Data Processing Agreement

1. What this agreement is

This agreement is between atTeam and the school or organization that uses atTeam (“you” or “the organization”). atTeam (the app at atteam.app) is operated by Tanner Monaco as an individual. “We,” “us,” and “atTeam” all mean the same thing.

It sets out how we handle the information your organization puts into atTeam. It is part of our Terms of Service and applies from the day your organization starts using the app, with nothing to sign. If this agreement and the Terms of Service disagree about how your data is handled, this agreement wins.

If your organization needs a signed copy, or needs us to sign its own student data privacy agreement, email privacy@atteam.app.

2. Whose data it is

Organization data means the personal information your organization and its people put into atTeam: staff accounts, rosters, events, messages, equipment records, posts, photos, and videos.

Organization data belongs to your organization. You decide what goes into atTeam and what it is used for. We handle it only to provide the app to you, following your instructions. Your instructions are this agreement, the Terms of Service, and what your people do in the app, such as publishing a post or removing a person.

In legal terms, your organization is the “controller” of organization data and atTeam is the “processor” (a service provider working on your behalf).

A small amount of information we handle for our own business needs, not on your behalf: billing records, security logs, and our correspondence with you. Our Privacy Policy covers that.

3. What we handle, and for how long

The people it is about

• Your creative team: creative staff, student aides, admins, and anyone else you give an account.
• People on your rosters: athletes and team members. Many are students and some are minors.
• Other people who appear in what you upload, such as someone in a photo.

The kinds of information

• Names, email addresses, roles, and profile details.
• Roster details your staff choose to enter, such as jersey number, position, class year, hometown, birthday, height, injury or active status, photo, notes, and social media handles.
• Posts, captions, photos, videos, chat messages, event schedules, and equipment records.
• Encrypted access keys for the social accounts you connect.

Why, and for how long

We handle organization data for one reason: to run atTeam for your organization. We do so for as long as your organization uses atTeam, and then return or delete it as described in section 11.

4. What we will and will not do

• We use organization data only to provide atTeam to your organization, keep it secure, and fix problems.
• We do not sell organization data. We never have.
• We do not use organization data for advertising, and we do not build profiles of students or anyone else for any purpose other than running the app for you.
• We do not use organization data to train AI models, and neither does the AI provider we use.
• We do not share organization data with anyone except the companies listed in section 7, the social platforms you choose to publish to, and where the law requires it.
• Anyone who can reach organization data on our side is bound to keep it confidential.
• If we believe an instruction from you would break the law, we will tell you instead of following it.

5. Student records

Some organization data may be part of a student’s education record under the United States law known as FERPA (the Family Educational Rights and Privacy Act). Where it is, we act as a “school official” with a legitimate educational interest: we perform a service the school would otherwise use its own staff for, we remain under the school’s direct control over how those records are used and kept, and we use them only for the purpose they were shared for.

We do not pass student records to anyone else, except to the companies in section 7 who help us run the app, to the social platforms your staff publish to, or where the law requires it.

atTeam accounts are for the adults and student aides on your creative team. Your organization is responsible for having the right to enter information about the people on its rosters, including any consent that a photo or a post about a student needs.

6. How we protect it

• Traffic between your people and atTeam is encrypted with HTTPS.
• The database and file storage are encrypted at rest by the providers that host them.
• Passwords are stored as one-way hashes, never in plain text. Social access keys and two-step secrets are encrypted before they are stored.
• Each organization’s data is kept separate from every other organization’s, and access inside an organization is limited by role.
• Two-step sign-in and passkeys are available to every account. Two-step sign-in is required on the atTeam support accounts that can reach more than one organization.
• When we use the support feature that lets us view the app as one of your people, we record who did it, when, and from where.
• Photos and videos are held in private storage, reachable only through temporary links that expire, and are deleted on the schedule in our Privacy Policy.

We may change these measures as the app grows, but never to something weaker.

7. Companies that help us

We use the companies below to run atTeam (often called “subprocessors”). Each one receives only what it needs for its job, and each is bound by its own written data protection terms with us. We stay responsible to you for what they do with organization data.

• Vercel: hosting and basic traffic analytics.
• Neon: the database that stores your data.
• Cloudflare R2: temporary, private storage for photos and videos while a post is being prepared and published, or while a file is shared in chat, and the private, time-limited links TikTok fetches a post's files from.
• Anthropic: the optional AI features, when you use them.
• Resend: sending account emails such as verification, invitations, and password resets.
• Railway: the server that powers live chat.
• Stripe: billing for an organization's subscription. Stripe receives billing contacts and payment details, never roster information. Card numbers go straight to Stripe and never reach us.

Before a new company starts handling organization data, we will update this list and email your organization’s owner at least 14 days ahead. If you object for a real data protection reason and we cannot work it out, you may cancel and we will refund any time you paid for and did not use.

Facebook, Instagram, and X are not on this list because we did not hire them: your staff connect your own accounts and choose to publish there, and we deliver the post on their instruction. The same goes for Google or Microsoft if one of your people chooses to sign in with them, and for the push service built into a person’s own browser or phone.

8. If something goes wrong

If we confirm that organization data was accessed, lost, or disclosed without permission, we will email your organization’s owner without delay, and no later than 72 hours after we confirm it. We will tell you what happened, what data and which people were affected as far as we know, what we have done about it, and who to contact. We will keep you updated as we learn more, and give you the information you need to meet your own duty to notify people.

9. Requests from people about their data

Your organization can view, correct, export, and erase a person’s information from inside the app. If you need help with a request from a student, a parent or guardian, or a staff member, email us and we will help.

If one of those people writes to us directly about organization data, we will point them to your organization and let you know. We will not answer for you unless you ask us to or the law requires it.

10. Requests from government or law enforcement

If a government agency, court, or police department asks us for organization data, we follow the process in our Privacy Policy: we require proper legal process, hand over the least we can, and tell your organization first unless the law forbids it.

11. Getting your data back, and deleting it

While your organization uses atTeam, an owner can export a person’s data from the app at any time, and we will help with a wider export if you ask.

When your organization closes its account, or asks us in writing to delete its data, we delete organization data from the live system within 30 days. Copies in backups are overwritten within a further 30 days. Posts already published to a social platform stay on that platform under your own account, where you control them.

We keep only what the law requires us to keep, such as billing records, and we keep it protected under this agreement until it is deleted.

12. Where data is stored

The companies in section 7 may store and process data in the United States and other countries. atTeam is built for schools in the United States. If your organization is covered by European or United Kingdom data protection law, email us before you add data so we can put the required transfer terms in place.

13. Showing that we keep these promises

Once a year, and after any incident under section 8, your organization may send us written questions about how we protect organization data, and we will answer them in writing within a reasonable time. If the law gives your organization or a regulator a right to more than that, we will cooperate with it.

14. Changes and how long this lasts

This agreement lasts for as long as we hold organization data. If we change it, we will update this page and the “last updated” date, and email your organization’s owner before any change that reduces a protection here. The limits on liability in the Terms of Service apply to this agreement, except where the law does not allow them to.

15. Contact

Questions about this agreement, or a request under it? Email us at privacy@atteam.app.