Data Processing Agreement

Scope and roles

This agreement applies when an organization (including a school) uses the platform and we process personal data on its behalf: about its members' work in the organization, its devices, the players of its puzzles in its analytics and, for schools, its classes and students. The organization is the controller and we are the processor. This agreement is part of the Terms of Service.

A school accepts this agreement when it creates a school organization. We record when it was accepted and which version.

What we process

• People: organization members, players of the organization's puzzles and, for schools, students.
• Data: member accounts and roles, content and its history, devices, analytics about the organization's puzzles and, for schools, student nicknames, class membership, progress and completions.
• Purpose: only to provide the platform to the organization, as described in the Terms of Service and the organization's settings.
• Duration: while the organization uses the platform, plus the retention periods in the Privacy Policy.

Our commitments

• We process the data only on the organization's documented instructions: this agreement, the Terms of Service and the organization's settings.
• Our staff with access to the data are bound by confidentiality.
• We apply the security measures described below.
• We help the organization answer requests from people about their data, including export and deletion.
• We tell the organization about a personal data breach without undue delay, and within 72 hours of becoming aware of it where possible.
• We give the organization the information it needs to show compliance, and support reasonable audits.

Subprocessors

The organization authorizes us to use these subprocessors, under contracts with data protection terms at least as protective as this agreement:

• Google Cloud: hosting, database and file storage.
• Cloudflare: content delivery, DNS and protection against attacks.
• Stripe: payments, invoices and tax.
• Google sign-in: only if you choose to sign in with Google.
• An email delivery provider for account and notification emails [to be named before publication].

We tell organizations in advance before adding or replacing a subprocessor, so they can object.

Schools and student data (COPPA school authorization)

Students join a class with a class code and a nickname chosen or assigned by the teacher. We collect no email, password, name, birth date or other personal data from students. Students can't comment, rate puzzles or appear in public rankings. Their progress is saved on our servers under the pseudonymous student profile.

In the United States, the Children's Online Privacy Protection Act (COPPA) allows a school to consent on parents' behalf to the collection of personal information from children under 13, when it is used only for the school's educational purposes and for no other commercial purpose. By accepting this agreement, the school:

• confirms that it is authorized to give that consent;
• gives that consent for its students' use of the platform for educational purposes;
• will inform parents about the service, as its policies and the law require.

We use student data only to provide the service to the school. We never use it for advertising, never build profiles for marketing and never sell it. There is no advertising or third-party tracking anywhere on the platform.

The school can review its students' data, ask us to delete it and stop further collection at any time. Parents should send such requests to the school, and we help the school answer them.

The school remains responsible for the other laws that apply to it, such as FERPA and state student-privacy laws in the United States, or the GDPR in the European Union.

Retention, return and deletion

We keep organization data for the retention periods in the Privacy Policy. The owner can export the organization's data at any time. When an organization is deleted, its unpublished content is erased after 90 days, and published puzzles stay published unless they are deleted. A deleted school organization's student data is erased together with its unpublished content.

International transfers

Where personal data is transferred outside the European Economic Area or another region with transfer rules, the transfer is protected by standard contractual clauses or an equivalent safeguard.

Security measures

• Encryption in transit, and passwords, API keys and student tokens stored only as hashes.
• Access limited by role, within each organization and for our own staff.
• Audit logs of staff and security-relevant actions; time-limited, recorded support access.
• Daily backups with point-in-time recovery, and regularly tested restores.

Changes to this agreement

Every version of this agreement has an identifier, shown at the top of this page. We tell organizations about changes in advance and ask schools to accept a new version where required.