Data Processing Agreement

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.
• "Data Subject" means the individual whose Personal Data is processed (your organisation's members).

We process Personal Data solely to provide the PersonDesk Organizations service, including confidential 1-on-1 support, the Townhall, and member management. We access the content of private conversations only when necessary for safety, abuse prevention, or legal requirements. [PLACEHOLDER: lawyer review]

Your organisation receives only aggregate usage data:

• Total number of members who used support (not who they are)
• Anonymous Townhall activity metrics (not individual posts)
• Seat utilization and billing information

Individual conversations, journal entries, and Townhall posts are completely confidential and inaccessible to organisation admins.

We implement industry-standard security measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row-level security in Supabase (PostgreSQL)
• Access controls and authentication (email/password and Google sign-in)

We retain Personal Data only as long as necessary to provide the service. When your organisation cancels, we delete all member data within 30 days. You may request earlier deletion by contacting [email protected].

We use the following sub-processors to deliver the service:

• Supabase — database and authentication (US-based, GDPR-compliant)
• Vercel — hosting and edge functions (US-based, SOC 2 certified)
• Stripe — payment processing (PCI DSS Level 1 certified)

We assist you in fulfilling Data Subject rights under GDPR, CCPA, and other applicable laws. Members can access, correct, or delete their own data via their profile settings. For bulk requests, contact us.

In the event of a data breach affecting your organisation's data, we will notify you within 72 hours of discovery, provide details of the breach, and assist with mitigation.

If your organisation is in the EU/EEA, we ensure adequate safeguards for international data transfers via Standard Contractual Clauses (SCCs) or adequacy decisions.

For privacy inquiries or to request a copy of this DPA, contact us at [email protected].