Data Processing Agreement

1. Scope

This agreement is part of the Terms of Service between David PM, LLC ("we") and each organisation that uses Meowdy ("you"). It applies to personal data you put into Meowdy or that Meowdy collects for you, and it lasts as long as we hold that data. Where this agreement and the Terms differ on data protection, this agreement applies.

2. Roles

You decide what personal data goes into Meowdy and why; you are the controller. We process it only to provide Meowdy, following your instructions as set by these terms, by your settings, and by the features your people use. If we think an instruction breaks the law, we tell you.

3. The data and the people

• People: your owners, admins, managers and members; the people you add without an account; and contacts named in your work.
• Data: names, emails, phone numbers, titles, reporting lines and teams; the measures, tiers, results, reviews, plans, tasks and project cards that belong to them; messages, notes and files.
• Do not put sensitive categories into Meowdy, such as health, religion, union membership, or government identification numbers. Meowdy is not built to hold them.

4. What we do

• Keep the data confidential and limit access to staff who need it, under confidentiality duties.
• Protect it with the measures on the Security page, including access rules on every table, encrypted connections, links stored only as hashes, and staff access to your content only with your grant, logged and shown to you.
• Help you answer requests from people about their data, and with security and impact assessments, as far as is reasonable.
• Tell you without undue delay, and within 72 hours of confirming it, if your personal data is exposed in a security incident, with what we know and what we are doing.
• Delete or return the data when the service ends, as set out below.

5. Companies that help us

You authorise these providers. Each processes data only for the job listed, in the United States, under written terms that protect it at least as well as this agreement.

• Cloudflare, Inc.: hosting, delivery and file storage.
• Supabase, Inc.: the database and sign-in.
• Anthropic, PBC: Claude, for conversation, drafting and summaries.
• TypeSafe: Jev, for short judgments on English text.
• ActiveCampaign, LLC (Postmark): email delivery.
• Stripe, Inc.: payments.
• Apple Inc.: the iOS app and its notifications, for people who use them.

We give at least 30 days' notice before adding or replacing a provider, on this page and by email to account owners. If you object for a reasonable data protection reason and we cannot address it, you may end the affected service and we refund any prepaid fees for the unused period.

6. Data from outside the United States

Meowdy processes data in the United States. Where the law where your people live requires a transfer mechanism, such as the European Union's Standard Contractual Clauses or the United Kingdom's addendum, we sign it with you on request, and it applies to the transfer.

7. Checks

We give you the information you reasonably need to confirm we meet this agreement. If that is not enough, you may audit once a year with 30 days' notice, during business hours, under confidentiality, and at your own cost, in a way that does not expose other customers' data.

8. Return and deletion

You can export your data from Meowdy at any time. When an owner deletes the account, we delete the data from our active systems at once and from backups within 30 days. If the service ends another way, you have 30 days to export before we delete it. We keep only what the law requires us to keep, such as payment records, and only for as long as it requires.

9. Your part

You make sure you may put the data into Meowdy, that you have told your people what you keep about them and why, and that your instructions to us follow the law.