Skip to main content
Homeschool Harbor

Legal

Data Processing Addendum: Cover Page

Last updated: October 12, 2026

This Cover Page and the Common Paper Data Processing Agreement Standard Terms, version 1.1 (commonpaper.com/standards/data-processing-agreement/1.1), together form the Data Processing Addendum ("DPA") between Homeschool Harbor, LLC ("Provider") and the Organization that accepts our Terms of Service ("Customer"). The Customer accepts this DPA electronically by accepting the Terms of Service. Capitalized terms have the meanings given in the Standard Terms.

Term Value
Agreement Homeschool Harbor Terms of Service, as accepted by Customer
Approved Subprocessors Listed at homeschoolharbor.org/legal/subprocessors
Provider Security Contact privacy@homeschoolharbor.org; Homeschool Harbor, LLC, 8401 Mayland Dr Ste S, Richmond, VA 23294, USA
Security Policy The security measures described in the Privacy Policy and below
DPA Covered Claim / DPA Liability Cap As set out in the Agreement
Governing Law and Chosen Courts As set out in the Agreement (Virginia)
Service Provider Relationship Provider is a "service provider" (or "processor") to Customer under the California Consumer Privacy Act and similar US state laws, and will not sell or share Customer Personal Data or use it outside the direct business relationship with Customer
Governing Member State Ireland (applies only if an EEA or UK Restricted Transfer occurs)
Data Exporter role Controller
Data Importer role Processor

Annex I: Description of processing

  • Categories of Data Subjects: Customer's administrators, instructors, and volunteers; member adults; member children; applicants and their children; emergency contacts.
  • Categories of Personal Data: names; email addresses; phone numbers; dates of birth; photos; family details (area, homeschool approach, interests); emergency contacts; class enrollments, attendance, and teachers' notes; volunteering records; membership application answers; invoice and payment records (no card or bank numbers).
  • Special Category Data: Yes. Health information that families choose to provide about children and adults (allergies, medical notes, learning differences, accommodations). Safeguards: visible only to the Customer's administrators and the child's teachers, removed from error reports, and never used by Provider for any other purpose.
  • Frequency of Transfer: Continuous, for as long as Customer uses the Services.
  • Nature and purpose of processing: Hosting and operating Customer's co-op management site: storing, displaying, organizing, emailing, and exporting Customer Personal Data at Customer's direction.
  • Duration and retention: For as long as Customer uses the Services; after cancellation or an unpaid trial ends, 60 days of read-only access for export, then deletion from active systems and from backups within a further 3 weeks.
  • Erasure of a family at Customer's request: when Customer's administrator erases a family, Provider deletes its personal information at once (see the Privacy Policy for what remains). Customer's invoices and payments keep the family's name for 30 days, so Customer can export them, and for as long as Customer places a hold, then Provider replaces the name with "Former family" and a number. Customer, as controller, decides what it must keep for its own accounting, tax, and school-record obligations, and is responsible for keeping those records outside the Services. Other families' records that mention an erased person, such as an emergency contact entry made by another family, are not changed by the erasure; Customer, as controller, decides whether to edit them.

Annex II: Technical and organizational measures

  • Encryption in transit (HTTPS with HSTS) and encrypted backups stored separately from production servers, kept for 14 days.
  • Passwords stored only as salted hashes.
  • Role- and permission-based access within each Customer's site; access to member-only photos is checked per request.
  • Every administrator "view as member" session is logged and visible to Customer, and changes made during it are attributed to the administrator.
  • Error reports stripped of contact details and sensitive fields before leaving our servers.
  • Provider personnel access Customer Personal Data only for support, fixing problems, security, or legal obligations; development and testing use anonymized data only.
  • Server logs kept for 30 days.
  • Security incidents affecting Customer Personal Data reported to Customer within 72 hours.

Common Paper DPA Standard Terms are licensed under CC BY 4.0.