Data Processing Addendum

This Addendum forms part of the FarmDeck Terms of Service and applies where FarmDeck processes personal data on your behalf. Where you are subject to the EU/UK GDPR or the CCPA/CPRA, this Addendum applies to that processing.

1. Roles

For the data you submit, and the personal data of your channels' viewers and subscribers that you access through the service, you are the "controller" (or "business" under CCPA) and FarmDeck is the "processor" (or "service provider"). FarmDeck processes personal data only on your documented instructions, which include your use of the service's features.

2. Scope of processing

• Subject matter: provision of the FarmDeck service.
• Duration: the term of your account, plus the retention periods in our Privacy Policy.
• Nature and purpose: hosting, generating, publishing, and measuring your video channels.
• Categories of data: account identifiers, encrypted channel OAuth tokens, content prompts/scripts, and channel analytics.
• Data subjects: you, your authorized users, and your channels' audiences as reported by the platforms.

3. Confidentiality and security

FarmDeck keeps personal data confidential, limits access to personnel who need it, encrypts sensitive data (including channel OAuth tokens) at rest, and maintains technical and organizational measures appropriate to the risk.

4. Sub-processors

You authorize FarmDeck to engage the sub-processors listed in our Privacy Policy (currently Hetzner, Google/YouTube, Stripe, PiAPI, Hume, Anthropic, PostHog, and Resend). FarmDeck imposes data-protection obligations on each sub-processor and remains responsible for their performance. We will give notice before adding a new sub-processor and a reasonable opportunity to object.

5. Data-subject rights and assistance

Taking into account the nature of the processing, FarmDeck will assist you in responding to data-subject requests (access, deletion, correction, portability) and in meeting your security, breach-notification, and impact-assessment obligations.

6. Personal-data breach

FarmDeck will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you reasonably need to meet your own notification duties.

7. International transfers

Personal data is hosted in the EU (Hetzner, Germany). Where data is transferred outside the EEA or UK — for example to a US-based sub-processor — FarmDeck relies on an appropriate transfer mechanism such as the EU Standard Contractual Clauses.

8. Deletion and return

On termination, FarmDeck deletes or returns personal data in line with the retention and deletion terms in our Privacy Policy, except where retention is legally required (for example, tax and billing records).

9. CCPA / CPRA

FarmDeck acts as a "service provider": it processes personal information only to provide the service and does not sell or share it, or retain, use, or disclose it for any purpose other than performing the service.

Contact

Questions, or to request a countersigned copy: hello@farmdeck.net.