Trust centre · Data processing terms for schools
Data processing terms for schools: the school decides.
Under our data processing terms for schools, your school is the data fiduciary and AI Flywheel is the school’s data processor. Subject to legal review.
Updated
Published after legal review. This is our working draft. The DPDP processor model needs a legal opinion, so the final text may change before it is published as a policy.
Data fiduciary
Your school
Decides why and how children’s data is used. Invites parents and collects consent.
Data processor
AI Flywheel
Processes data only on the school’s written instructions, to run lessons and reports.
Subject to legal review: the school-as-fiduciary, AI Flywheel-as-processor model under the DPDP Act needs a legal opinion before these terms are signed.
What we commit to
- Use data only for the purposes in the school’s agreement.
- Store and process children’s data in India.
- Never use school data to train AI models.
- Keep data secure: access by role, encryption, and logs of who looked at what.
- Help the school answer parents who ask to see, correct or delete data.
- Delete or return data when the agreement ends.
Sub-processors
Any company that helps us run the service (for example, hosting in India) is listed for the school before it is used. The school can object.
If something goes wrong
We tell the school promptly after we learn of a data incident, with what happened and what we are doing, so the school can meet its own duties to parents and the regulator.