Skip to content
AcademyTempo
Request a demo

Effective September 16, 2026 · Version 1.0

Data Processing Addendum

This Addendum forms part of the AcademyTempo Terms of Service or the signed agreement between AcademyTempo (“Processor”, “we”) and the academy or organization using the Service (“Customer”, “Controller”). It governs Customer Personal Data that we process on Customer’s behalf.

1. Definitions

“Customer Personal Data” means personal information contained in Customer Data (as defined in the Terms) that we process on Customer’s behalf. “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data, including the Personal Information Protection and Electronic Documents Act and substantially similar provincial laws, Quebec’s Act respecting the protection of personal information in the private sector, the Children’s Online Privacy Protection Act, the Family Educational Rights and Privacy Act, U.S. state privacy and student-privacy laws, and, where applicable, the EU and UK GDPR. “Subprocessor” means a third party we engage to process Customer Personal Data. “Security Incident” means a confirmed unauthorized access to, or acquisition, disclosure, alteration, or destruction of, Customer Personal Data in our or a Subprocessor’s possession. Other capitalized terms have the meaning given in the Terms.

2. Roles, scope, and instructions

Customer is the controller, business, or equivalent and determines the purposes and means of processing. We act as processor or service provider. We process Customer Personal Data only (a) to provide, secure, support, and improve the Service for Customer, (b) on Customer’s documented instructions, which include the Terms, this Addendum, the configuration Customer chooses in the Service, and each approval Customer’s authorized users give, and (c) as required by law, in which case we notify Customer before processing unless the law prohibits notice. If we believe an instruction violates Data Protection Laws we will inform Customer and may suspend the affected processing.

We do not sell Customer Personal Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than the Service, combine it with personal data from other sources except as the Service requires, or use it to train artificial-intelligence models. We certify that we understand and will comply with these restrictions.

Annex I describes the subject matter, duration, nature and purpose of processing, the categories of data subjects, and the categories of personal data.

3. Customer obligations and student data

Customer warrants that it has a lawful basis and all required notices and consents for the Customer Personal Data it provides, including any parental or guardian consent required for minors and any consent required before recording or transcribing a lesson. Where Customer is an educational institution, Customer designates us as a “school official” with a legitimate educational interest, or the equivalent under applicable law, and we will use education records only for the purposes Customer authorizes, will not disclose them except as this Addendum permits, and will not re-disclose them to third parties except to Subprocessors bound by this Addendum. Where Customer relies on the school-consent exception under COPPA, Customer represents that it is authorized to provide consent on behalf of parents for the educational use of the Service. Customer will not provide Customer Personal Data that the Service is not designed to hold, including payment card numbers, government identifiers, biometric identifiers, or health information beyond what a field is designed to hold.

4. Confidentiality and personnel

We restrict access to Customer Personal Data to personnel and contractors who need it to provide the Service, bind them to written confidentiality obligations that survive their engagement, and train them on their responsibilities.

5. Security

We implement and maintain the technical and organizational measures in Annex II, which are appropriate to the risk presented by the processing, and we will not materially reduce the overall security of the Service during the subscription. Customer is responsible for securing its own accounts, credentials, devices, and role assignments, for the accuracy of the data it enters, and for reviewing approvals before they take effect.

6. Subprocessors

Customer authorizes us to engage the Subprocessors listed on the Subprocessors page, which forms Annex III. We impose data-protection obligations on each Subprocessor that are no less protective than those in this Addendum and remain liable for their performance. We will give at least 30 days’ notice before adding or replacing a Subprocessor by updating that page and notifying the Customer’s account owner. Customer may object on reasonable data-protection grounds within that period; if we cannot address the objection, Customer may terminate the affected Service and receive a pro-rated refund of prepaid fees for the remaining term.

7. International transfers

Customer Personal Data is hosted in the United States (Vercel edge and serverless runtime; Supabase managed Postgres and authentication). Customer authorizes processing in Canada, the United States, and the countries where Subprocessors listed in Annex III operate. Where Data Protection Laws restrict a transfer, the parties rely on an appropriate mechanism, such as the European Commission’s Standard Contractual Clauses (Module Two, Controller to Processor, and Module Three, Processor to Processor), the UK International Data Transfer Addendum, or another lawful mechanism, which are incorporated by reference and completed by the details in Annex I and Annex II. In the event of conflict, those clauses prevail over this Addendum for the transfers they govern.

8. Assistance with individuals’ requests

If we receive a request from a data subject, parent, guardian, or teacher concerning Customer Personal Data, we will direct the person to Customer and will not respond directly unless Customer instructs us or the law requires. Taking into account the nature of the processing, we will help Customer respond to requests to access, correct, delete, restrict, port, or object, and will help Customer with data-protection impact assessments and consultations with regulators, in each case to the extent Customer cannot do so through the Service itself. We may charge reasonable fees for assistance beyond what the Service provides.

9. Security Incidents

We will notify Customer without undue delay, and in any event within 72 hours after confirming a Security Incident, by email to the account owner. The notice will describe the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a point of contact, and we will update it as information becomes available. We will take reasonable steps to contain and remediate the incident and will cooperate with Customer’s investigation. Customer controls, and is responsible for, notifications to individuals and regulators required of it as controller; we will not notify Customer’s data subjects or regulators unless Customer instructs us or the law requires us to. Our notification is not an acknowledgement of fault.

10. Return and deletion

During the subscription Customer can export Customer Data through the Service or by request. Within 30 days after the subscription ends we will, at Customer’s choice, return or delete Customer Personal Data from live systems and instruct Subprocessors to do the same. Backup copies are deleted on a rolling schedule within 90 days and are not restored except to recover the Service. We may retain Customer Personal Data where and for as long as law requires, keeping it confidential and processing it only for that purpose. On request we will confirm deletion in writing.

11. Audits and evidence

On written request no more than once per year, and additionally after a Security Incident or where a regulator requires, we will provide the information reasonably necessary to demonstrate compliance with this Addendum, including our then-current security documentation, third-party reports we hold, and answers to a reasonable security questionnaire. If that information is insufficient, Customer or an independent auditor bound by confidentiality may audit the relevant controls on at least 30 days’ notice, during business hours, at Customer’s expense, in a manner that does not compromise the security of other customers and that respects our confidentiality and our Subprocessors’ terms.

12. Liability, term, and precedence

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms or the signed agreement, and the parties’ combined liability under this Addendum and the Terms is subject to a single aggregate cap. This Addendum takes effect when the Terms take effect and continues for as long as we process Customer Personal Data. If this Addendum conflicts with the Terms, this Addendum prevails on data-protection matters; if it conflicts with standard contractual clauses incorporated under Section 7, those clauses prevail. This Addendum is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and disputes are resolved as the Terms provide.

Notices under this Addendum to us: usajaysim@gmail.com.

Annex I. Description of processing

  • Subject matter and duration. Provision of the AcademyTempo hosted service for the term of Customer’s subscription plus the return and deletion period in Section 10.
  • Nature and purpose. Hosting, storage, scheduling, attendance recording, drafting and delivery of approved communications, enrollment and finance administration, AI-assisted interpretation and drafting with human approval, transcription of adult lesson audio where enabled, audit logging, and support.
  • Data subjects. Students (including minors), parents and guardians, teachers and other academy staff, academy administrators, and prospective families.
  • Categories of personal data. Identification and contact details of adults; student names, grades, class assignments, attendance, learning notes, and approved reports; guardian relationships, contact channels, consent and delivery records; staff subjects, availability, compensation and payroll records; invoices and payment evidence (no card numbers); approved message content; lesson transcripts, speaker mappings, and coaching drafts for adult teachers; account, role, and audit metadata.
  • Sensitive data. Not intended. Customer must not enter health, biometric, or other special-category data except where a field is expressly designed for it.
  • Frequency. Continuous for the duration of the subscription.

Annex II. Technical and organizational measures

  • Access control. Every request resolves the authenticated identity, academy membership, and role on the server; browser-supplied tenant or role values are never trusted. Roles limit what each user can see and approve.
  • Tenant isolation. Tenant-scoped repositories, database constraints, and forced row-level security on every customer table; cross-tenant access is denied at the database layer and tested.
  • Encryption. TLS for all traffic in transit; provider-managed encryption at rest for databases, backups, and storage; application-layer encryption of third-party integration tokens with a server-only key; certificate-verified TLS to the database.
  • Secrets. Provider credentials and keys are held in the hosting platform’s encrypted environment and are never sent to browsers or written to logs.
  • Logging and audit. Request logs use a strict metadata allowlist that excludes message content, identities, tenant values, network addresses, tokens, and secrets. Business changes are written to an append-only audit trail that records actor, action, and time.
  • AI safeguards. Deterministic rules own validity, authorization, and persistence. Model inputs are minimized (first names only, contact details and sensitive numbers removed, task-scoped context). Each AI feature has its own on-off switch, rate limit, and daily budget, with a local rules-only fallback and a kill switch. Model providers may not train on our data.
  • Human approval. Consequential schedule changes, guardian-facing content, sensitive feedback, learning records, payments, and external sends require an authorized person’s approval, and sandbox, pending, failed, and externally executed states are kept distinct.
  • Integrity of external events. Inbound provider webhooks are signature-verified and replay-protected before they change state.
  • Availability and recovery. Managed database backups with point-in-time recovery, redundant hosting, and forward-only migrations run before each release.
  • Secure development. Type checking, automated tests including tenant-isolation and authorization suites, dependency auditing, and a release gate that must pass before deployment.
  • Data minimization and retention. Raw lesson audio is not retained by default and provider artifacts are deleted after processing; retention and deletion follow Section 10.
  • Incident response. A documented process for detection, containment, customer notification within 72 hours of confirmation, and post-incident review.

Annex III. Subprocessors

The current list, including purpose and location for each provider, is maintained on the Subprocessors page and is incorporated into this Addendum.