For schools and districts
Student data privacy agreement
What we promise schools about student data, in plain words. Download our sample agreement, or send us yours.
Sample agreement provided for convenience. Districts may use their own DPA; we’re happy to review and sign the district’s standard agreement.
Our commitments
- Student data is used only to run CompPrep for the school’s educational purposes.
- We never sell student data, use it for advertising, or build profiles for anything other than learning. Students covered by a chapter plan never see ads in the app.
- The district controls its students’ records. We act as a “school official” under FERPA.
- Students must be 13 or older. Sign-up blocks anyone younger.
- AI requests don’t include student names or emails, and we don’t allow student work to be used to train AI models.
- Data is encrypted in transit and at rest, with role-based access rules and logged admin actions.
- If a breach affects district data, we tell the district within 72 hours of finding it.
- We delete student data within 30 days of a district request or the end of the agreement. Students can delete their own account anytime.
- We follow applicable state student privacy laws, including Texas Education Code Chapter 32.
Who helps us run CompPrep
These service providers (subprocessors) handle data only to provide their service to us.
Supabase
- What they do
- Database, sign-in and server functions
- Data they handle
- Account, profile, chapter and practice data
Cloudflare
- What they do
- Hosts compprep.app and blocks attacks
- Data they handle
- IP address and basic request details
Anthropic
- What they do
- AI coach, judge and practice questions
- Data they handle
- Practice content and responses, without names or emails
Resend
- What they do
- Sends account, reminder and summary emails
- Data they handle
- Email address, first name and the email’s contents
Stripe
- What they do
- Payments, invoices, receipts and sales tax
- Data they handle
- Billing name, email, address or ZIP code; card details stay with Stripe
Google
- What they do
- Sign in with Google, and the natural judge voice
- Data they handle
- Sign-in details the user allows; the AI judge’s words only
PostHog
- What they do
- Cookieless usage analytics: page views and sign-up steps
- Data they handle
- Page addresses without codes or IDs, sign-up steps, device and browser type; no names, emails, ages, schools or user IDs
Get the agreement
The sample covers scope, FERPA and COPPA, data we collect and don’t, AI processing, security, breach notice, deletion, Texas law, and signature blocks.
Download the sample agreement (PDF)Email support@compprep.app to request a signed copy or send us your district’s agreement.
See also the privacy policy. CompPrep AI is independent and isn’t affiliated with or endorsed by DECA, FBLA, HOSA, TSA or any Model UN conference.