Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is between the school or organization named below ("School" or "Controller") and Permission Please ("Processor"), operated at permissionplease.app.

The School is the controller of student, parent, and staff personal data it uploads or causes to be processed. Permission Please processes that data only to provide the digital permission-slip service.

2. Subject matter and duration

Processing is limited to creating, distributing, signing, storing, and exporting permission slips and related audit records for the School. Processing lasts for the term of the School's use of the Service and until deletion is completed under Section 7.

3. Categories of data and people

Personal data typically includes:

• Staff names, emails, roles, and school affiliation
• Student names and grade levels
• Parent or guardian names and emails
• Form content, field responses, electronic signatures, and timestamps
• Masked IP addresses on signatures and audit logs
• Documents the School attaches to a form

Data subjects are school staff, students, and parents or guardians. The School decides what records to import. Permission Please does not require Social Security numbers, medical records, or payment card data for the core service.

4. Processor obligations

• Process personal data only on documented instructions from the School
• Do not sell student or parent data or use it for advertising
• Limit staff access to people who operate or support the Service
• Keep data encrypted in transit (HTTPS/TLS)
• Notify the School without undue delay if we become aware of a personal data breach
• Assist the School with reasonable access, correction, and deletion requests
• Delete or return School data when the School asks, except where law requires retention

5. School obligations

• Import only the student and parent data needed to run permission slips
• Have a lawful basis for providing that data to Permission Please
• Decide retention for the School's records and request deletion when appropriate
• Keep staff accounts invite-only and promptly ask us to disable departed users

6. Subprocessors

The School authorizes Permission Please to use the following subprocessors to operate the Service:

• Vercel — application hosting
• Supabase — PostgreSQL database and file storage
• Resend — transactional email
• Google — sign-in, when the School uses Google accounts
• Sentry — error monitoring, when configured

We will notify the School of a material subprocessor change and give a reasonable chance to object before that change applies to the School's data. We do not claim that every subprocessor relationship is already under a signed DPA of its own.

7. Retention and deletion

Permission records stay until the School asks us to delete them or the School account is closed. We do not currently run an automatic anonymization job. Deletion requests go to /privacy/delete or privacy@permissionplease.app. We will confirm when School data has been removed from production systems, except backups that expire on their normal cycle and records we must keep by law.

8. What this agreement is not

This DPA does not certify FERPA, COPPA, SOC 2, or any other compliance badge. The School remains responsible for its own student-privacy obligations. Permission Please does not market to children and does not claim to collect verifiable parental consent for the platform itself — parents sign slips the School sent.

9. Contact

Privacy and deletion requests: /privacy/delete or privacy@permissionplease.app
Related documents: Privacy Policy and Terms of Service.