School Data Processing Agreement

Scribbletastic · Expressions Creative Studio · Version 1.3 · October 2026

UK GDPR CompliantChildren's DataEdtech Safe

In short

✓No child accounts. Children only type a first name or nickname on a shared class device.
✓No email addresses, photos or personal identifiers collected from children.
✓Your school stays in control. Teachers can delete all class data at any time.
✓I never sell, share or advertise using any pupil or class data.
✓Data is encrypted and access controlled. Only your school sees your class data.
✓I will sign a countersigned DPA on request. Just email me.

1. Parties to This Agreement

Data processor: Expressions Creative Studio, operating Scribbletastic.
Contact: expressionscreativestudio@gmail.com

Data controller: the subscribing school or educational institution, represented by the member of staff who created the Scribbletastic school account.

By using Scribbletastic in a school setting, the school confirms it has the authority to enter into this agreement on behalf of the institution.

2. What Data Is Processed

Teacher and staff accounts:

Email address and name (needed to sign in)
Class names and pupil first name lists (created by the teacher)
If the school asks to be invoiced: the organisation name, contact name and email address, an optional pupil headcount, and any notes added

Children (pupils):

First name or nickname only, typed by the child on a shared device
Drawings (image file and optional stroke recording)
Mood check-ins (an emotion picked from a list, such as happy, calm or worried)
An optional short note about how they feel

Not collected: no child email addresses, passwords, photos, dates of birth, location data or device identifiers.

3. Purpose of Processing

Data is processed only to provide the Scribbletastic service to the school:

letting children draw and do mood check-ins on shared class devices
letting teachers see class artwork and feeling patterns
optional sharing with parents or a named therapist, when the teacher turns it on

No pupil or class data is ever used for advertising, profiling or research.

4. School Responsibilities

As data controller, the school is responsible for:

getting appropriate parental or guardian consent before children use the app
making sure children only enter a first name or nickname, not a full legal name
only sharing class access with authorised parents or therapists
deleting class data at the end of each academic year using the tools provided
telling Expressions Creative Studio promptly about any suspected data breach

Tip: use the "Delete all pupil data" button inside each class at the end of the school year to remove all drawings and mood data from the app.

5. My Responsibilities as Processor

Expressions Creative Studio commits to:

processing school data only on the school's documented instructions
keeping strong technical and organisational security measures in place
being transparent about where data is stored: my servers are in the United States, and any transfer outside the UK relies on the safeguards in my hosting provider's data processing agreement
helping the school respond to requests from parents or pupils
deleting or returning all school data when the service ends
telling the school about any personal data breach within 72 hours

6. Data Retention and Deletion

Data is kept while the school subscription is active.

Teachers can delete all drawings and mood data for any class at any time from the School Dashboard. The drawings and mood data come out of the app immediately.

When a subscription is cancelled or an account closed, all associated data is deleted within 30 days. One honest limit: saved artwork images and drawing recordings are held as files in storage, and I have no way to delete those files, so the stored files stay even after the drawing is gone from the app.

7. Companies That Help Me Run the App

I use the following companies to deliver the service:

Company	What they do	Location
Hosting provider	App hosting, database and sign in	USA, under standard contract clauses
Stripe	Payment processing (staff accounts only)	EU / USA, under standard contract clauses

No child data goes to Stripe. Stripe only handles staff billing information.

Need a countersigned DPA?

Some schools and multi academy trusts need a formally countersigned DPA for procurement. I am happy to provide one. Email me with your school name and I will return a signed copy within 5 working days.

Request a Signed DPA