Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Feedle Inc ("Processor", "we"), which runs decidenda, and the organisation that uses decidenda to invite people to rooms or programmes ("Controller", "you"). It applies to the personal data we process for you in doing so.

1. What we process, and why

• Subject matter. Running decidenda's team features for you: rooms on a case, programmes, the answers and reviews in them, and the emails that sign people in.
• Duration. For as long as you use decidenda, and until the data is deleted under section 8.
• Nature and purpose. Hosting and storage; sending sign-in and programme emails; reviewing answers people send for a review with an AI model; showing you participation and group results; measuring how the site is used.
• People. The people you invite (participants), and the people in your organisation who host rooms or programmes.
• Data.
  • Names and email addresses.
  • What participants write in answers and memos.
  • The reviews of what they send.
  • When they joined, sent and finished.
  • Technical and usage data: device, browser, pages visited.
• Special categories. None are needed. Ask participants not to include health, political, religious or similar information in what they write.

2. Your instructions

We process personal data only on your documented instructions. This DPA, the Terms of Use and the way you set up a room or programme are those instructions. If we think an instruction breaks data protection law, we will tell you.

3. Confidentiality

Everyone at Feedle Inc who can access personal data is bound to keep it confidential.

4. Security

We keep personal data safe with measures that fit the risk:

• Encryption. Every connection is encrypted (HTTPS), and stored data is encrypted at rest by our hosting providers.
• Database access. Only our server reads the database; there is no direct database access from the browser.
• Access by role. A room's or programme's host sees participation facts and group results. Hosts never see a participant's scores. Answers reach a host only when the participant chooses to show them, without their name. Group figures appear only from five people.
• Sign-in. People sign in with a one-time email link that works once and expires after an hour. There are no passwords to leak.

5. Sub-processors

You authorise these sub-processors:

Sub-processor	What it does	Where
Vercel Inc.	Hosts the website	United States
Supabase Inc.	Stores accounts and what people write	United States
Resend Inc.	Sends emails	United States
OpenAI, L.L.C.	Reviews answers sent for a review; turns dictation into text. Requests are sent with storage off and are not used to train models	United States
Amplitude Inc.	Measures site use and records sessions; form fields are masked, and room pages are left out of the recordings	EU data centre

We will announce a new sub-processor on this page at least 30 days before it starts processing your data. You may object within that time; if we cannot meet your objection, you may stop using decidenda for the affected data. Each sub-processor is bound by data protection terms that protect the data at least as well as this DPA.

6. Transfers

Personal data is stored and processed in the United States, except usage analytics, which Amplitude keeps in the EU. If your rules require the personal data we process for you to be kept in another region, such as the UK, the EU or Kazakhstan, tell us: we will store and process it there, agree the region and the date with you in writing, and update the list in section 5 before the move. For personal data from the EU, the EEA, the UK or Switzerland, the EU Standard Contractual Clauses (Module 2, controller to processor) apply. For the UK they apply with the UK Addendum. Both are incorporated into this DPA by reference.

7. Helping you

• People's requests. We help you answer requests from people exercising their rights: access, correction, deletion, objection. If such a request reaches us directly, we pass it to you.
• Breaches. We tell you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data. We tell you what happened and what we are doing about it.
• Assessments. We help, as far as is reasonable, with data protection impact assessments and with consultations with a supervisory authority.

8. Deleting the data

When you stop using decidenda, or on your request, we delete the personal data we process for you within 30 days. The exception is what the law requires us to keep.

A participant's own account and their own answers belong to the participant. They may keep them, or ask us to delete them.

9. Showing that we comply

On request, we give you the information needed to show that we meet this DPA. We answer reasonable audit questions in writing. An on-site audit is possible, at your cost, with 30 days' notice, once a year.

10. Order and law

Where this DPA and the Terms of Use differ on personal data, this DPA prevails. Liability under this DPA follows the Terms of Use.

---

Signed for the Controller

Organisation: ____________________
Name and role: ____________________
Date: __________

Signed for the Processor, Feedle Inc

Name and role: ____________________
Date: __________