Legal · memore.tech

Data Processing Agreement

Last updated: 19 August 2026

This Data Processing Agreement (the "DPA") governs our processing of personal data that you put into Memore about other people — most often your students. It forms part of the Terms of Service between you and Shoon's LLC ("Memore", "we", "us"), and applies automatically when you use the Services. No signature is required; if your organisation needs a countersigned copy, write to legal@memore.tech.

In one sentence: for the data you record about your students, you decide why and how it is used and we act only on your instructions. This DPA is the Article 28 contract that makes that lawful.

1Which data this covers, and who is responsible

Memore handles two different kinds of personal data, and our role differs between them. This distinction is the point of this document.

Data	Your role	Our role
Customer Data — what you record about your students and their households: names, contact details, lesson history, attendance, private notes, materials, recordings, transcripts, vocabulary, payment and balance records.	Controller	Processor, acting on your instructions under this DPA
Your account data — your own name, email, password, timezone, settings, billing, support correspondence, and how you use the product.	Data subject	Controller, under the Privacy Policy

Where the other party to a relationship also holds their own Memore account, they are a data subject in their own right and we are the controller of their account data, exactly as we are of yours. Data you have both contributed to a shared record — a shared glossary, a lesson both of you can read — remains available to each of you if the other leaves.

"Data Protection Law" means the EU GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss FADP, and any other data protection law applicable to the processing, each as amended.

2Details of the processing

Required by Article 28(3):

Item	Detail
Subject matter	Provision of the Memore platform to you.
Duration	For as long as your account is active, plus the retention periods in section 9.
Nature and purpose	Hosting, storage, organisation, retrieval, transmission, backup, transcription, and AI-assisted generation of teaching material, in each case to deliver the features you use.
Types of personal data	Identification and contact data; scheduling and attendance data; free-text notes authored by you; educational performance and progress data; audio, video and image recordings and their transcripts; financial records of lessons and payments; and any other personal data you choose to enter.
Categories of data subjects	Your students; where applicable their parents or guardians; and other people you enter into the product.
Special category data	Not required by the product and not to be entered. See section 3.

3Your obligations as controller

You are responsible for the lawfulness of what you ask us to process. In particular you must:

Have a valid lawful basis for every purpose you use Memore for, and keep your own record of it.
Give the people concerned the transparency information Data Protection Law requires — including that you use Memore, and that lessons may be recorded and transcribed.
Obtain every consent, notice and authorisation needed before recording, uploading or transcribing anyone, and meet the additional requirements that apply to children's data.
Not enter special category data (health, biometric, racial or ethnic origin, religious or philosophical belief, trade union membership, sex life or sexual orientation) or criminal offence data. The product does not require it and is not configured for it. If it reaches us in a free-text note or a transcript, you remain responsible for that decision and for any additional condition for processing it.
Ensure your instructions to us do not put us in breach of Data Protection Law.

4Our obligations as processor

We will:

Process Customer Data only on your documented instructions, which are given by your use of the Services, the settings you choose, this DPA and the Terms — unless a law we are subject to requires otherwise, in which case we will tell you before processing unless that law forbids it.
Tell you if, in our opinion, an instruction infringes Data Protection Law.
Ensure that everyone authorised to process Customer Data is bound by an appropriate duty of confidentiality.
Not use Customer Data for our own purposes, and specifically not to train or improve any machine-learning model, not for advertising, and not to build any product other than the Services we provide to you.
Not sell Customer Data or disclose it for cross-context behavioural advertising.

5Security

We implement appropriate technical and organisational measures under Article 32, described in the Annex below, and keep them under review. We do not reduce the overall level of security during the term of this DPA.

6Sub-processors

You give general authorisation for us to engage sub-processors to deliver the Services. The current list, with what each does and where it processes, is published in section 10 of the Privacy Policy and is part of this DPA.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will publish any material new or replacement sub-processor at least 30 days before it begins processing Customer Data. The published list is the authoritative notice of sub-processor changes. Where a replacement is needed urgently to keep the Services secure or available, we may engage it immediately and will publish the change as soon as reasonably practicable. If you reasonably object on data protection grounds within 30 days of publication, tell us and we will work with you on a reasonable alternative; if none is available, you may terminate the affected Services without penalty and receive a pro-rata refund of any prepaid fees.

7Assisting you

Taking into account the nature of the processing and the information available to us, we will assist you with:

Data subject requests. The product already lets you access, correct, export and delete Customer Data yourself; that self-service is the primary route. Where a request cannot be met that way, we will provide reasonable assistance. If a request reaches us directly we will not respond to it on your behalf other than to direct the person to you, unless legally required.
Security, breach notification and impact assessments (Articles 32 to 36), on request and to the extent the information is available to us.

8Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information available to us so you can meet your own Article 33 and 34 obligations. Notification is not an admission of fault. Reporting to a supervisory authority and to affected individuals is your decision as controller.

9Deletion and return

You may export Customer Data at any time while your account is active. On termination we delete Customer Data in accordance with the retention schedule in the Privacy Policy, save where Data Protection Law requires us to keep it. Deleted data is removed from backups on their normal rotation.

10Audit

We will make available the information reasonably necessary to demonstrate compliance with this DPA, in the first instance through this document, the Privacy Policy, the sub-processor list and the security description. Where that is genuinely insufficient for your own compliance obligations, we will respond to a reasonable written information request no more than once a year, and will cooperate with an audit where Data Protection Law obliges us to. Audits must be at your cost, on 30 days' written notice, during business hours, subject to confidentiality, and must not disrupt the Services or risk another customer's data.

11International transfers

Shoon's LLC is established in the United States and our sub-processors operate in the European Union and the United States. Where Customer Data is transferred out of the EEA, the United Kingdom or Switzerland:

The European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and are completed as follows: you are the data exporter and Shoon's LLC the data importer; the optional docking clause applies; in Clause 9 Option 2 (general written authorisation) applies with the 30-day notice period in section 6; in Clause 11 the optional independent dispute resolution body does not apply; in Clause 17 the governing law is that of Ireland; in Clause 18(b) the forum is the courts of Ireland; Annex I is section 2 of this DPA together with the sub-processor list; and Annex II is the Annex below.
For the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies to those Clauses, with Tables 1 to 3 completed from this DPA and Table 4 selecting neither party.
For Switzerland, the Clauses apply with references read as references to the FADP and the competent authority read as the Swiss FDPIC.

If a transfer mechanism is invalidated, we will adopt a valid alternative without undue delay.

12Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not permit that. Nothing in this DPA limits a data subject's rights.

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Data. If this DPA conflicts with the Standard Contractual Clauses, the Clauses prevail.

13Annex — technical and organisational measures

Measures in place at the date above:

Encryption in transit. HTTPS/TLS for all traffic to the platform and to every sub-processor.
Encryption at rest. Provided by our hosting and storage providers. Third-party calendar tokens are additionally encrypted by us with AES-256-GCM before storage.
Credentials. Passwords stored as Argon2 hashes, never in plain text. One-time codes stored only as SHA-256 digests, expiring after 10 minutes with a 5-attempt lockout. A password set at registration is not activated until the email address has been proven.
Access control. Signed, expiring session tokens; long-lived refresh tokens stored only as hashes and rotated on every use; every database query scoped to the requesting account, so one customer's records are not reachable from another's session.
Application hardening. A Content Security Policy on every page; server-side sanitisation of user-authored HTML against an allowlist; a guard that blocks fetches to internal network addresses; per-IP and per-account rate limiting on authentication and other sensitive endpoints; size limits and concurrency bounds on file ingestion.
Segregation. Production data is separated from staging and demonstration environments, which are seeded with synthetic data.
Logging and monitoring. Application error monitoring with secrets redacted before capture; server-side errors return no internal detail to the client.
Deletion. Account deletion removes the departing account's own records and irreversibly severs the identifiers that could re-link a future registration to them, while preserving the counterparty's own records.
Backups. Managed by our hosting providers, encrypted, and rotated.
Development. Automated dependency vulnerability scanning, enforced code review on changes to money, authentication and security paths, and an automated test suite run on every change.

14Contact

Privacy and data protection: legal@memore.tech. Memore is operated by Shoon's LLC.