Privacy and procurement
Compliance and district review
Use the documentation for the installation your district actually runs. Identify enabled services, data storage, responsible operators, and verified safeguards before approving student use.
Distinguish the storage paths
| Installation | Records and controls |
|---|---|
| Browser only | Board drafts and exports on the device. Device and browser policies govern cleanup. |
| Google Apps Script | Drive/Sheets storage with the Apps Script Compliance Console, family requests, safety settings, and configured retention triggers. |
| District MariaDB / MySQL | Account-owned boards, district rosters, classroom assignments, student submissions, and feedback. Authenticated role and membership checks apply. District operators manage backups, retention, export/deletion procedures, and server security; the Apps Script console does not manage these records. |
Prepare an NDPA / DPA review
- Read the NDPA / DPA Review Packet and Compliance Gap List.
- Document actual hosting location, enabled components, Google permissions, providers, data categories, contacts, retention schedule, and access roles.
- Complete the District Privacy Addendum and applicable district agreement. Check the DPA Register for recorded execution status.
- Test authentication, student access boundaries, backup/restore, and the district’s record-request and deletion procedure. Attach evidence from your installation.
- Have your district’s authorized privacy and legal reviewers approve the deployment and agreement.
Free software licensing, a review packet, and policy templates do not establish an executed NDPA/DPA or certify a district’s legal compliance.
Reference documents
- Terms and privacy · Combined policy packet
- Google OAuth disclosure · Widget security boundary
- Texas compliance reference · GDPR reference
- Accessibility statement · Privacy Notice Builder
- Apps Script Compliance Console guide
Keep review evidence current
Repeat operational review after changes to hosting, authentication, enabled components, storage providers, or backend code. Keep protected backups and deployment-specific privacy packets. Do not reuse another district’s settings or assume a declaration proves a control is enforced.