Between the customer academy or school ("Customer") and [VindicaOS legal entity name], operator of the VindicaOS platform, a Seneca product ("VindicaOS"). This Agreement forms part of, and is governed by, the VindicaOS Terms of Service.
Personal Data means information relating to an identified or identifiable person that Customer uploads to or generates within the platform. Data Subject means the person the Personal Data is about: here, Customer's students (which may include minors) and staff. Processing means any operation performed on Personal Data. Sub-processor means a third party engaged by VindicaOS to process Personal Data.
Customer is the party that decides why and how the Personal Data is processed. VindicaOS processes Personal Data solely on Customer's behalf and under Customer's documented instructions, to provide the platform. VindicaOS does not act as a school official and does not assume Customer's own legal obligations (for example under FERPA, COPPA, or Korea's PIPA); this Agreement provides the controls and commitments Customer needs to meet those obligations.
| Subject matter | Provision of the VindicaOS SAT-program platform (diagnostics, mock tests, homework, reports, classroom, question bank). |
|---|---|
| Duration | The term of Customer's subscription, plus the deletion window in Section 9. |
| Nature & purpose | Hosting, storing, analyzing, and displaying student assessment data to run Customer's program; generating scores, prescriptions, and reports. |
| Categories of Data Subject | Customer's students (including minors) and instructional/administrative staff. |
| Categories of Personal Data | Names, grade level, school name, contact details (including a parent/guardian contact where provided), assessment responses and scores, teacher notes and feedback. VindicaOS does not require sensitive special-category data. |
VindicaOS will process Personal Data only as instructed by Customer, as set out in this Agreement and the Terms of Service, and as needed to provide and secure the platform. VindicaOS will tell Customer if, in its opinion, an instruction infringes applicable law.
VindicaOS keeps Personal Data confidential and ensures that personnel authorized to process it are bound by confidentiality obligations and access it only as needed to provide the service.
VindicaOS maintains technical and organizational measures appropriate to the risk, including:
Customer authorizes VindicaOS to engage the sub-processors below to provide the platform. VindicaOS remains responsible for their performance and imposes data-protection terms on each that are no less protective than this Agreement. VindicaOS will give Customer advance notice of any new or replacement sub-processor and an opportunity to object on reasonable data-protection grounds.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase (incl. its cloud host) | Database, authentication, and storage | [region] |
| Netlify | Web hosting, serverless functions, CDN | [region] |
| Google (Gemini API) | AI-generated explanations and report drafting | [region] |
| Resend | Transactional email delivery (e.g. reports) | [region] |
| Stripe | Subscription billing (billing-contact data only; no student data) | [region] |
Taking into account the nature of the processing, VindicaOS will provide reasonable assistance, including the platform's export and deletion tools, to help Customer respond to requests from Data Subjects (or their parents/guardians) to access, correct, or delete Personal Data.
VindicaOS will notify Customer without undue delay, and in any case within [72 hours], after becoming aware of a breach affecting Customer's Personal Data, and will provide information reasonably needed for Customer to meet its own notification obligations.
On termination, and at Customer's request during the term, VindicaOS will return and/or delete Customer's Personal Data within [30 days], except where retention is required by law. Routine backups are purged on their normal cycle.
Where Personal Data is transferred across borders (including via the sub-processors above), VindicaOS will ensure an appropriate transfer mechanism consistent with applicable law. [Specify mechanism / data-residency commitments per region, e.g. Korea PIPA for international schools.]
On reasonable request and no more than [once per year], VindicaOS will make available information necessary to demonstrate compliance with this Agreement, subject to confidentiality.
This Agreement is governed by [governing law / jurisdiction]. If any conflict arises between this Agreement and the Terms of Service regarding the processing of Personal Data, this Agreement controls. Liability is subject to the limitations in the Terms of Service.