Data processing agreement

1. Who is who

Your PTO decides what questions to ask your staff and who can see the answers. That makes your PTO the controller of that information. We store and process it on your instructions and for no other purpose, which makes us the processor.

In practice: we do not decide what your form asks, we do not decide who your organizers are, and we do not use anything your staff tell you for our own purposes — not for advertising, not for training models, not for selling to anyone.

2. What we process

Whatever your form asks for. Typically a staff member’s name, their grade or role, their room, an email address we use only to send them their own edit link, and their answers to your questions.

Some PTOs ask about food allergies or dietary needs. That is your choice to make, and it is health information when you make it. Our templates ship those questions visible to organizers only, and the builder asks you to confirm before any answer becomes visible to families.

We hold no student information, no family accounts, and nothing a child enters. The product is built so that stays true.

3. What we do with it

• Show it to the people your visibility settings allow.
• Email edit links to the staff member who owns a response.
• Email your organizers about the account.
• Keep backups, and fix the service when it breaks.

Nothing else, and nothing further without asking you.

4. Who else can see it

Our subprocessors, and only for what each one does:

• Railway — hosting and the database, in the United States.
• Resend — sending email.
• Cloudflare — bot protection on your form.
• Stripe — payment, if you pay by card. Stripe never receives your staff data.

We will tell your organizers before adding or changing one.

5. Our own access

Our support staff can see account-level information — your school’s name, your organizers, how many responses you have, whether your payment is current. They cannot see your staff’s answers from the support console at all.

If we need to look at your account to help you, that session is read-only by default, requires a stated reason, expires after thirty minutes, and is written to your own activity log where your organizers can see it. Getting further than read-only takes a second, separately logged step.

6. Security

• Encrypted in transit and at rest.
• Each school’s data is isolated from every other school’s, at the database level as well as in the application.
• No passwords anywhere. Organizers sign in with a single-use link sent to their address; our own staff need a second factor as well.
• Every change an organizer makes is recorded in your activity log.

7. How long we keep it

Responses stay until you archive or delete them. The annual rollover archives last year’s answers rather than deleting them, so you keep your history.

If you cancel, your data is kept for 90 days so you can export it, and then deleted. Deletion is real deletion, not a hidden flag.

You can ask us to export or delete everything at any time, and we will do it within 30 days. A teacher can remove their own response themselves, without asking anyone.

8. If something goes wrong

If we become aware of a breach affecting your data we will tell your organizers without undue delay and within 72 hours, with what we know, what we are doing, and what you may need to do. Our contact for this is security@mypto.rocks.

9. Ending it

You can close your account whenever you like and take your data with you — export works in every account state, including if a payment lapses. We will not hold your PTO’s questions or answers hostage to a bill.