Data Processing Addendum

On a school account, the school is the data controller and education agency. Sacred Blue Studios(operator of Parler) is the data processor and service provider. We process student data only on the school’s documented instructions and only to provide the service.

For family accounts, the parent is the controller; this addendum is about school accounts. See our privacy policy for the full picture.

We process only the student data needed to deliver the reading service:

• A student’s name (or nickname), reading language, per-student feature toggles, and an illustration / avatar reference.
• The content students create or that a teacher adds for them: stories, sentences, captured-page images, generated audio, and AI-generated illustrations, plus optional pronunciation recordings the student chooses to make.

We do not collect student email addresses, passwords, or home addresses. We use this data only to provide the reading service— never for advertising, and never to train AI models.

We use the following subprocessors, each only for the purpose noted:

• Google Cloud / Firebase— authentication, per-project storage, and the AI services (Vertex AI illustrations, Cloud TTS, Vision OCR, Cloud Translation, Speech-to-Text scoring).
• Stripe— billing and invoicing.
• SendGrid— transactional email (invites, receipts, account notices).
• Printify— only when a school or family orders a physical product printed from a drawing, to fulfil and ship that order.

• Each school’s data lives in its own private Firebase project, readable only by that account and the users it authorizes.
• Content moderation runs server-side before AI-generated or user-written content is saved.
• No advertising, no cross-account discovery or messaging, and no use of customer data to train AI models.

• The school can request export or deletion of student data at any time, and we support the school in handling parent and data-subject requests.
• Parents can be invited as read-only viewers of their own child’s work (“follow mode”).
• Deleting a student cascades to all of that student’s pages, stories, audio, and sessions.
• Closing the account deletes all data within 30 days; email us for immediate deletion. Stripe retains billing records as required by financial law.

FERPA.Where the service touches education records, Parler acts as a “school official” with a legitimate educational interest under the school’s direction. We use education records only to provide the service, do not sell them and do not use them for advertising, and return or delete them at the school’s request.

COPPA. For school use, the school or teacher may provide consent on behalf of parents under the COPPA school-consent mechanism, limited to the educational context. The school is responsible for providing any required notices.

GDPR-K.Where GDPR applies, the school is the controller and Parler is the processor; we minimise the data collected about children and support the school’s handling of data-subject requests.

This addendum applies for as long as the school account is active and Parler processes student data on the school’s behalf. To request a countersigned DPA or ask a compliance question, email legal@parler123.app.