Data processing agreement

Last updated October 12, 2026

How we process personal data on your team's behalf, as data protection law such as the GDPR requires.

Parties

This agreement is between Placeholder Company, 123 Placeholder St, Suite 100, City, ST 00000, Country ("we", the processor), and the customer that accepts our terms for a team ("you", the controller). It is part of the terms, and applies whenever we process personal data on your behalf.

Subject and duration

We process personal data only to provide the service to your team, as the terms and the privacy policy describe, for as long as your team exists and for the 30 days after its deletion during which it can be restored.

Personal data and data subjects

The data subjects are your team's members, the people you invite, and anyone whose data your members upload. The personal data is their names, email addresses, roles, and sign-in details; the IP address and browser of each signed-in device; the audit log of their actions; and the files and content your members upload.

Your instructions

We process personal data only on your documented instructions: the terms, this agreement, and the way you set up and use the service. If the law requires other processing, we tell you first, unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

Confidentiality

Everyone we allow to process personal data is bound to keep it confidential.

Security

We protect personal data with appropriate technical and organizational measures, including encryption in transit and at rest, each team's data kept apart from every other team's, access limited by role and permission, and limits on sign-in attempts.

Subprocessors

You authorize us to use these subprocessors. We'll tell you before we add or replace one, so you can object; each is bound by data protection terms at least as protective as these.

Cloudflare

Hosts the service and stores and processes its data: the database, files, email, reading the files and converting the photos you send the assistant, analytics, and the Turnstile check that sign-up and sign-in come from a person.

Anthropic

Runs the assistant's AI model (Claude) on your messages, the files you attach, and the bakery data it looks up to answer you.

Paddle

Our merchant of record, processes payments, taxes, and invoices. Card details go to Paddle and never reach us.

Google and GitHub

Confirm who someone is when they sign in with Google or GitHub.

Helping you

We help you answer requests from data subjects, mostly through the service's own export, correction, and deletion tools, and help you with security, data protection impact assessments, and consultations with authorities, as far as our processing is concerned.

Personal data breaches

We tell you without undue delay after we become aware of a breach affecting your team's personal data, with what we know and what we're doing about it, so you can meet your own duty to notify.

International transfers

Our subprocessors may process personal data outside your country. Where the law requires it, these transfers rely on the European Commission's standard contractual clauses or another lawful safeguard.

Deletion and return

You can export your team's data at any time. When your team is deleted, we delete its personal data 30 days later, except what the law requires us to keep, such as billing records. Our database's point-in-time backups keep deleted data for up to 30 more days, and its daily backups for 35 days, then it's gone for good.

Audits

We make available the information you need to show that we meet this agreement, and allow audits by you or an auditor you appoint, with reasonable notice.

This agreement applies as soon as you accept our terms, with nothing to sign. For a signed copy, write to support@farinu.com.