CourseSmith Data Processing Addendum

The short version

• This addendum applies when we handle personal data for you: your learners in interactive lessons, the people who comment on your review links, and people who appear in the files you upload or record.
• For that data, you decide why and how it is used. We follow your instructions and use it to run CourseSmith for you, with the limited exceptions in section 5.
• Some features run on providers that handle content under their own terms (section 5.2). Read that section before you send other people's personal data through those features.
• It is part of our Terms of Service. You do not need to sign anything.
• Our Privacy Policy lists the companies that help us (section 11) and the security measures we use (section 14).

1. Who this addendum is between

1.1 This Data Processing Addendum ("DPA") is between CourseSmith.AI, Inc., a Delaware corporation ("CourseSmith", "we", "us"), and the account holder who accepted our Terms of Service ("you").

1.2 It forms part of the Terms of Service and applies automatically whenever we process Customer Personal Data. If this DPA and the Terms disagree about personal data, this DPA wins. If the Standard Contractual Clauses described in section 10 apply and disagree with this DPA, the Clauses win.

2. Meanings

• Customer Personal Data means personal data that we process for you while providing the Service. It includes data about your learners and reviewers collected through your links, and personal data about other people contained in Your Content. It does not include the public sources described in section 5.6.
• Data Protection Laws means the laws that apply to that processing. Examples include the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA) and similar US state laws, and India's Digital Personal Data Protection Act 2023.
• Sub-processor means a company we engage to process Customer Personal Data for us, as listed in section 11.1 of our Privacy Policy.
• Independent Provider means a provider listed in section 11.2 of our Privacy Policy. These providers handle content under their own published terms, and we do not have a data processing agreement with them.
• Terms such as controller, processor, data subject, personal data breach and processing have the meanings given in the GDPR. "Service provider" has the meaning given in the CCPA. Other capitalised terms have the meanings given in the Terms of Service.

3. Roles

3.1 For Customer Personal Data, you are the controller (or, under Indian law, the data fiduciary) and we are your processor. Under the CCPA and similar US laws, we are your service provider.

3.2 You are responsible for:

• having a lawful basis for the processing you ask us to do;
• giving your learners, reviewers and anyone shown in your content the notices the law requires;
• getting any consent the law requires, including parental consent or school authorisation for children, as section 10.3 of the Terms explains; and
• the accuracy of the personal data you give us.

3.3 This DPA does not cover personal data we handle as a controller for our own purposes, such as your account details and billing records. Our Privacy Policy covers that data.

4. What we process, and why

5. Our obligations

5.1 Instructions. We process Customer Personal Data only on your documented instructions, including for transfers to other countries. Your instructions are these: the Terms of Service, this DPA, and the choices you make in the Service, such as the features you use and the links you share. By accepting this DPA you also give us these standing instructions:

• to honour access and deletion requests from your learners, or their parents, for learner records, and to tell you when we do;
• to delete learner data that we learn was collected without a consent the law requires;
• to apply the retention periods in sections 4, 6 and 13 of our Privacy Policy, including erasing learner records after 12 months without activity; and
• to remove content that breaks the Acceptable Use Policy in section 9 of the Terms.

We may also process Customer Personal Data where EU or member state law (or UK or Swiss law, for data covered by those laws) requires it. In that case we will tell you first, unless that law forbids it. If another government or authority asks for Customer Personal Data, we will tell you unless the law forbids it, challenge the request where we have reasonable grounds to, and disclose only the minimum required. If we believe an instruction breaks Data Protection Laws, we will inform you immediately.

5.2 Independent Providers. Some features run on Independent Providers, as section 10 of our Privacy Policy explains. Today these include the standard narration voices, voice cloning and premium voices, Indian-language voices, some AI image, video and diagram features, the Kimi writing model, and the features that call Google through the Gemini Developer API. Please read this carefully:

• these providers may keep content they receive and, under their own terms, some of them may use it for their own purposes, such as improving their services;
• we have no data processing agreement with them, so no GDPR Article 28 contract and no EU or UK transfer safeguard is in place for them;
• we cannot make them delete their copies, though we will ask them to on request; and
• our commitments in section 5.5 (no sale, no training, no other use) do not cover what these providers do under their own terms.

If you are subject to the GDPR, the UK GDPR or US state privacy laws, do not send Customer Personal Data through these features. Keep personal data out of lesson text that becomes narration, image, video or diagram prompts, and do not clone the voice of another person through these features unless that person has agreed to the provider's own use described in our Privacy Policy. We are working to move these features to providers under data processing terms, and we will update our Privacy Policy as we do.

5.3 Confidentiality. We require everyone at CourseSmith who can access Customer Personal Data to keep it confidential. Staff access it only when needed for the purposes in section 4, such as giving support you asked for or fixing a failed job.

5.4 Security. We protect Customer Personal Data with technical and organisational measures appropriate to the risk. The measures we use today, including their limits, are listed in Annex 2. We may change them, as long as the overall level of protection does not go down.

5.5 No other use. We do not sell Customer Personal Data or share it for cross-context behavioural advertising. We do not use it to train AI models or to build profiles. We do not combine it with personal data we receive from other sources, except as needed to provide the Service. We use it only to provide the Service to you, except for these limited purposes, for which we act on our own account:

• keeping the Service secure and preventing fraud and abuse;
• billing and accounting;
• meeting our legal obligations; and
• troubleshooting a specific failed or faulty job, using the AI request logs described in our Privacy Policy.

5.6 Public sources. When you point us to a public source, such as a public code repository or a YouTube video, the analysis we cache from it may be reused when another user points us to the same source. For that public material we act as an independent controller under our Privacy Policy, and it is not Customer Personal Data. Do not point us to a public source that contains personal data you do not want reused this way.

5.7 US state privacy laws. Where the CCPA or a similar US state law applies, we act as your service provider (or processor) and:

• we process Customer Personal Data only for the business purposes in section 4;
• we do not retain, use or disclose it outside our direct business relationship with you, except as these laws allow;
• we comply with these laws and give Customer Personal Data the same level of privacy protection they require, including reasonable security;
• we will tell you if we can no longer meet our obligations under these laws;
• you may take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data, including by contacting us at [email protected];
• you will tell us about consumer requests we need to act on, and we will help you respond; and
• our Sub-processors are bound by written terms that protect the data in the same way.

6. Sub-processors

6.1 Authorisation. You give us general authorisation to use the Sub-processors listed in section 11.1 of our Privacy Policy.

6.2 Our duties. We bind each Sub-processor by a written contract that gives Customer Personal Data protection at least as strong, in substance, as this DPA. We remain responsible to you for our Sub-processors' performance.

6.3 Changes. We notify account holders by email or in the app, and update our Privacy Policy, at least 30 days before:

• a new Sub-processor starts processing Customer Personal Data; or
• a feature starts sending Customer Personal Data to a provider that is not already listed in section 11.2 of our Privacy Policy, or an existing feature moves to an Independent Provider.

If you do not object within that period, the change applies to you.

6.4 Objections. You may object to a change on reasonable data protection grounds within that 30-day period, by email to [email protected]. We will work with you in good faith to find a solution. If we cannot find one, you may stop using the affected feature or close your account. If you close your account, you will receive a refund of the unused part of any prepaid billing period and of any purchased credits you have not used, made through Stripe to the payment method you used, as section 5.7 of the Terms describes.

7. Helping you meet your duties

7.1 Requests from individuals. Except for the requests covered by our standing instructions in section 5.1, if a learner, reviewer or other person asks us to exercise their rights over Customer Personal Data, we will refer them to you and will not answer them ourselves, unless the law requires us to. Taking into account the nature of the processing, we will help you respond, for example by finding, correcting, exporting or deleting a learner record.

7.2 Other assistance. Taking into account the information available to us, we will give you reasonable help with your security obligations, with data protection impact assessments, and with consultations with regulators, where these relate to our processing.

8. Personal data breaches

8.1 If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, using the email address on your account.

8.2 Our notice will describe, as far as we know them at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, the steps we have taken or propose to take, and a contact point at CourseSmith for more information ([email protected]). We will send further details as we learn them, and we will cooperate with you and provide the information you reasonably need for your own notifications to regulators and individuals.

8.3 Telling you about a breach is not an admission of fault.

9. Deleting or returning data

9.1 In the app you can revoke review and lesson links, delete individual review comments, and delete Your Content. To erase learner records, email [email protected]. We also erase learner records automatically, as section 5.1 and Annex 2 describe.

9.2 When you ask us to close your account, it stays open for downloads for up to 30 days after you confirm, or less if you ask. Before it closes, you can ask us for a copy of your learner and reviewer data. Within 30 days of closing it, we delete Customer Personal Data as section 13.1 of our Privacy Policy describes, and we email you to confirm when the deletion is complete. Copies in backups and logs are deleted as those backups and logs are rotated out. We keep Customer Personal Data longer only where the law requires us to, and we keep protecting it while we do. If Customer Personal Data appears in a support email you sent us, we keep that email only as long as we need it to handle your request and its follow-up.

10. International transfers

10.1 We are based in the United States, and our main servers and storage are there. Sub-processors may process Customer Personal Data in the locations listed in our Privacy Policy.

10.2 EU. Where a transfer of Customer Personal Data subject to the GDPR to us is not covered by an adequacy decision (including because we are not certified under the EU-US Data Privacy Framework), the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 ("Clauses") are incorporated into this DPA as follows:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor for someone else;
• Clause 7 (docking clause) applies;
• under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 6.3 of this DPA;
• the optional wording in Clause 11 does not apply;
• under Clause 13, the supervisory authority is the one competent for you; if you are not established in the EU but have appointed a representative under Article 27(1) GDPR, the one in the member state where your representative is established; and if you are not established in the EU and are not required to appoint a representative under Article 27(2) GDPR, the one in the member state where the data subjects concerned are located (and if several, the one where most of them are located);
• under Clauses 17 and 18, the Clauses are governed by the law of Ireland and disputes go to the courts of Ireland; and
• Annexes I and II of the Clauses are completed by section 4 and Annexes 1 and 2 of this DPA, and Annex III by section 11.1 of our Privacy Policy.

10.3 UK. Where a transfer subject to UK data protection law is not covered by UK adequacy regulations (including because we are not certified under the UK Extension to the EU-US Data Privacy Framework), the International Data Transfer Addendum to the EU Clauses issued by the UK Information Commissioner ("UK Addendum") applies, completed with the information in this DPA. Either party may end the UK Addendum as allowed by its section 19.

10.4 Switzerland. Where a transfer subject to Swiss law is not covered by a Swiss adequacy finding (including because we are not certified under the Swiss-US Data Privacy Framework), the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner. The term "member state" in Clause 18(c) shall not be read so as to exclude data subjects in Switzerland from bringing claims where they habitually live. Where a transfer is also subject to the GDPR, the EU supervisory authority under section 10.2 remains competent for that part.

10.5 Onward transfers. Where a Sub-processor processes Customer Personal Data outside the country where you are, we rely on a lawful transfer mechanism, such as an adequacy decision, the EU-US Data Privacy Framework where the provider is certified, or the Clauses, as listed in section 11.1 of our Privacy Policy. Independent Providers are not covered by such a mechanism, as section 5.2 explains.

11. Information and audits

11.1 On written request, we will give you the information you need to show that we comply with this DPA, for example by answering a reasonable written questionnaire about our processing of Customer Personal Data.

11.2 You, or an independent auditor you appoint who is bound by confidentiality, may audit our compliance with this DPA, including by inspection where a questionnaire or other information is not enough. Audits take place normally no more than once a year, and also after a personal data breach, at a regulator's request, or where there are reasonable indications that we are not complying. They take place at your cost, with reasonable notice, at a reasonable time, and without access to other customers' data. Nothing in this section limits your rights under Clause 8.9 of the Clauses.

12. Liability and duration

12.1 Our liability under this DPA is subject to the limits in the Terms of Service, except for claims by data subjects, liability under Clause 12 of the Clauses, and any other liability that Data Protection Laws do not allow to be limited.

12.2 This DPA lasts as long as we process Customer Personal Data for you. Our obligations continue for any data we still hold after the Terms end.

12.3 We may update this DPA to reflect changes in law or in the Service. We will not reduce the overall protection it gives Customer Personal Data, and section 21 of the Terms explains how we tell you about material changes.

Annex 1: Parties

Annex 2: Security measures

These are the measures in place on the date at the top of this page, including their limits.

• Access control. Passwords are stored only as bcrypt hashes. Sign-in tokens are signed and expire, and refresh tokens change each time they are used. Staff access to production systems is limited to authorised people who need it.
• Secrets. API keys and review-link tokens are stored only as one-way hashes. Provider keys, webhook signing secrets and lesson-link tokens are encrypted with a key kept outside the database.
• Storage. Files in our AWS storage are encrypted at rest. Uploaded documents and voice samples are kept in private storage and reached through links that expire within an hour; images extracted from documents for your lessons use links that last up to 7 days. Most other media, including narration audio, images, recordings and captures, is reached through links that are hard to guess, do not expire and are not password protected. Finished videos and the media copied to make them sit at public addresses that are hard to guess. Anyone who has one of these addresses can open the file.
• Transmission. Connections between your browser and the Service use HTTPS.
• Abuse prevention. Rate limits protect the public review, lesson, support, waitlist, error-reporting and API endpoints.
• Integrity. Payment notifications are checked against a signature before we act on them.
• Monitoring. We keep server logs and monitoring data for up to 90 days to find and fix problems.
• Minimisation. Learners do not create accounts or give an email address, and the learner name field is optional. Shared lesson and review pages load no advertising, analytics or affiliate trackers.
• Retention. Learner records are erased on request, when the creator's account is erased, and after 12 months without activity.