Data Processing Agreement

Version dated: June 16, 2026

This Data Processing Agreement (“DPA”) is entered into between 4436725 Nova Scotia LIMITED, doing business as Fynaxis (“Fynaxis”), operator of Typing Safari (the “Provider”), and the school, district, camp, or organization that uses the Service (the “Customer”). It governs the Provider’s processing of personal information — including student and children’s data — on the Customer’s behalf, and forms part of the agreement between the parties for use of Typing Safari (the “Service”). To execute this DPA for your institution, contact privacy@typingsafari.com.

1. Roles of the parties

For personal information the Customer submits or that is generated by roster members, the Customer is the controller (and, for U.S. schools, the educational agency) and the Provider is the processor / service provider. The Provider processes such data only to provide the Service and only on the Customer’s documented instructions, which include this DPA and the Customer’s configuration of the Service.

2. Scope & nature of processing

• Subjects: the Customer’s roster members (students/children), staff (teachers/counselors), and account holders.
• Data types: a display name (we recommend a first name and last initial), an optional identifier (e.g. a student number), a login PIN, and typing activity (WPM, accuracy, lesson/game progress). No child email or contact details are required.
• Purpose: to deliver typing lessons, practice, games, progress tracking, leaderboards, and certificates for the Customer.

3. Provider obligations

• Process personal information only for the purposes above and per the Customer’s instructions; not for the Provider’s own commercial purposes.
• Never sell personal information, serve targeted advertising, build non-educational profiles, or use student/children’s data to train AI/ML models.
• Ensure personnel with access are bound by confidentiality.
• Implement reasonable administrative and technical security measures (see §6).
• Assist the Customer in responding to data-subject, parent, and regulator requests.

4. Customer obligations & authorization

The Customer represents that it is authorized to provide the personal information it submits and, where required by law, has obtained parental consent or is relying on a lawful basis (including COPPA’s school-authorization provisions) to add roster members. The Customer is responsible for the accuracy of roster data and for using first-name-plus-initial display names rather than full legal names.

5. Sub-processors

The Customer authorizes the Provider to engage the sub-processors listed in the Privacy Policy (currently: Supabase — database, backups and authentication; Vercel — application hosting; Cloudflare — DNS, network security and encrypted transport; Stripe — payments, for the Customer’s billing contact only; Resend — transactional email to adult account holders only). Student data is stored or transmitted only by Supabase, Vercel and Cloudflare. Each is bound by written data-protection terms. The Provider will notify the Customer by email before adding a sub-processor that receives student data, and the Customer may object on reasonable data-protection grounds.

6. Security

The Provider maintains safeguards including encryption in transit, row-level access controls, least-privilege administrative access, and audit logging of privileged actions. The Provider reviews these measures periodically.

7. Data-breach notification

The Provider will notify the Customer in the most expedient way possible and without unreasonable delay, and in any event no later than seven (7) calendar days after becoming aware of a personal-data breach affecting the Customer’s data, with the information reasonably available to support the Customer’s own notification obligations.

8. Data subject, parent & school rights

The Customer (and, through it, parents/guardians) may review, correct, export, or delete a roster member’s data at any time via the Service (roster management) or by contacting privacy@typingsafari.com. The Provider will assist with such requests and will not charge schools for them.

9. Retention, return & deletion

The Provider retains personal information while the Customer’s account is active. On termination, or on the Customer’s request, the Provider will export the Customer’s personal information on request and then delete it within 30 days, except where retention is required by law. Deleting a roster member immediately removes their data, including typing history, speed tests and certificates. Encrypted backups expire automatically within 7 days.

10. FERPA (U.S. schools)

Where the Customer is subject to the Family Educational Rights and Privacy Act (FERPA), the Provider acts as a “school official” with a legitimate educational interest, under the Customer’s direct control. The Provider uses education records solely to provide the Service, does not re-disclose them except as directed or required by law, and returns or deletes them on request. Student data is not used for advertising, sold, or used to train AI/ML models.

11. COPPA (U.S. children under 13)

For children under 13, the Customer provides consent on behalf of parents under COPPA’s school-authorization provisions, or confirms it has obtained verifiable parental consent. The Provider collects only the limited data described in §2, provides parents/schools the right to review and delete it, and does not condition participation on collecting more than is reasonably necessary.

12. International transfers

Personal information is hosted in the United States (Oregon / AWS US-West) and may therefore be processed in a country other than the Customer’s own. Where required, the parties will rely on an appropriate transfer mechanism (e.g. Standard Contractual Clauses).

13. Term & termination

This DPA takes effect when the parties execute it, or when it is incorporated into a signed agreement with the Customer, and remains in force while the Provider processes the Customer’s personal information. §§6–11 survive termination as to any data retained.

14. Governing law & execution

This DPA is governed by the laws of Canada, without prejudice to mandatory data-protection laws applicable to the Customer. To execute a countersigned copy for your district or institution, contact Fynaxis at privacy@typingsafari.com.

See also our Privacy Policy and Terms of Service.