Legal · B2B

Data Processing Agreement

Last updated: September 2026

For organizations (agencies, corporate L&D teams) that need a Data Processing Agreement on file for their own compliance requirements when using ProgramArchitect — operated by Allied Circle, doing business as Learning Architectures, registered at 177, Secunderabad, India. This describes the relationship as it exists today; if your organization needs a countersigned, negotiated DPA, email us and we'll work through it directly.

1. Roles

When your organization submits information through ProgramArchitect on behalf of your own clients or participants (for example, participant personas, business context, or a call transcript used to build a design), your organization is the data controller for that information, and Allied Circle, operating as Learning Architectures ("we," "us") is the data processor, processing it solely to provide the service — generating your requested design, presentation, and workbook.

2. What we process, and why

The form fields and any transcript you submit through the design-request intake, processed by our AI generation pipeline for the sole purpose of producing your requested deliverables. We do not sell this data, and we don't use it to train third-party AI models beyond the API calls required to generate your design in the moment. See our Privacy Policy for the complete data inventory.

3. Sub-processors

We use a small number of infrastructure sub-processors to operate the service:

• Netlify — hosting and file storage.
• Neon — the underlying Postgres database (submission records, account/session data).
• Anthropic — the AI model that generates your design content.
• Resend — transactional email delivery (account and status notifications).
• Razorpay — payment processing (receives payment details directly; we hold only payment identifiers and amounts).
• Our architect team — only for designs with a paid architect review or architect-reviewed design: the assigned learning architect receives the generated design and the submitted intake (client contact names and emails removed) to review, redesign and sign it off.

We'll update this list if it changes, and you're welcome to ask for the current list directly at any time.

4. Security measures

See our Security page for the specific technical measures in place — session handling, rate limiting, upload validation, error monitoring, dependency auditing, and secret management.

5. Data retention and deletion

Submitted form content, transcripts, and generated deliverables are retained for up to one year from the date they were created, after which they're deleted unless your organization asks us to delete them sooner. If your organization needs specific data deleted before then — a participant's information, a full account, or an organization's records — email support@learningarchitectures.com and we'll process the request.

6. International transfers

Our infrastructure providers may process and store data in the United States. If your organization requires a specific transfer mechanism (such as EU Standard Contractual Clauses) for your own compliance obligations, email us — we'll work through what's needed for your situation.

7. Your obligations as controller

You're responsible for having a lawful basis to collect and share the information you submit to us, including any participant or client data, and for your own obligations to the individuals whose data it is (notice, consent, or otherwise, as your situation requires).

8. Requesting a signed agreement

This page describes our standard processing relationship. If your organization's procurement or compliance process requires a formal, countersigned DPA (including EU SCCs or your organization's own DPA template), email support@learningarchitectures.com with "DPA" in the subject line and we'll work through it with you directly.