DRAFT prepared for legal review, not a policy.

# Data processing agreement: outline (draft)

Prepared 2026-09-19 as a drafting brief for counsel. This is an outline of the
terms Limud can actually perform today, with the facts a DPA schedule needs. It
is not an agreement, it is not an offer, it is not legal advice, and it binds
nobody.

## 1. Parties and roles

Customer is the controller, or the owner of the database under Israeli law.
Limud is the processor, or the holder. Limud processes only on documented
instructions from the customer.

## 2. Subject matter and duration

Subject matter: provision of the Limud education platform. Duration: the term of
the customer agreement, plus the deletion window in section 7.

## 3. Nature and purpose of processing

Hosting, storage, retrieval, AI-assisted rewriting of teaching material,
AI-assisted reading of student answers producing suggestions a teacher approves,
AI tutoring, and reporting.

## 4. Categories of data subject

Students, teachers, other school staff, parents or guardians.

## 5. Categories of personal data

As listed in the FERPA and Israeli law drafts in this packet.

## 6. Technical and organisational measures

- Encryption in transit.
- Role-based access enforced at the network edge and again in every handler.
- Audit logging of staff reads of a student's personalised version and of AI
  tutor conversations.
- Idle session expiry.
- Rate limiting on authentication and on AI endpoints.
- Separation of tenants by district.

## 7. Retention and deletion

- Accountless live-session data: deleted after 7 days.
- Individual learner data after a subscription ends: 90 days.
- Wellbeing check-in notes: redacted after 45 days, or 14 days after a flag is
  resolved.
- On termination: deletion on request, within the window the signed agreement
  states. The published commitment today is 30 days.

## 8. Subprocessors

The current list is in the subprocessor draft in this packet. Customer is
notified of additions before they process customer data.

## 9. Assistance

Limud assists the customer with data subject requests, with security incident
notification, and with any assessment the customer must carry out.

## 10. Audit

Customer may request the audit log for its own tenant at any time. Broader audit
rights are for counsel to settle.

## 11. Transfers

See the data residency draft. Data is processed in the United States.

## 12. Open items for counsel

1. Whether Limud signs the customer's DPA template or offers its own.
2. Liability, indemnity and insurance. None of these is addressed here.
3. Whether standard contractual clauses are annexed for European customers.
4. Breach notification timing.
5. The deletion window in a signed agreement, which may differ from the 30 days
   published today.