Data Processing Addendum
ACSI Accreditation Assistant — Olive & Rose LLC
Last updated and effective: June 17, 2026 (version 2026-06-17)
This Data Processing Addendum ("DPA") supplements the Terms of Use (https://www.oliveandrose.net/terms-of-use) between Olive & Rose LLC ("Olive & Rose," the "Processor") and the subscribing school (the "School," the "Controller") and governs the processing of School Data in the ACSI Accreditation Assistant (the "Service"). On data-processing and security topics, this DPA controls over the Terms of Use.
Note for schools migrating from the Olive & Rose consulting tool: this DPA covers the subscription web Service, in which the School uploads documents to infrastructure operated by Olive & Rose. It replaces, for the Service only, the earlier rendering-only Data Processing & Security Addendum used in consulting engagements, where School files never left the School's own accounts.
1. Roles
​
1.1 The School is the data controller and owns all School Data.
1.2 Olive & Rose is a data processor, processing School Data only on the School's documented instructions — which are: to provide the Service as described in Section 2, as configured by the School in the app. Olive & Rose will inform the School if, in its opinion, an instruction conflicts with applicable data-protection law.
​
2. Scope and purpose of processing
​
2.1 "School Data" means: (a) institutional documents the School uploads and text extracted from them; (b) the School's profile (school name, enrollment count, accreditation dates and type, primary contact name and email); (c) content generated for the School (analyses, draft self-assessments, reports); and (d) agreement and audit records.
2.2 Processing activities: secure storage; text extraction; automated screening for prohibited personal data (Section 5); classification and organization against the ACSI Inspire blueprint; readiness auditing; AI-assisted draft generation; report rendering; export packaging; and transactional email delivery to School-designated recipients.
2.3 Prohibited data. The Service is not designed or permitted to process student personally identifiable information, FERPA-covered education records, or other personal information that identifies an individual (such as personal contact details). The School agrees not to upload such data and to redact it beforehand (see the Data Responsibility Acknowledgement in the app). Section 5 describes the technical fail-safe.
2.4 Duration: for the life of the School's subscription plus the retention periods in Section 8.
​
​
3. Subprocessors
​
3.1 Olive & Rose engages the following subprocessors to operate the Service:
-
Google LLC (Google Cloud) — United States (us-central1). Hosting (Cloud Run), document storage (Cloud Storage), database (Firestore), job queue, and secrets management.
-
Anthropic, PBC — United States. AI model processing (analysis and draft generation) via the commercial API: no training on School Data, with limited-duration retention per Anthropic's commercial data-handling terms.
-
Pinecone Systems, Inc. — United States. Vector search over ACSI-framework reference content; queries may contain short excerpts derived from School documents; School documents are not stored in Pinecone.
-
Wix.com Ltd. — per Wix's terms. Member identity, authentication, subscription billing, and (at checkout) acceptance records.
-
Resend (Plus Five Five, Inc.) — United States. Transactional email delivery.
​
3.2 Olive & Rose will give the School reasonable advance notice before adding or replacing a subprocessor that processes School Data, allowing the School to object on reasonable data-protection grounds. Olive & Rose remains responsible for its subprocessors' performance of this DPA's obligations and for its own configuration and operation of their services; it is not liable for breaches of a subprocessor's underlying infrastructure, which are governed by that provider's own terms.
​
4. Security measures (Schedule)
​
Olive & Rose maintains the following measures for the Service:
• Encryption in transit: all connections over HTTPS/TLS, including to all subprocessors.
• Encryption at rest: all stored School Data encrypted at rest (Google Cloud default encryption).
• Tenant isolation: every piece of School Data is keyed to a school identifier derived only from a verified session; all storage access is school-scoped; cross-tenant access is denied and isolation is covered by automated tests run on every release.
• Authentication: Wix Members login (with Wix's password and account protections), exchanged for short-lived, signed, HttpOnly, secure session cookies; single-use sign-in tokens with replay rejection; rotating refresh tokens.
• Secrets: all keys and credentials in a managed secrets service; never in source code; access restricted to the Service's service account; version-pinned.
• Least privilege: the Service runs under a dedicated service account holding only the roles it needs.
• Content-free logging: operational logs record which school performed which action and outcome — never document contents; screening events are logged without the matched text.
• Personal-data fail-safe: automated pre-processing screening that refuses non-compliant files (Section 5).
• Upload controls: file-type and size restrictions; executable and macro-enabled files rejected; malware scanning (as rolled out in the upload release).
• Abuse controls: request-size limits and rate limiting.
• Data residency: Service infrastructure runs in a United States region.
​
5. Personal-data fail-safe (refusal at upload)
​
5.1 Every uploaded file is screened locally, before any content is sent to any AI subprocessor. Files that appear to contain personal information that could identify an individual — including student data (e.g., rosters, gradebooks, identifier patterns, name-grade pairings) and direct contact details (e.g., personal phone numbers, email addresses, and street addresses) — are refused: they are not stored, not classified, not analyzed, and not sent to Anthropic or Pinecone. The School sees only a notice that the file could not be uploaded.
​
5.2 A refused file's contents are deleted immediately at the point of refusal — they are not retained. The School's remedy is to redact and re-upload.
​
5.3 The screen is deliberately tuned toward over-blocking. It is a fail-safe, not a license: the School's obligation not to upload student or other personal data (Section 2.3) is unaffected.
​
6. Breach notification
​
If Olive & Rose becomes aware of a personal-data breach affecting School Data, it will notify the School without undue delay — and in any event within 72 hours of becoming aware — with the information reasonably available to support the School's own legal obligations, and will cooperate with the School's reasonable investigation and remediation efforts.
​
7. Controller responsibilities
​
The School is responsible for: (a) the lawfulness of the content it uploads, including any required consents; (b) redacting student personal information before upload, including compliance with FERPA and state student-privacy laws where applicable to the School; (c) securing its own member accounts and devices; (d) designating and managing which staff have access; and (e) reviewing and approving all AI-drafted content before any use in an accreditation submission.
​
8. Return and deletion of School Data
​
8.1 Self-service export: the Service provides a complete export (organized documents plus reports) the School can download at any time while subscribed.
8.2 Pause: while a subscription is paused, School Data is retained in full and Service functions are locked.
8.3 Termination or lapse: School Data is retained for a 90-day grace period (for resubscription or export on request), then deleted from the Service's systems. Backup copies expire on the backup provider's normal cycle thereafter.
8.4 On request: the School may request earlier deletion at john@oliveandrose.net; verified requests are honored within 30 days, subject to minimal records Olive & Rose must keep by law (e.g., billing and agreement records).
8.5 Subprocessor retention: content sent to Anthropic is subject to Anthropic's commercial limited-duration retention and is not used for model training.
​
9. Assistance and information
​
Taking into account the nature of the processing, Olive & Rose will provide reasonable assistance with the School's obligations regarding data-subject requests, security, and breach notification, and will make available information reasonably necessary to demonstrate compliance with this DPA. Olive & Rose's personnel access School Data only as needed to operate and support the Service and are bound by confidentiality.
​
10. Liability
​
Liability under this DPA is subject to the limitations and cap in the Terms of Use. Olive & Rose's responsibility extends to its own operation and configuration of the Service and its obligations in this DPA; it does not extend to (a) breaches or failures of a subprocessor's underlying infrastructure, or (b) consequences of the School uploading data prohibited by Section 2.3.
​
11. General
​
11.1 This DPA takes effect when the School accepts it (at checkout or in the app) and remains in force for the duration of processing.
11.2 If a provision of this DPA is held invalid, the remainder stays in effect. This DPA is governed by the laws of the State of Arizona, without regard to conflict-of-laws principles.
Questions: john@oliveandrose.net · Olive & Rose LLC, Phoenix, AZ, USA