DATA PROCESSING AGREEMENT

Last Updated: March 21, 2025

This Data Processing Agreement (“DPA”) is entered into between Vibration Mentor LLC (“Company,” “we,” “our,” or “us”) and users of our services (“Customer,” “you,” or “your”). This DPA supplements our App Privacy Policy and Terms of Service to reflect the parties’ agreement regarding the processing of personal data under applicable data protection laws.

1. DEFINITIONS

1.1 Applicable Data Protection Laws

Refers to all applicable laws, regulations, and directives relating to personal data protection and privacy, including but not limited to:

  • General Data Protection Regulation (GDPR) (EU) 2016/679
  • UK GDPR and Data Protection Act 2018
  • California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA)
  • Illinois Personal Information Protection Act (PIPA)
  • Other applicable U.S. federal and state privacy laws

1.2 Personal Data

Any information that identifies, relates to, describes, or is capable of being associated with an individual, as defined under the Applicable Data Protection Laws.

1.3 Processing

Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

1.4 Controller & Processor

  • Controller: You, the user, determine the purposes and means of processing personal data.
  • Processor: We process personal data on your behalf within the scope of providing services.

2. DATA PROCESSING DETAILS

2.1 Scope and Purpose

We process personal data strictly for the purpose of providing our services, including but not limited to:

  • User authentication and account management
  • Customer support and communication
  • Course participation tracking
  • App functionality enhancement
  • Marketing and promotional activities (where applicable and legally permissible)

2.2 Categories of Personal Data Processed

The types of data we may process include:

  • Identifiers: Name, email address, username
  • Transactional Data: Payment history, subscription status (via Apple, Google, or Stripe)
  • Usage Data: Course participation, post interactions (via GHL Member Portal)
  • Communication Data: Support requests, messages

We do not process biometric or financial data directly. Payment transactions are handled by Apple, Google, and Stripe.

3. OBLIGATIONS OF VIBRATION MENTOR LLC

3.1 Data Security Measures

We implement technical and organizational security measures to protect personal data, including:

  • Data encryption (in transit and at rest)
  • Access control and authentication
  • Regular security audits
  • Data minimization and retention policies (7-year retention for IRS compliance, unless longer retention is required by law)

3.2 Confidentiality

We ensure that only authorized personnel have access to personal data and that they are bound by confidentiality obligations.

3.3 Subprocessors

We may use subprocessors, including GHL, Stripe, Apple, and Google, for specific processing activities. We ensure that all subprocessors adhere to equivalent data protection obligations.

4. DATA SUBJECT RIGHTS

Under applicable laws, users have the following rights regarding their personal data:

  • Access: Request copies of your personal data.
  • Rectification: Request corrections to inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data, subject to legal retention obligations.
  • Restriction: Request to limit the processing of your data.
  • Portability: Request transfer of your data to another service provider.
  • Objection: Object to processing, including direct marketing.

Users can exercise these rights by contacting data@vibrationmentor.com.

5. CROSS-BORDER DATA TRANSFERS

We may transfer and process personal data in jurisdictions outside of your country. When transferring data internationally, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) for EU/UK data transfers
  • Data Privacy Framework compliance (where applicable)

6. DATA BREACH NOTIFICATION

In the event of a data breach that is likely to result in a risk to user rights and freedoms, we will notify affected users and relevant authorities in accordance with Applicable Data Protection Laws.

7. RETENTION PERIODS

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

  • 7 years for IRS compliance
  • As long as required by law for security, fraud prevention, and contractual obligations
  • Until the user requests deletion, subject to legal retention requirements

8. THIRD-PARTY SERVICES & EXTERNAL LINKS

This DPA applies solely to data processing conducted by Vibration Mentor LLC.

We may use trusted third-party services and processors to support our app and business operations, including (but not limited to) platforms for hosting, communications, analytics, customer support, and payment processing. These services are carefully vetted and contractually obligated to comply with applicable data protection laws.

To maintain transparency and ensure you stay informed:

📩 You may request a full list of third-party service providers and subprocessors we currently use by contacting us at data@vibrationmentor.com.

We encourage you to review the privacy practices of third parties when using their platforms:

9. GOVERNING LAW & DISPUTE RESOLUTION

This DPA shall be governed by the laws of Illinois, USA. Any disputes shall be resolved through binding arbitration in accordance with our Terms of Service.

10. CHANGES TO THIS DPA

We reserve the right to update this DPA as necessary to comply with legal requirements. We will notify users of any material changes.

For questions regarding this DPA, contact data@vibrationmentor.com.