Move School Data Privacy Agreement
How Move handles student data for schools: the FERPA, COPPA, and state student-privacy commitments, in plain language, signable by the school's owner in Move and printable for counsel. The full posture with the engineering behind each commitment is documented for review on request.
Printing this page produces the complete agreement text for a conventionally executed original with team@kaifect.com.
1. Parties and roles
This agreement is between the school or educational organization accepting it (the School) and Move Performance, Inc., a Delaware corporation and the operator of the Move platform, together with Kaifect LLC, which provides services and fulfillment. References to Kaifect in this agreement include both companies. The School owns and controls its student data. Kaifect processes it only to provide Move to the School, acting as a school official with a legitimate educational interest under FERPA's school official exception, under the School's direct control as set out here.
2. What Move collects and why
Move collects the account and profile information students, staff, and parents provide, the work they create in the School's space, and product activity, and uses it for one purpose: operating and personalizing the School's Move experience. Each student's inputs personalize that student's own experience. No data is collected for advertising and no advertising exists on the platform.
3. What the School and its staff can see
Teachers and School owners see rosters, class work, progress, and aggregate patterns across their people. Move does not show any staff member a student's private personal profile, and this line is enforced by row level security inside the database, not by policy alone.
4. FERPA
Student education records are used solely to provide the service, are never sold, and are never disclosed to third parties for their own purposes. Parent and eligible student requests to inspect, amend, or receive a copy of records route through the School, and Move provides a complete export of a user's records on demand. Kaifect maintains an append only audit log of administrative access and provides it to the School on request.
5. COPPA and students under 13
The School consents to collection from students under 13 on parents' behalf, solely for educational purposes, and will inform parents as COPPA requires. Independently, Move never stores a birth year (only an age band and the month and day), gates under 13 accounts behind a parent or guardian link with both consents recorded, and gives parents a first class view of their child's work.
6. State student privacy laws
Kaifect will not use student data for targeted advertising, will not sell student data, and will not build a profile of a student for any non educational purpose, consistent with Tennessee's student data protections and similar state laws. Cross network product learning uses only anonymized aggregate patterns and can be disabled for the School's accounts on request.
7. Subprocessors and AI
Move runs on Supabase (database hosting, United States) and Vercel (application hosting), with Stripe for payments where the School uses paid features, and AI model providers for personalization under API terms that prohibit training on the data. Kaifect does not train models on student data, provides the current subprocessor list to the School on request, and remains responsible for its subprocessors.
8. Security
Kaifect protects student data with row level security at the database, encryption in transit, managed encryption at rest, encrypted third party tokens, server validated sessions, and salted password hashing. Secrets are never included in exports. Kaifect will notify the School without undue delay, and no later than 72 hours after confirming a breach affecting the School's student data, with the facts needed for the School to meet its own notice obligations.
9. Retention, export, and deletion
The School and its users can export their data at any time. On written request from the School, or when this agreement ends, Kaifect will permanently delete the School's student accounts within 30 days using Move's verified deletion engine and provide deletion receipts. Records Kaifect must keep for legal or financial reasons are retained only in anonymized form, never attached to a student's identity.
10. Signature and changes
The School's authorized owner accepts this agreement in Move, and the acceptance is recorded with the version, time, and network details as the School's signature. Kaifect countersigns by delivering the recorded acceptance receipt on request. A material change produces a new version that must be accepted again, and the School may end this agreement at any time, which triggers the deletion terms above.
Ready to sign?
The school's workspace owner signs in to Move and accepts here. The acceptance is recorded with the version, time, and network details as the school's signature. Sign in