Data Processing Agreement

For Schools and Districts using ConnectInk

This Data Processing Agreement ("DPA") is entered into between ConnectInk ("Processor") and the school or district ("Controller") that has authorized student access to the ConnectInk platform. This page summarizes our standard terms; a signed agreement — on this template or the district's own — is available on request.

1. Scope and Purpose

ConnectInk processes student data solely to provide the educational writing feedback service described in our Privacy Notice. No processing occurs outside this defined purpose.

2. Data Protection Obligations

ConnectInk agrees to:

• Process student data only on documented instructions from the school.
• Ensure authorized personnel are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Not engage additional sub-processors without school notification.
• Assist the school with data subject rights requests (access, correction, deletion).
• Delete or return all student data upon termination of service.
• Provide all information necessary to demonstrate compliance with NYS Ed Law 2-d and FERPA.

3. Sub-Processors

Current sub-processors: Clerk (authentication), Convex (database and backend), Anthropic (Claude API inference — does not train on API data; retention per its API data-retention policy), Vercel (hosting and edge network), Upstash (rate limiting), and Resend (transactional email). ConnectInk will notify schools at least 30 days before adding new sub-processors.

4. Security Incidents

ConnectInk will notify the school without undue delay and no later than seven (7) calendar days after becoming aware of a security incident involving student data, and will provide the information the school needs to meet its own notification obligations.

5. Governing Law

This DPA is governed by the laws of the State of New York, consistent with NYS Education Law Section 2-d.

6. Contact

For DPA inquiries: rahul@innovateinsightfully.com