Terms of Service & Data Processing Agreement

InternationalGPA.com is a cloud-delivered SaaS application that enables international admissions and credential evaluation teams to convert international grades and credentials into U.S.-style GPAs and to use those results in admission, scholarship, and related workflows.

We may update the Service from time to time, including by adding, modifying, or removing features, provided we do not materially reduce core functionality during a paid subscription term without reasonable notice.

You may use the Service only for lawful purposes and in accordance with these Terms. You may not:

• Use the Service in any manner that could damage, disable, or impair it or interfere with others' use;
• Attempt to gain unauthorized access to the Service or related systems;
• Use the Service to store or transmit content that is unlawful, infringing, or that violates privacy rights;
• Reverse engineer, decompile, or create derivative works of the Service except to the extent permitted by law.

Fees, billing terms, and subscription duration are set forth in your order or agreement.

Unless otherwise specified:

• Subscriptions renew according to the agreed billing cycle.
• To cancel, you must email Support@InternationalGPA.com at least 31 days before your next billing date; access continues until the end of the then-current billing period, and no refunds are provided for partially used terms.

If technical issues materially prevent use of the Service, you must notify us within one business day at the support address for troubleshooting.

We will use commercially reasonable efforts to provide the Service in a professional and workmanlike manner and to maintain reasonable administrative, physical, and technical safeguards to protect data as described in our Information Security Policy and this DPA.

Except as expressly stated:

• The Service is provided "as is" and "as available", without additional warranties of any kind, whether express, implied, statutory, or otherwise, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

These Terms apply for as long as you have an active subscription to the Service.

We may suspend or terminate access if:

• You materially breach these Terms and do not cure within a reasonable period after notice;
• Your use presents a security or legal risk; or
• Required by law.

Upon termination, your right to use the Service ceases, and data handling will follow the Data Return and Deletion provisions in the Data Processing Agreement below.

We may update these Terms from time to time. When we do, we will:

• Revise the "Last updated" date, and
• Where changes are material, provide reasonable notice (for example, via email or in-app notification).

• Subject-matter: Processing of Student Data and Institutional User Data to provide the InternationalGPA.com Service.
• Duration: For the term of Customer's subscription and any data retention period agreed or required by law.
• Nature and purpose: Hosting and processing data to calculate GPA conversions, support admission/scholarship workflows, generate reports, and provide related analytics and support.

Provider will:

• Use Student Data only for purposes permitted by Customer and FERPA;
• Not disclose Student Data to third parties except as permitted under FERPA (e.g., to sub-processors acting as our agents) and this DPA;
• Adhere to the core principles of GDPR/UK GDPR for applicable data subjects, including transparency, security, and data minimization.

Provider will implement and maintain appropriate technical and organizational measures to protect Customer Data, including:

• Formal Information Security Policy (ISP) covering all systems and personnel, reviewed annually.
• Access control and MFA: Principle of least privilege; admin access restricted to two System Administrators; mandatory MFA for Supabase, Cloudflare, Netlify; mandatory use of 1Password and strong password criteria.
• Encryption:
  • In transit – TLS 1.2+ for all communications over public networks.
  • At rest – database encryption at rest in Supabase, validated as part of Supabase's SOC 2 Type II certification.
• Tenant isolation: Row Level Security (RLS) to ensure each institution can only view its own records.
• Endpoint security: FileVault full-disk encryption, macOS security controls, and seven-day patching SLA for admin endpoints.
• BCP/DRP: RTO 4 hours, RPO 24 hours, serverless architecture with Cloudflare/Netlify redundancy, Supabase backups and point-in-time recovery, with annual review and failover testing.

Customer is responsible for maintaining appropriate security for their own systems, credentials, and network connections to the Service.

Customer Data is hosted in the United States (US-East-2).

Where Customer Data originates from the EEA or UK, Provider will ensure that transfers to the U.S. are supported by appropriate safeguards, including Standard Contractual Clauses (SCCs) or equivalent mechanisms, and will assist Customer in documenting these mechanisms as required.

If Provider becomes aware of a Security Incident (confirmed unauthorized access, disclosure, or loss of Customer Data):

• Provider will activate its Incident Response Plan, promptly investigate, contain, and remediate the incident, and preserve relevant logs.
• Provider will notify Customer without undue delay and, for FERPA-protected data, immediately upon confirmation of unauthorized access or disclosure of PII, via designated contacts.
• Where GDPR/UK GDPR applies and notification to a DPA is required, Provider will assist Customer in meeting the 72-hour deadline.

Notifications will include:

• The nature of the incident;
• Types of data affected;
• Known or suspected impact;
• Actions taken or planned; and
• Recommendations for Customer.

Upon termination or expiration of the Service, or upon Customer's written request:

• Provider will, within a reasonable period, provide Customer with an export of Customer Data (if feasible within the Service's standard functionality) and then delete Customer Data from active systems.
• Deleted data may persist only in Supabase's automated backups for the duration of the defined backup retention window (aligned with the 24-hour RPO), after which it is overwritten. Provider will not retain or export deleted PII outside this environment.

Where applicable law requires retention beyond these periods, Provider may retain minimal necessary data in a secure manner solely for compliance purposes.

We may update this DPA from time to time. When we do, we will:

• Revise the "Last updated" date, and
• Where changes are material, provide reasonable notice (for example, via email or in-app notification).