CreativeTrail High School Student Data Addendum, Retention Policy, Subprocessor List, and Security Overview

1. Purpose

This document summarizes CreativeTrail's High School student-data practices for schools, teachers, districts, and educational programs.

It is intended to supplement the CreativeTrail High School Privacy Policy and Terms of Use. If CreativeTrail signs a separate written agreement with a school or district, that signed agreement will control where it conflicts with this document.

2. Role of CreativeTrail

CreativeTrail provides an educational writing-process service to schools, teachers, and students.

For High School deployments, CreativeTrail processes student data to provide the educational service requested by the school, teacher, district, or authorized educational program.

CreativeTrail does not use High School student data for targeted advertising, unrelated marketing, sale of student information, or non-school profiling.

3. High School Data Collected

3.1 Pseudonymous Student Access Data

• Pseudonymous student code
• PIN hash
• Class code
• Enrollment record
• Signed High School access session
• Confirmation that the student is 13 or older

High School students do not provide an email address through the High School student flow.

3.2 Encrypted Student Name Data

CreativeTrail stores High School student names as encrypted identity blobs.

The student name is encrypted in the browser before being stored. Teachers can unlock roster names locally using their roster passphrase. CreativeTrail does not store the roster passphrase.

Although names are encrypted, the student's work may still be linked to a pseudonymous student code, class, assignment, teacher, and enrollment.

3.3 Student Work and Educational Records

CreativeTrail may store:

• Assignment responses
• Drafts
• Final writing
• Revision history
• Autosave content
• Source work
• Uploaded source materials
• Extracted PDF text
• Source annotations
• Planning/mind map work
• Prompt responses
• Reflection answers
• Teacher comments and annotations
• Final reports
• Process scores and review flags
• Process-evidence artifacts

3.4 High School Process Information

High School mode is designed to avoid storing raw input logs in process-event rows.

High School process-event rows may store aggregate or sanitized information such as activity counts, timing, document-length information, focus/selection counts, revision counts, paste counts, and a flag indicating that raw input logs were not stored.

High School mode does not store raw key names, raw typed text, raw pasted text, raw selected text, or detailed mouse coordinates in High School process-event rows.

However, CreativeTrail may still store raw student writing and educational work in drafts, revisions, submissions, source work, prompt responses, and reports.

4. Use of Student Data

CreativeTrail uses High School student data to:

• Provide the CreativeTrail service
• Allow students to complete assignments
• Allow teachers to review student writing-process evidence
• Generate classroom reports and process summaries
• Support Socratic prompting and reflection
• Maintain security and access controls
• Debug and improve product reliability
• Provide support to teachers and schools
• Comply with legal, security, and contractual obligations

CreativeTrail may use aggregated or deidentified information to improve educational products, evaluate reliability, and understand product effectiveness, provided the information is not reasonably linkable to a student, class, teacher, school, or unique writing sample.

5. AI Processing

CreativeTrail uses Anthropic to process limited student-content excerpts, prompt responses, source snippets, process summaries, or report context for supported educational features.

AI processing may support:

• Socratic question generation
• Question selection
• Prompt response scoring
• Process-evidence analysis
• Report generation or summaries
• Semantic judgment of writing-process evidence

CreativeTrail minimizes the amount of student content sent to AI providers and does not send more information than reasonably necessary for the educational feature.

AI outputs must not be treated as final grading, disciplinary, or academic-integrity determinations.

6. Subprocessor List

CreativeTrail currently uses or expects to use the following subprocessors or infrastructure providers for High School mode:

CreativeTrail does not use product analytics in the High School product at this time. CreativeTrail may later use Google Analytics on the public landing page only. If added, Google Analytics will not be used inside the High School student product unless this policy and the applicable school disclosures are updated.

CreativeTrail does not rely on local file servers for High School student storage. Student data is stored in server-side infrastructure, primarily Railway Postgres and related Railway-hosted application systems.

7. Internal Access Controls

CreativeTrail limits internal access to High School student data to authorized personnel with a legitimate need, such as:

• Security
• Debugging
• Technical support
• Compliance
• Service operation
• School-requested assistance

Internal access to admin tools, impersonation tools, raw exports, or audit tools is limited to authorized CreativeTrail personnel and is not used for casual review.

8. Export Controls

High School raw Inputlog, CSV, and IDFX exports are blocked or disabled by default.

Teachers normally receive reports, summaries, process evidence, and classroom views rather than raw process logs.

Any exceptional raw export requires explicit school authorization, documented approval, and appropriate access controls.

9. Retention Policy

9.1 Active Class or Pilot

CreativeTrail retains High School student-linked data while the class, pilot, or school-authorized use is active.

9.2 Post-Class Review Period

Unless a school requests a different period or applicable law or agreement requires otherwise, CreativeTrail's default is to retain High School student-linked data for up to 90 days after the class or pilot ends.

This allows teachers and schools time to review assignments, resolve support issues, and request deletion or export where appropriate.

9.3 Deletion or Deidentification After Review Period

After the review period, CreativeTrail will delete or deidentify student-linked data where feasible, including:

• Drafts
• Final writing
• Revisions
• Prompt responses
• Source work
• Uploaded or extracted source content
• Reports
• Process scores
• Review flags
• Session records
• Enrollment-linked records

9.4 Aggregated or Deidentified Data

CreativeTrail may retain aggregated or deidentified data for longer to improve the product, evaluate reliability, and demonstrate product effectiveness.

Data is not treated as deidentified merely because student names are encrypted or removed. Writing samples, long excerpts, rare process traces, student codes, class links, school links, and assignment links may still make information identifiable or student-linked.

9.5 Teacher and School Account Data

Teacher and school account data may be retained while the account, school relationship, pilot, or contract remains active and for a reasonable period afterward for support, legal, security, and operational purposes.

9.6 Backups and Logs

CreativeTrail does not currently enable Railway database backups. If backups are enabled in the future, deleted information may remain in backups for a limited period before backup rotation.

Railway deployment logs, server logs, or error logs may retain technical information for operational purposes.

10. Deletion and Deidentification Requests

Schools, districts, or authorized teachers may request deletion or deidentification of High School student data.

Parents or students should generally direct access, correction, or deletion requests to the school, because the school controls the educational relationship and classroom record.

CreativeTrail will reasonably assist the school with deletion or deidentification requests, subject to:

• Technical feasibility
• Legal obligations
• Security needs
• Backup limitations
• Contractual requirements
• The need to preserve records requested by the school

Deidentification may involve more than removing names. It may require breaking links between student codes, enrollments, classes, assignments, writing records, reports, process evidence, and teacher records.

11. Security Overview

CreativeTrail's High School security design includes:

• Pseudonymous student access
• Student codes instead of student email accounts
• PIN hashing
• Browser-side student-name encryption
• Teacher-controlled roster passphrase
• Signed High School access cookies
• Teacher account authentication
• Class and enrollment records
• Route-level authentication and authorization checks for student report and classifier endpoints
• High School aggregate/sanitized process-event storage
• Blocking High School raw Inputlog exports
• Server-side storage through Railway Postgres
• Infrastructure hosted on Railway

CreativeTrail is continuing to strengthen security ahead of wider production deployment, including:

• Production admin allowlisting
• Export logging
• Rate limiting for sensitive routes
• Reduced logging of student text
• Documented deletion/deidentification procedures
• Access logging for admin/support activity

12. Security Incidents

If CreativeTrail becomes aware of unauthorized access to High School student data, CreativeTrail will investigate, take reasonable containment steps, and notify affected schools or authorized contacts as required by applicable law or agreement.

13. No Advertising or Sale of Student Data

CreativeTrail does not sell High School student data.

CreativeTrail does not use High School student data for targeted advertising.

CreativeTrail does not use High School student data to build non-educational advertising profiles.

14. Product Improvement

CreativeTrail may use aggregated or deidentified information to improve educational features, reliability, reporting, usability, and product effectiveness.

CreativeTrail does not use identifiable High School student data for external research, model training, classifier improvement, or publication unless approved by the school, district, IRB where applicable, or other required consent process.

15. Contact

Questions about this document may be sent to:

Benton Growth Labs LLC / CreativeTrail
Email: contact@bentongrowthlabs.com