SAVAL.app

Data Processing Addendum

Effective: October 10, 2026

This addendum sets out how Saval protects student and staff data on behalf of schools and institutions, in line with GDPR, UK GDPR, COPPA and FERPA. See also our Privacy Notice.

1. Scope

  1. This Data Processing Addendum ("DPA") forms part of the Saval Terms of Service or any order form between Saval, a product of uDurrani Inc. ("Saval", "Processor"), and the school, institution or customer ("Institution", "Controller").
  2. It applies whenever Saval processes personal data on the Institution's behalf, and takes precedence over the main agreement on data protection matters.
  3. It is designed to meet Article 28 of the GDPR and UK GDPR, COPPA (16 CFR Part 312) and FERPA (34 CFR Part 99).

2. Roles

  1. The Institution is the controller and owns all student data and teaching content. Saval is the processor.
  2. Saval processes personal data only on the Institution's documented instructions, which are this DPA, the agreement and the Institution's use of the Service. Saval will tell the Institution if it believes an instruction breaks data protection law.
  3. Saval will not sell personal data, use it for advertising, build commercial profiles of students, or use it to train AI models.

3. Education law (COPPA and FERPA)

  1. COPPA: where students are under 13, the Institution authorizes collection on behalf of parents solely for the use and benefit of the school, as permitted by the FTC. Saval collects only what is reasonably needed for the learning activity and will help the Institution respond to parents who ask to review or delete their child's data.
  2. FERPA: Saval acts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1), under the Institution's direct control, and will not re-disclose education records except as permitted by FERPA.

4. Confidentiality

  1. Everyone at Saval who can access personal data is bound by confidentiality obligations, and access is limited by role to what each person needs.

5. Security (GDPR Article 32)

  1. Encryption of data in transit (HTTPS/TLS) and at rest.
  2. Database row-level security that separates each user's and institution's data.
  3. Role-based access for administrators, teachers and students, with audit logging of administrative actions.
  4. Student code runs in an isolated sandbox with no access to Saval's systems or other users' data.
  5. Regular security reviews and prompt fixing of identified vulnerabilities.

6. Sub-processors

  1. The Institution gives general authorization for Saval to use the sub-processors listed in Annex B.
  2. Saval binds each sub-processor to written terms at least as protective as this DPA and remains responsible for its performance.
  3. Saval will give at least 30 days' notice of any new or replacement sub-processor. If the Institution objects on reasonable data protection grounds and no solution is found, it may terminate the affected service and receive a pro-rata refund of prepaid fees.

7. International transfers

  1. Where personal data leaves the EEA, UK or Switzerland, Saval relies on an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK Addendum), together with any needed additional safeguards.

8. AI processing

  1. Student responses are sent to AI providers only to produce feedback or grading suggestions for that activity. Saval engages providers under terms that prohibit using this data to train their models.
  2. AI output is a suggestion. Teachers keep control of rubrics, strictness and final grades.

9. Data subject rights and assistance

  1. Saval will promptly pass to the Institution any request it receives from a student, parent or teacher, and will help the Institution answer access, correction, deletion, restriction, objection and portability requests within legal timeframes.
  2. Saval will reasonably assist with data protection impact assessments and consultations with supervisory authorities.

10. Personal data breaches (GDPR Article 33)

  1. Saval will notify the Institution without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting its data.
  2. The notice will describe the nature of the breach, the data and approximate number of people affected, likely consequences and the measures taken, and Saval will keep the Institution updated.

11. Audits

  1. On reasonable request, Saval will provide the information needed to show compliance with this DPA and will allow audits by the Institution or its appointed auditor, with reasonable notice and at most once a year unless a breach or regulator requires otherwise.

12. Return and deletion

  1. At the end of the service, Saval will, at the Institution's choice, return or delete its personal data within 90 days, unless the law requires it to be kept. Deletion from backups follows the normal backup cycle.

Annex A: Details of processing

Subject matter
Providing the Saval problem-based learning and assessment platform
Duration
The term of the Institution's subscription, plus the return/deletion period
Data subjects
Teachers, administrators, students and guest participants
Personal data
Names or nicknames, email addresses, quiz responses (text, code, images), scores, feedback and activity logs
Special category data
None intended. Institutions should not ask students to submit such data
Purpose
Delivering quizzes, AI feedback, analytics and support to the Institution

Annex B: Authorized sub-processors

  • Supabase (cloud hosting) — Database, sign-in, file storage and server functions. Data: Account details, quizzes, student responses, activity logs.
  • Lovable AI Gateway (Google Gemini, OpenAI GPT) — AI feedback, grading suggestions and question generation. Data: Question text, rubric and the student response being assessed.
  • Piston code runner — Running student code in an isolated sandbox. Data: Submitted source code (not stored after execution).
  • Resend — Service emails such as invitations and password resets. Data: Email address and display name.
  • Stripe — Subscription payments. Data: Billing contact and payment details of paying teachers or institutions only; never student data.

Need a countersigned copy? Email privacy@saval.app.