Data Processing Agreement — IQChess for Schools & Clubs

Version: 2026-10-27 • Last updated: 27 October 2026 (what changed: §11)

This Data Processing Agreement ("DPA") forms part of the agreement between 9517-9206 Québec inc. ("IQChess", "we") and the school, club or other organisation that buys IQChess seats on teach.iqchess.org (the "Organisation"). It describes what personal information IQChess processes for students enrolled by the Organisation, where, why, for how long, and on whose instructions. It is written to be read alongside our Privacy Policy, Terms of Service and Terms for Schools & Clubs (which cover prices, renewal and refunds); where they differ for student accounts created under an Organisation, this DPA prevails.

1) Roles

• The Organisation decides which students use IQChess, creates or authorises their accounts (class codes, class accounts, school Google accounts), and can remove them. For the student data described in §3 the Organisation is the controller (or, in Québec, the person responsible) and IQChess acts as its service provider / processor, on the documented instructions in this DPA and in the teacher dashboard.
• IQChess processes that data only to provide the Services to the Organisation's students, to keep them secure, and as the law requires. IQChess does not sell student data, does not use it for advertising, and does not use it — or allow anyone else, including AI providers, to use it — to train or improve AI models (§3a, §6).
• Teachers' and administrators' own accounts (used to sign in to the dashboard) are governed by the Privacy Policy as ordinary user accounts.

2) Who the students are

The Organisation confirms it has the authority — and, where required by law (e.g. COPPA for children under 13 in the United States, GDPR-K for children under the applicable age in the EU/UK, Québec's Law 25 and PIPEDA for minors in Canada), the consent of a parent or guardian or a lawful basis as an educational institution — to enrol each student and to authorise IQChess to process the data in §3 on its behalf. IQChess relies on the Organisation for this and does not independently collect parental consent. This authority covers the AI features in §3a: some AI model providers require a parent's or guardian's consent for users under 18, and the Organisation's confirmation serves as that consent for its students. Where the Organisation does not have it for a group of students, it switches the AI features off for them (§4).

3) What is processed, per student

Not processed for students under an Organisation: advertising identifiers (seats carry the Arena plan, which shows no ads), payment data (the Organisation pays; students never see Stripe — a parent who chooses to buy a plan for their own child from a link the Organisation sends pays Stripe directly, and that purchase is governed by the Terms of Service and Privacy Policy, not this DPA), precise location, contacts, photos, or audio (voice input uses the device's own speech recogniser and only the resulting text is sent, if the student chooses to send it).

3a) AI features and safety

Students can use IQChess's AI chess tutors as the Organisation allows (§4): Kai (a chess sparring partner they can chat with), Deep analysis (questions about a position), Fast analysis, game reports, hints, Chess Gym grading and Think aloud. For every one of them:

• No training. Nothing a student types, and no AI answer to a student, is used by IQChess or anyone else to train or improve AI models. Students' requests are excluded from IQChess's model-improvement logs on our servers; AI providers receive them under zero-retention, no-training terms and without the student's identity (§6).
• It says it is an AI. Kai's first message in every game says it is an AI, not a person; during a long chat it repeats this at least every three hours and suggests a break. AI answers can be wrong, and the app says so.
• Self-harm protocol. A message that expresses wanting to die or to hurt oneself is not sent to the AI; the student sees a fixed message pointing to a trusted adult, local emergency services and a helpline directory. IQChess records only how often this happens, never the words or the student. The full protocol is published at iqchess.org/ai-safety.html.
• Chess only. Questions are safety-checked before the AI answers; requests outside chess and attempts to change the AI's instructions are refused; the AI is instructed not to ask for personal details or to discuss harmful or adult topics; links are removed from Kai's replies.

4) Kid-safe mode and AI settings

Kid-safe mode is on by default for organisations of type "school" and can be changed by an administrator. With it on, a student can send friend requests and game challenges only to students of the same Organisation, online matchmaking against the public is off, and the profile shows no email or last name.

AI settings are separate, and the administrator decides each one for every student: Kai chat (starts switched off for schools and in young-learners mode), Deep analysis (starts switched off in young-learners mode, ages 6–9) and AI grading of written answers. Until 27 October 2026 Kid-safe mode also switched Kai chat off; every Organisation that had it on keeps Kai chat switched off until an administrator turns it on.

All of these controls are enforced on our servers, not only in the app.

5) Where data is stored

All student data is stored on Amazon Web Services in the us-east-2 (Ohio, United States) region. Game servers for live online play run in the United States, the United Kingdom and Singapore; a kid-safe student never uses public online play, only games against classmates (challenges and the class arena). See the Privacy Policy §7 for the transfer safeguards IQChess relies on (including for Québec Law 25 and GDPR).

6) Sub-processors

We will give the Organisation at least 30 days' notice (on this page and by email to the Organisation's administrators) before adding a sub-processor that processes student data; the Organisation may object by terminating the seats, with a pro-rated refund of the unused period (Terms for Schools & Clubs, §6).

7) Retention and deletion

• Removing a class account (a coach-created account) from the dashboard deletes the Cognito user and the student's profile, token balance, seat, Chess Gym statistics and attempts immediately; game records and AI chat sessions linked to the deleted id expire within 30 days.
• Removing a student who joined with their own account withdraws the seat and the Organisation's visibility of their activity. The account itself stays the student's (or their parent's) and can be deleted in the app at any time (Settings → Delete account).
• When an Organisation's seats end (cancellation, a full refund, non-payment or the end of a free pilot), every seat is withdrawn. Class accounts the Organisation has not removed are deleted by IQChess, with their data as described above, 90 days after the seats end unless the Organisation buys seats again; the administrators are emailed about 30 days before. Students who joined with their own account keep it.
• Backups are overwritten within 35 days of a deletion.

8) Security

Data is encrypted in transit (TLS) and at rest (AWS-managed encryption). Access to production data is limited to IQChess staff who need it, behind single sign-on and multi-factor authentication. Student passwords for class accounts are stored by Amazon Cognito only (salted and hashed); IQChess shows a password once, when a coach creates or resets it, and never stores it in clear. Incidents affecting student data are reported to the Organisation's administrators without undue delay and, where required, to the Commission d'accès à l'information du Québec and other authorities (Privacy Policy §12).

9) The Organisation's rights and duties

• Administrators can at any time export the class report, remove a student, reset a class-account password, change Kid-safe mode, switch each AI feature on or off (§4) and restrict joining to a school email domain.
• Requests from parents or students to access, correct or delete data should be directed to the Organisation, which can act on them from the dashboard; IQChess assists within 10 business days where the dashboard is not enough (privacy@iqchess.org).
• The Organisation keeps class-account credentials safe and tells IQChess if they are compromised.
• The Organisation must not enrol students for whom it lacks the authority described in §2.

10) Legal frameworks

• COPPA (US): for students under 13, IQChess collects no email, shows no advertising and offers no public chat or public profile; the school provides consent on the parents' behalf for the educational use described here, as the FTC permits. IQChess uses students' information only to provide the Services to the Organisation — never for advertising and never to train AI models.
• Québec Law 25 and PIPEDA (Canada): IQChess acts as a service provider under a written agreement (this DPA), keeps student data to what is necessary for the stated purposes, conducts a privacy impact assessment for cross-border transfers, and supports the Organisation's accountability obligations.
• AI chatbot laws (for example California's companion-chatbot law, SB 243, and the EU AI Act's transparency rules): Kai identifies itself as an AI and reminds users of it during long chats, and the self-harm protocol in §3a is published on our website.
• GDPR / UK GDPR (Article 28): this DPA sets out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and IQChess's obligations as processor, including assistance, deletion on termination, audit information on request and the sub-processor terms in §6.

11) Term and changes

This DPA applies for as long as the Organisation holds seats and for the deletion period after. We may update it to reflect new features or legal requirements; material changes are announced on the dashboard at least 30 days in advance. 27 October 2026: AI settings separated from Kid-safe mode (§4), the no-training commitment, AI disclosure and self-harm protocol added (§3a), and AI consent clarified (§2). These changes add protections and leave every Organisation's current settings unchanged, so they apply from that date; they were announced on the dashboard. Questions: privacy@iqchess.org — 9517-9206 Québec inc., 4736 Saint Jean Blvd., Pierrefonds, QC H9H 4B2, Canada.