1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between StudyBridge AI ("Processor") and the user or institution ("Controller") and governs the processing of personal data in connection with the StudyBridge learning system.

This DPA is designed to meet the requirements of GDPR Article 28, FERPA, and other applicable data protection regulations.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable individual
"Processing" means any operation performed on Personal Data
"Sub-processor" means any third party engaged by the Processor to process Personal Data

3. Scope of Processing

The Processor processes Personal Data solely for the purpose of providing the StudyBridge learning system's educational services, including:

User account management and authentication
AI-powered learning content generation
Learning progress tracking and analytics
Communication features (study groups, messaging)
Payment processing

4. Sub-processors

We use the following categories of sub-processors:

Category	Purpose	Data Processed
Cloud Hosting Provider	Infrastructure and data storage	All platform data
AI Model Provider	AI-powered content generation	User prompts and context
Payment Processor	Subscription billing	Payment details (tokenised)
Email Service Provider	Transactional and marketing emails	Email address, name
Authentication Provider	User sign-in (e.g. Google OAuth)	Email, profile info

5. Security Measures

The Processor implements appropriate technical and organisational measures, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Access controls and role-based permissions
Regular security assessments and penetration testing
Incident response procedures
Employee training on data protection

6. Data Subject Rights

The Processor shall assist the Controller in fulfilling data subject requests including access, rectification, erasure, portability, and objection, in accordance with applicable data protection laws.

7. Data Breach Notification

In the event of a personal data breach, the Processor shall notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, providing details of the nature, scope, and recommended mitigation measures.

8. International Transfers

Where Personal Data is transferred outside the European Economic Area, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Data Retention and Deletion

Upon termination of the service agreement, the Processor shall delete or return all Personal Data within 30 days, unless retention is required by applicable law.

10. Contact

For DPA-related inquiries: admin@studybridge.tech