Data processing agreement

This is the agreement under which GasBuggy Media LLC processes personal data on behalf of a customer using facets.team. It gives effect to Article 28 of the UK GDPR and of Regulation (EU) 2016/679, and it carries the standard contractual clauses for moving personal data out of the United Kingdom and the European Economic Area.

You do not need to sign it. Accepting the terms of service has the same effect as signing this document and the clauses annexed to it, and it takes effect from the moment you create an account. We will counter-sign a copy for any customer whose procurement needs one — write to privacy@facets.team — but the protection does not wait for that and never depended on it.

It applies wherever UK or EU data protection law applies to what you are doing, and it does no harm where neither does. We have not made it conditional on your telling us which you are: a customer who discovers halfway through a cycle that they have employees in Ireland should find the agreement already in place rather than discover they needed to ask for it.

You are the controller and we are the processor for everything your people put into the service: the roster, survey invitations, ratings, written comments, nominations, self-assessments, and everything in the manager tools — goals, check-ins, colleague input, performance bands and written assessments, and the idea boards, with their canvases and pictures, and projects that managers run with their teams. You decide why it is collected and who is included. We process it to run the service and for no other purpose.

The customer is the organization that owns the workspace, whoever created it. A practitioner may create a workspace for a client, or work in one the client already has. Once the client’s owner has accepted the practitioner’s engagement, the client’s organization owns the workspace and is the customer, and the controller, for what it holds. A practitioner the customer engaged works in it on the customer’s instructions, as one of the customer’s authorized users, as the customer’s own admins do; their access is recorded, and it ends when the engagement does. A practitioner’s own workspace is theirs, and there the practitioner is the customer.

We are the controller, and this agreement does not apply, for the account data of the person who signs in — their name, their email address, their sign-in records — and for the ordinary operation of the public website and our billing. The privacy policy governs those, and clause 1 of it says the same thing.

The line matters more here than it usually does, because the two halves of the service sit on different sides of it in the way people expect and the same side in law. Whether a rating is developmental or a performance record changes what may be done with it under terms clauses 2A and 2B; it does not change who is the controller. You are, for both.

We process personal data only on your documented instructions. Your instructions are these terms, this agreement, and what you and your people do in the product — opening a cycle, inviting a rater, running a report. There is no other channel by which we take instruction, and a request from someone who is not an account holder is not one.

If we think an instruction breaks data protection law, we will tell you and may pause that processing until it is resolved. If a law we are subject to requires us to process beyond your instructions, we will tell you before we do unless that law forbids it.

We do not use anything your people write to train machine-learning models, and we do not sell it. Terms clause 6 permits us to compute aggregated, de-identified statistics across many organizations to improve the instrument and, in future, to publish research from them. That is the one use beyond running the service, it is described there, and clause 6 also says how to opt out of it.

Everyone we permit to touch personal data is bound to keep it confidential, by contract or by a duty that survives their leaving. Administrative access to production is limited to a small number of named operator accounts, each of which must pass a one-time code from an authenticator app before the operator console opens; the roster is revocable and report accesses are logged. Annex II gives the rest.

We keep the technical and organizational measures set out in Annex II, which describe what is in place today rather than what we intend. Where a measure has a known limit — the backup window, the absence of an off-site copy, the fact that no security audit has been completed — Annex II says so, and /security keeps the longer version. We may change a measure, and will not reduce the overall level of protection by doing so.

You give us general authorization to engage the sub-processors listed in Annex III. Each is engaged under a written contract imposing obligations equivalent to these, and we remain fully liable to you for what any of them does.

If we want to add one, we will email every workspace owner at least thirty days before it begins handling any data. Within those thirty days you may object on reasonable data-protection grounds by writing to privacy@facets.team. We will make a good-faith effort to offer you a way to keep using Facets without that provider; if we cannot, you may end the affected part of your subscription without penalty and we will refund what you have paid for time you have not used. If a provider has to be replaced at short notice to keep the service secure or running, we will tell you as soon as we reasonably can rather than thirty days ahead. This is the same commitment clause 5 of the privacy policy makes, in the same words, because it is the same promise.

The product is built so that most of this does not need us. A manager can export any person’s record and any assessment at any time. A participant can be told what was collected from them, because the consent screen says it before they answer. Where a request does need us, we will help you meet it within the time the law gives you, at no charge, and if a request reaches us directly we will pass it to you rather than answer it ourselves.

One thing we will not do. We will not tell you, or anyone with an account, how a particular person rated somebody or what they wrote. Individual peer ratings have no read access for any signed-in account, results appear only when enough people have answered (the minimum depends on the survey and the kind of result; Annex II lists them), and written comments are never quoted verbatim. That is not a limitation on our assistance to you; it is how the product is built, and terms clause 4 makes it an obligation on you as well.

The consequence is worth stating plainly: a subject access request cannot be used as a route to rater identity, by you, by an employee, or by us on anyone’s behalf. Where a regulator or a court orders otherwise we will comply and will tell you unless we are forbidden to.

What a requester does get, so that you can answer them. Their results as the product shows them, which they can already reach. The substance of what was written about them, in paraphrase, which is the only form it exists in for reporting. Not individual ratings tied to a rater, and not rater identity. Where paraphrase would still identify the writer — on a small team, content does that by itself — a description of the theme rather than the text, disclosed as such rather than passed off as the whole. Clause 7 of the privacy policy says the same thing to the person making the request, in the same order, and the two are meant to be read together.

We will not approach a rater for consent, and you should not either. It is the orthodox mechanism and it defeats the purpose: asking tells the rater they have been identified as one, and a declined request is itself information about them. Terms clause 4 already makes pressuring a rater a breach on your side; this is the same rule applied to us.

On who is striking this balance. You are the controller, so the Article 15(4) assessment is formally yours. We are not making it for you case by case. The constraint is a property of the system you bought — individual ratings have no read access for any account, and the floors cannot be lowered by you, by a manager, or by anyone signed in, with the single exception Annex II records: a lower floor set on one engagement cycle at your written request, never as a default, and shown on that cycle’s own page to everyone who can read its results — and it applies to every request identically, including ones you would rather answer in full. If that is not a constraint you can work within, it is better found before a cycle opens than during a request.

Rectification and erasure need the same care. An opinion is not made accurate by being corrected; what can be corrected is the record that it was expressed, and a data subject may have a statement of their own recorded beside it. Erasure of individual answers about a person removes part of an aggregate other people’s results were built from. We will help you work out which is possible in a given case.

If personal data is breached we will tell you without undue delay and in any case within seventy-two hours of becoming aware — first with whatever we know at the time, which may be very little, and then in writing with the full account once we have it. We will not wait for a complete picture to make the first call. We will give you what you need for your own notifications, and we will not notify your regulator or your people on your behalf unless you ask us to or the law requires us to directly.

For a product built on people answering candidly, a breach is not only a data loss. It is an unmasking, and we treat it that way.

We will help with a data protection impact assessment or a prior consultation, and we will give you whatever description of the system a works council or equivalent consultation needs. Terms clause 4 names that obligation as yours and this is the half of it that is ours; asking us costs nothing and finding out late is expensive.

Raw answers are deleted within 90 days of the team or organization leaving the service. That covers per-person ratings, free text, nominations, self-assessments and engagement responses — seventeen tables. It is the commitment made to every participant on the consent screen before they answer.

Backups add up to seven days to that. Our database provider takes automatic daily backups and keeps them on a rolling seven-day window in the same region, so a backup taken before a deletion holds the deleted rows until it ages out. End to end that is ninety-seven days, and we would rather publish the second number than let the first imply something cleaner than the truth. There is no off-site copy and point-in-time recovery is not enabled.

Two things deliberately survive. Derived reports — evidence packs, coaching packs, briefs, engagement scorecards — are kept, because they are your record of a debrief that happened and they identify nobody once the reporting floors have been applied. The respondents’ own words that a report carried forward — comments, and notes written to a facilitator — are emptied from it at the same time as the answers are deleted, and its scores, bands and counts stay. Survey links, invitations and the roster kept for the next engagement cycle are deleted then too, and the email addresses of the people the kept reports still name are removed, with their names kept. And the audit log keeps its entries, including entries recording that something existed which has since been deleted; a log that could be erased by the same action it exists to record would not be a log. It holds what happened and when, not the answers, and no email address; nothing in the service can edit or delete an entry.

On termination you have sixty days to export before anything is deleted, matching the notice in terms clause 7. Ask at privacy@facets.team for deletion of a team, a review, or a whole account at any other time and we will do it.

Export is self-serve, with one deliberate gap. An owner or admin can download the workspace from its settings at any time: each team’s roster and team packs, each engagement cycle’s written summary and themes, and a record of what was bought. A manager can export any person’s record and assessments, and each idea board and project they run. Individual feedback notes and leadership briefs are never in a workspace download, because each is readable only by the person it is about or the facilitator named for it. For anything else you need that a download does not give you, ask at the same address and we will send it within thirty days. Terms clause 7 says the same thing.

We will give you the information you need to show that we are meeting these obligations. /security is the standing version and is written to be read by somebody evaluating us rather than somebody being reassured; our sub-processors’ own certifications are named there.

No independent security audit of Facets has been completed. There is no SOC 2 report and we do not imply one. If your procurement requires it before signing, say so early: it is a real piece of work with a real cost and a real calendar, and it belongs in an agreement as a scoped commitment rather than as a box we tick optimistically.

You may audit us once in any twelve months on reasonable written notice, or more often if a regulator requires it or after a breach affecting your data. You pay your own costs, we pay ours, and anything you learn is confidential.

We are in the United States and so is the service, so personal data coming from the UK or the EEA is transferred out of it. Two mechanisms are incorporated into this agreement and take effect without either of us signing anything further.

For the EEA: the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor). You are the data exporter, GasBuggy Media LLC is the data importer. The optional docking clause applies; the Clause 17 governing law and the Clause 18 forum are those of Ireland, unless you are established in another member state, in which case they are that state’s. Annex I, II and III below are the Annexes to those clauses.

For the UK: the same clauses as modified by the Information Commissioner’s International Data Transfer Addendum (version B1.0), which is incorporated with the tables completed by Annexes I to III below and with no additional protections selected. The importer may end the addendum where a change in UK law makes it no longer possible to comply.

We rely on the clauses rather than on adequacy, deliberately. Some of our sub-processors are certified under the EU–US Data Privacy Framework and could carry a transfer on that basis, but the framework is under appeal to the Court of Justice, the US oversight board it depends on has lacked a quorum since January 2025, and two earlier frameworks were struck down. A transfer resting on a mechanism that may not exist next year is not a protection we want to be relying on when it stops existing. Where a sub-processor is DPF-certified that is a second basis and not the first one.

Onward transfers by a sub-processor are made under its own equivalent clauses, verified against each provider’s published terms. Where those clauses conflict with these, these prevail as between you and us.

The standard contractual clauses win over this agreement, and this agreement wins over the terms of service, in each case only on the point of conflict and only where the winning document gives more protection. A signed agreement under terms clause 1A can replace this one for the customer who signed it, and cannot reduce what a participant was told on the consent screen.

Data exporter. The customer — the organization that owns the workspace, whoever created it — acting as controller. Its name, address and contact are those on its account; its activities relevant to the transfer are running team feedback surveys, leadership 360s, engagement cycles and manager tools for its workforce or, where the customer is a practitioner, for the workforce of a client that engaged it under the practitioner licence. A client that engaged a practitioner in a workspace of the client’s own is the controller of that workspace, and its data exporter.

Data importer. GasBuggy Media LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110-7825, United States, acting as processor. Contact: privacy@facets.team. Its activities relevant to the transfer are operating facets.team.

Categories of data subject. The customer’s employees, workers and contractors, and, where the customer is a practitioner running a client’s team in the practitioner’s own workspace, the client’s, in whichever of these roles they occupy: people rated by their team, people who give ratings, leaders receiving a 360, raters in a 360, respondents to an engagement cycle, managers, people managed, colleagues asked for written input on an assessment, and people a manager adds to an idea board or a project.

Categories of personal data. Name, work email address, job role, team membership and reporting relationship; ratings on the instrument’s items; free-text answers and comments; nominations; self-assessments; engagement responses and comments; and, in the manager tools, goals, check-in notes, colleague input, performance bands and written assessments, and topics a person adds for their own one-to-ones; on idea boards, ideas, comments, votes and reactions, what is drawn on a board’s canvas and pictures uploaded to it; and on projects, tasks, checklists, comments and a log of who changed what; hours a week noted by a manager for a person they track; hours a week planned for a named person on a project or on work tracked elsewhere; a weekly load computed from those and from task estimates, not stored.

Updates sent outside a project. A manager who runs a project may name people outside it to receive the updates they write about it, typing a name and an email address for each, which only that manager can see; those people are sent the manager’s own words about the work with counts and dates taken from the project, never a comment, the log of who moved what, or a figure about one person, and every update email carries a link that stops them. A manager may also switch on a read-only link, of which only a one-way hash is stored: anyone holding it reads the project’s updates, its milestones, and the title, status and due date of each open task, and nothing else. The names and addresses of the people updates are sent to are deleted with the project’s member records within 90 days of the organization leaving the service.

Days off and capacity on a project. A manager who runs a project may note the days each person on it is away, and each person may note their own; only that manager and that person see them. A day off is deleted once it has passed. If that manager turns on planning around each person’s weekly capacity, the dates a schedule then sets can reflect how many days a week each person works, and those dates are seen wherever the project’s dates are seen.

Special categories. None. Terms clause 2B forbids using the manager tools to record health data, beliefs, or any other special category, and the surveys have no field that asks for one. If special category data is entered anyway it is entered against instructions, and clause 3 above applies.

Frequency. Continuous for as long as the account exists.

Nature and purpose. Collecting, storing, aggregating, scoring and reporting structured feedback for the customer’s development purposes, hosting the customer’s own performance records, and hosting the idea boards and projects its managers run with their teams.

Invitations by direct message. At your choice, for each engagement cycle, team survey, pulse or Leadership 360, we deliver its invitations and reminders as direct messages through your own Slack app or Microsoft Teams flow, each to the person it invites and carrying that person’s own link and nothing about anyone else. We look the person up by their work email address at the moment of sending and keep no Slack or Teams identity for them, only whether their invitation went by direct message or by email. Anyone the service cannot find or reach is sent the email instead, and everyone invited through Teams is sent the email as well. Each direct message that carries a person’s own link also carries a link with which that person can stop your direct messages to them, after which we send them only the email.

A roster from your own systems. At your choice, the roster for your engagement cycles may be sent to us by your own HR system or identity provider, which remains your processor and is not our sub-processor; we keep from it each person’s name, work email address, manager, department, whether they are active and their end date, with the identifiers it uses for them, and write nothing back to it.

Duration. For the life of the account. Raw answers are deleted within 90 days of a team or organization leaving, plus up to seven days in backups. Derived reports and audit entries persist as clause 9 describes.

Competent supervisory authority. The supervisory authority of the EU member state in which you, as the data exporter, are established. Where you are not established in the EU but are caught by Article 3(2) and have appointed an Article 27 representative, it is the authority of that representative’s member state; where neither applies, it is the authority of a member state in which the data subjects are located. For a transfer under the UK Addendum it is the Information Commissioner’s Office. This is stated as the rule rather than as a name because the answer depends on facts about you, and naming one authority would be wrong for most customers.

Encryption. Data is encrypted at rest with AES-256 and in transit with TLS by our infrastructure providers.

Field-level encryption. In addition, the service encrypts the following with AES-256-GCM before they are stored, under keys kept outside the database, with each value bound to its column and to the record it belongs to, so that a value copied into another column or onto another record will not decrypt: what a manager records about the people who report to them (notes, check-ins, results against goals, one-to-one notes and agendas, the topics a person adds for their own one-to-ones, follow-up actions, conversation guides and assessments, colleague input and handover notes, and what someone said in a growth or stay conversation); the written answers given in team surveys, 360 reviews and engagement surveys, with the comments and notes to a facilitator that reports keep; shared open links; and the addresses of connected Slack and Teams channels. Names, email addresses, job titles, goals, ratings, idea boards and projects are not encrypted this way. The keys are held by us, and customer-held keys are not offered. This protects what is stored this way against a copy of the database or its backups, not against a compromise of the running service, which holds the keys.

Access control. Administrative access to production is limited to named operator accounts, controlled by an allowlist in the deployment configuration together with a revocable roster, and each must additionally pass a one-time code from an authenticator app before the operator console will open. Customer accounts may enable two-step verification; it is offered and not required. Report accesses are logged.

Access links. Participant links are random tokens of which only a one-way hash is stored, so an existing link cannot be looked up or read back by anyone, including us.

Shared open links. The one exception is a shared open link: the single link one of your users may switch on for an idea board, a project or a leadership review so that a whole team can join by it. While it is switched on it may be stored as the link itself, not only as a hash, so that the user who switched it on can copy it again later; that copy is encrypted, as the measure above describes, it is shown only to that user, and it is deleted when it is switched off or replaced, when a review’s link reaches its limit, or when the board, project or review it belongs to closes. Personal links are never stored this way.

Business-intelligence feed. A read-only feed to the customer’s own business-intelligence tool under a credential the customer’s manager holds; no sub-processor of ours is involved.

Segregation and least privilege. Row-level security separates one workspace from another. Individual peer ratings have no read access for any signed-in account, including the customer’s own administrators.

Data minimization in reporting. Results appear only when enough people have answered, and the minimum depends on the survey and the kind of result. In a team survey, a person’s own scores need 3 raters, question-level detail 5, summaries of the four self-reports 4 people, trust 6 rated pairs, and comment themes 3 writers. A Leadership 360 needs 3 raters, and 5 for question-level detail and the overall questions. An engagement cycle reports a group only at 5 respondents by default, a figure the customer may raise to 50. Counts are completed responses, not team size. Unit and manager suppression apply jointly; free-text answers are paraphrased rather than quoted. These floors cannot be lowered by a customer, a manager, or anyone with an account. One exception exists: at the customer’s written request, a lower floor, below 5, can be set on a single engagement cycle before it opens, never as a default. The cycle’s own page says so in plain sight to everyone who can read the results, and everyone invited to it sees the floor in force before answering.

Model provider constraints. Where narrative output is enabled, the model provider receives aggregates, or comments with the writer’s identity removed, and never the confidential note to a facilitator. Where a manager asks for a conversation guide, a one-to-one agenda, follow-up actions from their notes, measurable wording for a goal or a draft assessment for someone who reports to them, it receives what that manager has recorded about the person, up to a fixed length for each: for a guide or an agenda, the person’s name, their role and the shape of their work, what they are accountable for and the strengths, development areas and support needs noted for them, their goals and results, check-ins and open follow-up actions, with what the manager typed for it; for a draft assessment, the same, with the manager’s answers to its questions, what the colleagues the manager asked wrote, with their names removed, and any summary the person chose to share with their manager; for follow-up actions, the person’s name and the manager’s notes; for a goal, the draft and the person’s role, and not their name. Where a manager asks for the guide to a growth or stay conversation adapted to the person, it receives the person’s role title, the name of the kind of work they are filed under and what they said in the last conversation of the same kind, up to a fixed length, and never a check-in, a band, a goal, a result, an assessment or anything a colleague wrote. Text goes as it was written, by the manager, a colleague or the person, so a name typed into a note goes with it, and it never receives an email address or anything from the surveys but a summary the person chose to share. Where the manager who runs a project asks for a draft plan or for a breakdown of one task, it receives what the manager typed and the project’s title; for a plan, also the project’s description and the titles of its sections and tasks, up to a fixed length; for a breakdown, that task’s title, description and section and the titles of its subtasks and checklist steps. For either it never receives the names or email addresses of the people on the project, who a task is assigned to or was created by, a task’s status or dates, a comment, the log of who moved what, or anything from the surveys or the manager tools. Text goes as it was written, so a name typed into a title goes with it, and nothing drafted is added to the project until the manager applies it. Where that manager asks for a draft of an update about the project, it receives what the manager typed, the project’s title, the status the manager picked, how many of its tasks were done since the last update and how many are overdue and blocked, the title and due date of the next task due, and the last update’s words, up to a fixed length and as written, so a name or a figure typed into them goes with them. It never receives the names or email addresses of the people on the project or of anyone its updates are sent to, who a task is assigned to or was created by, a comment, the log of who moved what, a figure about one person, or anything from the surveys or the manager tools, and nothing drafted is saved or sent until the manager saves the update. Where that manager asks how long the project’s tasks will take, it receives the project’s title and, for each task being estimated, its title, description and section, its parent task’s title and the titles of its subtasks and checklist steps, up to a fixed length and as written, so a name typed into a title goes with it. It never receives the names or email addresses of the people on the project, who a task is assigned to or was created by, a task’s status, its dates or the time already estimated for it, a figure about one person, a comment, the log of who moved what, or anything from the surveys or the manager tools, and the days it suggests change no task until the manager applies a schedule. Where a manager plans a new project, it receives what the manager typed — the goal and any timeframe, team size and constraints — and, from each earlier round, the questions it asked and the manager’s answers, up to a fixed length and as written, so a name typed into them goes with them. It never receives anything from an existing project, the name or email address of anyone in the workspace, or anything from the surveys or the manager tools, and no project exists until the manager creates it. Where the manager who runs an idea board opened with theme suggestions on asks for them, it receives up to sixty of the ideas everyone on the board can see, numbered, each with its title and the words under it up to a fixed length, as written — so a name typed into an idea goes with it — and never who wrote an idea, on any names setting, a comment, a vote or a reaction, the manager’s answers or private notes, a date, or the names and email addresses of the people on the board; on a board where each person sees only their own ideas it receives nothing. The themes it suggests are shown to that manager alone and nothing on the board moves. Its commercial terms state it may not train models on customer content. A workspace can turn model-written output off entirely, in which case every report comes from deterministic templates and the project assist is off, and so are theme suggestions, and the People guide tools answer from their own templates and send nothing.

Drafts. Where a manager asks Drafts for a message to send themselves, or for a check of how a message’s tone reads, the model provider receives what the manager typed for it, the message they are answering, if any, who it is to as a kind of recipient and, for one of the people who report to them, that person’s first name, the tone and other choices the manager made, and, for another version, the version before it, up to a fixed length and as written, so a name typed into any of it goes with it; and, only while the manager has that person’s notes switched on for the draft, the agenda and notes of their latest one-to-one and what was written in their latest check-in. It is never given an email address from the workspace or anyone’s record; one typed or pasted into the text goes with it as written. No draft is stored on the website, and the usage record each request leaves holds none of the text; where notes were used, the audit log records the person and the dates of the notes, never their words; in the iPhone and iPad app the finished draft or tone check is held, encrypted, for 24 hours so the app can collect it, and is deleted by the daily retention sweep once those 24 hours have passed. Nothing is sent on the manager’s behalf, and with model-written output off Drafts is off and sends nothing.

Bot protection. Cloudflare Turnstile on the sign-in form and on the public contact and access forms. It is not present on any page where somebody answers a question.

Backups and recovery. Automatic daily backups on a rolling seven-day window, held in the same region as the database. No off-site copy. Point-in-time recovery is not enabled, so up to 24 hours of writes could be lost in a restore. No recovery time is published, because none has been measured.

Deletion. An automated sweep deletes raw answers across seventeen tables within 90 days of a team or organization being marked as having left. In the same run it empties the respondents’ own words from the reports it keeps, deletes survey links, invitations and the roster kept for the next engagement cycle, and removes the email addresses of the people the kept reports name while keeping their names; and on the same clock it deletes the idea board and project content that the privacy policy lists as deleted.

Certifications. Ours: none. Our providers’, as they state them, are listed on /security. We do not present a provider’s certification as ours.

Connections from your systems. A connection from your identity provider authenticates with a token we show once and store only as a keyed hash, so it cannot be read back by anyone, including us; what it sends is held apart from the roster until it is applied, and only an owner of your workspace can make, stop or replace one.

These four process personal data for which you are the controller:

Supabase — database, authentication and file storage. Managed PostgreSQL in AWS us-east-1, United States. Holds everything.

Vercel — application hosting, United States. Processes data in the course of serving the application.

Resend — transactional email, United States. Receives recipient addresses and message contents, including invitation links.

Anthropic — narrative report text, the conversation guides, one-to-one agendas, follow-up actions from notes, measurable wording for goals and draft assessments a manager asks for about the people who report to them, the draft project plans and task breakdowns a manager asks for, the plans for new projects a manager asks for, the draft project updates a manager asks for, the estimates of how long a project’s tasks will take that a manager asks for, the guides to growth and stay conversations a manager asks to have adapted to the person, and the themes a manager asks to have suggested for an idea board opened with theme suggestions on, and the options suggested beneath a cycle’s written summary, the options suggested for a manager’s group, and the wording suggested for what an organization will try, where a workspace has model-written output enabled, United States. Receives what Annex II describes and never individual ratings attributable to a person. It also writes the message drafts and tone checks a manager asks for in Drafts, receiving what Annex II says of Drafts.

Four companies appear in the privacy policy and deliberately not here. The lists differ for a reason and it is easier to say it than to be asked. Stripe acts as merchant of record for a purchase and decides on its own account what that requires, which makes it a separate controller rather than anyone’s sub-processor here. Cloudflare sees the IP and browser characteristics of someone opening the sign-in form or one of the public site’s contact and access forms, which is account or visitor data we control rather than data you control, and it is absent from every page where a participant answers. Google measures the public marketing site only, is never present in the application, and touches nothing you control; it is also where a person who chooses to sign in with a Google account does so, and what passes between Google and us then is that person’s own sign-in, which is account data we control under clause 2 rather than data you control. GIPHY is reached by a participant’s own browser, and only on an idea board whose manager has switched GIFs on: we send it nothing and instruct it on nothing, it receives what it receives from that browser, and it handles that under its own terms rather than ours. None of the four is engaged by us to process data on your behalf, so none is a sub-processor under this agreement, and all four are named in the privacy policy because that document answers a different question.

Each of the four sub-processors above uses sub-processors of its own and publishes its own list. Changes to this annex follow clause 6.

Slack and Microsoft Teams are not sub-processors under this agreement. When you connect them, to post to a channel or to deliver invitations and reminders as direct messages, they remain your own services, used under your own agreements with them: what they receive is delivered at your instruction to a place you control, and what an administrator of them can read, including the run history a Teams flow’s owner can open, is governed by those services and your plan with them.

Anything about this agreement, a data subject request, an audit, or a sub-processor objection — privacy@facets.team.