School Data Agreement (with College & Career addendum)

This agreement is between [School legal name] (“the School”) and Homebook, LLC, an Arkansas limited liability company (“Homebook”). It starts on the date the last person signs below.

1. What this agreement is for

1.1 The School uses Homebook, a school records service at app.gethomebook.com (the “Service”). This agreement says how Homebook protects information about the School’s students, families and staff.

1.2 Products covered: Homebook (records, attendance, gradebook, report cards and transcripts, family portal, messages, check-in and check-out, tuition and ledgers, student logins if the School turns them on) and, if the School buys it, College & Career (Schedule 2). If Homebook adds a product that uses student information in a new way, Homebook will tell the School in writing at least 30 days before it applies to the School’s data, and the School may object (section 13.3).

1.3 Information covered (“School Data”): everything the School, its staff, families or students put into the Service, and everything the Service creates from it. Schedule 1 lists it. School Data includes information about children under 13 and teens.

1.4 If this agreement and the Homebook Terms of Service disagree about School Data, this agreement wins. If this agreement and Schedule 2 disagree about College & Career, Schedule 2 wins.

2. Who owns and controls the data

2.1 The School owns School Data and controls it. Homebook has no ownership of it. Homebook acts only as the School’s service provider.

2.2 Homebook uses School Data only to provide the Service to the School, on the School’s instructions, under this agreement, and for no other purpose.

2.3 If the School receives U.S. Department of Education program funds and so is subject to FERPA, Homebook acts as a “school official” with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B): it is under the School’s direct control for its use of education records, uses them only for the purposes of this agreement, and does not disclose them further except as this agreement allows (34 CFR 99.33).

3. Parent and student requests

3.1 Records the School’s staff entered (attendance, grades, schoolwork, report cards, transcripts, discipline and support notes, health details, pickup list, tuition, messages with the School): requests from a parent or student to see, correct or delete them are sent to the School to decide, and Homebook acts on the School’s instruction. Homebook shows each request in the School’s dashboard, with a due date and reminders. This routing does not limit any right the law gives parents or students directly. If a requester shows that information is inaccurate and the School does not correct it, Homebook will work with the School to make sure it is corrected; Homebook may also deliver a copy the law requires if the School has not responded within 21 days, redacting other students’ information.

3.2 Information collected from the student (the student’s login, the notes the student sent to the office, technical sign-in data) and information a student or parent entered for optional features (College & Career): the law gives parents and teens rights over these directly (COPPA, 16 CFR 312.6; Arkansas Act 952, Ark. Code 4-88-1503(b)(3), (b)(4)). Homebook honors those requests. If a parent refuses further collection, Homebook switches off the child’s login and stops using what it collected from the child (except to complete the request) as soon as it confirms the parent’s identity, without waiting for the School, and tells the School. For deletion of a student’s login and notes, Homebook tells the School and completes the deletion within 30 days unless a law requires a note to be kept. For College & Career, the student or parent can delete in Settings and the School sees that it happened.

3.2A Student photos are optional. Homebook honors a verified request from the family or the School to remove a student’s photo, tells the School, and deletes it.

3.3 Homebook confirms the identity of anyone asking before acting, and finishes within 30 days. For a FERPA-covered school, Homebook helps the School meet FERPA’s 45-day limit for parent access.

3.4 The School can export its data (CSV) at any time, and can download a single student’s records.

4. What Homebook will never do

4.1 Sell or rent School Data.

4.2 Use School Data for advertising, including targeted advertising, or let anyone else do so.

4.3 Build a profile of a student for any purpose other than the School’s own use of the Service.

4.4 Market to families or students through School notices, or put promotions in Service emails.

4.5 Use School Data, including student photos, to train artificial intelligence, or use photos for facial recognition or any biometric identification.

4.6 Disclose School Data to anyone except: (a) the School and the people it authorizes; (b) Homebook’s service providers under section 6; (c) as required by law, under section 5. Bright Pathway Academy receives no School Data (Schedule 2).

4.7 De-identified data. Homebook may use counts and statistics that cannot identify a student, a family or the School (for example “how many schools use the gradebook”) to run and improve the Service. Homebook will not try to re-identify anyone and will not sell or share de-identified student data.

5. Requests from police, courts or government

If anyone other than the School asks Homebook for School Data (for example a subpoena), Homebook will tell them to ask the School, and will tell the School right away unless the law forbids it. Homebook will disclose only what the law requires.

6. Service providers (subprocessors)

6.1 Homebook uses the service providers listed in Schedule 1, part D, only to run the Service. Each one has agreed in writing to protect the data it receives (16 CFR 312.8(c)).

6.2 Homebook will tell the School at least 30 days before adding a service provider that receives School Data, by email and on gethomebook.com/privacy. The School may object (section 13.3).

6.3 Homebook is responsible for what its service providers do with School Data.

7. What the School agrees to do

7.1 Use the Service for its educational and school-administration purposes.

7.2 Give access only to staff who need it, keep roles correct, and remove access when someone leaves.

7.3 Student logins. Before student logins work, Homebook verifies that the School is a real school and that the person authorizing has authority to act for it (for example by checking the School’s public listing or website and confirming by phone or by email from the School’s own domain), gives the School the notice in Schedule 1, and the School confirms in the Service that it authorizes student logins for its educational use on behalf of parents. Payment alone is not enough. The authorization continues until the School withdraws it, with a yearly confirmation due by August 15: if the School has not confirmed by September 15, student logins at the School switch off until it does (school records and family access are not affected). A material change in Homebook’s practices for students under 13 needs a new authorization before it applies (section 13.3). The School agrees to tell families about student logins before turning them on. Homebook provides the notice text and can send it for the School. (Homebook remains responsible for its own duties under COPPA and Arkansas law; this clause only records the School’s authorization and its promise to tell families.)

7.4 If the School is subject to FERPA, give parents its annual notice of FERPA rights, including that it uses school officials such as service providers.

7.5 Tell Homebook promptly if it believes someone has gained access to School Data who should not have.

7.6 Pass to Homebook any parent or student request it wants Homebook to handle.

8. Security

8.1 Homebook keeps a written information security program for School Data (16 CFR 312.8; Ark. Code 4-110-104; Ark. Code 4-88-1503(b)(6)). Highlights: each school’s data is separated by database rules that are tested before every release and checked automatically every day; encryption in transit and at rest; passwords stored only as hashes; private storage for documents and photos with short-lived links; two-step sign-in on every Homebook administrative account; a yearly risk assessment; and a named security contact.

8.2 Security contact: Sam Bartolotta, privacy@gethomebook.com, (501) 514-5811.

8.3 School Data is stored in the United States.

8.4 Only Homebook’s members, and the tools Homebook uses to build and fix the Service (including the AI assistant named in Schedule 1, part D), access School Data, and only to support the School, keep the Service running, or fix a problem. Everyone with access is bound to keep it confidential.

8.5 Audit. Once a year, or after a breach, the School may ask for a summary of Homebook’s security program and the latest risk assessment results. Homebook answers within 30 days.

9. Security breaches

9.1 If Homebook discovers unauthorized access to, or acquisition of, School Data, Homebook will tell the School immediately following discovery, with the facts then known (Ark. Code 4-110-105(b)(1)), and will update the School as the investigation develops. As an outer limit for incidents where the facts are still unclear, Homebook will contact the School within 48 hours of first suspecting a problem; this outer limit never permits delaying a notice the law requires immediately.

9.2 The notice will say, as far as known: what happened and when, what data and which students or families were affected, what Homebook has done to contain it, what Homebook will do next, and a contact person. Homebook updates the School as it learns more.

9.3 Homebook will help the School notify affected families and any government office that the law requires (for example the Arkansas Attorney General when more than 1,000 people are affected, Ark. Code 4-110-105(b)(2)). If the breach was caused by Homebook or its service providers, Homebook will prepare the notices and pay their reasonable cost.

9.4 Homebook keeps each written breach determination and its supporting documentation for 5 years from the date of the determination, and provides them to the Arkansas Attorney General within 30 days of a written request (Ark. Code 4-110-105(g)).

10. Keeping and deleting data

10.1 Homebook keeps School Data only as long as its written retention policy allows (summary in Schedule 1, part E). The School may delete sooner at any time.

10.2 When the School cancels: the School may export its data for 30 days; then Homebook deletes all School Data from the Service. Homebook emails the School’s director 7 days before deleting. Remaining backup copies expire within a further 30 days, are used only to recover from loss, and are never used to restore deleted data.

10.3 On written request, Homebook will confirm in writing that School Data has been deleted.

10.4 Homebook may keep only what the law requires it to keep, and its own payment records (7 years, without the link to any student).

11. Term and ending

11.1 This agreement lasts as long as Homebook holds any School Data.

11.2 Either party may end it in writing if the other seriously breaks it and does not fix the problem within 30 days. Ending it ends the Service.

11.3 Sections 4, 5, 9 and 10 continue until all School Data is deleted.

12. If Homebook is sold or closes

If Homebook, LLC is sold or merged, the buyer must keep this agreement’s promises for existing School Data, and Homebook will tell the School at least 30 days before the change. If Homebook stops operating, it will give the School at least 30 days to export its data and then delete it.

13. General

13.1 Arkansas law governs this agreement.

13.2 Liability is as stated in the Homebook Terms of Service, except that the Terms’ liability cap does not limit Homebook’s duty to pay breach notice costs under section 9.3.

13.3 Changes. Homebook may update this agreement only by written notice at least 30 days before the change. If the School objects in writing within that time, the old terms continue for the School until it agrees or cancels; if the School cancels for this reason, Homebook refunds any prepaid fees for the unused period. A material change in how Homebook collects, uses or discloses information collected from students under 13 does not apply to the School’s students until the School renews its authorization in the Service (section 7.3); the School’s silence is not authorization.

13.4 Each person signing confirms they are allowed to sign for their organization.

13.5 If one part of this agreement is unenforceable, the rest still applies.

13.6 Notices go to the emails below.

Signed for the School: ______________________ Name: ____________ Title: ____________ Date: ______

Notice email: ____________

Signed for Homebook, LLC: ______________________ Sam Bartolotta, Managing Member Date: ______ Notice email: privacy@gethomebook.com

Schedule 1. Student Login Notice for Schools, data list, providers and retention

This schedule is Homebook’s direct notice to the School about the information collected from students. COPPA requires an operator relying on a school’s authorization to give the school the same notice it would give a parent (FTC COPPA FAQ N.1, N.2; contents follow 16 CFR 312.4(c)(1)).

A. Information Homebook collects directly from students who have a login

• The school-issued email address (entered by the School), the student’s name and a password the student types when setting up the login (password stored only as a hash), sign-in times, the student’s notice choice, and any “Tell the office” note the student sends (the School can switch notes off).
• Technical information: a session token on the student’s device, and standard request logs at Homebook’s hosting providers (IP address, browser type, request times), used only to sign the student in, run and secure the Service, and fix errors.
• College & Career entries, only if the School buys it and the student or parent agrees (Schedule 2).
• Students cannot upload files, post anything publicly, message other students, or change records. Student logins work in a web browser only.
• Use: only to let the student see their own grades, schoolwork and attendance and reach the School office; to run College & Career where enabled; and to sign the student in, keep the Service secure and fix errors.
• Who receives it: the School (notes go to the School office; staff see what their roles allow), the student’s approved parents, Homebook, and the service providers in part D, only to run the Service. Nothing is made public, and nothing is disclosed to any other third party except where the law requires. The School can review, delete, or stop collection for any student at any time (remove the login, delete notes, delete the student), and Homebook does the same on the School’s request.
• Without the School’s authorization, student logins do not work.

B. School records the School and families enter (Homebook does not collect these from students)

Names, grade, date of birth, student number, address, guardian and emergency contacts, attendance and check-in and check-out (including who picked a child up), grades, assignments, assessments, report cards, transcripts, documents, discipline and incident notes, support plans, goals and services, allergies, conditions, medications, doctor, office visits, pickup authorizations and requests, photos (optional), tuition and ledger entries, lunch records, messages, and notes.

C. College & Career (only if bought)

See Schedule 2.

D. Service providers that may receive School Data

E. Retention

The full table is published in the Homebook Privacy Policy, section 8, and the written policy is available on request. Student login stops the day a student is withdrawn and is deleted within 30 days; office notes deleted after 12 months; health, emergency, pickup and photo details deleted within 30 days after withdrawal; the rest of the record deleted 1 year after withdrawal unless the School asks in writing to keep it longer for a stated educational or legal reason with a fixed end date; College & Career deleted 30 days after withdrawal or 30 days after the School stops it, whichever comes first; all School Data deleted 30 days after the School cancels; backups clear within 30 days of a deletion and are never used to restore deleted data.

F. Parent and student rights

See section 3 and gethomebook.com/privacy/requests.

Schedule 2. College & Career, by Bright Pathway (addendum)

Completed only if the School buys College & Career.

1. What it is. An optional part of Homebook for the School’s students in grades 9 to 12: a career quiz, saved scholarships with statuses, and college and financial-aid deadlines, with a read-only progress view for School staff. The quiz content and the scholarship and deadline lists are licensed from Bright Pathway Academy, LLC (“Bright Pathway”).
2. School Data. Quiz answers, results, saved scholarships and the activity record are School Data under this agreement.
3. No sharing with Bright Pathway or anyone else. Homebook gives Bright Pathway only the number of seats the School bought. Bright Pathway, scholarship sponsors, colleges, advertisers and data brokers receive no student information from Homebook.
4. Turning it on. Homebook turns College & Career on after the School pays. The School’s director chooses which grades (9 to 12) can use it, whether parents of students aged 13 to 16 may see individual answers, and whether the Bright Pathway program card is shown. The card is a plain link with no student information.
5. Consent. A student aged 13 or older reads a notice and ticks “I agree” before anything is saved. The Bright Pathway program card is never shown to students under 13. A parent or guardian of a student aged 13 to 16 can say yes or no for their child in Homebook; a parent’s no keeps it off for that child. In Family mode, a parent confirms they are the child’s parent or guardian before saving anything.
6. Students under 13. College & Career is not available to a student under 13 unless the School signs a separate written authorization for that student, for the School’s educational use only. Homebook records it before the student can use the feature.
7. Staff access. The director and counselor can see students’ answers. Other school leaders and the student’s own teachers see a summary only. The School gives these roles only to the right people.
8. Rights. A student or parent can see, delete, or turn off College & Career data themselves (it is information they entered); the School sees that it happened.
9. When it ends. If the School stops College & Career, access ends that day. Homebook keeps the data 30 days so the School can ask for a copy, then deletes it, unless the School asks in writing for earlier deletion. A withdrawn student’s College & Career data is deleted 30 days after withdrawal.
10. Seats and price. Seats: __ seniors (grade 12) at $__ each; __ students in grades 9 to 11 at $__ each; for the school year ending August 15, 20__.

Signed for the School: ______________________ Name: ____________ Title: ____________ Date: ______

Signed for Homebook, LLC: ______________________ Sam Bartolotta, Managing Member Date: ______