School Data Agreement

Last updated: 20 October 2026

This agreement is between Necudah (“we”) and the school or teacher who opens a school on Necudah (“the school”). It forms part of our Terms of Service. A school accepts it by opening or running a school on Necudah. It explains how we look after the personal data of the people the school brings in: its students, teachers and, where they are involved, parents.

1. Who decides, who processes

The school decides whose data goes into its school on Necudah and what it is used for. The school is the controller of that data.
Necudah stores and processes it for the school, only to run the school’s Necudah site. We are the school’s processor.
This covers: members’ accounts in the school, profile fields the school adds, classes, lessons, messages, events and attendance, quiz answers, uploaded answer files, essays, grades and feedback, progress, assignments, and anything else members create inside the school.
The kinds of people concerned: students (who may be children), teachers, school staff, and parents when the school records their details.
It lasts as long as the school is on Necudah, and until the data is deleted afterwards (section 8).

2. What the school is responsible for

having a lawful reason to put each person’s data into Necudah, and telling its students (and their parents) that it uses Necudah, for example by pointing them to our Privacy Policy;
getting the consent of a parent or guardian for children where the law requires it. In Spain, children under 14 cannot consent on their own; other countries set other ages. Necudah does not collect students’ ages and relies on the school for this;
adding only the data it needs: please do not put sensitive details (health, religion, and so on) into profile fields, messages or AI requests unless there is a real need and a lawful basis;
keeping its own members’ accounts in order: removing people who leave, and choosing who in the school may see what.

3. What Necudah promises

We will:

use the school’s data only to run the school’s Necudah site and as the school instructs through the platform’s settings or in writing; never for advertising, never sold, never used to profile students. If we think an instruction breaks data-protection law, we will say so;
make sure that anyone who works on Necudah with access to the data is bound to keep it confidential;
keep it secure (section 5);
use only the sub-processors listed in section 4, and tell the school before adding or replacing one (section 4);
help the school answer requests from its students, teachers or parents to see, correct, delete or take away their data. During the beta we do this by hand, on request to hello@necudah.com, within 30 days;
tell the school about a breach (section 6) and help it meet its own duties, including any impact assessment it needs to do, as far as we reasonably can;
delete or return the data when the school leaves (section 8);
give the school the information it reasonably needs to check that we keep these promises, and answer its questions.

4. Sub-processors

The school agrees that we use these services to run Necudah:

Sub-processor	What for	Where
Hostinger	server hosting and email delivery	France (EU)
Google (Drive)	nightly backups	USA / global
Anthropic	AI generation on the platform’s key, and the Help assistant	USA
OpenAI	narration (text-to-speech) and pictures; AI generation for schools that choose it	USA
Google (Gemini)	AI generation, only for schools that choose it	USA
Cloudflare	bot check on sign-up forms	USA / global
Stripe	payments, only once paid plans start (not used during the free beta)	USA / EU

What goes to the AI services is what a teacher puts into an AI request: instructions, lesson text and reference files. We do not attach names or email addresses. The school should make sure its teachers do not put students’ personal details into AI requests.

Where a sub-processor is outside the EU, the transfer relies on the safeguards the law provides, such as the EU-US Data Privacy Framework or standard contractual clauses.

Changes: we will tell the school by email at least 30 days before adding or replacing a sub-processor. If the school objects on reasonable data-protection grounds and we cannot solve it, the school may close its school and have its data deleted.

5. Security

What we do today:

encrypted connections (HTTPS) everywhere;
each school’s data in its own separate set of database tables;
passwords stored scrambled; protection against password guessing;
answer files and AI reference files stored where they cannot be opened by a direct link;
server firewall and blocking of repeated failed attacks; only the platform operator can reach the server, the database and the backups;
nightly backups kept for 30 days, with restores tested.

6. Breaches

If we learn of a security breach affecting the school’s data, we will tell the school without undue delay, and in any case within 72 hours where we can. We will say what happened, what data and how many people are affected as far as we know, and what we are doing about it. We will help the school with its own notifications. The school decides whether to inform the authority and its students or parents, since it is the controller; we will do it ourselves where the law requires it of us.

7. Help with requests

Students and parents usually ask the school. The school can correct most data itself through Necudah. For anything it cannot do itself, such as a full copy of a student’s data or deleting a student and everything they wrote, the school writes to hello@necudah.com. We do it within 30 days. If a request reaches us directly, we pass it to the school and help.

8. When a school leaves

When a school closes its Necudah school or the beta ends:

the school can ask us, within 30 days, for an export of its courses and its members’ records;
we then delete the school’s data within 30 days, and it leaves our backups as they roll over (within 30 more days);
we keep only what the law obliges us to keep, and only for as long as it does.

9. Liability and order of documents

This agreement sits alongside the Terms of Service. If they disagree about personal data, this agreement wins.