Data Processing Agreement

1. Roles

Customer controls the personal information of its administrators, instructors, and learners ("Customer Data"). Max University processes Customer Data only on Customer's documented instructions, including through the product's settings. For education records, Max University acts as a school official under FERPA, under Customer's direct control.

2. Scope of processing

• Subject matter: providing CoachMax assessment, feedback, reporting, and integrations.
• Data subjects: Customer's administrators, instructors, mentors, and learners (aged 18+).
• Data types: names, emails, roles, submissions (text, files, video), assessments, scores, feedback, usage logs.
• Duration: the term of the agreement plus up to 30 days for deletion or return.

3. Our commitments

• Use Customer Data only to provide and secure the service; never sell it or use it for advertising.
• Never use Customer Data to train AI models.
• Ensure staff with access are bound by confidentiality and access it only when needed (for example, in a support session the Customer approves, which is logged).
• Keep Customer Data logically separated from other customers' data.
• Assist Customer in responding to data subject requests and with security and privacy assessments.

4. Security measures

• Encryption in transit (TLS) and at rest.
• Row-level, organization-scoped access controls enforced on the server.
• Role-based permissions and two-factor sign-in for administrators.
• Private file storage with expiring links and malware scanning of uploads.
• Append-only audit logging of sensitive actions.
• Daily backups with tested restores, monitoring, and an incident response plan.

5. Subprocessors

Customer authorizes the subprocessors below. We will give at least 30 days' notice of new subprocessors, and Customer may object on reasonable grounds. [Confirm vendors before signing.]

• Hosting: Vercel (USA) — in use
• Database and file storage: Supabase (USA) — in use
• Virus scanning of uploaded files: Cloudmersive (USA) — in use; files are scanned and not retained by the vendor (per vendor) [confirm in vendor terms]
• AI assessment: Anthropic (USA) — in use
• Video analysis for video submissions: Google Gemini API, paid tier (USA) — when enabled. Receives the learner's video only to describe it for assessment; the copy is deleted from Google right after. On the paid tier Google does not use it to improve its products [confirm in vendor terms before enabling]
• AI drafting of course setup (optional; only for organizations that opt in in writing): Google Gemini API (USA). Receives course materials only (lesson text and questionnaire templates), never learner submissions or personal data. On Google's free tier, Google may use this content to improve its products [confirm before offering to any customer]
• Payments: Stripe (USA) — billing contacts only
• Email delivery: Resend (USA, us-east-1 region) — account and notification emails (sign-in links, invitations, feedback-ready and review emails, demo-request confirmations), sent from coachmax.maxuniversity.org. Google Workspace (USA) — our own support mailboxes (support@, privacy@, security@, hello@maxuniversity.org)
• Error monitoring: Sentry (USA) — personal data scrubbed — planned

6. Security incidents

We will notify Customer without undue delay, and within 72 hours of confirming a security incident affecting Customer Data, with the information Customer needs to meet its obligations, and we will take reasonable steps to contain and remediate it.

7. Deletion and return

Customer can export or delete Customer Data at any time. Within 30 days after the agreement ends, we delete Customer Data (including from active systems) unless the law requires us to keep it; backups roll off on a fixed schedule.

8. Audits

On reasonable request, no more than once a year, we will provide information needed to demonstrate compliance with this DPA, such as security documentation or third-party assessment summaries when available.

9. Contact

Privacy: privacy@maxuniversity.org. Security: security@maxuniversity.org. The Boost Pad Inc. (Max University), 2400 Greenland Ave., Charlotte, NC 28208, USA.