Our commitment
TimeGraphics is committed to protecting student data and is prepared to enter into Data Processing Agreements (DPAs) with educational institutions. We understand that schools require formal agreements before adopting technology tools, and we aim to make this process as straightforward as possible.
SDPC National Data Privacy Agreement (NDPA)
TimeGraphics supports the Student Data Privacy Consortium (SDPC) National DPA, a standardized framework used by thousands of US school districts.
- General Offer: TimeGraphics extends a General Offer of terms under the NDPA framework. Qualifying schools and districts may adopt the NDPA without individual negotiation by contacting schools@time.graphics
- Exhibit 1 (data elements): See our School Accounts page for the specific data elements collected
- Standard Student Data Privacy Agreement: We also accept state-specific SDPA templates used in many US states
Key DPA commitments
Any DPA executed between TimeGraphics and a School will include the following commitments (which are also reflected in our Terms of Service section 19):
- Purpose limitation: Student data used solely for the educational purpose authorized by the school
- No sale or commercial use: Student data is never sold, rented, or used for advertising or non-educational profiling
- Data minimization: Only minimum necessary data collected (email/school ID + display name)
- Security: Industry-standard technical and organizational measures (see Security)
- Breach notification: 72 hours from confirmation of incident
- Subprocessors: Transparent list with flow-down obligations and 30-day advance notice of changes (see Subprocessors)
- Data return/deletion: Export (JSON) and deletion within 30 days of request or termination, with written confirmation
- School access: Schools may inspect, review, correct, or request amendment of student data at any time
- No unilateral reduction: Material changes that reduce student data protections require 60-day advance notice and school opt-out/termination right
- Governing law: Student data provisions are governed by applicable US federal law and the school's state law
How to initiate a DPA
- Email schools@time.graphics with your school or district name, contact person, and state
- We will provide a pre-filled DPA (or accept your state's SDPA template) within 5 business days
- Review, sign, and return — we aim to complete the process within 10 business days
- Once executed, we activate enhanced School Account privacy settings (private-by-default timelines, GA4 disabled, restricted profiles)
Contact
- DPA requests: schools@time.graphics
- Privacy questions: privacy@time.graphics