Enterprise controls for administrators: single sign-on, signed data-processing terms, and a full audit trail of every AI interaction.
Download our standard DPA (PDF, ready to attach to procurement packages), review with your counsel, and upload the countersigned copy below. For most districts we can turn around a signed DPA in under a week.
Template version 2026-07. Not a substitute for legal advice — please review with your counsel.
School controls the student data; CanopyKids processes it only on your instructions.
We collect an age band, not date of birth, and never sell student data.
EU Standard Contractual Clauses (2021/914) and UK IDTA included for international transfers.
Written notification within 72 hours of any confirmed incident affecting your data.
Supabase, Anthropic, Stripe, Cloudflare. 30 days' notice before any change.
All customer data deleted within 30 days of termination or written request.
Once your counsel has reviewed and signed the DPA, upload the countersigned copy here (PDF, DOC, or DOCX). It's stored privately — only you and our legal team can access it.