Data Processing Addendum

1. Roles and instructions

The participating school determines the educational purpose and who may use the service. The Alchemy Lab processes school-authorized data only to provide, secure, support, and improve the contracted pilot services, and otherwise as required by law.

2. People and data covered

The data subjects are adult learners, teachers, administrators, and invited adult participants.

Covered data may include:

• Names, email addresses, school affiliations, account and activity identifiers.
• Audio recordings when teacher review requires them, written or dictated responses, activity materials, scores, and feedback.
• Pronunciation analysis results. The pronunciation tool does not retain a transcript of the spoken response.
• Attempt history, timestamps, AI usage records, and security or diagnostic information.

3. Processing purpose and duration

Processing supports language activities, transcription, AI-assisted analysis and feedback, teacher review, access control, support, and platform security. Processing continues for the pilot and as reasonably needed to return or delete covered data, maintain backups, resolve security issues, and meet legal obligations.

Raw pronunciation audio from guest and immediate-feedback activities is not stored by The Alchemy Lab. Pronunciation audio held for teacher review is deleted when feedback is released or after 14 days, whichever occurs first.

4. The Alchemy Lab commitments

• Limit access to people and providers who need it to deliver or support the service.
• Use reasonable technical and organizational safeguards appropriate to the pilot.
• Not sell covered data or use it for targeted advertising.
• Not use covered data for an unrelated commercial purpose.
• Assist the school with reasonable, verified access, correction, and deletion requests.
• Notify the school without unreasonable delay after confirming a security incident affecting its data.
• Return or delete covered data on verified request, subject to backup, security, and legal constraints.

5. Service providers

The Alchemy Lab currently relies on:

• Google Gemini API for transcription, analysis, and AI-generated feedback.
• Supabase for authentication, databases, and file storage.
• Vercel for application hosting and related infrastructure.

The Alchemy Lab remains responsible for selecting providers appropriate to the service and will update this list when a material provider changes.

6. School responsibilities

The school will:

• Provide required notices and have authority to direct the processing.
• Limit the current pilot to adults age 18 and older.
• Give access only to authorized staff and participants.
• Avoid submitting unnecessary sensitive or regulated information.
• Promptly report suspected unauthorized access or misuse.

7. Education records

Where FERPA applies and the parties rely on the school-official exception, The Alchemy Lab will use education records only for the school-authorized service, remain under the school's direct control regarding that use, and not redisclose records except as authorized by the school or law. This provision does not replace the school's responsibility to determine whether its use satisfies applicable law and policy.

8. Requests and conflicts

The parties will work in good faith on reasonable security, deletion, or audit questions. If a signed pilot agreement conflicts with this addendum, the signed agreement controls for that school.