DRAFT — requires review by legal counsel before launch. Bracketed items are placeholders.

Studio Data Processing Addendum

Effective date: [EFFECTIVE DATE]

This Addendum ("DPA") is part of the Terms of Service between [COMPANY LEGAL NAME] ("RythmoLabs", "we") and the studio that subscribes to RythmoLabs ("Studio", "you"). The studio owner accepts it at signup on the studio's behalf. It covers personal information that RythmoLabs processes for the Studio through the service ("Studio Data").

1. Roles

• The Studio decides which personal information about its families, students, leads and staff to collect and why. It is the "business" (or "controller") for Studio Data.
• RythmoLabs processes Studio Data only to provide the service to the Studio. It is the Studio's "service provider" or "contractor" under the California Consumer Privacy Act as amended by the CPRA (CCPA), and a "processor" under other US state privacy laws.
• RythmoLabs is separately responsible for its own account, billing and security data about Studio users, as described in the Privacy Policy.

2. Studio Data

Item	Details
Data subjects	Parents and guardians, children and other students, prospective families (leads), Studio owners, staff and instructors
Categories	Contact and identity details; children's names, dates of birth, sizes, photos, emergency contacts, notes and progress; enrollment, attendance and billing records; payment identifiers (card data is held by Stripe); signed waivers and signatures; messages; costume measurements; consent and acceptance records
Purpose	Providing the RythmoLabs service: registration, scheduling, attendance, billing, payments, waivers, events, store, costumes, messaging and support
Duration	The subscription term plus the return and deletion period in section 8

3. Our commitments

RythmoLabs will:

• Process Studio Data only on the Studio's documented instructions, which are these Terms, this DPA and the Studio's use of the service, and tell the Studio if we believe an instruction breaks the law.
• Not sell or share Studio Data (as those terms are defined in the CCPA), and not retain, use or disclose it outside the direct business relationship with the Studio or for any purpose other than providing the service, except as the law permits.
• Not combine Studio Data with personal information from other sources, except as the CCPA permits a service provider to do.
• Comply with the CCPA and applicable state privacy laws, and provide the same level of privacy protection they require. The Studio may take reasonable steps to stop and remediate unauthorized use of Studio Data.
• Ensure everyone who processes Studio Data is bound by confidentiality.
• Help the Studio respond to requests from individuals (to access, correct, delete or obtain a copy of their data) through the service's features or, where those are not enough, on request.
• Give the Studio information reasonably needed to show compliance with this DPA. [COUNSEL TO SET audit rights, frequency and cost.]

4. Children's data

The Studio is responsible for obtaining any parental consent the law requires before collecting a child's information. The service provides an in-app consent step for parents adding children, records each consent (who, how, when and which wording), and lets parents withdraw consent, which deletes or anonymizes the child's data. When Studio staff create student records directly, the Studio confirms it has obtained consent offline. RythmoLabs uses children's data only to provide the service to the Studio and never for advertising or profiling.

5. Security measures

RythmoLabs maintains reasonable administrative, technical and physical safeguards, including:

• Encryption in transit (TLS) and at rest through our hosting and database providers.
• Tenant isolation: application-level scoping of every query to the Studio's organization, backed by Postgres row-level security.
• Argon2id password hashing with a server-side pepper; rate limiting on sign-in, signup, verification and password reset.
• Role-based access for Studio staff (owner, admin, manager, instructor, event staff) and audit logs for sensitive platform actions.
• Payment card data handled only by Stripe (PCI DSS Level 1); RythmoLabs stores only Stripe identifiers.
• Access-controlled file storage for waivers, signatures and photos.
• Error monitoring configured to exclude request bodies and names or email addresses, and to anonymize IP addresses.
• Limited, need-to-know access by RythmoLabs personnel.

6. Subprocessors

The Studio authorizes RythmoLabs to use the subprocessors listed at /legal/subprocessors. RythmoLabs will bind each subprocessor to written data protection terms at least as protective as this DPA and remains responsible for its subprocessors. We will update the list at least [30] days before adding or replacing a subprocessor; the Studio may object on reasonable data protection grounds, and if we cannot resolve the objection the Studio may terminate the affected service.

7. Security incidents

RythmoLabs will notify the Studio without undue delay, and in any case within [72 hours], after confirming a breach of security that leads to unauthorized access to or acquisition of Studio Data. The notice will describe what happened, the data involved, the steps taken and a contact for more information. We will reasonably assist the Studio with any notices it must give to individuals or regulators under state breach notification laws.

8. Return and deletion

• During the subscription, the Studio can export its data from the service.
• After the subscription ends, the Studio may export its data for [30] days. RythmoLabs then deletes Studio Data from the live systems, and from backups as they expire within [BACKUP RETENTION PERIOD].
• RythmoLabs may keep data the law requires it to keep (for example platform billing records), and de-identified or aggregated data that cannot reasonably be linked to a person, under continued confidentiality.

9. Order of precedence

If this DPA conflicts with the Terms on the processing of Studio Data, this DPA controls.

10. Contact

[COMPANY LEGAL NAME], [ADDRESS], [privacy@COMPANY.com]