P3 Data Sharing Addendum

This Addendum governs personal data about your students that P3 processes in connection with your subscription. It forms part of the Enterprise Subscription Terms 2026.1 and is entered into by The Pulse of Perseverance Project, Inc., a 501(c)(3) nonprofit corporation incorporated in Illinois.

P3 does not claim school official status under the Family Educational Rights and Privacy Act, and this Addendum is not drafted on that basis.

P3 runs a free mobile and web platform on which students register directly, consent to P3's own Terms and Privacy Policy directly, and use mentorship, opportunity, career pathway and milestone features. Your institution receives aggregated reporting about the students who have claimed it. Your institution does not provide education records to P3 under this Addendum, and P3 does not process any on your behalf.

This Addendum applies to data students submit directly to P3, to the affiliation a student asserts by claiming your institution, and to the aggregated reporting P3 generates for your institution from them.

The analytics available through the Dashboard describe student participation and engagement on the P3 platform, as students reported it. P3 holds no registrar or employer record and does not verify anything a student reports against your systems or anyone else's.

The account a student created. Name, email, and the profile fields a student filled in themselves: education goal, the help they are looking for, industry interest and meeting rhythm.

What a student did on P3. Mentor matches, conversations, milestone check-ins, saved opportunities and app activity.

What a student told us about themselves. Outcome milestones require a note before they complete, so a student says in their own words where they started work or which major they chose. The career timeline holds the education and roles they entered, with organization and years. All of it is volunteered, and none of it is verified.

The institution a student claimed. One organization identifier, set by the student, from your join code or link, and removable by the student at any time.

Anything from your systems. No student information system record, no learning management system record, no roster, no transcript, no financial aid record. P3 has no feed from any of them and asks for access to none of them.

A verified outcome record. P3 holds no registrar or employer record. Graduation, major, first role and employer reach P3 only when a student volunteers them, in a milestone or their own career timeline, and P3 does not verify any of it against your systems or anyone else's. There is no GPA, no credit hours, no salary, no credential award from an awarding body, and no enrollment verification.

Demographics or location. No race, ethnicity, first generation status, Pell eligibility or home address. P3's records carry no location field. Analytics city and region are derived from a device's network address and are never treated as where a student lives.

Any cost data about your institution. P3 holds none, which is why no dollar figure of any kind appears anywhere in the dashboard.

P3 does not accept a list of your students. Students claim your institution themselves, from a join link, a six character code or a printed poster, and a student can remove that claim at any time.

If your institution needs P3 to receive a roster, that requires a separate signed agreement naming the data elements, the transfer method, the retention period and the deletion trigger. It cannot be accepted online, and nothing in this Addendum authorizes it.

P3 is the controller of the personal data it collects directly from students through the P3 platform, including the profile a student completes, their mentorship activity, their engagement with opportunities and career pathways, their questions, their milestone check-ins and the notes they attach to them, and the institution they claim. Students hold a direct relationship with P3 under P3's own Terms and Privacy Policy.

Your institution is an independent controller of any information it holds in its own systems. This Addendum does not make P3 a processor of your institution's records and does not establish a controller to processor relationship for platform data, because none of that data comes from you.

Where P3 generates aggregated reporting for your institution, P3 acts as an independent controller for the purpose of creating it, and the output is governed by Sections V and VI.

Requests from students to access, correct, delete, port or restrict their personal data are directed to P3 and handled under P3's Privacy Policy at https://www.pulseofp3.org/privacy. P3 responds to a verified request within 30 days unless the law requires sooner. Your institution will not act on a student's platform data, and cannot, because it never receives it.

P3 is not a school official under the Family Educational Rights and Privacy Act and does not maintain education records on your behalf. Data a student submits to P3, including the affiliation the student asserts, is not an education record of your institution in P3's hands. Because P3 accepts no roster under this Addendum, no obligation under that Act attaches to anything your institution supplies.

No figure representing fewer than 10 students appears anywhere in the partner dashboard or in any export. Where showing the remaining figures would let a hidden one be worked out by subtraction, we hide a second one as well. This is the same threshold state education agencies use in public reporting, and it is a commitment in your Data Sharing Addendum rather than a setting somebody at P3 can change.

Both the aggregation and the suppression happen on P3's servers. A suppressed value never reaches your browser, because there is no view and no export that contains one. There is also no individual level export, deliberately and permanently, because offering one would defeat the commitment we just made you.

The practical consequence, stated up front rather than discovered later: a small cohort will see totals and a growth curve, and will see most breakdowns held back until the cohort grows. The dashboard tells you how many students each view still needs.

The floor is 10 individuals. It is a commitment in this Addendum and not a setting, and changing it is an amendment to this Addendum. Where a figure is withheld, the Dashboard says that it is withheld and why.

P3 provides your institution with the Dashboard and its exports. At the effective date of this Addendum the Dashboard reports, for the students who have claimed your institution: how many have claimed it and how that number has grown; how many have at least one active mentorship, and how many have asked for a mentor and are waiting; what students say they want help with, their education goal, their industry interest and their meeting rhythm; their activity on the platform, such as opportunities opened and applied to and questions asked; and the milestones they have completed and the outcomes they have reported, which P3 labels as student reported and unverified.

Every figure is a count of the students behind it, and every one is subject to Section V. P3 does not report on a student individually and does not report dollar figures. Your cohort is compared only against all P3 students in aggregate, never against a named institution or a third party benchmark, and no figure is presented as an effect P3 caused.

P3 may improve, revise, replace or retire particular figures, frameworks and features, including its milestone framework, provided the Dashboard as a whole keeps substantially equivalent functionality and value. P3 will not add a figure that represents fewer individuals than Section V allows.

P3 identifies your institution's cohort only from claims students make themselves, from your join link, your six character code or your printed poster. P3 does not verify enrollment.

P3 does not sell personal data. P3 may use aggregated or de-identified information that cannot reasonably identify a student or your institution for platform analytics and improvement, grant and funder reporting, research and impact studies, and publications. Anything that names your institution beyond its name and logo needs your prior written approval under Section 17 of the Terms.

P3 stores personal data governed by the Data Sharing Addendum in United States regions of its cloud providers, and P3's subprocessors are entities organized in the United States. Certain edge computing, content delivery and network security functions may process data in transit at points of presence outside the United States. That processing is transient, is incidental to delivering the service, and does not result in personal data being stored outside the United States.

P3 will tell your Administrators before it moves storage of personal data governed by this Addendum outside the United States, and will treat that as a material change under Section 18 of the Terms.

P3 maintains administrative, technical and physical safeguards designed to protect the confidentiality, integrity and availability of personal data. P3 does not hold a SOC 2 Type I or Type II report, has not completed a NIST SP 800-171 assessment, and does not represent that it has. Where this Addendum names a safeguard, that safeguard is a present commitment and not an aspiration.

The safeguards include:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest on each store P3 uses, as provided by the subprocessors named in Section X.
• Suppression of any reported figure representing fewer than 10 individuals, applied on P3's servers before the figure is transmitted to your institution.
• No endpoint that returns your institution's analytics accepts an organization identifier from the caller. The institution is read from the Administrator's server side session.
• Administrator sign-in by single-use code sent to an address on your institution's verified domain, with server side sessions that P3 revokes when an Administrator is removed.
• Server side role checks, re-read from the membership record on every request, for the owner, admin and viewer roles.
• An append-only audit log of sign-ins, invitations, role changes, metrics reads and exports, which your institution can export.
• Security monitoring and error logging, and documented incident response and disaster recovery planning.

On request and at no charge, P3 completes your institution's standard security questionnaire, including the Higher Education Community Vendor Assessment Toolkit, and supports an assessment of the institutional surface, which is one Cloudflare Worker and one web application.

P3 maintains practices designed to align with applicable United States state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act and the Texas Data Privacy and Security Act, as they apply to P3.

If P3 confirms unauthorized acquisition, disclosure or compromise of personal data governed by this Addendum, P3 notifies your Administrators within 72 hours of confirming it.

The notice includes, where reasonably available: the nature and scope of the incident; the categories of information affected; the containment and remediation measures taken; the mitigation still under way; and any protective steps P3 recommends.

P3 cooperates in good faith with your institution on incident response and on any notification the law requires of either party.

P3 uses the subprocessors named below. P3 gives you 30 days written notice before a new subprocessor starts processing personal data governed by this Addendum.

• Amazon Web Services, Inc.: Core platform infrastructure and the application database. Region: United States.
• Cloudflare, Inc.: Edge compute and databases for the enterprise gateway, Pulse AI, Conversations and the web app. Network security and content delivery. Region: United States, with transient edge processing worldwide.
• Anthropic, PBC: AI features: the Pulse assistant, Discover, CV review, and automated moderation of mentor and student messages. Region: United States.
• Algolia, Inc.: Search indexes for mentors, students, opportunities, posts and questions. This is the index the institutional dashboard reads. Region: United States.
• Google LLC (Firebase): Mobile analytics, crash reporting and deep links. Region: United States.
• Amplitude, Inc.: Product analytics. Region: United States.
• Retool, Inc.: Internal administration console used by P3 staff. Region: United States.
• Twilio Inc. (SendGrid): Transactional email. Region: United States.
• Resend: Administrator sign-in codes and safeguarding alert delivery. Region: United States.
• Intercom, Inc.: Customer messaging and support. Region: United States.
• Functional Software, Inc. (Sentry): Error and crash monitoring, including session replay. Region: United States.
• Stripe, Inc.: Payments, invoicing and quotes. Stripe never receives student data. Region: United States.
• 3Advance, LLC: Engineering delivery partner for the P3 platform. Region: United States.

The current list, with a dated change log, is published at /legal/subprocessors. If you object to a new subprocessor on documented data protection grounds within the notice period, we discuss it in good faith, and if it cannot be resolved you may terminate under clause 16.3 of the Terms.

Stripe processes your institution's billing contact and payment details and never receives student data. Every subprocessor named here, including P3's engineering delivery partner, is bound by confidentiality and data protection obligations consistent with this Addendum.

P3's services are not directed to and are not available to children under 13. P3 may provide services to students aged 13 to 17. The Children's Online Privacy Protection Act applies to children under 13, and P3 does not knowingly collect personal information from them.

For students aged 13 to 17, P3 screens age at registration, limits collection to what is reasonably necessary to provide mentorship, opportunity, career pathway and milestone features, and applies further restrictions: P3's AI features and direct messaging between a student and a mentor are available only to users aged 18 and over. Figures about AI features in the Dashboard therefore describe students aged 18 and over only, and the Dashboard says so.

P3 maintains practices designed to align with applicable state minor privacy and age appropriate design requirements as those laws take effect.

Administrator access to live reporting ends. Your dashboard stays available in read-only export mode for 12 months so you can retrieve what you need.

Your students' access to the P3 app is never affected by the end of this agreement. Students hold their own relationship with P3.

Because P3 accepts no roster under this Addendum, there is no institutional record to return or delete. Student data stays governed by P3's Privacy Policy and the student's own relationship with P3. Aggregated and de-identified reporting that cannot reasonably identify a student or your institution may be retained. P3 keeps its own record of your acceptance of the Terms and this Addendum for as long as the law allows a claim on them.

Your institution may request reasonable documentation of P3's security and privacy practices. P3 provides, at no charge: its completed response to your security questionnaire, including the Higher Education Community Vendor Assessment Toolkit; its current subprocessor list; a summary of its incident response practice; and a certificate of insurance. P3 does not hold a SOC 2 report or a third party penetration test report and will not represent that it does. If your institution requires either, we discuss scope and cost separately.

On-site audits are not permitted unless required by law or agreed in writing. P3 cooperates reasonably with your institution's standard vendor review and security assessment process.

P3 maintains commercial general liability and cyber liability insurance and provides a certificate of insurance on reasonable request. The coverage types and limits are the ones stated on that certificate.

Liability under this Addendum is governed by Section 15 of the Terms. Liability connected with privacy, confidentiality, security or data protection sits inside the cap in clause 15.2 of the Terms and is not unlimited or uncapped.

This Addendum takes effect when you accept the Terms and remains in effect for as long as the Terms remain in effect, including through any renewal period. It terminates automatically and at the same moment as the Terms. Neither party may terminate this Addendum separately or on notice, and this Addendum grants no right to terminate that the Terms do not grant. Termination rights, including the right of either party to terminate for convenience on 60 days written notice, are set out in Section 16 of the Terms and apply to this Addendum through them.

This Addendum is governed by the law and subject to the venue stated in Section 19 of the Terms, including the public institution provision in clause 19.3.

Sections V, VII, XII and XIII of this Addendum survive termination.

This Addendum, together with the Terms and your Order Summary, is the entire agreement between P3 and your institution about the personal data P3 processes in connection with your subscription, and replaces any prior discussion or representation about it. It is accepted electronically together with the Terms and has no separate signature page.

Every published version of this Addendum stays at its own permanent address and is never edited after publication. Material changes are made under Section 18 of the Terms, by a new version accepted at renewal.