Data processing addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of our Terms of Service and applies whenever we process personal data on your behalf — for example when a squad organizer, employer, community group or agency uses Survival Squads to coordinate other people. In that arrangement you are the controller (or business) and Survival Squads is the processor (or service provider).

For our own account, billing, security and product-improvement purposes we act as a controller, and the privacy policy governs that processing.

2. Subject matter and duration

We process personal data only to provide the Service: hosting accounts and squads, storing readiness details and squad plans, delivering messaging and media, sending transactional email, retrieving public alert data, and providing support. Processing lasts for as long as your account is active plus the retention periods described below.

3. Our obligations as processor

We process personal data only on documented instructions; we do not sell it or use it for cross-context behavioral advertising. We keep processing confidential and bind our personnel to confidentiality. We maintain appropriate technical and organizational measures, including TLS in transit, encryption at rest, database-level row security, signed short-lived links for media, and hashed passwords checked against breach lists. We assist you with data subject requests, notify you without undue delay after becoming aware of a personal data breach, and make available the information needed to demonstrate compliance.

4. Sub-processors

You authorize the sub-processors listed below. We impose data protection terms on each of them that are no less protective than this DPA, and we remain responsible for their performance. We will update this page before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds by contacting us before the change takes effect.

5. International transfers

We operate primarily in the United States. Where personal data is transferred out of the EEA, UK or Switzerland, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses (including the UK Addendum), together with supplementary technical measures like encryption in transit and at rest.

6. Data subject requests and audits

Most requests can be satisfied directly with in-app controls or through our privacy request form. If a request reaches us that belongs to you as controller, we forward it rather than answering it ourselves. On reasonable notice, and no more than once a year unless required by a supervisory authority, we will provide documentation to demonstrate compliance.

7. Retention, return and deletion

On termination, or on your written request, we delete or return personal data processed on your behalf, except where we are legally required to retain it (such as payment and tax records). Backups age out on a rolling schedule, normally within 30 days and no later than 90 days.

8. Liability and precedence

This DPA is subject to the limitation of liability in our Terms of Service. Where this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.