Legal · for schools
Data Processing Agreement
For schools and organisations that need a data processing agreement (DPA). This summarises the terms; a countersigned DPA is available on request. Note that LingoChorus is designed not to process student personal data — assessment is class-level only.
Effective date: [to be confirmed on publication] · Draft last written: July 2026 · Provider: AxixOS Operations Ltd (registered in Malta, company no. C 115851; Wardija Gardens, Alley in il Wardija Wardija Court, first building on left on Wardija Gardens, 6 Triq Tac Cawl, Qala QLA 1513, Malta).
1. Roles
When your school uses LingoChorus and provides personal data (for example, your teachers’ email addresses and profiles), your school is the controller and AxixOS Operations Ltd is the processor for that data. Because the product does not collect the names or personal details of individual students, there is no student-level personal data for us to process.
2. Scope and instructions
We process personal data only to provide the service and on your documented instructions (which these terms and your configuration form), unless required otherwise by law.
3. Sub-processors
We engage the following sub-processors, and will give notice of material changes:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Supabase | Database, authentication and file storage (saved packs, media) | [region — confirm] |
| Vercel | Website and application hosting, CDN | US / global |
| Anthropic (Claude) | Lesson text generation and image quality checks | US |
| Fal.ai | Flashcard image generation (FLUX) | US |
| ElevenLabs | Sung song audio, when a teacher generates it | US |
| Google (Gemini) | Alternative image generation (optional/legacy) | US / global |
| Stripe | Payment processing for paid plans (when billing is live) | US / [region] |
| [Email provider] | Sending sign-in (magic-link) and service emails | [region — confirm] |
4. Security measures
Encryption in transit; database row-level security so a teacher can only reach their own data; least-privilege service credentials; and access controls on administrative functions. [Detailed technical and organisational measures (TOMs) annex to be attached to the signed DPA.]
5. Confidentiality
Personnel with access to personal data are bound by appropriate confidentiality obligations.
6. Assisting you
We will provide reasonable assistance to help you respond to data-subject requests and to meet your obligations for security, breach notification and impact assessments.
7. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
8. International transfers
Where sub-processors are outside the EU/EEA, transfers rely on appropriate safeguards (Standard Contractual Clauses or an adequacy decision). [Confirm the mechanism per sub-processor.]
9. Return and deletion
On termination, we will delete or return the personal data we process on your behalf within [X days], except where retention is required by law.
10. Audit
We will make available the information reasonably necessary to demonstrate compliance with these terms.
11. Requesting a signed DPA
Schools that need a countersigned agreement can request one at hello@lingochorus.com. See also Privacy for schools and our Privacy Policy.
Questions about this document, or to request a signed copy: hello@lingochorus.com. Related: Privacy · Terms · Cookies · Data processing · Privacy for schools