{
  "version":1,"reviewed":"2026-10-15","changeNoticeDays":30,"noticeContact":"drawsplat@gmail.com","noticePage":"/legal/service-providers.html#changes",
  "requirements":{"studentDataSale":false,"targetedAdvertising":false,"profiling":false,"modelTraining":false,"flowDown":"Before enabling student processing, the operator must bind each selected provider to the approved educational purpose, confidentiality, security, retention/deletion, incident notice, no-sale/no-profiling/no-training limits, and applicable transfer safeguards. Provider consumer terms or an app checkbox alone do not establish this."},
  "providers":[
    {"name":"Cloudflare, Inc.","companyCountry":"United States","purpose":"Public-site static hosting, CDN and security","data":"HTTP request metadata, IP address, user agent, requested URL; no student project storage backend provided by the public site","processing":"Global edge network; no country-only residency promise","enabled":"Public sites; self-hosters select their own host","terms":"https://www.cloudflare.com/cloudflare-customer-dpa/","transfer":"Applicable Cloudflare DPA transfer clauses; operator must verify account coverage and deployment-specific requirements"},
    {"name":"Google LLC / district Google Workspace contracting entity","companyCountry":"United States; actual contracting entity and selected data region depend on district agreement","purpose":"Optional Apps Script, Drive, Sheets, Docs, PlanSplat Calendar, sign-in and email notifications","data":"Selected school records, files, account claims, PlanSplat deadline/study-event details and family-request notices","processing":"District Workspace region/configuration; document exact location and backups","enabled":"Only selected and authorized school/cloud workflow","terms":"https://workspace.google.com/terms/dpa_terms.html","transfer":"District Workspace DPA and applicable transfer clauses; verify service and feature coverage","scopes":"SplatWorks office apps, AudioSplat, PDFSplat, VideoSplat, MediaSplat, MarkdownSplat, ConceptSplat and MermaidSplat direct Drive save: drive.file; PlanSplat autoload/autosave: drive.file; PlanSplat combined sign-in: drive.file and optional calendar.app.created; one authorization for Drive/Calendar, with same-account matching on Calendar retries; Apps Script/Hub capabilities and stored records described in /legal/google-oauth-disclosure.html"},
    {"name":"Microsoft Corporation / district Microsoft contracting entity","companyCountry":"United States; actual contracting entity varies","purpose":"Optional identity and OneDrive save/open","data":"Authorized account claims and selected project files","processing":"District tenant and contract region; verify selected services","enabled":"Only configured and user-authorized integration","terms":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","transfer":"District Microsoft DPA and applicable transfer terms; verify actual scopes and location"},
    {"name":"Dropbox, Inc.","companyCountry":"United States","purpose":"Optional GridSplat cloud file save/open","data":"User-selected native spreadsheet file and authorization metadata","processing":"Provider/account configuration; district records actual location","enabled":"Only configured and user-authorized integration","terms":"https://www.dropbox.com/privacy","transfer":"District-approved provider contract and applicable transfer safeguards required before student use"},
    {"name":"OpenAI API contracting entity","companyCountry":"United States; regional contracting entities may apply","purpose":"Optional task-tool AI processing","data":"Prompt and selected input; request metadata","processing":"API account configuration; approval must record retention, region and transfer basis","enabled":"Key stays in tab memory; separate tab approval; approved API account only","terms":"https://openai.com/policies/business-terms/","dataControls":"https://developers.openai.com/api/docs/guides/your-data","transfer":"Applicable business DPA/transfer clauses; school verifies no data-sharing/training opt-in and approved retention before student input"},
    {"name":"Anthropic API contracting entity","companyCountry":"United States; regional contracting entities may apply","purpose":"Optional task-tool AI processing","data":"Prompt and selected input; request metadata","processing":"Commercial API account configuration; record retention and region","enabled":"Key stays in tab memory; separate tab approval; approved API account only","terms":"https://www.anthropic.com/legal/commercial-terms","dataControls":"https://privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training","transfer":"Applicable commercial DPA/transfer clauses; school verifies no-training configuration and approved retention before student input"},
    {"name":"User-selected services: hosting, roster/SSO, remote media, libraries, model downloads, QR/bot endpoints and sharing recipients","companyCountry":"Must be recorded for each enabled service","purpose":"Only the specifically approved feature","data":"Selected data and request metadata; imported remote resources may contact their host","processing":"Must be documented before student processing","enabled":"Optional; no blanket approval from self-hosting or browser-only editing","terms":"Use the actual service contract, approved scopes, data region and provider privacy/security documentation","transfer":"Select applicable adequacy/SCC/UK transfer safeguards with district review; no transfer approval is implied by this register"}
  ]
}