Skip to main content

Data Processing Agreement

Last updated: February 2026 - DRAFT: Flagged for attorney review before launch

For District Procurement: This DPA template is available for download and execution as part of the TXPD district licensing process. To receive a signed copy or to discuss custom terms, contact sales@aimeducate.com.

1. Parties

This Data Processing Agreement ("DPA") is entered into between AIM Educational Services, LLC ("Processor" or "TXPD") and the school district identified in the associated District License Agreement ("Controller" or "District").

2. Scope of Processing

TXPD processes the following categories of personal data on behalf of the District:

  • Practitioner names, email addresses, and professional role information
  • Course enrollment, progress tracking, and completion records
  • Quiz attempt data and assessment scores
  • CEU certificate records and verification data
  • AI tutor conversation logs (anonymized after 1 year)
  • Discussion forum contributions

3. FERPA Compliance

TXPD acknowledges that it may be designated as a "school official" under FERPA and agrees to:

  • Use personally identifiable information only for the purposes specified in the District License Agreement
  • Not disclose or re-disclose education records without consent
  • Maintain reasonable security measures to protect education records
  • Return or destroy data upon termination of the agreement
  • Not collect, store, or process student PII. TXPD serves practitioners only.

4. Security Measures

  • AES-256 encryption at rest for all stored data
  • TLS 1.2+ encryption for all data in transit
  • Row Level Security (RLS) on all database tables ensuring data isolation between districts
  • Microsoft Azure hosting with SOC 2 Type II and ISO 27001 certifications
  • Multi-factor authentication available for all administrator accounts
  • Regular security audits and penetration testing
  • Supabase PostgreSQL with automated daily backups and point-in-time recovery

5. Data Retention

  • AI tutor conversations: 1 year, then auto-purged
  • Quiz attempts: retained indefinitely (required for certificate verification)
  • Discussion responses: 2 years
  • Audit logs: 3 years minimum
  • Account data: retained until district requests deletion or agreement terminates
  • Upon termination, all district data exported and deleted within 30 days

6. Sub-Processors

TXPD uses the following sub-processors:

  • Supabase, Inc. - Database and authentication
  • Microsoft Azure - Cloud hosting and storage
  • Stripe, Inc. - Payment processing
  • Anthropic, PBC - AI content generation (no PII shared)
  • ElevenLabs - Audio narration generation (no PII shared)
  • Resend - Transactional email delivery

7. Breach Notification

In the event of a confirmed data breach affecting District data, TXPD will notify the District within 72 hours of discovery. TXPD will comply with all applicable state breach notification laws, including the Texas Data Privacy and Security Act (TDPSA) requirement of notification within 60 days.

8. Data Portability

Upon request, TXPD will provide the District with an export of all district-related data in standard formats (CSV for records, PDF batch for certificates). SCORM-compatible course content exports are available for LMS integration.

9. Contact

For DPA inquiries, data requests, or to execute this agreement:

Email: privacy@aimeducational.com

District Sales: sales@aimeducate.com