Data Processing Agreement

1. The controller / processor split

The DPA's central allocation:

2. Personal data in scope

The DPA covers the personal data categories that pass through the platform on the Center's behalf:

• Child records — name, date of birth, family contacts, attendance, daily logs, care notes, milestones.
• Family contacts — parent / authorized adult names, contact methods, custody designations.
• Staff records — names, roles, schedules, certifications, attendance.
• Video — live broadcast to enrolled families; incident footage stored on the in-room Pi; opt-in plan-tiered cloud archive when enabled by the Center.
• Billing identifiers — payment methods, tuition / subsidy records, autopay setup.
• Technical & diagnostic data — access and API logs; technical error reports (error message, stack trace, the page where it occurred, browser / device info, a truncated IP address, and the facility / account identifier), retained about 30 days and accessible only to TinyGuard super-administrators, used solely to diagnose and fix platform faults.

What is not in scope: biometric data of any kind (per the standalone no-biometrics covenant — see /legal/biometric-data-policy); raw video derivatives sent to AI providers (AI features receive structured text, metadata, and — for opt-in photo features — still images of the moment, never video frames or face crops); and any data category not generated by the platform's documented features.

3. COPPA

The DPA incorporates the Center's COPPA obligations under the operator-exception path. The Center is the COPPA-regulated operator; TinyGuard, as processor, supports the Center's compliance by:

• Surfacing the printable parental consent template at /legal/coppa-parental-consent-template for the Center to use at enrollment.
• Maintaining facility-scoped data isolation so one Center's child records are not accessible to another.
• Honoring deletion requests escalated by the Center within the COPPA-required timelines.

The Center, not TinyGuard, is responsible for obtaining the operator-exception parental consent at enrollment. TinyGuard's role is to make the Center's compliance work mechanically easier, not to be the COPPA-regulated party.

4. State-specific addenda

Where a state's child-privacy or wiretap or biometric statute imposes obligations beyond the federal baseline, the DPA is paired with a state addendum (Texas, California, Illinois, Minnesota, New York, Florida, Connecticut, Maryland, Massachusetts, Pennsylvania, Washington, and Oregon drafted — TG-STA-001..012; all other states drafted on signing). If your facility state is not yet drafted, email legal@tinyguard.co — we draft a state-specific addendum on signing.

5. Term, termination, and data return

The DPA's term is the same as the underlying Master Service Agreement (TG-MSA-001). On termination or expiry, TinyGuard returns or destroys the Center's personal data at the Center's election within 30 days, retaining only what is required for ongoing legal obligation (e.g., financial records subject to 6-year retention under state law). The audit log is retained for six years for breach-defense purposes, scrubbed of personal data on a Center-specific request where statutory retention does not prohibit it.

6. Cross-references

• Four Legal Stack v1.0 covenants — the architectural commitments the DPA wraps.
• No-Biometrics Covenant — Covenant 01 in full.
• Subprocessor list — the third parties TinyGuard contracts on the Center's behalf.
• COPPA parental consent template — printable form for facility enrollment.
• Privacy Policy — public-facing TG-PUB-001.
• BAA — the parallel agreement for elder care (TG-BAA-E-001 = HIPAA path).
• Terms of Service — TinyGuard's general terms.

7. Contact

DPA template requests + counsel review: legal@tinyguard.co
Procurement / general legal questions: del@tinyguard.co
Phone: (510) 686-3357
TinyGuard LLC, 7428 SW Ashford St, Tigard, OR 97224