 Once a year, or after an incident, the Institution may request written answers to a reasonable security questionnaire and a copy of the access log entries concerning its students.
9. Term and termination
This Agreement lasts while any instructor of the Institution uses StudyWire for a class, and for the retention periods in §5 thereafter. On termination the Provider deletes Institution data within 30 days except as the Institution asks for its return first.
10. General
No fees are owed under this Agreement itself; plans are bought by instructors or students under the Provider's terms of service. This Agreement controls over the terms of service where they conflict for Institution data. Governing law: North Carolina, USA. Contact for this Agreement: jeremy.heydon@transparencytechnologies.ai.
Signatures
Institution: ______________________ Name / title: ______________________ Date: ________
Recovery Transparency Technologies LLC: ______________________ Name / title: ______________________ Date: ________