Data Processing Agreement

1. Subject matter and duration

Processor provides the Mandarin tone and pronunciation training service at https://tones.fixmandarin.com (including the Google Play Android app and the App Store iOS app). Processing lasts for the term of Customer’s account and any period we must retain records under the Terms or law.

2. Nature, purpose, and types of data

Nature: hosting accounts, authenticating users, taking payment, unlocking Premium, syncing trainer progress, logging security events. Purpose: performing the contract. Data subjects: Customer’s staff and learners they enroll.

• Account: name, email, user ID, sign-in method.
• Billing: Freemius license/plan status and/or Google Play or App Store purchase and subscription status (full card data is processed by Freemius, Google, or Apple, not stored by us in full).
• Usage: technical logs needed to run the site; signed-in trainer clears and review favorites in Supabase.
• Special category data: not intentionally processed. Voice recordings from speak features are not uploaded to Processor’s servers.

3. Processor obligations

• Process personal data only on documented instructions from Customer, including this DPA and use of the product, unless law requires otherwise.
• Ensure persons authorized to process data are bound by confidentiality.
• Implement appropriate technical and organizational measures (HTTPS, access control to dashboards, least-privilege keys, subprocessors with their own security programs).
• Assist Customer with data-subject requests, DPIAs, and breach notices, taking into account the nature of processing. Email obeulah36@gmail.com.
• After the end of services, delete or return Customer personal data on request, except copies we must keep for legal or billing records.

4. Customer obligations

Customer is responsible for a lawful basis to enroll learners, parental or student notices where required, and not submitting special-category data the product is not designed to hold.

5. Subprocessors

Customer authorizes Processor to use the following subprocessors for the purposes listed in the Privacy Policy: Clerk (auth), Apple (optional Sign in with Apple and App Store Billing), Google (optional OAuth, Google Play Billing, and website Google Ads only after cookie consent), Freemius (website payments and licenses), Supabase (signed-in trainer progress sync), Vercel (hosting), Cloudflare (R2 media hosting). Processor will remain responsible for their performance. Material changes will be reflected in the Privacy Policy. Customer may object by stopping use of the service and requesting deletion.

6. International transfers

Data may be processed in the United States and other countries where subprocessors operate. Where GDPR requires a transfer tool, Customer instructs Processor to rely on the Standard Contractual Clauses (and UK addenda where applicable) that those subprocessors offer to their customers, plus any supplementary measures they document.

7. Security incidents

Processor will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer data, with facts we reasonably know (nature, likely consequences, measures taken). Contact for notices: obeulah36@gmail.com.

8. Audits

On written request no more than once per year (unless a regulator or incident requires more), Processor will provide available security summaries or subprocessor reports sufficient to demonstrate compliance. On-site audits are not offered for this small consumer product except where mandatory law requires them; then they occur on reasonable notice, during business hours, and at Customer’s cost unless a material breach is found.

9. Liability and order of documents

Liability follows the Terms, except that this DPA prevails over the Terms on data-protection conflicts. Nothing excludes liability that cannot be limited under applicable law.

10. Governing law

This DPA follows the governing law of the Terms, without limiting mandatory GDPR rights of data subjects or supervisory authorities.