DrawSplat^TM NDPA / DPA Review Packet

1. Product description & approved educational purpose

DrawSplat^TM is a self-contained interactive whiteboard for K–16 classrooms. It runs as a static web app and can optionally save boards, templates, collaboration rooms, and student turn-ins to a Google Apps Script + Sheets backend the district controls, or to a self-hosted Node + MySQL backend the district runs on its own infrastructure.

Approved educational purpose: classroom drawing, notes, diagrams, charts, sticky notes, audio notes, collaboration, turn-in workflows, and supporting classroom activities. DrawSplat^TM is not used for advertising, behavioural profiling, or AI training. Full feature list.

2. Three deployment modes and what each collects

3. Data flow diagram

Browser-only mode:
  [Student browser] <-- everything stays here. No external requests by default.

Google Apps Script mode:
  [Student / teacher browser]
      |
      |  HTTPS POST/GET, only when the teacher has configured a script URL
      v
  [script.google.com /macros/s/.../exec]  (the district's own Apps Script project)
      |
      v
  [Google Sheet]  (Boards / Rooms / TurnIns / Audit / ParentRequests / Users etc.)
      and
  [Google Drive]  (per-board JSON + PNG files in the district's Drive)

Self-hosted MySQL mode:
  [Student / teacher browser]
      |
      |  HTTPS to the district's own domain
      v
  [district.example.org/api/drawsplat/mysql]  (Node + Express in the district's infra)
      |
      v
  [MySQL]  (users, sessions, boards, audit_events, parent_requests, time_usage, ...)

4. Subprocessors

DrawSplat^TM as a product has no required subprocessors. Subprocessors only enter the picture when a district opts into a feature that needs them, and the relationship is between the district and that subprocessor — not between the vendor and that subprocessor:

5. Security controls matrix

6. Breach notification SOP

1. Discovery. A teacher, admin, parent, or external researcher reports a suspected breach via Contact / Information Request or the audit log surfaces an anomaly.
2. Triage within 24 hours. Operator confirms scope: which deployment mode, which records, which audit trail rows are affected.
3. Contain. Freeze affected boards / rooms (server-enforced write block). Revoke active sessions on the self-hosted backend. Disable affected Apps Script deployment if necessary.
4. Notify within 72 hours. Operator notifies the named district Privacy / Security Contact from the District Data Privacy Addendum using the breach notice contact method declared there. Notice includes: what happened, what data was involved, what containment was done, what the district should do next.
5. Investigate & remediate. Operator investigates root cause, patches, re-tests. The Activity Records audit log is preserved for the investigation.
6. Post-incident report. Written summary delivered within 30 days, including timeline, scope, remediation, and any changes to security controls.

7. Retention schedule

All retention windows are district-configurable from Teacher Admin → Compliance Console → Retention. Every cleanup writes a RETENTION_ACTION audit row with counts.

8. Parent / student request workflow

1. Parent visits Family Access Tools and submits a request (view, export, correct, delete, pause, safety report, privacy question).
2. Request lands in the ParentRequests sheet tab / DB table as pending_verification.
3. Compliance admin gets an email notification (Apps Script MailApp.sendEmail) and reviews the request in Teacher Admin.
4. Identity verified via teacher-issued one-time 8-character code (SHA-256 hashed, 14-day expiry, single-use).
5. Verified request transitions to verified, then approved / denied / completed by an admin click.
6. Export: one-click ZIP of the student’s boards + turn-ins + user row (no hashed credentials), emailed as a 15-minute download link.
7. Delete: admin button trashes Drive files, removes rows, logs DATA_DELETED.
8. Acknowledged within 10 school days; completed within 30 calendar days when feasible.

9. FERPA / COPPA / SCOPE / CIPA crosswalks

FERPA school-official crosswalk

When DrawSplat^TM is engaged as a service provider, the district designates the vendor as a school official under FERPA’s school-official exception. Conditions:

• Performs an institutional service or function. The product is operated as part of classroom instruction (the district’s approved educational purpose stated in section 1).
• Under direct control of the school. The district controls the deployment mode (browser-only / Apps Script / MySQL), storage location, retention windows, and access rules; the District Data Privacy Addendum names the controlling district and the privacy contact.
• Use / redisclosure limits. Student data is used only for the school-authorized educational purpose. No advertising, behavioural profiling, AI training, or sale of data. No redisclosure outside the district’s subprocessors.
• Inspect / correct / delete rights. Parents and eligible students can submit a request via Family Access Tools; the District’s admin verifies and acts on the request from Teacher Admin.

COPPA school-consent notice (for under-13 users)

Under COPPA the district may provide consent on behalf of parents when the service is for an educational purpose and the district retains direct control. The district’s notice to parents typically says, in plain language:

Our school uses DrawSplat^TM, a free interactive whiteboard for classroom drawing, notes, and collaboration. The school controls all storage and access. DrawSplat^TM does not show ads, does not sell student data, does not use student work to train AI, and does not require student accounts in browser-only use. If you would like to view, correct, export, or delete your child’s data, use Family Access Tools at /parents/ on the school’s DrawSplat^TM site.

Texas SCOPE / TEC 32.151+

See legal/texas-compliance.html for the plain-language explainer.

CIPA

CIPA is a school / library E-rate internet-safety and filtering obligation, not a vendor privacy law. DrawSplat^TM supports CIPA via link allowlists, board freeze, text filtering, the moderation + image-approval queues, and the audit log, but does not replace the district’s network-level filter or its internet safety policy. Full statement: CIPA support statement.

10. District contracting documents

• Terms & Privacy
• District Data Privacy Addendum (signature-ready)
• Privacy Notice Builder (generate a local notice)
• Widget Security Boundary & Data Inventory
• Accessibility Statement
• Texas Compliance Explainer
• Compliance Roadmap
• Compliance Console Operator Guide

11. Recommended production posture

For classroom production use today, the supported path is Google Apps Script + Sheets + Drive in the district’s own Google Workspace tenant. The MySQL self-hosted path is feature-complete in code but has not yet been exercised against a live database in production. Districts that want to pilot the MySQL path should run a technical review (integration test against a non-production database, single-instance only, manual cron monitoring) before student production use. See server/mysql-backend/README.md for the production checklist.

12. Evidence gallery (district reviewer)

These are the screens a district reviewer typically needs to see — the live Compliance Console, the Family Access Tools queue, the District Privacy Packet download, and the audit log. The CAPTURE.md checklist in the repo describes exactly where to find each one and what state to put the app in before capturing. Operators are expected to drop in their own deployment’s screenshots before sharing this page with a district reviewer, since each capture should reflect the district’s own configuration.

Operator note: replace each .evidence-placeholder div with an <img src="evidence/capture-key.png"> once you’ve captured the screen. The data-capture attribute matches the filename in docs/CAPTURE.md.

Working with us

This packet plus the District Data Privacy Addendum is the contracting surface. If your district’s review process needs a specific format, screenshot evidence, or a custom exhibit, send the request through the Contact / Information Request form and we’ll respond within five business days.