Get started

Data processing agreement

Draft: details marked in yellow are still missing, and this text has not yet been reviewed by a lawyer. Not legal advice.

This agreement under Art. 28 GDPR applies between you as our customer (the controller) and us (the processor). It is part of our terms and applies as soon as you activate a plan.

Processor:

[Your full name, or company name with legal form]
[Street and house number]
[Postcode and city]
Austria
Email: [Contact email]

1. Subject, duration and purpose

We process personal data of your students only to provide the Followthru course companion for your course: signing students in, answering their questions, passing questions on to you, reminding inactive students and showing you their progress. The agreement lasts as long as you use Followthru.

2. Data and data subjects

Data subjects: the students of your courses. Data: first name, email address, chat messages, the goal they share, lesson progress, activity times and questions passed on to you. Students may mention health-related information in their messages; the companion does not answer such questions itself but passes them on to you.

3. Your instructions

We process the data only on your documented instructions – these terms, your settings in Followthru and your messages to us – unless the law requires otherwise. If we think an instruction breaks data protection law, we will tell you.

4. Our obligations

  • Everyone who works with the data is bound to confidentiality.
  • We take appropriate technical and organisational measures (section 7).
  • We help you answer requests from students exercising their rights and with your duties under Art. 32–36 GDPR.
  • We tell you without undue delay if we become aware of a personal data breach.
  • We give you the information you need to show compliance and allow reasonable audits, after notice.

5. Sub-processors

You agree that we use the following sub-processors:

  • Vercel Inc. (USA) – Hosting of website and app
  • Neon, Inc. (USA – data stored in the EU (Frankfurt, Germany)) – Database
  • Anthropic PBC (USA) – Generating AI answers
  • Resend, Inc. (USA – EU sending region (Ireland)) – Sending emails (sign-in codes, reminders)

We bind them to equivalent data protection obligations. We will tell you before adding or replacing a sub-processor; you may object for good reason and, if we can't find a solution, cancel. Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.

6. End of processing

When your contract ends, or if you ask us earlier, we delete your students' data within 30 days, unless the law requires us to keep it. You can ask us for an export before that.

7. Technical and organisational measures

  • All connections are encrypted (HTTPS/TLS); data is stored encrypted by our hosting and database providers.
  • Data is stored in the EU where our providers offer it (database: Frankfurt; email: Ireland).
  • Students and coaches sign in with one-time codes, which are stored only as hashes and expire after a short time.
  • Sign-in cookies are random, HTTP-only and secure; admin access is password-protected.
  • Each coach can only see the data of their own courses.
  • Rate limits protect against misuse; we collect only the data the companion needs and don't use tracking.
  • Course data and chats are not used to train AI models.

Last updated: [date]