Curriculum Warehouse Student Data Scope

---

Effective Date: August 22, 2026
Last Updated: August 23, 2026

Curriculum Warehouse, operated by NJ Data Diva LLC, is a curriculum management platform designed for use by authorized educational professionals and administrators.

Curriculum Warehouse is not a student-facing platform and is not designed to collect, solicit, maintain, or store Student Identifiable Information (“SII”) or student education records.

Students are not intended to be Authorized Users of the private Curriculum Warehouse Platform.

This Student Data Scope describes:

• the intended boundaries of Curriculum Warehouse;
• the responsibilities of Clients and Authorized Users;
• the prohibition against submitting Student Identifiable Information;
• the limited circumstances in which basic authentication or security information may be received as a result of an unintended student authentication attempt; and
• the steps that may be taken when unintended student information or access is identified.

This Policy should be read together with the Curriculum Warehouse Privacy Policy, Terms of Service, Terms of Use, Security & Data Protection Policy, AI Use Policy, and Subprocessors notice.

Curriculum Warehouse is designed to support professional curriculum and instructional-management activities such as:

• curriculum maps;
• course information;
• unit frameworks;
• pacing guides;
• academic standards;
• curriculum alignment;
• lesson-planning materials;
• instructional resources;
• curriculum documents;
• curriculum auditing;
• public curriculum displays;
• staff account and permission management; and
• related administrative curriculum functions.

The private Curriculum Warehouse Platform is intended for authorized educational professionals and administrators.

Students are not intended to maintain Curriculum Warehouse professional-user accounts or access private district curriculum-management environments.

Curriculum Warehouse is not designed to function as a:

• student information system;
• gradebook;
• student learning management system;
• student communications platform;
• special education records system;
• student health-record system;
• assessment repository for identifiable student results;
• student portfolio;
• student behavioral or disciplinary records system; or
• permanent repository of student education records.

Clients and Authorized Users must not upload, create, maintain, or store Student Identifiable Information within Curriculum Warehouse.

Prohibited information includes, but is not limited to:

• student names when associated with educational records or other identifiable educational information;
• student identification numbers;
• student grades;
• Individualized Education Programs (“IEPs”);
• special education records;
• identifiable student assessment results;
• student health or medical information;
• disciplinary records;
• counseling records;
• identifiable student work;
• student rosters;
• student demographic records; or
• other confidential student information or education records.

Student information must not be placed within:

• curriculum maps;
• courses;
• units;
• lesson plans;
• instructional resources;
• attachments;
• notes;
• administrative fields;
• AI prompts;
• public curriculum displays; or
• other Platform content areas.

The existence of a field, upload capability, lesson-planning tool, attachment feature, or other Platform functionality does not authorize the submission of Student Identifiable Information.

Clients determine which individuals are authorized to access their private Curriculum Warehouse environment.

Authorized access is intended for professional staff and administrators designated by the Client.

Current Client-level Platform access roles may include:

• Admin;
• Supervisor;
• Editor; and
• Viewer.

An account may also be placed in an Inactive state, which prevents ordinary Platform access.

A separate Corporate Admin role is reserved for authorized NJ Data Diva LLC personnel requiring Provider-level access for legitimate Platform administration, configuration, support, security, maintenance, or related operational purposes.

Students are not authorized to:

• create or maintain professional Curriculum Warehouse accounts;
• access private district curriculum-management environments;
• create or edit curriculum;
• access professional lesson-planning functionality;
• access administrative functionality;
• review private administrative information; or
• otherwise use the private Platform as professional Authorized Users.

Clients are responsible for configuring and managing authentication and access settings so that student accounts are excluded from authorized Platform access.

Clients are also responsible for determining which professional users receive Platform access and which roles and permissions are appropriate for those individuals.

Curriculum Warehouse may support Single Sign-On (“SSO”) through Client-managed identity providers such as:

• Google Workspace;
• Microsoft 365; and
• other supported organizational identity providers.

The Client is responsible for providing appropriate authentication configuration information and managing which organizational accounts are authorized to access Curriculum Warehouse.

In limited circumstances, a student account may attempt to authenticate to Curriculum Warehouse because of:

• Client identity-provider configuration;
• shared staff and student email domains;
• an access-approval setting that has not yet been enabled or properly configured;
• an incorrectly authorized account; or
• another Client-controlled authentication configuration.

An authentication attempt does not by itself authorize an account to use Curriculum Warehouse.

When an unauthorized student account attempts to authenticate through SSO, Curriculum Warehouse may technically receive limited information supplied by the identity provider or generated by Platform security and authentication systems.

Depending upon the circumstances, this may include:

• name;
• email address;
• account identifier;
• authentication provider;
• authentication status;
• date and time of the authentication event;
• related technical authentication information; and
• related security or audit information.

If an account progresses beyond an initial authentication event before unauthorized access is identified, additional Platform activity records may technically be generated, including session or activity information.

Receipt or generation of this limited technical information does not authorize the student to use Curriculum Warehouse.

Curriculum Warehouse does not intentionally use information associated with an unintended student authentication attempt to create:

• a student educational profile;
• a student curriculum record;
• a student academic history;
• a student instructional record;
• a student performance record; or
• another persistent student-data record.

Authentication, security, and audit information generated in connection with unauthorized access may be maintained only as reasonably necessary for purposes such as security, access administration, troubleshooting, investigation, remediation, or Platform integrity.

Clients are responsible for reasonably managing access to their Curriculum Warehouse environment.

Client responsibilities include:

• identifying individuals authorized to use Curriculum Warehouse;
• configuring appropriate SSO or authentication settings;
• excluding student accounts from authorized Platform access;
• reviewing access rules where staff and students use the same email domain;
• assigning appropriate Platform roles and permissions;
• using Admin, Supervisor, Editor, Viewer, and Inactive account states appropriately;
• deactivating or removing accounts that are no longer authorized;
• reviewing access when personnel change roles or employment status;
• protecting Client-controlled identity-provider accounts;
• reviewing available account-approval or access-approval settings; and
• notifying Curriculum Warehouse if unintended student authentication or access occurs.

Where Curriculum Warehouse provides an account-approval or access-approval function, Clients should use that functionality as appropriate to prevent unauthorized access.

Clients should periodically review their user-access configuration, particularly where students and professional staff share the same organizational identity-provider environment.

If a Client becomes aware that a student has unintentionally authenticated to or accessed the private Curriculum Warehouse Platform, the Client should notify NJ Data Diva LLC promptly.

The Client should provide sufficient non-sensitive information to allow Curriculum Warehouse to identify and investigate the relevant account or access event.

Curriculum Warehouse may take reasonable steps to:

• restrict or deactivate the unauthorized account;
• place an account in an Inactive state;
• review relevant authentication information;
• review relevant security and audit information;
• determine whether the account progressed beyond authentication;
• identify Platform activity associated with the unauthorized account;
• assist the Client in correcting applicable access settings;
• remove unauthorized account information where appropriate and technically feasible; and
• take reasonable security measures to prevent continued unauthorized access.

If an unauthorized account progresses beyond an authentication attempt, Platform systems may generate ordinary technical or security records associated with that account's activity.

Depending upon the activity, such records may include:

• login or authentication events;
• session dates and times;
• active session duration;
• actions performed within the Platform;
• attempted or completed administrative or curriculum actions; and
• related system-generated security or audit events.

Such records are generated for operational, security, troubleshooting, access-administration, and audit purposes.

They are not intended to create a student educational, instructional, behavioral, or academic record.

An unintended authentication or access event does not provide the student with continuing authorization to use Curriculum Warehouse.

Past technical access also does not create a right to future Platform access.

If Student Identifiable Information is inadvertently uploaded into Curriculum Warehouse, the Client or Authorized User should notify NJ Data Diva LLC promptly.

Curriculum Warehouse may take reasonable steps to:

• identify the affected information;
• restrict access where appropriate;
• remove the prohibited information;
• assist the Client in determining how the upload occurred;
• review relevant activity or audit information; and
• recommend appropriate corrective action.

Curriculum Warehouse reserves the right to remove Student Identifiable Information from the Platform when it is identified.

The existence of an inadvertent upload does not authorize:

• continued storage;
• continued use;
• redistribution;
• incorporation into other Platform content; or
• submission of that information to AI-assisted functionality.

Clients and Authorized Users should avoid duplicating or transmitting prohibited information when reporting an inadvertent upload. Where possible, the report should identify the location of the information without reproducing the Student Identifiable Information itself.

Certain Curriculum Warehouse features allow Clients to publish selected curriculum information for public access.

The Client determines what curriculum information it elects to publish.

Before publishing curriculum information, Clients and Authorized Users are responsible for confirming that the material does not contain:

• Student Identifiable Information;
• student education records;
• confidential student information;
• identifiable student work;
• unintended personal information;
• confidential Client information that should not be made public; or
• other information that should not be publicly disclosed.

Curriculum Warehouse provides the technical publishing functionality but does not independently determine what Client content is legally appropriate, required, or authorized for public disclosure.

Student Identifiable Information must not be submitted to Curriculum Warehouse AI-assisted functionality.

This prohibition applies regardless of whether the Client has authorized or enabled AI-assisted functionality.

Authorized Users must not enter information such as:

• student names or identifying information;
• student identification numbers;
• identifiable student records;
• grades tied to identifiable students;
• IEP information;
• special education records;
• identifiable assessment results;
• student health information;
• disciplinary or counseling information;
• student rosters;
• identifiable student work; or
• other confidential student information

into Curriculum Warehouse AI-assisted functionality.

Curriculum Warehouse currently uses Google Gemini, provided by Google LLC, to support certain production AI-assisted functionality.

Authorized Users with access to supported functionality may invoke Google Gemini through Curriculum Warehouse features, including supported lesson-planning functionality.

Curriculum Warehouse currently uses Gemini 2.5 Flash for supported AI-assisted lesson-content generation.

When an Authorized User invokes an applicable AI feature, information included in the request may be transmitted to and processed by Google Gemini as reasonably necessary to generate the requested output.

For this reason, Student Identifiable Information must not be included in prompts, curriculum context, lesson-planning content, or other information submitted to AI-assisted functionality.

Google Gemini is identified on the Curriculum Warehouse Subprocessors page.

Where instructional context is useful when using an AI feature, users should use generalized or de-identified descriptions that do not identify an individual student.

For example, instructional descriptions may refer generally to:

• grade level;
• curriculum standard;
• instructional objective;
• general learner needs;
• general differentiation approaches; or
• non-identifiable instructional circumstances.

Users should not include information that would permit an individual student to be identified.

Additional AI requirements are provided in the Curriculum Warehouse AI Use Policy.

Information associated with Authorized Users, authentication activity, Platform use, audit records, and active session information is handled according to the Curriculum Warehouse Privacy Policy.

Curriculum Warehouse maintains commercially reasonable safeguards designed to protect Platform information as described in the Security & Data Protection Policy.

Security measures include controls relating to:

• authentication;
• role-based permissions;
• Client separation;
• Platform activity and audit records;
• administrative access; and
• cloud-hosted infrastructure.

The private Curriculum Warehouse application is hosted through Firebase Hosting and related Google Cloud/Firebase infrastructure.

Client curriculum information and private Platform data are maintained within the Google Cloud/Firebase environment.

The public Curriculum Warehouse marketing and legal Website at curriculumwarehouse.com is hosted separately through GoDaddy.

GoDaddy does not serve as the primary hosting environment for private Client curriculum data.

Curriculum Warehouse uses third-party technology providers to operate and support the Platform and related business services.

Relevant providers are identified on the Curriculum Warehouse Subprocessors page.

Current disclosed providers include services supporting:

• Google Cloud/Firebase Platform infrastructure;
• Google Gemini AI-assisted functionality;
• the public GoDaddy-hosted Website; and
• Brevo email and communications.

Client-selected identity providers such as Google Workspace or Microsoft 365 may also be used for authentication.

These providers are used for legitimate operational purposes and are not authorized by NJ Data Diva LLC to independently use Platform information for unrelated purposes except as otherwise governed by their applicable service relationship, terms, or legal obligations.

Authentication attempts and Platform access may generate audit, technical, session, or security records.

Depending upon Platform activity, these records may include:

• authentication events;
• session dates and times;
• active session duration;
• Platform actions;
• administrative actions;
• curriculum changes; and
• related system-generated information.

Such records may be maintained as reasonably necessary for:

• security;
• troubleshooting;
• session management;
• access administration;
• investigation of unauthorized access;
• operational visibility; and
• Platform integrity.

Platform audit and active-session information are not designed as student academic records, payroll records, attendance records, or employee timekeeping records.

Additional information regarding audit records and active session duration is provided in the Curriculum Warehouse Privacy Policy.

Curriculum Warehouse is intentionally designed to minimize student-data privacy risk by:

• limiting the private Platform to authorized professional users;
• prohibiting Student Identifiable Information within Platform content;
• prohibiting Student Identifiable Information within AI-assisted functionality;
• separating Client environments;
• supporting role-based access controls;
• providing administrative access controls;
• maintaining authentication, security, and audit functionality;
• requiring Clients to manage appropriate user authorization; and
• providing procedures for responding to unintended student authentication or prohibited student information.

NJ Data Diva LLC does not rely upon student information as part of Curriculum Warehouse's ordinary business model.

Nothing in this Policy authorizes a Client or Authorized User to submit Student Identifiable Information to Curriculum Warehouse.

The limited receipt or generation of authentication, security, or audit information resulting from an unintended student authentication or access event does not change Curriculum Warehouse's intended professional-user scope.

Because legal requirements may depend upon the particular circumstances of a Client, NJ Data Diva LLC will reasonably cooperate with Clients regarding legitimate:

• privacy;
• security;
• procurement;
• technology-review; or
• legal-review

questions concerning Curriculum Warehouse.

If Curriculum Warehouse introduces functionality in the future that is intentionally designed for student users or intentionally designed to collect, maintain, store, or otherwise process Student Identifiable Information, NJ Data Diva LLC will review and update its:

• privacy practices;
• technical safeguards;
• contractual documentation;
• subprocessor disclosures; and
• applicable policies

before such functionality is generally offered.

Nothing in this provision means that Curriculum Warehouse currently authorizes Student Identifiable Information within the Platform.

NJ Data Diva LLC may update this Student Data Scope as:

• Platform functionality changes;
• authentication practices evolve;
• security practices change;
• AI functionality changes;
• service providers change; or
• applicable requirements develop.

The current version will be published within the Curriculum Warehouse Terms & Policies center with an updated “Last Updated” date.

Questions or reports regarding Student Identifiable Information, unintended student authentication, unauthorized student access, or this Student Data Scope may be directed to:

NJ Data Diva LLC
Curriculum Warehouse

Email: jackie@curriculumwarehouse.com

Website: curriculumwarehouse.com