School data processing agreement
Between the school and eSora Labs Ltd., for Barnabut. Schools sign it in Barnabut for schools → Settings. Version 2026-11.
1. Who is who
The school (or its school board) is the controller of student information. eSora Labs Ltd., which makes Barnabut, processes it only on the school’s documented instructions, to provide Barnabut to the school.
2. What is processed
Teacher name and work email; class names and grades; student first names, the picture each student chooses, their picture password, lesson progress, answers to checks, practice results, minutes played, and requests for help. No surnames, birthdays, addresses, photos, or contact details of students. No advertising and no profiling.
3. Purpose
Only to run lessons, show progress to the teacher and linked families, and keep the service secure. Student information is never sold, never used for advertising and never used to train AI models.
4. Where it is kept
Without a connected school account, everything stays in the browser on the class device. With a school account, records are stored by eSora Labs in Canada, encrypted in transit and at rest.
5. Retention and deletion
The school chooses: 30 days after a student’s last activity, the end of the school year (July 31), or until the school deletes it. The school can export or delete everything at any time from Settings. Backups are overwritten within 30 days of deletion.
6. People and sub-processors
Only staff who need access to support the school, bound by confidentiality. Sub-processors (hosting, email delivery) are listed on request and the school is told 30 days before a new one is added.
7. Security and incidents
Access controls, encryption, logging and regular testing. eSora Labs tells the school without undue delay, and within 72 hours, of any breach that affects its information, and helps it meet its own obligations.
8. Requests and audits
eSora Labs helps the school answer access and correction requests from families, and provides the information needed to show compliance with this agreement.
9. Law
This agreement supports the school’s obligations under applicable privacy law for students, including PIPEDA, Québec Law 25, provincial education privacy law, FERPA and COPPA where they apply. Questions: privacy@barnabut.com.
Version 2026-11