Should I Use This
Tool with Students?

When data ownership isn't defined, the vendor's default terms apply — and those terms are written to protect the vendor, not your students. Student work, responses, and personal information can be used in ways you never intended or agreed to.

A DPA is the only legally binding document that obligates a vendor to protect your students' data. Without one, you're operating on goodwill — and goodwill doesn't hold up in a breach. This is the single most important document in your EdTech toolkit.

Vague language like "we may share data with partners" is a data sale in disguise. FERPA and COPPA restrict how student data can be shared — but only if the vendor is contractually bound to follow them. Silence in a privacy policy is not protection.

If your district has an AI policy and you introduce a tool that conflicts with it, you carry that liability — not the vendor, not admin. If your district doesn't have a policy yet, that's a conversation worth starting before something goes wrong.

Parents have the right to know how their child's data is used — and you are the first line of accountability in that conversation. If you can't answer it now, a parent asking at Back to School Night will be a much harder moment.