ThinkKits collects only the minimum data necessary to provide our services:

• Account information: Name, email, job title, phone (optional), organization, role, state, and goals (provided during onboarding via Clerk)
• Usage data: Searches performed, pages visited, reports generated (for service improvement and your activity history)
• Payment information: Processed and stored exclusively by Stripe. We never see or store credit card numbers.

• Individual student records or personally identifiable student information (PII)
• Social Security numbers, dates of birth, or home addresses
• Student grades, disciplinary records, or health information

All school and district data on ThinkKits is derived from publicly available federal datasets (NCES CCD, Census SAIPE, USAC E-Rate, ED CRDC, DOE TSA). We do not access, process, or store any protected education records as defined under FERPA.

ThinkKits uses only publicly available, aggregated education data published by federal agencies. We are not a "school official" under FERPA and do not require access to student education records. Our platform:

• Does not collect, store, or process protected student records
• Uses only data published in public NCES, Census, and DOE datasets
• Strips all potential PII identifiers before any data processing
• Will sign Data Privacy Agreements (DPAs) upon request for institutional customers

• Access: Request a copy of all data we hold about you
• Correction: Update or correct your account information at any time
• Deletion: Request complete account deletion within 30 days
• Export: Download your activity history and saved data
• Opt-out: Disable analytics, notifications, and email digests in Settings

In the event of a data breach affecting your account, we will notify you via email within 72 hours of discovery, consistent with SOC 2 Aligned and state breach notification requirements.

By accessing or using the ThinkKits platform ("Service"), you agree to be bound by these Terms of Service ("Terms"). If you are using the Service on behalf of an organization, you represent that you have the authority to bind that organization to these Terms.

ThinkKits provides an education data intelligence platform that aggregates publicly available federal, state, and local education data to deliver school profiles, funding analysis, grant writing tools, equity dashboards, and related analytics services via web application and API.

You must provide accurate, complete information when creating an account. You are responsible for maintaining the confidentiality of your credentials and for all activities under your account. You must notify us immediately of any unauthorized access. Accounts are non-transferable.

• Free Tier: Limited access at no cost, subject to daily usage limits.
• Paid Tiers: Billed monthly or annually via Stripe. You authorize recurring charges until canceled.
• Upgrades/Downgrades: Changes take effect at the start of the next billing cycle. No partial refunds for mid-cycle downgrades.
• Cancellation: You may cancel at any time via Settings. Access continues until the end of the current billing period.
• Refunds: We offer a 14-day money-back guarantee on first-time paid subscriptions. Contact support for processing.

You agree not to:

• Use the Service for any unlawful purpose or to violate any laws
• Attempt to reverse-engineer, decompile, or extract source code from the Service
• Use automated scrapers, bots, or crawlers to extract data beyond API rate limits
• Resell, redistribute, or sublicense data obtained from the Service without written permission
• Attempt to access other users' accounts or data without authorization
• Use the Service to identify, contact, or market to individual students
• Overwhelm or impair the Service through excessive requests (DDoS, stress testing)

The Service, including its design, code, AI models, and proprietary analytics, is owned by ThinkKits LLC. Underlying education data is sourced from public federal datasets (NCES, Census, USAC, DOE) and remains in the public domain. Reports and analyses generated by the Service for your use are licensed to you for internal business purposes only.

You retain ownership of all data you input into the Service (saved schools, searches, notes). We retain the right to use anonymized, aggregated usage data to improve the Service. Your personal data is handled in accordance with our Privacy Policy. We do not sell your personal information.

API access is provided subject to rate limits defined by your subscription tier. API keys are confidential and must not be shared publicly. We reserve the right to throttle or revoke API access for abuse or violation of these Terms.

The Service is provided "AS IS" without warranties of any kind. While we strive for accuracy, education data is sourced from third-party federal databases and may contain errors or lag behind real-time conditions. AI-generated content (grants, reports, analyses) should be reviewed by qualified professionals before submission. ThinkKits is not a law firm, grant consultant, or financial advisor.

To the maximum extent permitted by law, ThinkKits shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of revenue, data, or business opportunity. Our total liability shall not exceed the amount paid by you in the 12 months preceding the claim.

We may suspend or terminate your account for violation of these Terms, non-payment, or if required by law. Upon termination, your right to use the Service ceases immediately. You may request export of your data within 30 days of termination.

We may update these Terms at any time. Material changes will be communicated via email or in-app notification at least 30 days prior to taking effect. Continued use of the Service after changes constitutes acceptance.

These Terms are governed by the laws of the Commonwealth of Pennsylvania. Any disputes shall be resolved through binding arbitration administered by the American Arbitration Association, except that either party may seek injunctive relief in any court of competent jurisdiction.

• "Controller" — The school, district, or organization ("Customer") using ThinkKits services
• "Processor" — ThinkKits LLC, which processes data on behalf of the Controller
• "Personal Data" — Account data provided by the Customer: name, email, job title, phone, organization details
• "Education Data" — Publicly available school/district data from federal sources (not student PII)

ThinkKits processes Personal Data solely for the purpose of providing the Service as described in the Terms of Service. We do not:

• Sell Personal Data to third parties
• Use Personal Data for advertising or profiling
• Use Personal Data or Customer inputs to train AI/ML models
• Process student PII or protected education records

• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption for all data in transit
• Role-based access control (RBAC) with least-privilege principles
• Multi-factor authentication for admin access
• Immutable audit logging of all data access and modifications
• Brute-force protection and IP-based rate limiting
• Regular security assessments and dependency scanning

ThinkKits uses the following sub-processors:

All sub-processors maintain SOC 2 Aligned compliance or equivalent certifications. We will notify customers 30 days prior to adding new sub-processors.

• Account data is retained for the duration of your subscription plus 90 days
• Upon account deletion request, Personal Data is purged within 30 days
• Audit logs are retained for 3 years for compliance purposes (anonymized after account deletion)
• Backup copies are purged within 60 days of deletion request
• To request data deletion, email privacy@thinkkits.com

You have the right to:

• Access — Request a copy of all Personal Data we hold about you
• Rectification — Correct inaccurate data via Settings or by contacting support
• Deletion — Request complete deletion of your account and Personal Data
• Portability — Export your data in machine-readable format (CSV)
• Restriction — Request that we limit processing of your data

Requests are processed within 30 days. Contact privacy@thinkkits.com.

In the event of a data breach affecting Personal Data, ThinkKits will:

• Notify affected customers within 72 hours of discovery
• Provide details of the breach scope, data affected, and remediation steps
• Cooperate fully with Customer's breach response procedures
• Implement immediate containment and remediation measures

ThinkKits does not access, process, or store protected education records as defined by FERPA (20 U.S.C. § 1232g). All education data on our platform is derived from publicly available federal datasets. ThinkKits does not knowingly collect information from children under 13 (COPPA). Our Service is designed for use by adult education professionals.

Data Protection Contact: privacy@thinkkits.com
General Inquiries: hello@thinkkits.com
Mailing Address: ThinkKits LLC, 151 Discovery Dr Ste 107, Colmar, PA 18915

This DPA is incorporated by reference into the Terms of Service and is governed by the same provisions.