Lingomir for Teachers — Data Processing Agreement

Lingomir for Teachers — operated by HomeDea LLC

Version 2.1 · Last updated: October 23, 2026

This Data Processing Agreement ("DPA") forms part of the Lingomir for Teachers Terms of Service (the "Agreement") between the Customer and HomeDea LLC ("the Operator", "we"). It sets out how we process personal data on the Customer's behalf, as required by Article 28 of the EU General Data Protection Regulation ("GDPR") and equivalent laws. Terms such as controller, processor, personal data, processing and data subject have the meanings given in the GDPR.

1. Roles

1.1 Class Data: the Customer is the controller

For the personal data of its organisation on the Platform — "Class Data", listed in Annex 1 — the Customer is the controller and we are its processor.

1.2 What we control ourselves

We are an independent controller for:

• each person's Lingomir account (sign-in, profile, settings) and their use of Lingomir outside the Customer's classes, under our Privacy Policy;
• a student's own learning: the words a published review adds to the student's «My words» and the mistakes it adds to the journal of Lingomir's AI teacher, and the student's continued access to the reviews published for them (Section 6 of the Agreement);
• billing data about the Customer's subscription, the record of our commissions on online payments, and the security and technical logs of the Platform.

For online payment by students, Stripe processes card and identity data as an independent controller under its own terms with the Customer and the student (Online Payments Addendum Section 10); the record of each payment the Platform keeps for the Customer is Class Data.

2. Instructions

We process Class Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's choices in the cabinet (roles, classes, switches such as transcription, invitations, publishing) are those instructions. We will tell the Customer if we believe an instruction breaks data-protection law, and may suspend that processing until it is confirmed or changed. We process Class Data otherwise only where the law that applies to us requires it, and then tell the Customer first unless that law forbids it.

3. The Customer's responsibilities

The Customer:

• has a lawful basis for the Class Data it brings to the Platform and for inviting each person;
• tells its students and staff, in its own privacy notice, that it uses the Platform and how;
• relies, for transcription of lessons, on the consent each participant gives in the Platform (Lesson recording and transcription) and does not override, pressure or circumvent it;
• gives roles that see sensitive data (recordings and transcripts — teacher and assistant of a class, and roles of its own given at a class) only to people who need them;
• for a lesson held outside the Platform and recorded by the meeting bot or uploaded: informs every participant, including people who are not on the Platform, and obtains their consent where the law requires it; names speakers truthfully;
• where it signs its team in through its company's identity provider, is responsible for that provider and its accounts;
• is the controller of what it takes out of the Platform through the API or receives by webhook, from the moment it leaves the Platform;
• does not invite people under 16.

4. Confidentiality and our people

Only staff who need access to operate, support or secure the Platform may access Class Data, under a duty of confidentiality. Our support staff enter an organisation's data only while its owner or an administrator has granted temporary support access in the cabinet (1 to 14 days, read-only), or to investigate a security incident or where the law requires it; every entry and what was opened is written to the organisation's journal, and access to recordings and transcripts is logged.

5. Security

We maintain the technical and organisational measures in Annex 2, appropriate to the risk, and may improve them over time without lowering the overall level of protection.

6. Sub-processors

6.1 Authorisation

The Customer gives general authorisation for the sub-processors in Annex 3. We bind each by written contract to obligations no less protective than this DPA and remain responsible to the Customer for them.

6.2 Changes

We announce a new or replaced sub-processor by email to the owner at least 30 days before it starts processing Class Data. The Customer may object on reasonable data-protection grounds within that period; if we cannot reasonably accommodate the objection, the Customer may terminate the Agreement with immediate effect as its sole remedy.

7. International transfers

Class Data is stored in the European Union (Annex 3). Where a sub-processor processes it outside the EU/EEA or another adequate country, the transfer relies on the European Commission's Standard Contractual Clauses (or an adequacy decision such as the EU-U.S. Data Privacy Framework where the sub-processor is certified), with additional measures where needed. The Operator itself is established in the United States; where the Customer is established in the EU/EEA, the parties agree that the Standard Contractual Clauses (Module 2, controller to processor) apply to transfers of Class Data to the Operator and are incorporated by reference, with the governing law and courts of Ireland for that purpose.

8. Helping the Customer

8.1 Data subjects' requests

The Platform lets the Customer answer most requests itself (seeing, correcting and removing class data, removing a student from a class). We pass on to the Customer any request about Class Data we receive, without answering it ourselves unless the Customer asks us to, and help with the rest within a reasonable time.

8.2 Withdrawal of consent

A participant's withdrawal of consent to transcription takes effect at once in the Platform: nothing more of their voice is captured from that moment.

8.3 Other assistance

We give the Customer reasonable help with data-protection impact assessments and consultations with supervisory authorities that concern the Platform.

9. Personal-data breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Class Data, with what we know of its nature, the data and people concerned, its likely consequences and the measures taken or proposed, and update the Customer as we learn more.

10. Retention, return and deletion

10.1 During the Agreement

• Recordings of voices — deleted 30 days after the lesson. For a lesson held elsewhere: the raw transcript (every speaker's lines, before the teacher names who spoke) and the speakers' sample lines are deleted as soon as the teacher has named the speakers, and the audio with anything left of them 7 days after the recording at the latest; the meeting bot provider's copy as soon as the transcript has reached us.
• The journal of the organisation, its online payment records, API keys (as hashes) and webhook settings (secrets sealed) — kept while the organisation exists; webhook deliveries — 30 days.
• The catalogue entry of a verified teacher — while they are verified and their page is published; it is public by the teacher's choice.
• Transcripts, reviews, marks, exercise results, chats, schedules, attendance and materials — kept while the class exists in the organisation; the Customer may delete them earlier where the Platform allows.
• Live hints shown to the teacher during a lesson — not stored.

10.2 At the end

For 30 days after the end of the Agreement the owner may export the organisation's data. We then delete the Class Data, except where the law that applies to us requires us to keep it. Copies in backups are deleted on their rolling cycle, within a further 30 days. Data we control ourselves (Section 1.2) is kept under our Privacy Policy.

11. Information and audits

We make available the information needed to show compliance with this DPA. Once a year (or after a breach), on 30 days' written notice, the Customer may audit our compliance itself or through an independent auditor bound by confidentiality, at its own cost, during business hours, in a way that does not disrupt our operations or breach others' confidentiality; we may first offer recent independent reports or certifications that answer the Customer's questions.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations of the Agreement, except where the law does not allow them. If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails; the Standard Contractual Clauses, where they apply, prevail over both.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Encryption in transit for every connection (HTTPS/TLS, and encrypted media in calls); data at rest on encrypted infrastructure of our hosting provider.
• Access by role and place: every request is checked against the person's role in the organisation, school or class; data of one organisation is never served to another; recordings and transcripts are reachable only by the teachers and assistants of the class (and the student for their own), are never inherited from higher roles, and each access is logged.
• Data minimisation: only the voices of participants who consented are captured, and only while they consent; silence is never sent for transcription; students' names are not sent to the AI provider; hints are not stored.
• Separation of recordings: lesson voices are stored apart from other files and are reachable only through the checks above, for 30 days (7 days for a lesson held elsewhere).
• Accounts: passwords stored only as bcrypt hashes; short-lived access tokens; sign-in links and invitations stored only as hashes.
• Resilience: daily backups kept on a rolling cycle of up to 30 days; monitoring and alerts; restore procedures tested.
• People: access to production limited to the staff who need it; confidentiality duties; logs of administrative access.
• Sign-in: two-factor sign-in (TOTP, secrets sealed with AES-GCM, recovery codes hashed) the Customer may require; company sign-in by OpenID Connect with PKCE, the provider's signed tokens and domains the Customer proved by DNS; a sign-in's sessions end when the second factor is turned on or the company account becomes the only way in.
• Integrations: API keys stored only as hashes, limited per key and per organisation, acting only within their maker's permissions; webhooks signed, sent only to public HTTPS addresses checked on every attempt, their secrets sealed at rest.
• Uploads: recordings processed in isolation from the network (only the file itself is read), the original deleted once its speech is extracted.
• Change and incidents: reviewed changes, automated tests of the access rules and tenant isolation (a permission matrix of a network of schools), an internal security review of every new surface and a second one, of the payment flows and tenant isolation, before online payment opens, an incident procedure with notification under Section 9.

Annex 3 — Sub-processors

Not sub-processors of Class Data, listed for transparency: Stripe (online payment — an independent controller, Section 1.2); the Customer's own Google Workspace or Microsoft tenant (company sign-in — the Customer's provider); Let's Encrypt (certificates for the Customer's own domain — it sees the domain name only). When calls move to our own media server in the EU, LiveKit, Inc. stops being a sub-processor and this table changes under Section 6.2.