Data Security and Privacy Plan

Substital Browser Extension
Prepared by Gaëtan Covelli, developer of Substital · March 24, 2026

Overview​

Substital is a browser extension that allows users to add, search for, and customize subtitles for online videos on many video platforms. It is used in educational settings for accessibility, language learning, and comprehension support.

Substital is developed and maintained by a single developer (Gaëtan Covelli). The core subtitle functionality does not collect, transmit, or store any personally identifiable information (PII), including student PII. All subtitle operations occur locally within the user's browser.

Substital also includes a GiveFreely affiliate/charity popup integration. This feature runs background configuration and analytics requests on extension startup regardless of the page being visited. The charity selection popup itself is displayed only on commercial e-commerce checkout pages. This feature is entirely separate from the educational subtitle service, does not target students, and is explicitly excluded from the scope of this NDPA. It is disclosed here for full transparency. See Section 2 for detail.

1. Implementation of Contract Requirements​

• The core subtitle service collects no student PII. All subtitle operations are local to the user's browser.
• Substital complies with FERPA, COPPA, and applicable state student privacy laws across the 16 NDPA participating states.
• LEAs will be notified of any material changes to data practices or this Plan in advance of such changes.
• The GiveFreely integration is excluded from NDPA scope and does not apply to students. See Section 2.

2. Administrative, Operational, and Technical Safeguards​

Core subtitle service:

• No user accounts, logins, or PII are required or stored.
• Browser extension storage holds only local user preferences (e.g. subtitle appearance). This is not accessible remotely.
• All external communications use HTTPS. The extension requests only permissions necessary for subtitle functionality.

OpenSubtitles.com API (subtitle search and download):

• Substital uses the OpenSubtitles.com REST API to enable subtitle search and download functionality.
• API requests transmit video metadata only — such as video title, language, and IMDb ID. No user identity, student data, or PII is transmitted to OpenSubtitles in the course of normal use.
• OpenSubtitles is a subprocessor for subtitle data retrieval only and has no access to any student PII.

GiveFreely integration (excluded from NDPA scope):

• On extension startup, regardless of the page being visited, background requests are made to GiveFreely's servers to fetch configuration, active merchant domains, standdown policy, merchant rates, and language files.
• Once per day, a health check event is sent to GiveFreely's analytics API containing only the user's browser language.
• The charity selection popup is displayed only on commercial e-commerce checkout pages — not on educational platforms, video platforms, or school websites.
• A country-level IP geolocation lookup is made via MaxMind GeoIP (once, then cached) to determine which charities to display.
• Creates an anonymous user profile on GiveFreely's servers (no name, email, or real identity — pseudonymous device ID and selected charity only).
• Logs anonymous interaction events (popup shown/dismissed, charity selected) to GiveFreely's analytics API.
• Uses Wildfire (affiliate network) to generate tracking links. GiveFreely and Wildfire are subprocessors of this feature only and have no access to any student data.

3. Employee and Subcontractor Training​

Substital is a sole-developer operation. The developer maintains awareness of FERPA, COPPA, and applicable state student privacy laws through ongoing review of SDPC documentation and applicable legal updates. Any future employees or contractors with access to student data will be trained on applicable laws before receiving access.

4. Contracting Processes​

No employees currently exist. Any future employees or contractors with access to student data will sign confidentiality agreements bound to the terms of this Plan and the NDPA. Any subprocessors receiving student data will enter into written data processing agreements providing protections no less stringent than the NDPA. Substital currently uses the following subprocessors: OpenSubtitles.com (subtitle data retrieval — receives video metadata only, no student PII), GiveFreely and Wildfire (affiliate integration — excluded from NDPA scope, no student PII). No subprocessors have access to student data.

5. Incident Management and Breach Notification​

In the event of a breach involving student PII, Substital will:

• Notify affected LEAs within 72 hours of confirmation (24 hours for Virginia LEAs).
• Provide notification including: date/range of breach, types of information involved, description of incident, number of records affected if known, and a point of contact.
• Cooperate with LEAs, the NYSED Chief Privacy Officer, and law enforcement as required.
• Take immediate containment and remediation steps and document lessons learned.

Because no student PII is currently collected by Substital, the risk of a student data breach from Substital-controlled systems is very low.

6. Data Transition Upon Termination​

Substital's core service stores no student PII on its own servers. If any student data is held pursuant to a service agreement, it will be returned or securely destroyed within the timeframes required by the NDPA (60 days standard; 90 days for New York; 30 days for Colorado). Data will be provided in a readable, exportable format upon request. Written confirmation of destruction will be provided upon request.

7. Secure Destruction​

If student data is ever stored, it will be destroyed using secure deletion methods consistent with NIST SP 800-88 Rev. 1. Written certification of destruction will be provided to the requesting LEA. For Colorado LEAs, written notice of the destruction date and method will be provided within 30 days of completion.

8. Alignment with LEA Policies​

• Substital will review and comply with the Data Security and Privacy Policy of any originating LEA, provided upon DPA execution.
• Substital will review the Parents' Bill of Rights of any subscribing New York LEA, provided upon Exhibit E execution.
• Substital will not use student data for commercial, advertising, or marketing purposes.
• Substital will not sell, rent, or trade student data to any third party.
• All student data remains the exclusive property of the LEA.
• Material changes to Substital's privacy policy will be communicated to LEAs in advance (15 days for Colorado; written notice for Washington).

9. NIST Cybersecurity Framework v1.1 Alignment​

Prepared by: Gaëtan Covelli, developer of Substital · gaetan@substital.com · March 24, 2026