Data Processing Agreements

These Data Processing Agreements outline how TechnologiesRehman (operating My NPPE Academia, https://mynppeacademia.ca) and our service providers handle your personal data in compliance with PIPEDA.

Overview

As a Canadian company collecting personal data from users of My NPPE Academia, TechnologiesRehman is committed to PIPEDA compliance. We have established Data Processing Agreements (DPAs) with all third-party service providers to ensure your data is protected.

Key Principle: All service providers are contractually required to process your data only on our instructions and with equivalent security measures to those we use.

Service Provider Agreements

1. Supabase (Database & Authentication)

Purpose: User account storage, quiz data, progress tracking, authentication

Data Types: Email, hashed passwords, quiz results, domain performance

Location: Canada (Toronto region available)

Status: ✓ PIPEDA-Compliant (Supabase offers Canadian data residency options)

View Data Processing Terms

Authorized Uses:

User authentication and session management
Storing quiz results and user progress
Database backups and disaster recovery
Security monitoring and fraud prevention

Prohibited Uses:

No marketing or profiling without explicit consent
No data sharing with third parties without approval
No use of data for AI model training

2. Stripe (Payment Processing)

Purpose: Payment processing, subscription management, invoice generation

Data Types: Billing name, email, payment intent IDs (NOT credit card numbers)

Location: United States / Canada

Status: ✓ PCI-DSS Level 1 Certified (highest payment security standard)

View Data Processing Terms

Data Security Measures:

PCI DSS Level 1 compliance (highest standard)
End-to-end encryption for all transactions
Tokenization (credit card data never visible to us)
Regular security audits and penetration testing

Important Note: TechnologiesRehman never stores, processes, or sees your credit card information. Stripe handles all payment data.

3. Anthropic (AI Tutor)

Purpose: Processing tutor questions, generating AI responses

Data Types: Tutor question text, page context (NOT user identity)

Location: United States

Status: ✓ No conversation history stored

View Data Processing Terms

Data Handling:

Your tutor question is sent to Anthropic's API
Response is generated by Claude AI
Response is returned to your browser
No conversation history is stored by TechnologiesRehman or Anthropic

Privacy Protection: We do NOT send your user ID or email to Anthropic. Only your question and page context are shared.

4. Vercel (Hosting & Infrastructure)

Purpose: Hosting, CDN, security, performance monitoring

Data Types: Access logs, IP addresses, page visit data

Location: Multiple regions (United States/Canada)

Status: ✓ SOC 2 Type II Certified

View Data Processing Terms

Authorized Uses:

Infrastructure management and reliability
DDoS protection and security
Performance monitoring and optimization
Access logs retention (30 days)

Standard Contractual Clauses

All service provider agreements include Standard Contractual Clauses (SCCs) to ensure PIPEDA compliance, including:

Limited processing instructions (data used only as instructed)
Adequate security safeguards
Sub-processor notification requirements
Data deletion/return upon contract termination
Audit rights and compliance verification
Incident notification and breach reporting

Your Rights

You have the right to:

Know what data is being processed and why
Request access to all your data (see Settings → Download My Data)
Request correction of inaccurate data
Request deletion of your data (see Settings → Delete Account)
Withdraw consent at any time
Lodge a complaint with the Privacy Commissioner of Canada

Questions About Data Processing?

If you have questions about how your data is processed or our agreements with service providers, contact:

technologiesrehman@gmail.com

We respond to all privacy inquiries within 30 days as required by PIPEDA.

Last updated: July 11, 2026 | These DPAs are reviewed annually