CreativeTrail High School Student Data Addendum, Retention Policy, Subprocessor List, and Security Overview

1. Purpose

This document summarizes CreativeTrail's High School/K–12 student-data practices for institution-administered use by K–12 schools, school districts, educators, and other K–12 educational organizations, including public and private institutions.

It is intended to supplement the CreativeTrail High School Privacy Policy and Terms of Use. If CreativeTrail signs a separate written agreement with a school or district, that signed agreement will control where it conflicts with this document.

1.1 Current Pilot Notice

The current school-specific pilot has a separate Current School Pilot Data Notice. That notice, together with the applicable school agreement, describes the pilot's current account, process-record, and retention practices.

2. Role of CreativeTrail

CreativeTrail provides an educational writing-process service to schools, teachers, and students.

For High School deployments, CreativeTrail processes student data to provide the educational service requested by the school, teacher, district, or authorized educational program.

CreativeTrail does not use High School student data for targeted advertising, unrelated marketing, sale of student information, or non-school profiling.

CreativeTrail High School/K–12 Mode is currently available only to students age 13 or older. Students under 13 may not use the service.

3. High School Data Collected

3.1 Standard Pseudonymous Student Access Data

• Pseudonymous student code
• PIN hash
• Class code
• Enrollment record
• Signed High School access session
• Confirmation that the student is 13 or older

The intended standard High School student flow does not require students to provide an email address. This pseudonymous access design applies only after it is activated for a school under the applicable school agreement; it does not describe the current pilot.

3.2 Encrypted Student Name Data

The intended standard High School student flow stores student names as encrypted identity blobs after that design is activated for a school under the applicable school agreement.

The student name is encrypted in the browser before being stored. Teachers can unlock roster names locally using their roster passphrase. CreativeTrail does not store the roster passphrase.

Although names are encrypted, the student's work may still be linked to a pseudonymous student code, class, assignment, teacher, and enrollment.

3.3 Student Work and Educational Records

CreativeTrail may store:

• Assignment responses
• Drafts
• Final writing
• Revision history
• Autosave content
• Source work
• Uploaded source materials
• Extracted PDF text
• Source annotations
• Planning/mind map work
• Prompt responses
• Reflection answers
• Teacher comments and annotations
• Immutable Trail submission versions and proposal review decisions
• Feedback receipts and student acknowledgement records for the exact artifact
• Teacher-provided instruction attachments, including original files and display-ready normalized content
• Teacher-entered academic component scores, configured weights, released grade snapshots, and the overall assignment percentage
• Final reports
• Writing-process evidence and teacher-facing process indicators
• Process-evidence artifacts

3.4 High School Process Information

The intended standard High School design avoids storing raw input logs in process-event rows after that design is activated for a school under the applicable school agreement.

High School process-event rows may store aggregate or sanitized information such as activity counts, timing, document-length information, focus/selection counts, revision counts, paste counts, and a flag indicating that raw input logs were not stored.

The intended standard High School design does not store raw key names, raw typed text, raw pasted text, raw selected text, or detailed mouse coordinates in process-event rows. This derived-only design does not describe the current pilot.

However, CreativeTrail may still store raw student writing and educational work in drafts, revisions, submissions, source work, prompt responses, and reports.

If a teacher enables the optional grammar-review step before final submission, CreativeTrail stores a student-declared review boundary, pre-review and returned versions, and an objective change summary. This workflow is not an integration with a particular grammar vendor and does not monitor activity outside CreativeTrail. It is process evidence, not an automatic authenticity finding or academic grade.

4. Use of Student Data

CreativeTrail uses High School student data to:

• Provide the CreativeTrail service
• Allow students to complete assignments
• Allow teachers to review student writing-process evidence
• Generate classroom reports and process summaries
• Support Socratic prompting and reflection
• Maintain security and access controls
• Debug and improve product reliability
• Provide support to teachers and schools
• Comply with legal, security, and contractual obligations

CreativeTrail may use aggregated or deidentified information to improve educational products, evaluate reliability, and understand product effectiveness, provided the information is not reasonably linkable to a student, class, teacher, school, or unique writing sample.

5. AI Processing

CreativeTrail uses Anthropic to process limited student-content excerpts, prompt responses, source snippets, process summaries, or report context for supported educational features.

AI processing may support:

• Socratic question generation
• Question selection
• Categorizing or interpreting prompt responses
• Process-evidence analysis
• Report generation or summaries
• Summarizing writing-process evidence for teacher review

CreativeTrail minimizes the amount of student content sent to AI providers and does not send more information than reasonably necessary for the educational feature.

AI outputs must not be treated as final grading, disciplinary, or academic-integrity determinations.

Academic component scores and released assignment percentages are entered and released by a teacher. Process evidence, reports, and authenticity indicators do not automatically change those academic scores.

6. Subprocessor List

CreativeTrail currently uses or expects to use the following subprocessors or infrastructure providers for High School mode:

CreativeTrail does not use product analytics in the High School product at this time. CreativeTrail may later use Google Analytics on the public landing page only. If added, Google Analytics will not be used inside the High School student product unless this policy and the applicable school disclosures are updated.

CreativeTrail does not rely on local file servers for High School student storage. Student data is stored in server-side infrastructure, primarily Railway Postgres and related Railway-hosted application systems.

7. Internal Access Controls

CreativeTrail limits internal access to High School student data to authorized personnel with a legitimate need, such as:

• Security
• Debugging
• Technical support
• Compliance
• Service operation
• School-requested assistance

Internal access to admin tools, impersonation tools, raw exports, or audit tools is limited to authorized CreativeTrail personnel and is not used for casual review.

8. Export Controls

High School raw Inputlog, CSV, and IDFX exports are blocked or disabled by default.

Teachers normally receive reports, summaries, process evidence, and classroom views rather than raw process logs.

Any exceptional raw export requires explicit school authorization, documented approval, and appropriate access controls.

9. Retention for the Intended Standard Service

This document describes the intended pseudonymous and derived-only High School service. Its retention and deletion configuration will apply only after it is activated for a school under an applicable school agreement.

Before that activation, the school agreement and deployed configuration must state the applicable retention and deletion terms. They may include storage of pseudonymous access information and derived process evidence, but this document does not promise that those future terms are active today. For the current pilot, see the Current School Pilot Data Notice.

9.1 Aggregated or Deidentified Data

CreativeTrail may retain aggregated or deidentified data for longer to improve the product, evaluate reliability, and demonstrate product effectiveness.

Data is not treated as deidentified merely because student names are encrypted or removed. Writing samples, long excerpts, rare process traces, student codes, class links, school links, and assignment links may still make information identifiable or student-linked.

9.2 Teacher and School Account Data

Teacher and school account data may be retained while the account, school relationship, pilot, or contract remains active and for a reasonable period afterward for support, legal, security, and operational purposes.

9.3 Backups and Logs

CreativeTrail maintains encrypted Railway Postgres database backups for security, reliability, and disaster-recovery purposes. The backups are retained and removed under the backup schedule configured with CreativeTrail's infrastructure provider.

Information deleted from the production database may remain temporarily in a previously created encrypted backup. While retained, that information remains protected and is not restored or used for ordinary product purposes except where necessary for disaster recovery or security. It is removed through the normal backup expiration and rotation process.

Railway deployment logs, server logs, or error logs may retain technical information for operational purposes.

10. Deletion and Deidentification Requests

Schools, districts, or authorized teachers may request deletion or deidentification of High School student data.

Parents or students should generally direct access, correction, or deletion requests to the school, because the school controls the educational relationship and classroom record.

CreativeTrail will delete student information upon a valid request from the applicable school, district, or educational institution when required by applicable law or agreement. CreativeTrail will also honor valid deidentification requests when required by applicable law or agreement.

A deletion from the production database may remain temporarily in an encrypted backup as described in Section 9.3. Those backup copies are not used for ordinary product purposes and expire through the normal backup-rotation process.

Deidentification may involve more than removing names. It may require breaking links between student codes, enrollments, classes, assignments, writing records, reports, process evidence, and teacher records.

11. Security Overview

CreativeTrail's standard High School security design includes:

• Pseudonymous student access
• Student codes instead of student email accounts
• PIN hashing
• Browser-side student-name encryption
• Teacher-controlled roster passphrase
• Signed High School access cookies
• Teacher account authentication
• Class and enrollment records
• Route-level authentication and authorization checks for student report and classifier endpoints
• High School aggregate/sanitized process-event storage
• Blocking High School raw Inputlog exports
• Server-side storage through Railway Postgres
• Infrastructure hosted on Railway

CreativeTrail is continuing to strengthen security ahead of wider production deployment, including:

• Production admin allowlisting
• Export logging
• Rate limiting for sensitive routes
• Reduced logging of student text
• Documented deletion/deidentification procedures
• Access logging for admin/support activity

12. Security Incidents

If CreativeTrail becomes aware of unauthorized access to High School student data, CreativeTrail will investigate, take reasonable containment steps, and notify affected schools or authorized contacts as required by applicable law or agreement.

13. No Advertising or Sale of Student Data

CreativeTrail does not sell High School student data.

CreativeTrail does not use High School student data for targeted advertising.

CreativeTrail does not use High School student data to build non-educational advertising profiles.

14. Product Improvement

CreativeTrail may use aggregated or deidentified information to improve educational features, reliability, reporting, usability, and product effectiveness.

CreativeTrail does not use identifiable High School student data for external research, model training, classifier improvement, or publication unless approved by the school, district, IRB where applicable, or other required consent process.

15. Contact

Questions about this document may be sent to:

Benton Growth Labs LLC / CreativeTrail
Email: [email protected]