Effective Date: August 2026
This Data Processing Agreement ("DPA") supplements the Terms of Service and Privacy Policy between you ("Customer") and Solo AI Coach ("we," "us," "Processor") whenever Customer processes personal data of a third party (e.g. an employee, contractor, or client of Customer's organization) using the Service. It is intended for organizational customers; individual coaches processing their own clients' data under an individual account are covered by the Terms of Service and Privacy Policy directly.
This document is a template draft. It has not been reviewed by legal counsel and should not be relied on as a signed, binding agreement until reviewed and countersigned by both parties.
1. Roles
- Data Controller: Customer, with respect to personal data about Customer's own clients contained in coaching session content Customer uploads to the Service. Customer determines the purposes and means of collecting that data (e.g. obtaining client consent, deciding what to upload).
- Data Processor: Solo AI Coach, with respect to that same data — we process it only on Customer's instructions, as described in this DPA and the Privacy Policy.
- Sub-processors: Third parties Solo AI Coach engages to process personal data on its behalf, listed in Section 5.
2. Subject Matter and Duration
- Subject matter: Processing of coaching session content (transcripts, audio for transcription, session notes) and related metadata, for the purpose of AI-powered analysis and reporting to Customer.
- Duration: For as long as Customer maintains an active account, plus any post-termination retention period described in the Terms of Service (Section 13) and Privacy Policy (Section 5).
3. Nature and Purpose of Processing
- Nature: Automated analysis of text (and, where applicable, transcribed audio) using natural-language-processing techniques (NLP meta-model detection) to identify communication patterns, beliefs, and emotional signals, and to generate coaching-relevant suggestions.
- Purpose: To provide the Service Customer has subscribed to — generating analysis findings for Customer's own coaching use.
- Categories of data subjects: Customer's coaching clients (the individuals whose conversations are analyzed), and Customer's own personnel who use the Service.
- Categories of personal data: Conversation content (which may include special-category data under GDPR Article 9 — see Section 4), account and billing information, and usage metadata. See the Privacy Policy, Section 2, for the full list.
4. Special-Category Data
Coaching conversations may reveal special-category personal data about Customer's clients (e.g. mental health, medical conditions). Processor does not independently seek to collect or infer this data — it processes whatever content Customer chooses to upload. Customer represents that it has obtained the necessary consent from each data subject (or another valid Article 9(2) basis) before uploading a session, as required by the mandatory consent confirmation shown in-app before every upload.
5. Sub-processors
Solo AI Coach uses the following sub-processors, each processing a limited category of data as described:
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Supabase (hosted on AWS, US) | Database hosting, authentication | All account and session data |
| Anthropic | AI analysis (Claude API) | Session transcript content, at time of analysis only |
| Deepgram | Audio transcription | Uploaded audio files, at time of transcription only (not retained by Deepgram after processing) |
| Stripe | Payment processing | Billing and payment information |
Customer authorizes the use of these sub-processors. We will provide notice of any change in sub-processors by updating this document and its "Last Updated" date; material changes will also be communicated via email to organizational customers.
6. Security Measures
- Encryption in transit (HTTPS/TLS) and at rest (AES-256 for transcript content while it exists)
- Row-level security enforced at the database layer, scoping every coach's data to their own account
- Multi-factor authentication available for account access
- Role-based access control for Solo AI Coach personnel — only authorized personnel can access raw session content
- See Privacy Policy, Section 7, for full detail
7. International Transfers
Solo AI Coach's infrastructure is hosted in the United States (via Supabase/AWS). For Customers located in the EU/EEA or UK, transfers of personal data to the US are made under Standard Contractual Clauses (SCCs) or another valid transfer mechanism. Details are available on request.
8. Data Subject Rights Assistance
Where Processor receives a request from a data subject relating to Customer's data (access, correction, deletion, portability, objection), Processor will forward the request to Customer without undue delay and reasonably assist Customer in responding to it, consistent with GDPR Article 28(3)(e).
9. Deletion / Return of Data
On termination of Customer's account, Processor will delete Customer's data in accordance with the retention schedule described in the Terms of Service (Section 13) and Privacy Policy (Section 5), except for data Processor is required to retain by law or for legitimate tax/audit purposes (see the audit-log retention described in the Privacy Policy).
10. Breach Notification
Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, consistent with the breach-notification commitment in the Privacy Policy (Section 7).
11. Audit Rights
Processor will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits (including inspections) conducted by Customer or an auditor mandated by Customer, subject to reasonable notice and confidentiality terms to be agreed by both parties.
12. Contact
Questions about this DPA, or to request a signed copy:
Email: privacy@soloaicoach.com
Version: 1.0 Last Updated: August 14, 2026