Infinite Nature Group, Inc. · Beaumont, Texas · schools@shel.app
Version 1.0 · Effective upon execution
This Data Processing Agreement ("DPA") is entered into between Infinite Nature Group, Inc. ("Shel™," "Processor") and the school or district identified in the accompanying Order Form ("School," "Controller"). This DPA is incorporated by reference into and governed by the Shel™ for Schools Terms of Service.
FERPA Notice: Shel™ operates as a "school official" under FERPA (20 U.S.C. § 1232g) with a legitimate educational interest in accessing student education records solely to perform the services described herein. Shel™ will not disclose student education records to any third party without written consent from the School except as required by law.
1. Definitions
"Student Data" means any information that, alone or in combination, identifies or could be used to identify a student, including but not limited to: name, grade level, internet browsing activity, device identifiers, and any flags generated by the Val™ wellbeing monitoring system.
"School Personnel" means teachers, counselors, administrators, and IT staff authorized by the School to access the Shel™ platform.
"Processing" means any operation performed on Student Data, including collection, storage, analysis, and deletion.
2. Nature and Purpose of Processing
Shel™ processes Student Data solely to:
Filter internet content to comply with the Children's Internet Protection Act (CIPA)
Provide real-time classroom management tools to School Personnel
Generate CIPA compliance reports for E-rate and regulatory purposes
Monitor student activity for early signs of wellbeing concerns via Val™
Enable student device enrollment and management
Shel™ will not use Student Data for advertising, marketing, profiling, or any commercial purpose not directly related to providing the services described above.
3. Categories of Student Data Processed
Student name and grade level (provided by School upon enrollment)
Internet browsing activity: domains visited, actions taken (allowed/blocked), timestamps
Device identifiers: browser fingerprint, device type, user agent string
Wellbeing indicators: pattern-matched flags from browsing activity (category and severity only — individual search terms are never stored)
Classroom assignment and join code used for enrollment
4. Data Retention
Active data: Student browsing activity is retained in Shel™'s database for 12 months from the date of collection.
Archive: Data older than 12 months is archived to encrypted cloud storage and retained for an additional 12 months to support legal proceedings if needed.
Deletion: Upon termination of services, all Student Data will be permanently deleted within 30 days of the termination date. School may request earlier deletion in writing.
Wellbeing flags: Retained for 3 years to support longitudinal student support documentation, unless School requests earlier deletion.
5. Data Security
Shel™ implements the following technical and organizational security measures:
Infrastructure: Hosted on Render (SOC 2 Type II certified) with Neon Postgres (SOC 2 Type II certified)
Annual security review
Breach notification: School will be notified within 72 hours of discovery of any unauthorized access to Student Data
6. Subprocessors
Shel™ uses the following subprocessors to provide the services. School consents to their use upon execution of this DPA:
Render Services, Inc. — Application hosting (SOC 2 Type II)
Neon, Inc. — Database hosting (SOC 2 Type II)
Cloudflare, Inc. — DNS filtering and content policy enforcement (SOC 2 Type II)
Resend, Inc. — Transactional email for wellbeing alerts
Shel™ will notify School at least 30 days before adding or replacing a subprocessor. School may object to a new subprocessor within 14 days; if School objects and the parties cannot resolve the objection, School may terminate the agreement without penalty.
7. CIPA Compliance
Shel™ provides filtering services that, when properly configured, satisfy the technological protection measure requirements of CIPA (47 U.S.C. § 254(h)(5)). School remains responsible for adopting an Internet Safety Policy as required by CIPA. Shel™'s monthly CIPA compliance reports are provided as documentation support and do not constitute legal certification.
8. Val™ Wellbeing Monitoring
The Val™ wellbeing monitoring system analyzes student browsing patterns to identify potential mental health concerns. School acknowledges and agrees that:
Val uses pattern matching, not human review. All flags require human counselor review before any action is taken.
Val may produce false positives. Counselors are expected to apply professional judgment before acting on any flag.
Individual search terms are never stored — only the count and category of pattern matches.
Val flags are visible only to counselors, principals, and IT admins — never to teachers.
Critical flags generate automated email alerts to designated counselors and principals.
9. FERPA Rights
School retains all rights to Student Data under FERPA. Upon written request, Shel™ will:
Provide School with a complete export of all Student Data within 5 business days
Delete specific student records upon written request within 3 business days
Correct inaccurate Student Data within 5 business days of receiving documentation of the inaccuracy
11. COPPA Compliance
The Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.) applies to the online collection of personal information from children under 13. When Shel™ operates as a service provider to a School under this DPA:
School-as-operator exception: Schools may consent on behalf of parents for Shel™ to collect personal information from students under 13, pursuant to 16 C.F.R. § 312.5(b)(1). By executing this DPA, the School represents that it has obtained or will obtain any parental consent required under COPPA before enrolling students under 13 in the Shel™ platform.
Data minimization: Shel™ collects only the minimum personal information necessary to provide the filtering and wellbeing services described herein. Shel™ does not collect location data, contact lists, photos, or any information not directly related to the services.
No commercial use: Shel™ does not use personal information collected from students under 13 for any commercial purpose, including advertising, profiling, or marketing.
Deletion on request: Shel™ will delete personal information for any student upon written request from the School or from a verified parent within 5 business days.
COPPA Safe Harbor: Shel™ is in the process of applying for the iKeepSafe COPPA Safe Harbor certification. Schools will be notified upon certification.
12. Governing Law
This DPA is governed by the laws of the State of Texas. Any disputes arising under this DPA shall be resolved in Jefferson County, Texas.
13. Contact
Data Protection inquiries: schools@shel.app
Infinite Nature Group, Inc.
222 Manor Street, Beaumont, TX 77701