Data Processing Addendum

When an institution uses WriteSignal to process personal data (including student records), the institution is the Controller and WriteSignal is the Processor, acting only on the Controller's documented instructions. For US education customers, WriteSignal acts as a "school official" with a legitimate educational interest under FERPA.

WriteSignal processes submitted text and account data to provide writing analysis, AI-assisted proofreading and rewriting, an AI-style detector, and classroom/roster management. Processing lasts for the term of the agreement.

Data subjects: the Controller's authorized users (teachers, students, staff). Personal data: account identifiers (email, display name), submitted writing, usage records, and classroom membership. WriteSignal does not request special-category data and asks Controllers not to submit it.

WriteSignal uses the sub-processors listed at /subprocessors (hosting, database, and AI providers). AI providers process submitted text solely to generate results under contractual no-training terms. WriteSignal will give notice before adding or replacing a sub-processor that handles personal data.

Encryption in transit, row-level tenant isolation, server-side authorization and quotas, per-user rate limiting, automatic data retention limits, and hardened response headers. See /security. Measures may be updated provided the level of protection is not degraded.

WriteSignal provides self-serve data export and deletion, and will assist the Controller in responding to data subject requests and regulatory inquiries, taking into account the nature of processing.

Batch/student submissions are purged after 180 days and usage telemetry after 400 days by default; account data is deleted on account deletion or, on termination, within a commercially reasonable period on the Controller's request.

Where personal data is transferred across borders, the parties will rely on an appropriate transfer mechanism[confirm — e.g. Standard Contractual Clauses]. WriteSignal will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.

WriteSignal will make available information reasonably necessary to demonstrate compliance, including third-party reports where available [e.g. SOC 2 — in progress].

To execute this DPA, contact [privacy@your-domain].