Data Processing Addendum

1. Parties

This Data Processing Addendum ("DPA") is entered into between:

• Outlaw Roundup ("Service Provider") — the operator of the Outlaw Roundup educational game service.
• The School/District ("School") — the educational institution whose teachers use Outlaw Roundup.

2. Purpose of Processing

Outlaw Roundup processes data solely for the purpose of providing an educational vocabulary game service for classroom use. The service enables teachers to create vocabulary review games and allows students to participate using anonymous aliases.

3. Types of Data Processed

3.1 Teacher Data

• Email address (required for account authentication)
• Password (stored using industry-standard encryption)
• Display name and school name (optional)

3.2 Student Data

• Anonymous alias only — no real names, emails, or student IDs
• Game performance data linked to alias only

4. Sub-processors & Data Residency

All service data is stored in the United States. Optional class rosters are stored only in the teacher's own browser and are never transmitted to Outlaw Roundup or any sub-processor.

5. Security Commitments

• Encryption in Transit: All data transmitted via HTTPS/TLS
• Encryption at Rest: Data encrypted on Firebase infrastructure
• Access Controls: Role-based access via Firestore security rules
• PII Prevention: Technical rules prevent storage of student PII

6. Data Retention & Deletion

• Teachers may delete game sessions at any time
• Automatic deletion configurable (24h, 7d, 30d, 90d)
• Account deletion removes all associated data
• Schools may request bulk deletion via privacy@outlawroundup.com

7. Prohibited Uses of Data

• No advertising: Zero ads displayed
• No data selling: We never sell user data
• No profiling: No behavioral profiles on students
• No social tracking: No tracking pixels or trackers

8. School & Teacher Rights

• Access: Request data copies
• Deletion: Request data deletion
• Export: Download results as CSV

9. Breach Notification

Outlaw Roundup will notify affected schools within 72 hours of discovering a data breach.

10. Contact