School Data Processing Summary
An operational summary that helps schools assess how NanoStudent processes data. A binding agreement must be signed by both parties and legally reviewed.
1. Roles
The school determines the purposes of its educational records and user permissions. NanoStudent processes those records to provide hosting, functionality, and support under the school’s lawful instructions. The platform may act independently for account, security, and billing data necessary to operate its service.
2. Data subjects and categories
Data subjects include students, parents, teachers, and staff. Categories may include identity, contact, class, attendance, homework, exam, result, behavior, fee, communication, file, and security records. Schools should not upload unnecessary sensitive data.
3. Purpose and duration
Processing supports the platform during the school account term and limited retention periods for export, backup, dispute resolution, and applicable obligations. The school may request export or deletion subject to permissions and lawful restrictions.
4. Confidentiality and security
Controls include school-data isolation, role-based access, password and token hashing, session and CSRF protection, security logging, private file storage, file-type validation, HTTPS transport, recommended backups, and incident-response procedures.
5. Subprocessors
Subprocessor categories may include hosting, email, sign-in, AI, and payment providers when enabled. Only data needed for the requested function is shared. Schools should approve optional services and review provider terms before use.
6. Artificial intelligence
Files or text are sent to an AI provider only when an associated feature is used and required consent is present. Teacher questions are created as drafts for human review. Schools or users can disable processing through available settings.
7. Data-subject requests and incidents
The platform assists schools with correction, export, and deletion requests within authorized scope and provides reference logs for investigation. Material incidents are assessed, contained, documented, and communicated according to applicable requirements.
8. Requesting an executed agreement
For an executed agreement naming the school, legal entity, location, hosting, and subprocessors, contact support@nanostudent.com. This page alone is not a signed contract.