Data Processing Addendum · MyVocalStudio

1. What this addendum is

1.1 This Data Processing Addendum (“DPA”) is part of the MyVocalStudio Terms of Service (the “Terms”) between Ayuda Ventures Inc., a Delaware corporation (“MyVocalStudio,” “we,” “us”), and the studio that holds the account (“you,” the “studio”). You accept it by accepting the Terms. No separate signature is needed.

1.2 It applies whenever we process Studio Personal Data (defined below) for you. It is written to meet Article 28 of the EU General Data Protection Regulation and of the UK GDPR, and the equivalent rules of the Swiss Federal Act on Data Protection. It also applies, as far as relevant, under other data-protection laws that cover your records, such as Canada’s PIPEDA, Australia’s Privacy Act 1988, and US state laws that require a contract with a service provider.

1.3 If this DPA and the Terms conflict, this DPA wins for Studio Personal Data. If the Standard Contractual Clauses (section 9) apply and conflict with this DPA or the Terms, the Standard Contractual Clauses win.

2. Words used here

“Data Protection Law” means every data-protection and privacy law that applies to the processing of Studio Personal Data, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (“FADP”).
“Studio Personal Data” means personal data in the records you, your team, or people acting for you (including students and families using the portal) put into or generate in MyVocalStudio, and that we process for you. Annex I lists the kinds. It does not include information we control ourselves, such as the login and billing details of your account, our support records, and website analytics; our Privacy Policy covers those.
“Subprocessor” means a company we engage that processes Studio Personal Data.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Studio Personal Data.
“Standard Contractual Clauses” or “SCCs” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).
“Controller,” “processor,” “data subject,” “personal data,” “processing” and “supervisory authority” have the meanings given in the GDPR.

3. Roles

3.1 You are the controller of Studio Personal Data, or, where you hold it for someone else, a processor acting for that controller. We are your processor (or subprocessor).

3.2 You decide what Studio Personal Data to collect and why. You are responsible for having a lawful basis for it, for any consent it needs (including from a parent or guardian, and consent to be emailed or texted), and for telling your students, families and staff how you use it. Sections 7, 8 and 10 of the Terms set out these duties in more detail.

3.3 Annex I describes the processing: its subject matter, duration, nature and purpose, the kinds of personal data, and the categories of people it concerns.

4. Your instructions

4.1 We process Studio Personal Data only on your documented instructions, including about transfers to other countries, unless the law requires otherwise. If it does, we will tell you before processing, unless the law forbids telling you.

4.2 Your instructions are: the Terms and this DPA; what you, your team and your portal users ask MyVocalStudio to do through its features and settings; and any other written instruction you give us that we agree is consistent with the Terms. That includes these specific instructions, which you give by using the features concerned:

(a) Messages. Sending the emails, texts and app notifications you or your settings ask for, and passing replies back to you.

(b) AI features. Sending the text or files someone enters, and the Studio Personal Data the feature needs to answer, to our AI subprocessor to produce the result.

(c) Address suggestions and maps. When someone types an address, the browser sends what is typed to Google Maps Platform for address suggestions, and a public teacher profile may show a Google map of a teaching address. Google handles this under its own terms as an independent controller, not as our subprocessor.

(d) Connections you set up. Sending Studio Personal Data to services you connect or configure — Google Calendar, Zoom, your own Stripe account, calendar feeds and webhooks. Once sent, those services handle the data under your own agreement with them; they are not our Subprocessors.

(e) Self-service copies. When someone asks for a copy of their information through our data request page, emailing that person, at the email address on the record, a copy of the Studio Personal Data held under that address. A teacher’s private assessment notes are left out, and the copy tells the person to ask you for them.

4.3 We will tell you promptly if, in our opinion, an instruction breaks Data Protection Law. We are not required to check every instruction for lawfulness.

5. What we will not do

5.1 We will not:

(a) sell Studio Personal Data, or share it for cross-context behavioral advertising;

(b) use it to train AI models, or allow our AI subprocessor to do so;

(c) use it for our own marketing, or combine it with personal data from other sources for any purpose other than providing the service to you; or

(d) process it for any purpose other than providing, securing and supporting the service for you, and complying with the law.

5.2 We may compile counts and statistics about how the service is used (for example, how many lessons are scheduled across MyVocalStudio) that do not identify any person or studio, to run and improve the service.

6. Our people

6.1 Only people who need access to Studio Personal Data to provide, secure or support the service have it. Everyone with that access is required to keep it confidential.

7. Security

7.1 We maintain the technical and organizational measures described in Annex II, which are designed to give a level of security appropriate to the risk, as Article 32 GDPR requires. We may change them, but not so that they protect Studio Personal Data less.

7.2 You are responsible for the security of your own devices and sign-in methods, for giving each person you invite only the access they need, and for removing access when someone leaves (section 4 of the Terms).

8. Subprocessors

8.1 Authorization. You give us general written authorization to engage Subprocessors. The current list is on our subprocessors page and in Annex III.

8.2 Notice of changes. We will email the account owner at least 14 days before we add or replace a Subprocessor, and update the list at the same time. If we must replace a Subprocessor urgently to keep the service running or secure, we will tell you as soon as we reasonably can and explain why.

8.3 Objecting. You may object to a new Subprocessor on reasonable data-protection grounds by contacting us within 14 days of our notice. We will discuss the objection with you in good faith. If we cannot resolve it, you may stop using the service and close your account, and we will not charge you for any period after the closure takes effect.

8.4 Our duties. We engage each Subprocessor under a written contract that imposes data-protection obligations as Article 28(4) GDPR requires. We remain responsible to you for each Subprocessor’s performance of those obligations.

9. Transfers to other countries

9.1 We process Studio Personal Data in the United States, and our Subprocessors process it in the places shown in Annex III.

9.2 EU. Where you transfer Studio Personal Data to us that the EU GDPR protects, and the transfer is not otherwise covered by an adequacy decision, the SCCs apply and are incorporated by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. Annex IV sets out the choices made in the SCCs, and Annexes I to III of this DPA are the Annexes to the SCCs. Accepting the Terms has the same effect as signing the SCCs.

9.3 UK. For Studio Personal Data protected by the UK GDPR, the SCCs apply as amended by the UK Addendum, completed as set out in Annex IV.

9.4 Switzerland. For Studio Personal Data protected by the FADP, the SCCs apply with the adjustments in Annex IV.

9.5 Onward transfers. We transfer Studio Personal Data to a Subprocessor outside the country you are in only where the transfer is covered by a safeguard Data Protection Law recognizes, such as the Subprocessor’s certification under the EU-U.S. Data Privacy Framework (and its UK Extension and Swiss-U.S. counterpart) or Standard Contractual Clauses in its data processing terms.

9.6 If a mechanism stops working. If a transfer mechanism we rely on is invalidated or no longer applies, we will tell you and work with you to put another lawful mechanism in place.

10. Requests from authorities

10.1 If a government authority asks us for Studio Personal Data, we will tell you promptly, unless the law forbids it. We will review whether the request is lawful, challenge it where, after careful assessment, we conclude there are reasonable grounds to do so, and give no more data than the request legally requires. This section applies alongside Clause 15 of the SCCs where they apply.

11. Helping you with people’s requests

11.1 MyVocalStudio lets you see, correct, export, archive and delete Studio Personal Data yourself, which is how most requests from students, families and staff can be answered.

11.2 If we receive a request from a person about Studio Personal Data, we will pass it to you without undue delay, and we will not answer it ourselves except as you have instructed (section 4.2(e)) or as the law requires.

11.3 Where you cannot answer a request using the service, we will give you reasonable help, taking into account the nature of the processing and the information available to us. Contact us from Support in the app.

12. Security Incidents

12.1 We will notify you of a Security Incident without undue delay after we become aware of it and, where feasible, within 72 hours. We will send the notice to the account owner’s email address.

12.2 The notice will describe, as far as we know at the time, what happened, the kinds and approximate number of people and records concerned, the likely consequences, what we have done or plan to do about it, and a contact for more information. Where we cannot give everything at once, we will give it in stages without further undue delay.

12.3 We will take reasonable steps to contain and investigate the incident and reduce its effects, and help you meet any duty you have to tell a supervisory authority or the people affected.

12.4 Telling you about a Security Incident is not an admission of fault or liability.

13. Helping with assessments and regulators

13.1 Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Articles 32 to 36 GDPR: security, notifying breaches, data protection impact assessments, and prior consultation with a supervisory authority. We will usually do this by giving you this DPA, Annex II, the subprocessors list, and answers to reasonable questions about the service.

14. Return and deletion at the end

14.1 Export. You can export your records from Settings at any time, including before you close your account. If you need a copy of something the export does not include, ask us from Support in the app and we will provide it in a common format.

14.2 Closing. When you ask us to close a studio that has students or lessons in it, or your whole account, we schedule the deletion and email you. Nothing is deleted for 30 days, and you can undo the closure during that time. After 30 days we delete the studio and its Studio Personal Data. A studio with no students and no lessons is deleted straight away. Section 18 of the Terms describes this, and also how a studio that has gone unused for a long time may be deleted after warnings.

14.3 Backups. Deleted data can remain in our database provider’s rolling backups for up to 7 days, after which it is overwritten.

14.4 What survives. These items are not deleted with the studio:

(a) support requests and feedback are emptied rather than deleted: we erase the name, email address, subject and message, and keep the date, status and kind of request. Later replies in a support conversation, and the copy of a request our support team received in Slack, are not erased this way;

(b) a log of each text message sent (kind, cost and date, with no phone number or words), counts of AI use (feature, model, amount, device type, no content) and where the studio first came from (with email domain and ad click identifiers removed). These hold nothing that names a person;

(d) copies of emails and texts held by our email and text Subprocessors are kept under their own policies.

The record that the account holder accepted the Terms, and the closure record about the account holder, are our own records, not Studio Personal Data; our Privacy Policy covers them.

14.5 Where the law requires us to keep any Studio Personal Data, we will keep it only for as long, and use it only as, that law requires, and continue to protect it under this DPA.

15. Information and audits

15.1 We will make available to you the information reasonably needed to show that we meet Article 28 GDPR and this DPA. We will start with documents: this DPA and its Annexes, the subprocessors list, and summaries of our Subprocessors’ security certifications or reports where they allow us to share them. Once in any 12 months, we will answer a reasonable written security and privacy questionnaire.

15.2 If those documents do not reasonably answer your question, or a supervisory authority requires it, or after a Security Incident affecting your data, you may audit our compliance with this DPA, either yourself or through an independent auditor bound by confidentiality, on these conditions: at least 30 days’ written notice; an agreed scope, date and length; during normal business hours; without access to other customers’ data or to our Subprocessors’ systems; and at your cost. We will tell you promptly if we believe an audit request would breach Data Protection Law.

15.3 Where the SCCs apply, nothing in this section limits your rights under Clause 8.9 of the SCCs; this section describes how we will meet them.

16. Liability

16.1 Each party’s liability under this DPA is subject to the limits in section 16 of the Terms, to the extent Data Protection Law and the SCCs allow.

17. Changes, term and law

17.1 We may update this DPA. We will email you at least 14 days before a material change takes effect, as section 20 of the Terms provides. We will not change it to reduce the protection it gives Studio Personal Data unless the law requires the change. A change required by law or by a supervisory authority, such as new versions of the SCCs, may take effect sooner if the law requires.

17.2 This DPA lasts for as long as we process Studio Personal Data for you, including during the closure period and until deletion is complete.

17.3 This DPA is governed by the law that governs the Terms (section 19 of the Terms), except that the SCCs, the UK Addendum and the Swiss adjustments are governed by the laws named in Annex IV.

Annex I — Description of the processing

A. Parties

Data exporter: the studio that accepted the Terms, using the name, address and contact email shown in its MyVocalStudio account. Role: controller (Module Two) or processor (Module Three). Activities relevant to the transfer: using MyVocalStudio to run a music or voice teaching studio. Signature and date: given by accepting the Terms.

Data importer: Ayuda Ventures Inc., a Delaware corporation, operating MyVocalStudio. Address: Portland, Oregon, USA; full postal address on request. Contact: support@myvocalstudio.com. Role: processor (Module Two) or subprocessor (Module Three). Activities relevant to the transfer: providing studio-management software as described in the Terms. Signature and date: given by the studio’s acceptance of the Terms, which we accept by providing the service.

B. Description of the transfer

Categories of data subjects

Students, including children under 18.
Parents, guardians, family members and other people who pay for lessons.
Emergency contacts.
The studio’s teachers, administrators and other staff.
Prospective students, enquirers and other contacts the studio records.
People who book through the studio’s booking page, buy event tickets or gift certificates, or attend events.
Anyone else the studio emails, texts, or records in MyVocalStudio.

Categories of personal data (what the studio chooses to record; not every studio uses every field)

Identity and contact: name and preferred name, email addresses, phone numbers, postal address, birthday or age, photo, school, instruments, skill level, languages.
Relationships: guardian and family links, who pays, emergency contacts.
Scheduling: lessons, classes and events, bookings, attendance, cancellations, availability, teaching locations, video-meeting links.
Teaching records: lesson notes, teachers’ private notes, practice assignments and logs, progress entries, repertoire, documents and files uploaded.
Money: prices and rates, packages, invoices, payments, refunds, credits, balances, autopay consent, payment-processor customer references. Not full card numbers, which go only to Stripe.
Messages: emails, texts, app notifications and in-app messages sent through the service, with their content, delivery status, replies, and, for studio emails, whether they were opened or a link was clicked.
Consent and signatures: waivers and policy acceptances, photo consent, signer name, IP address, browser details and time of signing, opt-ins and opt-outs for email and texts.
Staff administration: permissions, pay type and rates, payroll periods, mileage logs, how teachers are paid.
Prospects: lead stage, source, follow-ups, notes.
App and calendar: push notification tokens, notification preferences, calendar feed and invitation settings.
Custom fields the studio defines.
AI features: what users type or upload to the assistant and other AI features, and the answers.

Sensitive data. MyVocalStudio does not ask for special categories of data. A studio may nonetheless record them in free-text notes, custom fields or uploaded files, for example a student’s health (such as vocal health). The studio is responsible for having a lawful basis for doing so. Children’s data is a large part of many studios’ records. Safeguards: the measures in Annex II apply to all Studio Personal Data, including role-based restriction of teachers’ private notes.

Frequency of the transfer: continuous, for as long as the studio uses MyVocalStudio.

Nature of the processing: hosting and storage; organizing, displaying, searching and reporting; sending emails, texts and app notifications; AI-assisted interpretation, drafting and extraction; import and export; backup; deletion.

Purpose of the processing: to provide MyVocalStudio to the studio under the Terms, keep it secure, support it, and comply with the law.

Retention: for as long as the studio’s account is open, then deletion as described in section 14 (30-day closure window; backups overwritten within 7 days after deletion).

Transfers to Subprocessors: as listed in Annex III, for the purposes and durations shown there.

C. Competent supervisory authority

As set out in Clause 13 of the SCCs:

where the studio is established in an EU Member State, the supervisory authority of that Member State;
where the studio is not established in the EU but is subject to the GDPR under its Article 3(2) and has appointed a representative, the supervisory authority of the Member State where the representative is established;
otherwise, the supervisory authority of the Member State where the data subjects whose data is transferred are located.

For UK transfers, the Information Commissioner. For Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex II — Technical and organizational security measures

These are the measures we use. Each is either something MyVocalStudio itself does, or a measure a Subprocessor publishes for its own service, and is labelled as such.

1. Encryption

All traffic to the MyVocalStudio website, app and API uses TLS.
The database and file storage are encrypted at rest with AES-256 and in transit with TLS (published by Supabase, our database provider).
Access tokens for connected services (Google Calendar, Zoom) are additionally encrypted by MyVocalStudio with AES-256-GCM before they are stored.

2. Signing in

MyVocalStudio has no passwords. People sign in with a one-time code sent to their email or phone, with Google or Apple, or with a passkey.
A child under 13 cannot be given a login.

3. Access control inside the service

Database row-level security policies restrict each signed-in person to the studios and records their role allows.
Role-based permissions within a studio: owners and administrators set what each teacher may see and do; students and families see only their own records, or their child’s.
Private files (for example student documents and imported files) are kept in private storage and served only through short-lived signed links after a permission check.
Server credentials that bypass row-level security are held only on the server, never in a browser or the phone app.

4. Protection against abuse

Limits on repeated requests to public and sensitive endpoints.
Bot checks (Cloudflare Turnstile) on sign-up, sign-in and public forms.
Signature checks on incoming webhooks from our email and text providers and from Slack; anti-forgery checks on connections to Google and Zoom.

5. Keeping monitoring data to a minimum

Error monitoring (Sentry) is set not to collect user details, cookies, request contents, database query data, local variables or AI inputs and outputs. Screen recording (“session replay”) is not used. The phone app reports only a login id, never an email address.

6. Messaging safeguards

A text is sent only to a number with a recorded opt-in by that person, and a STOP reply stops texts from every studio to that number.
Studio emails carry unsubscribe handling, and repeated bounces or spam complaints pause sending.

7. AI features

The assistant can do only what the person using it is allowed to do. Changes that reach more than one person, or cannot be undone, wait for confirmation. It cannot charge cards or issue refunds.
Our AI provider may not train on Studio Personal Data and deletes it within 30 days, except content flagged for misuse (up to 2 years) or where the law requires longer (Anthropic’s published terms).

8. Availability and recovery

Daily database backups, kept for 7 days (Supabase, Pro plan).
Errors are reported to error monitoring and alerted to us.

9. Deletion

An automated deletion job removes closed studios and accounts after the 30-day closure window, and an erase routine empties support requests and feedback as described in section 14.

10. Changes to the software

Automated checks run on proposed code changes before they are merged.

11. People and accounts

Access to production systems is limited to the people who operate MyVocalStudio and the development tools they supervise, and is reviewed when someone’s role changes.

12. Subprocessors

Each Subprocessor is bound by data processing terms (Annex III). Certifications published by our Subprocessors include, for example, SOC 2 Type 2 (Supabase) and ISO/IEC 27001:2022 and SOC 2 Type II (Anthropic). These are the Subprocessors’ certifications, not MyVocalStudio’s. MyVocalStudio holds no security certification of its own.

Annex III — Subprocessors

The current list, with what each Subprocessor does, the data it receives, where it processes data and the transfer safeguard, is published at /subprocessors and is incorporated here as of its date. At the date of this draft it lists: Supabase, Inc.; Vercel Inc.; Anthropic, PBC; Resend; Telnyx LLC; 650 Industries, Inc. (Expo), with Apple and Google push services; Functional Software, Inc. (Sentry); Slack Technologies, LLC; and Cloudflare, Inc. (Turnstile).

Not Subprocessors: Google Maps Platform (an independent controller, section 4.2(c)); services you connect (section 4.2(d)); and providers we use only for our own account, billing and marketing, which do not receive Studio Personal Data.

Annex IV — Transfer elections

EU Standard Contractual Clauses (Decision (EU) 2021/914)

Modules: Module Two (studio as controller, MyVocalStudio as processor); Module Three (studio as processor, MyVocalStudio as subprocessor).
Clause 7 (docking clause): applies.
Clause 9(a) (subprocessors): Option 2, general written authorization; the time period for notice of changes is 14 days (section 8 of this DPA).
Clause 11(a) (redress): the optional independent dispute-resolution language does not apply.
Clause 13 (supervision): as in Annex I.C.
Clause 17 (governing law): Option 1; the law of Ireland.
Clause 18(b) (forum): the courts of Ireland.
Annexes I, II and III: Annexes I, II and III of this DPA.

UK Addendum (ICO, version B1.0)

Table 1 (parties): as in Annex I.A. Start date: the date the studio accepts the Terms.
Table 2 (selected SCCs): the Approved EU SCCs, including the Appendix Information, with the modules and clauses selected above.
Table 3 (Appendix Information): Annex I.A (list of parties), Annex I.B (description of transfer), Annex II (technical and organizational measures) and Annex III (list of subprocessors) of this DPA.
Table 4 (ending the Addendum when the Approved Addendum changes): the Importer may end it.
Governing law and forum for the UK Addendum: England and Wales.

Switzerland (FADP)

For transfers governed by the FADP, the SCCs apply with these adjustments: references to the GDPR are read as references to the FADP where the transfer is governed by it; the Federal Data Protection and Information Commissioner is the competent supervisory authority; the term “Member State” in Clause 18(c) does not prevent data subjects in Switzerland from bringing claims in Switzerland, where they habitually reside; and references to personal data cover the data the FADP protects.

Other countries

Where another country’s law requires a contract or safeguard for a transfer of Studio Personal Data to us, this DPA is that contract, to the extent that law allows.