Student Data Privacy Addendum

Storylines is designed to help Institutions capture and share memories, activities, milestones, classroom experiences, photos, videos, audio, artwork, journal entries, and similar content. Storylines is not intended to serve as an Institution’s official grading, attendance, disciplinary, medical, academic, or student records system. This Addendum governs Storylines’ processing of Student Data on behalf of the Institution in connection with the Storylines Services. If this Addendum conflicts with the general Terms of Service or Privacy Policy regarding Student Data, this Addendum controls. “Student Data” means personal information about a child or student submitted to, collected through, or maintained in Storylines by or on behalf of the Institution for a school or educational purpose, including names, photos, videos, audio, classroom information, activities, milestones, journal entries, artwork, comments, and related metadata.

As between the parties, the Institution controls Student Data and determines the purposes for which it is submitted to Storylines. Storylines processes Student Data as a service provider to the Institution. Individual teachers and staff do not acquire independent ownership or control of Student Data merely because they upload or manage it.

Storylines will process Student Data only to provide, maintain, secure, support, and improve the Services for the Institution; to perform instructions authorized by the Institution; and as otherwise permitted or required by applicable law. Storylines will not use Student Data for targeted advertising, cross-context behavioral advertising, advertising profiles, data brokerage, or general-purpose AI model training. Storylines will not sell Student Data.

School Storylines containing Student Data may not be made Public. Storylines may implement technical controls that disable Public visibility for School Storylines. For clarity, this Addendum does not govern a religious organization’s general congregational or youth-group Storylines, or a sports team’s Storylines, unless the Organization is acting as an Educational Institution and the data is processed for a school or educational purpose. The Institution is responsible for determining which School Personnel, parents, guardians, and other recipients are authorized to access School Storylines.

Storylines does not currently offer Accounts directly to children under 13. The Institution may submit information about children through authorized adult users where permitted by law. If the Services later permit children under 13 to directly provide personal information, the parties will comply with applicable COPPA notice and consent requirements before enabling such use.

The Institution is the primary point of contact for requests to access, correct, export, or delete Student Data. Storylines will reasonably assist the Institution in responding to valid requests from parents, guardians, students, or regulators as required by applicable law and this Addendum.

Storylines will maintain reasonable administrative, technical, and organizational safeguards designed to protect Student Data against unauthorized access, acquisition, use, alteration, or disclosure. Storylines will limit access to Student Data to personnel and service providers who need access to provide or support the Services and who are subject to appropriate confidentiality and data protection obligations.

Storylines will notify the Institution without unreasonable delay after confirming a security incident involving unauthorized acquisition of or access to Student Data, consistent with applicable law. Storylines will provide information reasonably necessary for the Institution to satisfy legally required notifications, subject to law enforcement restrictions and legitimate security considerations.

Storylines may use subprocessors and service providers to provide hosting, infrastructure, support, security, printing, media processing, and other Services. Storylines will require service providers that process Student Data to protect it and use it only for contracted purposes. Student Data will not be disclosed to advertising networks, marketers, or data brokers.

Storylines will not use Student Data to train general-purpose AI models. Where face and scene organization features are enabled, analysis is designed to occur on-device. Resulting organizational metadata may be synchronized to Storylines servers to provide organization and search. Student Data will not be used for unsolicited Surprise Videos or transmitted to third-party media-generation services unless an authorized Institution user expressly initiates the feature and the processing is permitted by law and this Addendum.

Storylines will retain Student Data for as long as necessary to provide the Services to the Institution and as directed by the Institution, subject to applicable law. Upon the Institution’s valid request or termination of the applicable school relationship, Storylines will provide a reasonable means to export Student Data where technically supported and will delete or de-identify Student Data within a commercially reasonable period, subject to legal retention obligations and limited backup cycles. Closing an individual teacher or staff account does not automatically delete Student Data controlled by the Institution.

Storylines may create and use aggregated or de-identified information that cannot reasonably identify a student to operate, secure, analyze, and improve the Services, only to the extent permitted by applicable law and this Addendum. Storylines will not attempt to re-identify de-identified Student Data except where necessary to test or validate de-identification safeguards and permitted by law.

The Institution will authorize only appropriate School Personnel to access the Services and will promptly remove access when authorization ends. The Institution is responsible for providing notices and obtaining consents, permissions, photo or media releases, or other authorizations required by applicable law or Institution policy for the submission, use, and sharing of Student Data, including photos, videos, voice recordings, and other content depicting or relating to minors. The Institution will use the Services in accordance with applicable student privacy, education, biometric, records, and child privacy laws. If the Institution also uses Storylines for non-school religious, sports, community, or other Organization purposes, those uses are governed by the general Terms of Service and Privacy Policy unless separately agreed in writing.

The parties intend for this Addendum to support compliance with applicable U.S. state student and child privacy laws relevant to the Institution’s use of Storylines. If a state, district, or Institution requires additional mandatory terms, the parties may execute a state-specific or negotiated addendum.

This Addendum remains in effect while Storylines processes Student Data on behalf of the Institution. Provisions concerning confidentiality, security, restrictions on use, and deletion survive as necessary to protect Student Data.

Privacy and legal notices concerning this Addendum may be sent to: First Time Media Inc. 2980 McFarlane Road, Miami, FL 33133 legal@storylines.media

This Addendum may be accepted electronically, incorporated into an order form or school agreement, or executed by authorized representatives of the parties.