The agreement between WaiverSaver and your school about student and family data. It is accepted by the authorized person who creates your account, and you can read it here any time.
This Data Processing Agreement is between WaiverSaver, operated by Yonah Create (“WaiverSaver”, “we”) and the organization that created the account (“the School”, “you”). It governs our handling of Student Data and other personal information you or your families provide through the WaiverSaver service, and nothing else.
To the extent the Family Educational Rights and Privacy Act (FERPA) applies to the School, the School designates WaiverSaver as a school official with a legitimate educational interest solely for the purpose below. WaiverSaver performs a service the School would otherwise perform with its own staff — collecting and holding signed permission and acknowledgment forms — remains under the School's direct control as to the use and maintenance of Student Data, and is bound by the restrictions in this Agreement.
School staff provide: the School's name, staff names and email addresses, and the documents the School uploads or writes. A parent or guardian, never the student, provides: the student's name; the parent or guardian's own name, relationship, email and phone; a signature; and any fields the School's own form asks for. School staff may also provide class lists containing student names. No student ever creates an account, logs in, or enters information directly.
We use Student Data solely to operate the service for the School: presenting the right documents to the right families, recording who signed what and when, producing certificates, showing staff who has and hasn't signed, and sending the emails needed to do those things. We do not use Student Data for advertising, to build a profile of any student, for any commercial purpose unrelated to the service, or for any purpose the School has not authorized. This section is written to meet Georgia's Student Data Privacy, Accessibility, and Transparency Act (O.C.G.A. § 20-2-666 et seq.).
We will never sell, rent, or trade Student Data. We do not disclose it to any third party except: (a) service providers bound by materially the same restrictions, used solely to operate the service — currently Cloudflare (hosting and storage) and Resend (email delivery); (b) as directed by the School; or (c) as required by law, in which case we notify the School first unless legally prohibited.
The School owns its data at all times; we hold it only as the School's processor and, where FERPA applies, its school official. The School's staff can export the School's data at any time and can ask us to delete it. We do not add, alter, or remove a School's data except at the direction of that School's staff using the service as intended.
Every signer receives a certificate of exactly what they signed, when, and a copy of each document as it read at that moment. A parent's right under FERPA to inspect their student's record is satisfied directly, with nothing to request.
Signed records are retained permanently by default, because a claim arising from an event involving a minor may be brought in Georgia for years after the minor turns eighteen. The School may direct us to delete specific records or all of its data; we will comply, and we will tell the School in writing what deletion means for the School's own record-keeping before we do.
We maintain reasonable administrative and technical safeguards appropriate to the sensitivity of the data: encryption in transit and at rest, isolation of each School's data under its own address, and access limited to the School's own staff, the signing parent for their own record, and WaiverSaver personnel who need it to operate the service.
If we learn of unauthorized access to the School's data, we will notify the School without unreasonable delay — in any event within 72 hours of confirming it — and cooperate with the School's own notification obligations.
This Agreement takes effect when the School's account is created and continues until either party ends it in writing. Ending it stops new collection; it does not by itself delete records retained under Section 8, which the School may separately direct.
Georgia law governs this Agreement. Accepting it electronically has the same legal effect as signing on paper under Georgia's Uniform Electronic Transactions Act and the federal ESIGN Act; the accepting person's name, email, date, time, and network address are recorded, and that person represents that they are authorized to bind the School.
Version 2026-10-06. Questions: team@yonahcreate.com. See also our plain-language guide to student data, FERPA & COPPA.