Version 2 · effective October 20, 2026 · Español

Data Processing Terms

Effective date: October 20, 2026

These Data Processing Terms ("DPA") are part of the Terms of Service between ACED | Advanced Concepts in Educational Design LLC ("ACED") and the Customer. They apply to personal information in Customer Data that ACED processes on the Customer's behalf ("Customer Personal Data").

1. Roles

The Customer decides why and how Customer Personal Data is processed. ACED processes it only as a service provider (processor) on the Customer's behalf.

2. Instructions

ACED processes Customer Personal Data only to provide, secure and support the Service, according to the Terms, this DPA, the Customer's use and settings in the Service, and other documented instructions, unless the law requires otherwise. ACED will not sell or share Customer Personal Data, use it for advertising, or combine it with other data except as allowed for a service provider.

3. Confidentiality

ACED limits access to people who need it to provide the Service and who are bound by confidentiality.

4. Security

ACED keeps reasonable administrative, technical and physical safeguards designed to protect Customer Personal Data, including: encryption in transit; encryption at rest of sensitive fields; deletion of audio right after transcription; retention limits; role-based access; single-use, time-limited sign-in links; logging of administrative access; and backups.

5. Subprocessors

The Customer authorizes ACED to use the subprocessors listed at Subprocessors. ACED requires each to protect data at least as well as this DPA requires, and remains responsible for their work. ACED will update that page at least 30 days before adding or replacing a subprocessor (except in an emergency). The Customer may object on reasonable data protection grounds by writing to privacy@incident-ally.com; if we cannot resolve the objection, the Customer may cancel the affected Service.

6. Requests from individuals and authorities

If ACED receives a request from a person about Customer Personal Data, it will refer the person to the Customer and help the Customer respond, as reasonably needed. If ACED receives a legal demand for Customer Personal Data, it will notify the Customer before responding where the law allows, and disclose only what is legally required.

7. Security incidents

ACED will notify the Customer without unreasonable delay after confirming a breach of security that leads to unauthorized access to or acquisition of Customer Personal Data, give the information reasonably available to help the Customer meet its obligations, and take reasonable steps to contain it.

8. Retention, return and deletion

Customer Personal Data is kept and deleted as described in the Privacy Policy and the Customer's retention settings. After the account ends, the Customer may request an export within 30 days; ACED then deletes Customer Personal Data within 90 days, except as required by law or held in backups deleted on their normal schedule.

9. Information and audits

On reasonable written request, no more than once a year, ACED will answer a written security questionnaire and provide information reasonably needed to show compliance with this DPA.

10. Order of precedence

If this DPA conflicts with the Terms about personal data, this DPA controls.