Data processing addendum

Last updated October 19, 2026. Provided by FrontRow Software LLC.

1. Scope and roles

This addendum forms part of the terms of service between your studio and FrontRow Software LLC. It applies to personal data in customer data that we process for your studio ("studio personal data"). Your studio is the controller (or "business") and we are the processor (or "service provider"). If this addendum and the terms conflict on data protection, this addendum wins.

2. Details of the processing

• Subject matter and duration: providing the service for as long as your studio uses it, and until deletion under section 9.
• People concerned: your staff, parents and guardians, students (including children), emergency contacts and authorized pickups, buyers, guests and people who contact your studio.
• Types of data: contact details, dates of birth, enrollment and attendance, payment records (never full card numbers), messages and media, policy acceptances, consent records, and any health information, such as medical notes and allergies, that your studio chooses to collect.
• Purpose: hosting, processing and transmitting the data to provide, secure and support the service.

3. Your instructions

We process studio personal data only on your documented instructions: these terms, this addendum and the way you configure and use the service. We won't sell it, share it for cross-context behavioral advertising, use it to train AI models, or combine it with data from other sources except as needed to provide the service. We'll tell you if we think an instruction breaks data protection law, or if the law requires us to process the data in another way, unless the law forbids telling you.

4. Our people

Only people who need access to provide or support the service can access studio personal data, and they are bound to keep it confidential. Our staff access a studio's data only to provide support, to keep the service secure, or as the law requires.

5. Security

We maintain technical and organizational measures that include:

• every record scoped to its studio, with automated isolation tests on every endpoint;
• encryption in transit, and encrypted backups;
• encryption of stored connection credentials, such as QuickBooks and Meta access tokens;
• role-based access for studio staff, with required two-step sign-in for owners and administrators;
• checks of new passwords against known breached passwords;
• an audit log of changes, and an append-only financial ledger;
• removal of location and camera data (EXIF) from uploaded photos.

We may update these measures over time, as long as the overall level of protection doesn't go down. More detail is on our security page.

6. Subprocessors

You authorize us to use the subprocessors listed on our subprocessors page. We bind each one to data protection terms at least as protective as this addendum, and we remain responsible for their work.

We'll give account owners at least 30 days' notice before adding or replacing a subprocessor. If you have a reasonable data protection objection, tell us at privacy@frontrowhq.com within that time. We'll try to find a solution, and if we can't, you may cancel the affected service and receive a refund of any prepaid fees for the period after cancellation.

7. Security incidents

If we become aware of a breach of security leading to unauthorized access to, or loss or disclosure of, studio personal data, we'll tell the account owner without undue delay, and within 72 hours of confirming it. We'll share what we know about its nature and likely consequences and what we are doing about it, and keep you updated as we learn more.

8. Helping you meet your obligations

The service gives you the tools to answer requests from the people whose data you hold: a full export of your studio's data, editing of any record, and erasure of a family on request. If we receive a request directly, we'll pass it to you and not answer it ourselves unless you ask us to. We'll also give you reasonable help with data protection impact assessments and with questions from regulators.

9. Deletion and return

• You can export all of your studio's data at any time while your account is active, and for 30 days after it ends.
• After those 30 days, we erase studio personal data from our live systems. We keep financial records as accounting and tax law requires, and the audit log entries of who did what, without the personal data they changed.
• Erased data ages out of our backups within 60 days.

10. Audits

We'll answer reasonable written security and privacy questionnaires once a year, or after a security incident, and make available the information needed to show we meet this addendum. Where the law requires an on-site audit, we'll agree its scope, timing and confidentiality with you in advance, at your cost.

11. International transfers

We and our subprocessors store and process studio personal data in the United States. Where data protection law requires a transfer mechanism, such as for data from the UK or European Economic Area, the relevant standard contractual clauses apply and are incorporated by reference, with your studio as exporter and us as importer.

12. General

The limitation of liability in the terms of service applies to this addendum. This addendum ends when we have deleted all studio personal data. Questions or a signed copy: legal@frontrowhq.com.