Data Processing Addendum

Form revision: October 4, 2026.

This is an execution form for institutional deployments. Reading this page, creating a class, or accepting individual Pilot Terms does not execute it. Lecture Hat and an authorized representative of Institution must complete and sign an execution copy, including the required deployment details and annexes, before covered personal data is submitted. The signed copy controls; later website changes do not amend it.

1. Cover Page and incorporated Standard Terms

This Data Processing Addendum (DPA) has two parts: this completed Cover Page, including its amendments and annexes, and the Common Paper DPA Standard Terms, Version 1.1, released May 9, 2025, at commonpaper.com/standards/data-processing-agreement/1.1/. The Standard Terms are incorporated by reference when both parties sign this form. Capitalized words not defined here have their Standard Terms meanings. This Cover Page controls an inconsistency with those Standard Terms, subject to mandatory transfer clauses properly executed by the parties.

Template attribution and changes: Adapted from the Common Paper Data Processing Agreement, Version 1.1, by Common Paper, Inc., under Creative Commons Attribution 4.0 International (CC BY 4.0). Original template and cover page; source repository. Lecture Hat added institutional/FERPA scope, restricted-feature authorization, California terms, product-specific annexes, and the explicit amendments in Section 3. Common Paper has not endorsed these changes.

2. Key Terms — complete before signature

• Provider: Lecture Hat, Inc., a Delaware corporation, 7710 SW 67th Ave, South Miami, FL 33143-4532, USA. Provider's legal, security, and privacy notice address: [email protected].
• Provider Security Contact: [email protected]; Lecture Hat, Inc., Attn: Security, at the Provider address above. This is the Provider Security Contact for requests under the incorporated Standard Terms.
• Customer / Institution: [FULL LEGAL NAME]; [PHYSICAL ADDRESS]; authorized representative [NAME AND TITLE]; designated privacy/security contact [NAME, TITLE, EMAIL, PHONE]. A teacher may bind Institution only with authority to do so.
• Agreement: [TITLE AND DATE OF SIGNED INSTITUTIONAL SERVICES AGREEMENT]. If there is no separate agreement, attach a signed deployment schedule identifying courses, dates, features, fees (including zero if applicable), and responsible contacts. That schedule and this DPA constitute the Agreement. Individual consumer Terms of Service are not Institution's Agreement.
• Service: Lecture Hat's website, iPad and macOS applications, browser extensions, and related services, only for the courses/features specified in the signed deployment schedule and Annex I(B).
• Customer role: [CONTROLLER, OR PROCESSOR FOR AN IDENTIFIED CONTROLLER]. Provider acts as Processor or Subprocessor accordingly. Identify an upstream controller and its authorization if applicable.
• Approved Subprocessors: The vendor identities, locations, tasks, and features expressly selected in the signed Annex III. The public Subprocessor List is an inventory for preparing that annex; viewing it does not approve every vendor or feature.
• Security Policy: Annex II to the execution copy. The public Security & Vulnerability Disclosure provides background and does not replace the agreed annex.
• Effective Date and Term: Date of the last party's signature; approved deployment [START AND END DATES]. Standard Terms Section 10 continues to apply while Provider processes Customer Personal Data.
• Governing Law and Chosen Courts: Delaware law, excluding conflict-of-laws rules, and state and federal courts in New Castle County, Delaware, unless the parties record a lawful alternative in the execution copy. Mandatory public-body requirements and an executed transfer instrument's law/forum take precedence where applicable. Consumer arbitration and class-action waivers do not apply to Institution.
• Liability and indemnification: Standard Terms Section 8, as modified in Section 3.8 below, applies to limitations in the signed institutional Agreement. No consumer liability cap or indemnity is incorporated. Any DPA-specific indemnity or increased cap must be expressly agreed in the execution copy. Nothing limits liability that cannot lawfully be limited or data subjects' rights.
• Legal relationships: Applicable data-protection laws [LIST]; FERPA school-official designation [YES / NO AND OUTSOURCED FUNCTION]; California service-provider relationship [YES / NO]; restricted-transfer mechanism [COMPLETE SECTION 3.3 IF APPLICABLE]. Required fields must be resolved before signature, rather than treating an omission as permission to process.

3. Changes and additions to the Common Paper Standard Terms

3.1 Scope, instructions, confidentiality, and permitted use

For Standard Terms Sections 1, 2, and 11.5, Customer Personal Data includes personal data Institution provides or Provider collects or generates from authorized users on Institution's behalf in the approved deployment. Personally identifiable information from education records is also called Student Data.

Standard Terms Section 2.2 is replaced: Institution determines lawful purposes and supplies lawful documented instructions. Provider processes only to provide, secure, maintain, and support the approved Service, as documented in the Agreement, Annex I, and further written instructions acknowledged by Provider. Use of the Service, a teacher's setting change, or an individual's consent does not authorize processing outside those instructions. Provider must notify Institution before legally required processing unless notice is prohibited, and immediately inform Institution if unable to follow an instruction or if it appears to violate applicable data-protection law. Institution must ensure its instructions comply with applicable law and, when acting as a processor, its controller's authorization.

Provider must bind authorized personnel to confidentiality, limit their access to their duties, implement Annex II safeguards, assist Institution with data-subject rights and GDPR Articles 32–36 where applicable, and demonstrate compliance. This form does not approve processing data about anyone under 18. Institution must not enroll minors or submit their personal data.

Provider will not sell Customer Personal Data, use it for advertising, or train or fine-tune AI models with it. Before routing covered data to a subprocessor, Provider must obtain written terms imposing the required restrictions. Feedback or optional research consent cannot authorize processing the DPA or Institution's lawful instructions prohibit. Any de-identified statistics must comply with applicable law, not permit reasonable identification of a person or Institution, and not be re-identified.

The second paragraph of Standard Terms Section 2.3 is replaced: material expansion of data categories, purposes, features, or processing locations requires Institution's prior written agreement. A product update does not itself authorize new processing. The baseline Privacy Policy describes actual processing and does not expand the DPA's instructions.

3.2 Subprocessor approval and feature limits

Standard Terms Section 2.6.1 is modified: the notice and objection periods are each 30 calendar days. Provider must email the designated contact at least 30 days before adding/replacing a subprocessor or materially changing its approved task or location. Posting an updated webpage alone is insufficient. Institution may object on reasonable data-protection grounds within that period; silence afterward constitutes approval. Proposed processing must not begin while a timely objection remains unresolved. The parties will work in good faith to resolve it; if they cannot, either may end the affected Service and Institution receives a refund of prepaid fees for its unused portion. Stricter approval rules required by law or an executed transfer instrument prevail.

This notice-and-objection process approves a subprocessor only within the previously agreed processing scope. Silence does not supply the prior written agreement required by Section 3.1 for a material expansion of data categories, purposes, features, or processing locations; obtain that agreement before the expanded processing begins.

Standard Terms Sections 2.6.2–2.6.4 continue to require written subcontracts, equivalent data-protection duties where applicable, access to relevant agreements, and Provider responsibility for subprocessors.

Eleven Labs Inc. is excluded from authorization in this form. ElevenLabs publishes a data-processing addendum that its terms incorporate for business-client content, but Lecture Hat has not verified the contractual coverage and configuration applicable to its account, including account-level Zero Retention Mode or model-improvement opt-out. Publication of that addendum alone does not approve the provider for this deployment. Live Closed Captions/Live Subtitles and text-to-speech, including Read Aloud and narrated lessons on web and native apps, must not send Student Data or other covered personal data to ElevenLabs unless the parties first agree in writing on compliant provider terms and a verified configuration. The same restriction applies to cloud fallback transcription of uploaded audio and video, which uses standard processing with provider logging and retention enabled. No fixed provider retention period has been verified. Asking ElevenLabs to disable logging for live captions or speech output is not verification. Signing this DPA does not disable features in software. The deployment schedule must identify how restricted features will be excluded for students and instructors; teacher exemptions from class feature gates do not authorize excluded processing. If exclusion cannot be established, the affected deployment must not begin.

Amazon Textract OCR fallback also requires approval of its task, region, and effective account settings before covered data is sent. Its separate AWS service terms permit content storage and service-improvement use unless an effective AI services opt-out applies; Lecture Hat has not verified that setting or zero retention.

AWS Bedrock routes also require review of actual models, regions, retention modes, and applicable provider terms before approval. A generic statement about Bedrock is not verification of every Runtime, Mantle, or global inference route.

3.3 Restricted transfers — replace Standard Terms Sections 3.1–3.4

Provider may process or transfer Customer Personal Data only in agreed locations with safeguards required by applicable law. Provider will supply information needed to assess an intended restricted transfer and assist with transfer assessments and supplementary measures where required.

This public form does not execute or automatically incorporate EU SCCs, the UK Addendum, or a Swiss transfer instrument. Before relying on contractual clauses, the parties must attach or expressly incorporate a completed, legally binding transfer instrument in the signed execution copy. Without a lawful mechanism and approved configuration, a restricted transfer must not occur.

• EEA: Where legally appropriate, use unmodified applicable modules of the European Commission's 2021/914 standard contractual clauses. Select Module Two or Three only after confirming actual roles and applicability. Complete docking, authorization/notice, redress, governing-law and court choices; Annex I(A) parties; Annex I(B) transfers; Annex I(C) competent supervisory authority under Clause 13; Annex II safeguards; and Annex III where required. No EEA governing state or supervisory authority is selected by this webpage.
• UK: Where applicable, complete and execute the ICO's International Data Transfer Addendum, Version B1.0, in force March 21, 2022, including Tables 1–4, selected SCC modules/options, appendix information, and the parties permitted to end it following a revision.
• Switzerland: Where applicable, record the required Swiss-law adaptations and competent authority in the transfer instrument instead of assuming unmodified EU clauses suffice.

An executed mandatory transfer instrument controls conflicts concerning its transfers, including law, forum, liability, audit, deletion, and data-subject rights. The annexes below become transfer annexes only when included in the completed transfer instrument.

3.4 Security, incidents, audits, and assistance

Standard Terms Section 4 remains in effect: notify Institution without undue delay, and no later than 72 hours after awareness of a Security Incident; provide information as it develops; and take reasonable containment/investigation steps. Include known information needed for Institution's reporting, including the nature, affected data/people, likely consequences, mitigation, and a contact. The 72-hour limit is not permission to delay an otherwise required notice.

Standard Terms Section 5.2 is replaced: no independent audit, SOC 2 report, or certification is represented by this form. Provider must supply relevant reports it actually holds, if any, confidentially. Section 5.1's restriction to reports and due diligence and Section 5.3's annual request limit are replaced: Institution may request information and audits, including inspections, reasonably necessary to demonstrate compliance, with reasonable notice, confidentiality, and protection of unrelated customers' data. Regulatory, incident-driven, and mandatory-law audits are not restricted by an annual limit. Provider must contribute to such audits. Remaining confidentiality or intellectual-property restrictions in Section 5.1 must not prevent an audit or disclosure required by applicable law or an executed transfer instrument. Its three-year compliance-record requirement continues, but does not authorize retaining Customer Personal Data contrary to Section 3.5; compliance evidence must be minimized or de-identified where possible.

Standard Terms Section 6 remains in effect, including rights requests, impact assessments, and authority consultations. Reimbursement for assistance must be reasonable and agreed in writing in advance; payment cannot condition assistance where law prohibits it, and Provider bears costs arising from its breach. Provider may respond to a binding legal demand when required, notifying Institution unless prohibited.

3.5 Return and deletion

Standard Terms Section 7.1 continues to apply. Section 7.2 is replaced: at the end of the covered processing services or on lawful instruction, return or delete Customer Personal Data at Institution's choice and delete existing copies, unless applicable law requires storage. Permission under law to retain data, or deletion being inconvenient or impracticable, is not a separate retention authorization. The execution copy must record return format, completion deadlines, required legal retention, backup rotation, and restore safeguards. Protect and isolate any temporarily retained copies; process legally retained data only to the extent and for as long as the law requires. An agreed schedule may not reduce mandatory rights. Provide written confirmation of completion, identify any legally retained copies and their retention basis, and provide deletion certification required by an executed transfer instrument without making it conditional on Institution's request.

Product deletion behavior does not establish an institutional erasure deadline. Records may first be hidden and enter later cleanup; backup rotation depends on successful jobs. The execution copy must address the schedules in Annex I(B) and any remediation Institution requires. Ending a class does not itself automatically purge all student records.

3.6 FERPA — only if expressly selected

If Institution selects a school-official relationship in the signed Cover Page, it identifies the outsourced institutional function for which it would otherwise use employees and the legitimate educational interest. Provider performs that function under Institution's direct control over the use and maintenance of education records, processes them only for that purpose, and is subject to 34 C.F.R. §§ 99.31(a)(1)(i)(B) and 99.33(a). Institution determines that the arrangement satisfies FERPA's conditions and limits access to records in which Provider has a legitimate educational interest. Its annual FERPA notice must include the applicable school-official and legitimate-interest criteria under 34 C.F.R. § 99.7(a)(3)(iii); signing this DPA does not supply that notice. Provider must follow Institution's lawful access, correction, retention, and deletion instructions and not redisclose record information except as legally authorized for the agreed purpose. Institution retains its rights in its records.

Creating a class, using a school email, or enrolling individually does not itself create this designation or imply institutional endorsement. The Service is for adults 18 and older and is not offered as a K–12 deployment.

3.7 California — only for a qualifying service-provider relationship

Where applicable and selected in the signed Cover Page, Annex I(B) specifies the limited business purposes. Provider must not sell/share personal information; retain, use, or disclose it outside those purposes or the direct business relationship except as legally permitted; or combine it with other-source information except as legally permitted. Provider certifies that it understands and will comply with those restrictions, will provide protection required by the CCPA, and will notify Institution if unable to comply. Institution may take reasonable and appropriate steps to verify compliance and, on notice, stop and remediate unauthorized use. This does not declare every Institution a CCPA business or every provider service a service provider.

3.8 Priority and changes

Between Institution and Provider, precedence for covered processing is: applicable mandatory transfer instrument; completed Cover Page and annexes; Common Paper DPA Standard Terms Version 1.1; signed institutional Agreement. Individual Pilot Terms exclusively govern participants' in-course use but cannot expand the institutional DPA's authorized processing. The DPA does not make an individual a party. The Privacy Policy remains the baseline factual notice.

Standard Terms Section 8.2 is replaced: Institution enforces the contractual rights granted to it by this DPA. This allocation does not restrict an individual's independent rights under their Pilot Terms, applicable law, or an executed transfer instrument; it does not make Institution the exclusive claimant for those independent rights.

Standard Terms Section 11.6 is replaced: this DPA consists of the signed Cover Page and completed annexes, the incorporated Common Paper DPA Standard Terms Version 1.1 as expressly amended here, and any additional documents expressly identified for incorporation in the signed execution copy. Except for documents expressly incorporated above or in the signed execution copy, links to public notices, vendor inventories, source templates, licenses, and legal authorities are informational references and do not incorporate their separate terms or later revisions into this DPA. An executed transfer instrument retains the priority stated above.

Except for the agreed subprocessor process, changes require a writing signed by both parties. Later publication does not amend an executed copy. The DPA may be signed in counterparts/electronically; obligations concerning retained data and mandatory individual rights survive expiry.

Annex I(A). Parties and deployment

Provider / importer if applicable: Lecture Hat, Inc.; address/email in Section 2; authorized signatory [NAME/TITLE]; privacy/security representative [NAME/TITLE]. Activities: supplying the approved Service. Role: Processor, or authorized Subprocessor.

Institution / exporter if applicable: [LEGAL NAME, ADDRESS, CONTACT NAME/TITLE/EMAIL, ACTUAL ROLE]; courses/departments [IDENTIFIERS]; approved features [SELECT FROM ANNEX I(B)]; deployment [DATES]; upstream controller and authorization [IF APPLICABLE]. Activities: operating the adult course/deployment and issuing instructions.

Institution confirms disclosure/instruction authority, supplies notices and obtains legally/institutionally required permissions. Where recording is approved, this includes recording notice and permission. An individual checkbox supplies neither other people's consent nor Institution's authority.

Annex I(B). Processing details

• Subject matter/purpose: Host and support the selected adult learning deployment. A chat-only Course Pilot answers questions grounded in teacher materials. Broader import, upload, transcription, assessment, collaboration, or research features require separate identification in the signed schedule.
• Nature: Receive/organize authorized content; store accounts, enrollment, notebooks and approved content in PostgreSQL/pgvector and MinIO; index/retrieve materials; transmit necessary prompts, excerpts and images for approved inference; deliver answers; keep usage/security metadata; and return, correct, restrict, or erase data. Uploading a supported teacher or student file starts indexing automatically, so content and rendered page images may reach an approved AI provider before any chat request. The default student chat-only preset restricts uploads; teacher tools and later setting changes require separate scope review. An accepted assignment submission can automatically trigger AI review, integrity signals, and a score stored on the submission; Pilot or Strict Privacy mode omits chat text from that review but does not disable the review itself. Assessment processing, like optional research retention, requires explicit authorization and cannot be enabled merely because the software permits it.
• Data subjects: Participating students, instructors, staff and other adults whose information Institution is authorized to provide. All must be 18 or older. Minors are excluded.
• Account/session categories: Name, institutional email, Clerk/user identifiers, enrollment/roles, age-verification data where collected, IP/user-agent/session metadata, preferences and versioned acceptance records.
• Content/derived categories, only for approved features: Teacher course materials; questions/answers processed for inference; files, images, notebooks, imported coursework, transcripts, submissions, grades, feedback, review/integrity signals, extracted text, embeddings, and knowledge-graph records. A chat-only pilot avoids saving student chat text by default. Separate optional prompt collection retains questions/answers for Lecture Hat's review only when institutional instructions and participant choice both allow it.
• Operational categories: Timestamps, model/token/usage records, enrollment, security/diagnostic records and support correspondence. Per-student usage remains personal data even without prompt text.
• Sensitive/special categories: Not requested or permitted under this form. No GDPR Article 9/10 data, biometric identifiers, health/financial-account information, or comparable sensitive content without a signed amendment establishing lawful basis and safeguards. Education records may still be FERPA-protected. Stripe collects full payment-card details directly for billing, outside learning-content processing.
• Frequency: Registration, enrollment, upload/indexing, each inference and enabled course activity, support, and scheduled operational/backup tasks throughout the term. Optional research collection is off by default for the standard pilot.
• Duration: Approved term, then return/deletion as instructed and any legally required storage. Complete [ACTIVE DATA DEADLINE; RETURN FORMAT; BACKUP EXPIRY; LEGAL EXCEPTIONS]. Settings → Privacy can revoke optional pilot collection and delete stored course chats. Course end does not automatically erase account, enrollment, usage or backup records.
• Current deletion baseline to assess: Consumer account deletion has a 30-day cancellation grace period, followed by application cleanup and separately queued retrieval-index cleanup. The current job excludes legacy audio in the retired notebook-recordings bucket, whose separate manual cleanup is unverified. Permanent deletion-coordination records can retain account/class/Stripe Customer identifiers and storage bucket/object keys, including filenames. These are not necessarily anonymous merely because they contain no document or message body. Identify any covered records and agree and implement their return/deletion or required-law retention before committing to institutional completion deadlines; this baseline does not authorize retention contrary to Section 3.5.
• Locations: PostgreSQL/pgvector and MinIO run on Lecture Hat-administered Amazon EC2 servers in US East (N. Virginia), with a Lecture Hat-owned server used for GPU processing and backup. A deployment can separately enable selected local Gemma chat inference on Lecture Hat-operated infrastructure; record that route and location if approved, without assuming upload indexing and background tasks stop using Bedrock. Record the applicable hosting/failover configuration and the owned server's physical country [CONFIRM IN EXECUTION COPY]. Approved external locations and AWS global inference routes must be recorded in Annex III.
• Current backup baseline to assess: Hourly database dumps target 48 hours; daily copies about 14 days; weekly/search-index copies about 28 days; direct encrypted database and Redis backups in Amazon S3 (US East, N. Virginia, us-east-1) about 35 days. EBS snapshots target hourly 48 hours and daily 14 days. Uploaded files are mirrored to Lecture Hat backup storage. An encrypted uploaded-file copy is also kept in Amazon S3, including while Amazon EC2 is primary. The current copy targets hourly synchronization; replaced or deleted objects target removal from backup history after about 14 days. Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3. Migrated historical archives have a separate expiration target of no more than 35 days after migration; they are outside routine dump and file-history pruning, and deletion still depends on successful cleanup. The residual-backup policy targets deletion within 90 days of a deletion request. These depend on successful backup/prune jobs and are not mechanically guaranteed erasure deadlines. Agree an institution-specific schedule and verify deletion/restore controls before deployment.

Annex I(C). Restricted-transfer particulars, if applicable

Complete with the applicable executed instrument: [INSTRUMENT AND MODULE]; [SUPERVISORY AUTHORITY AND CLAUSE 13 BASIS]; [GOVERNING MEMBER STATE/COURTS]; [SCC OPTIONS/NOTICE PERIOD]; [UK TABLES 1–4]; [SWISS ADAPTATIONS]; [TRANSFER ASSESSMENT/SUPPLEMENTARY MEASURES]. If no restricted transfer is approved, record the configuration preventing it. Missing fields do not authorize a transfer.

Annex II. Technical and organizational measures

These baseline measures must be maintained for the approved deployment. Confirm the actual configuration and required additions in the execution copy. No independent certification, annual training program, or recovery-time/recovery-point guarantee is represented.

1. Transmission: Clients use HTTPS. Cloudflare terminates TLS and can access payloads; its tunnel protects the hop to cloudflared, whose local reverse-proxy hop uses HTTP. External AI calls use encrypted transport. Inter-server traffic uses WireGuard through Tailscale. Record any additional boundary safeguards Institution requires.
2. Storage: Amazon EC2 volumes/snapshots use Amazon EBS encryption; the owned server uses LUKS2 (AES-256-XTS). Database dumps are encrypted before upload. Record verified key access, backup locations, schedules and restore controls for the deployment. Backups can contain covered personal data.
3. Identity/access: Clerk issues/verifies sessions; protected requests check authenticated users and notebook, class, enrollment or ownership permissions. Maintain those checks. Restrict production operator access to authorized duties and revoke credentials when access ends. Personnel must have confidentiality obligations.
4. Separation/minimization: Records/objects are scoped to owners and course/notebook context. Send only content needed by the approved feature to its approved provider. Maintain pilot retention and optional-collection controls.
5. Software/execution: Repository controls include automated tests and dependency/container scanning. User code runs in a browser sandbox; server-side LaTeX runs with reduced privileges/resource limits. Maintain risk-appropriate change and patch controls. This is not an independent audit assertion.
6. Incident/rights handling: Provider contact is [email protected]. Maintain personnel/procedures to meet incident notice, assistance, correction, return and deletion duties. Restrict operational logs and support evidence to necessary purposes. Complete escalation contacts and additional requirements [DETAILS].
7. Continuity/review: Assess safeguards appropriate to approved processing and provide compliance information. Confirm backup restoration/deletion tests and additional agreed measures [DETAILS]. Rotated backups are not a promised institutional recovery or erasure deadline.

Annex III. Subprocessor approval schedule

Prepare a signed snapshot from the vendor inventory, selecting legal identities, countries, data categories, tasks and configurations. These are candidate services to assess, not blanket approval:

• Amazon Web Services, Inc. (Amazon EC2 and EBS): Hosting/storage/snapshots; all covered data stored on those systems; US East (N. Virginia). Record approved volume/snapshot retention and failover configuration.
• Cloudflare, Inc.: Edge/tunnel/security/bot detection; IP/request metadata and transiting payloads; United States/global edge network.
• Clerk, Inc.: Identity, sessions and authentication messaging; contact/age/account identifiers and session metadata; United States.
• Amazon Web Services, Inc. (Amazon Textract): Cloud fallback OCR and text coordinates; uploaded images and rendered document pages. Requests use US East (N. Virginia); AWS service-improvement processing may occur in another Region. Record approved service terms, effective AI services opt-out, and retention settings before approval.
• Amazon Web Services, Inc. (AWS Bedrock): Approved inference/indexing; prompts, excerpts, extracted text and images. Cactus Micro uses Google Gemma through AWS Bedrock in the standard hosted catalog; any separately enabled local chat route must be identified in Annex I(B). Record models, Runtime/Mantle endpoints, regions and effective retention/provider terms. US East source endpoints; global inference may process in supported worldwide regions.
• Amazon Web Services, Inc. (Amazon SES): Transactional email; recipients, message content and delivery metadata; United States. Course instructions do not authorize marketing.
• Amazon Web Services, Inc. (Amazon S3): Direct encrypted database and Redis backups and encrypted uploaded-file copies; US East (N. Virginia, us-east-1). Database and Redis backups target about 35 days; replaced or deleted uploaded files target about 14 days in backup history. Historical archives migrated from B2 have a separate expiration target of no more than 35 days after migration, outside those routine pruning jobs. Confirm the agreed deletion/restore schedule, including the residual-backup policy target of deletion within 90 days of a deletion request.
• Backblaze, Inc. (B2), historical migration only: Existing encrypted database backups and uploaded-file copies; US East. Any remaining historical copies are archived and removed after verified restore checks. Do not treat the S3 migration as completed erasure of B2 copies; confirm removal and any remaining historical retention in the deployment schedule.
• Stripe, Inc., if institutional billing uses it: Subscription management; United States. Separately identify independent-controller payment/fraud processing; full card handling is not a student-content subprocessing task.

Also assess infrastructure-support services relevant to the deployment. Tailscale supports the private inter-server network and receives server/operator account, device, and connection metadata; relays may carry WireGuard-encrypted traffic. Its presence does not mean it receives plaintext student content. Identify any covered metadata processing, actual legal role, location, and required terms in the execution copy rather than treating an ancillary service as an approved AI provider.

Excluded pending written approval and verified compliant terms: Eleven Labs Inc. for live captions, cloud fallback transcription of uploaded audio and video, and text-to-speech, including web/native Read Aloud and narrated lessons. Other optional external tools, search or remote execution services are excluded until assessed and recorded. If a required service cannot meet the signed instructions, exclude the feature or deployment.

Approved attached snapshot: [DATE, SELECTED PROVIDERS, LOCATIONS, TASKS, RESTRICTIONS, CONFIRMED TERMS]. Institutional approval: [AUTHORIZED SIGNATURE/RECORD]. Changes follow Section 3.2 or the stricter executed transfer instrument.

Signatures and notices

By signing the completed execution copy, each party agrees to this Cover Page, completed annexes, and incorporated Common Paper DPA Standard Terms Version 1.1, as expressly amended. Retain an identical copy of all agreed documents and executed transfer instruments. The blank webpage is not signed.

Lecture Hat, Inc.: Signature [SIGNATURE]; name/title [NAME/TITLE]; date [DATE].

Institution [FULL LEGAL NAME]: Signature [SIGNATURE]; name/title [NAME/TITLE]; authority [CONFIRM]; date [DATE].

Notices must be in writing to the completed Cover Page's contacts and are effective on confirmed delivery. A party may change its contact by written notice. Request a completed copy or propose Institution's form at [email protected].