School Data Privacy Addendum

1. Scope and Product Boundary

ShowNotePad is a production-note service used to record, transcribe, classify, organize, synchronize, and retain shared rehearsal and production notes.

ShowNotePad student accounts are limited to students age 13 or older. Provider does not offer accounts for children under 13 or students whose age is unknown. Only an authorized adult owner or administrator may enable and invite student accounts.

2. Definitions

Authorized User means a person whom School permits to use its ShowNotePad production team.

School Data means information submitted to or generated through ShowNotePad for School, including information associated with students, staff, production notes, audio, transcripts, tags, and account activity. School Data excludes Provider's de-identified operational statistics that cannot reasonably identify School, an individual, or rehearsal content.

Student Data means School Data directly related or reasonably linkable to an individual student, including education-record information when applicable.

Security Incident means confirmed unauthorized access to, acquisition of, use of, disclosure of, or material loss of Student Data maintained by Provider. It does not include unsuccessful attempts that do not compromise Student Data.

Subprocessor means a service provider engaged by Provider to process Student Data for ShowNotePad.

3. School Responsibilities and Authority

School represents that:

1. the person accepting this Addendum is an adult authorized to act for School;
2. ShowNotePad will be used for an authorized educational, theatrical, or school-production purpose;
3. every student account will be assigned only to a student confirmed by School to be age 13 or older;
4. School has provided notices and obtained permissions required by applicable law, district policy, and its recording practices;
5. School will invite only Authorized Users and promptly remove access that is no longer authorized; and
6. School will not direct a child under 13 to create or use a ShowNotePad account.

School determines which records and recordings its users submit. School should not submit information that is unnecessary for the production-note purpose.

4. Provider Responsibilities

Provider will:

• process Student Data only to provide, secure, maintain, support, and improve the reliability of ShowNotePad for School;
• follow School's documented instructions that are consistent with the Agreement, this Addendum, the product's capabilities, and applicable law;
• restrict access to persons and Subprocessors who need it to provide or secure the service;
• maintain reasonable administrative, technical, and organizational safeguards;
• not sell Student Data;
• not use Student Data for behavioral advertising or advertising profiles;
• not use student notes, audio, or transcripts to train public AI models;
• not disclose Student Data except to authorized School users, approved Subprocessors, as directed by School, or as required by law; and
• apply the retention and irreversible deletion controls described below.

Provider does not make educational decisions about students and does not use Student Data to determine eligibility, grading, discipline, or opportunities.

5. Ownership and Limited License

As between School and Provider, School and its users retain their rights in School Data. School grants Provider a limited, non-exclusive right to host, copy, transmit, transcribe, classify, synchronize, secure, support, retain, and delete School Data only as needed to provide and protect ShowNotePad and comply with law.

This limited right does not require Provider to retain content after an authorized deletion or the end of the applicable retention period.

6. Data Elements and Purpose

ShowNotePad may process:

• names, email addresses, roles, and 13+ student member category;
• account, session, and device identifiers;
• typed and recorded production notes;
• audio, transcripts, department tags, scene references, completion state, and note history;
• synchronization, security, diagnostic, and support records; and
• organization, subscription, and billing-contact information for adult owners.

Provider processes these elements to authenticate users, operate the shared notebook, transcribe and classify notes, synchronize devices, enforce permissions, detect abuse, provide support, and satisfy authorized requests.

7. Subprocessors

Provider may use Subprocessors for infrastructure, storage, transcription, classification, transactional email, app distribution, security, and adult-owner billing. Current categories include Cloudflare, Resend or a successor transactional email provider, Apple, and Stripe.

Provider remains responsible for limiting each Subprocessor to the services it provides. Payment card data is entered on Stripe-hosted pages and is not stored directly by ShowNotePad. Student rehearsal content is not sent to Stripe.

8. Security

Provider maintains safeguards appropriate to the nature of Student Data, including:

• encrypted network connections;
• tenant and role authorization checks;
• hashed credentials and protected session tokens;
• bounded request and upload controls;
• audit and security-event handling;
• restricted administrative access;
• retention and deletion automation; and
• testing designed to prevent cross-tenant access and stale-client restoration.

School acknowledges that no system can guarantee absolute security and agrees to use ShowNotePad only for information appropriate to a shared production notebook.

9. Security Incidents

Provider will investigate a confirmed Security Incident and notify the authorized School contact without unreasonable delay after confirming that Student Data was affected, subject to law-enforcement restrictions and the time needed to determine reliable facts.

The notice will include available information reasonably necessary for School to understand the nature of the incident, affected information, corrective steps, and recommended actions. Notification timing will also follow applicable law and any applicable customer agreement.

10. Review, Correction, Export, and Deletion

School may request reasonable assistance reviewing, correcting, exporting, or deleting retained School Data by contacting [email protected]. Provider may verify the requester's identity and authority before acting.

Assistance is limited to data still retained by ShowNotePad. Provider will not restore information already irreversibly deleted.

11. Retention and Deletion

Unless School's approved plan states otherwise:

• uploaded audio is retained for up to 10 days;
• notes, transcripts, tags, and related notebook content are retained for up to 365 days from server creation, unless deleted sooner; and
• bounded security events are generally retained for up to 30 days.

Deleting a note erases its content and classification data. Attached audio becomes unavailable and is queued for physical deletion. Provider may retain minimal non-content identifiers, timestamps, versions, and deletion state needed to prevent an old or offline client from restoring deleted material, secure the service, and satisfy legal-preservation duties.

At expiration or termination, School may use the service through the paid term subject to the Agreement. Existing content then follows the ordinary retention schedule unless School requests earlier deletion and Provider is legally able to honor it.

12. Under-13 Reports and Actual Knowledge

If School or Provider learns that a ShowNotePad account belongs to a child under 13 or a student whose age cannot be confirmed as at least 13:

• the account and active sessions will be revoked;
• pending invitations for that user will be revoked;
• further collection will stop; and
• retained personal information will be deleted through Provider's established process, subject to required legal preservation.

School will promptly report such an account to [email protected]. Provider will not preserve access by relabeling the account.

13. Legal Requests

Provider may disclose School Data when required by valid legal process. To the extent legally permitted, Provider will notify School before disclosure and will disclose only the information reasonably required.

14. Compliance Cooperation

The parties will reasonably cooperate concerning FERPA, applicable state student-privacy laws, school policies, and authorized privacy requests.

This Addendum does not state that Provider is a "school official" for every customer or jurisdiction. School is responsible for determining the applicable legal basis and any required state or district addendum.

15. Term, Suspension, and Termination

This Addendum remains in effect while Provider processes Student Data for School. Provider may suspend access necessary to address security threats, unlawful use, nonpayment, or material breach, consistent with the Agreement. Deletion and confidentiality obligations survive as applicable to retained Student Data.

16. Contact

Questions and authorized data requests can be sent to [email protected].

Steven Harriton, operating as Pro Event Tools
Canton, Georgia, United States