Data Processing Agreement

1. Roles

Customer controls the personal information of its administrators, instructors, and learners ("Customer Data"). Max University processes Customer Data only on Customer's documented instructions, including through the product's settings. For education records, Max University acts as a school official under FERPA, under Customer's direct control.

2. Scope of processing

• Subject matter: providing CoachMax assessment, feedback, reporting, and integrations.
• Data subjects: Customer's administrators, instructors, mentors, and learners (aged 18+).
• Data types: names, emails, roles, learner profiles (business or idea, stage, resources, goals, chosen by the learner), submissions (text, files, video), assessments, scores, feedback, usage logs, and operational logs (technical error details with organization names and submission references, never learner names or emails, visible to Max University staff only).
• Duration: the term of the agreement plus up to 30 days for deletion or return.

3. Our commitments

• Use Customer Data only to provide and secure the service; never sell it or use it for advertising.
• Never use Customer Data to train AI models.
• Ensure staff with access are bound by confidentiality and access it only when needed (for example, in a support session the Customer approves, which is logged).
• Keep Customer Data logically separated from other customers' data.
• Assist Customer in responding to data subject requests and with security and privacy assessments.

4. Security measures

• Encryption in transit (TLS) and at rest.
• Row-level, organization-scoped access controls enforced on the server.
• Role-based permissions; two-factor sign-in required for administrators and available to every user.
• Private file storage with expiring links and malware scanning of uploads; files that can't be scanned are refused and deleted.
• Append-only audit logging of sensitive actions.
• Daily database backups by our database provider, automated daily system checks (website, sign-in, storage, email, AI, integrations), and error alerts to our staff.

5. Subprocessors

Customer authorizes the subprocessors below. We will give at least 30 days' notice of new subprocessors, and Customer may object on reasonable grounds. Our AI providers are named in Schedule A of each signed copy of this DPA, and for customers on request (privacy@maxuniversity.org). [Confirm vendors before signing; keep Schedule A, with the AI providers' names, in the signed copy only.]

• Hosting: Vercel (USA) — in use
• Database and file storage: Supabase (USA) — in use
• Virus scanning of uploaded files: Cloudmersive (USA) — in use; files are scanned and not retained by the vendor (per vendor) [confirm in vendor terms]
• AI assessment: AI provider (USA), under commercial terms that don't allow training on Customer Data — in use
• Backup AI assessment, video analysis, and (if Max University chooses it for a feature) AI features such as feedback questions and model answers: backup AI provider, paid tier (USA) — only when enabled; grades written work only when the main AI provider can't. Receives the learner's video only to describe it for assessment; the copy is deleted from the provider right after. On the paid tier the provider does not use it to improve its products [confirm in vendor terms before enabling]
• Learner-work features such as Ask CoachMax and model answers, only while Max University turns this on for a feature (the Trust Center lists any such feature while it's on): backup AI provider, free tier (USA). The provider may use this content to improve its products.
• AI drafting of course setup and grading in test programs (optional; only for organizations that opt in in writing): backup AI provider, free tier (USA). Course setup sends course materials only (lesson text and questionnaire templates). Test-program grading sends the test submissions the Customer chose; never live learner work. On the free tier, the provider may use this content to improve its products [confirm before offering to any customer]
• Payments: Stripe (USA) — billing contacts only — planned, not yet in use
• Email delivery: Resend (USA, us-east-1 region) — account and notification emails (sign-in links, invitations, feedback-ready and review emails, demo-request confirmations), sent from coachmax.maxuniversity.org. Google Workspace (USA) — our own support mailboxes (support@, privacy@, security@, hello@maxuniversity.org)
• Error monitoring: Sentry (USA) — personal data scrubbed — planned

6. Security incidents

We will notify Customer without undue delay, and within 72 hours of confirming a security incident affecting Customer Data, with the information Customer needs to meet its obligations, and we will take reasonable steps to contain and remediate it.

7. Deletion and return

Customer can export or delete Customer Data at any time. Within 30 days after the agreement ends, we delete Customer Data (including from active systems) unless the law requires us to keep it; backups roll off on a fixed schedule.

8. Audits

On reasonable request, no more than once a year, we will provide information needed to demonstrate compliance with this DPA, such as security documentation or third-party assessment summaries when available.

9. Contact

Privacy: privacy@maxuniversity.org. Security: security@maxuniversity.org. The Boost Pad Inc. (Max University), 2400 Greenland Ave., Charlotte, NC 28208, USA.