RivetRundown · Data processing agreement
Data processing agreement · owner-completion draft
Not ready for signature. This draft contains verified app disclosures and clearly marked owner fields. The parties, legal terms, security measures, locations, retention and subprocessors must be completed and reviewed before it is signed or relied on.
Controller: [OWNER TO COMPLETE: legal entity name, registration number and address].
Processor: [OWNER TO COMPLETE: contracting service operator and address]. The app is deployed through Polsia, but the repository does not establish the legal contracting entities for each infrastructure service.
Effective date: [OWNER TO COMPLETE]. This document is a draft and has no signature date.
The app currently provides email-and-password accounts and an empty report workspace. Better Auth is configured with a Prisma adapter using a Postgres database for authentication records. Sign-up verification email is sent through the configured Polsia email module.
The homepage demo captures up to five seconds of audio briefly in the browser and discards it without upload or transcription. The displayed report is fixed sample content. The repository does not identify a production transcription or AI provider or establish production report processing.
Processing instructions and any additional live services: [OWNER TO COMPLETE before signature. Do not add a transcription, AI, report-storage or customer-data operation unless it is actually enabled and its provider and instructions are verified.]
The currently evidenced account flow processes the name and email address supplied at registration and authentication records needed by Better Auth. The app configuration also uses a sign-in session cookie. If the Polsia analytics setting is present in a deployment, the framework stores a visitor identifier in local storage and sends a page-view beacon.
Other categories, data subjects, special-category data and the controller's actual purposes: [OWNER TO COMPLETE]. The repository does not establish production voice recordings, transcripts, site photos or customer report data.
Processing duration, account closure behaviour, backup retention, analytics retention and deletion timelines are not specified in this repository. [OWNER TO COMPLETE the period for each data category, the deletion or return process, and any legally required retention.]
The app uses Better Auth for authentication and a configured Postgres-backed Prisma adapter. This limited description is not a complete technical and organisational security schedule.
Measures, access controls, encryption, backups, incident contacts and notification timelines: [OWNER TO COMPLETE from verified operational documentation. Do not infer them from this app's source code.]
The repository shows a Polsia-provisioned Postgres connection and a Polsia email module. Where the deploy supplies analytics configuration, the framework sends page-view beacons to the configured Polsia service. It does not identify every legal subprocessor, data centre or processing region.
Subprocessor legal names, services, locations, transfer mechanisms and notice/objection process: [OWNER TO COMPLETE against the actual production configuration and current provider terms.]
Database region and EU hosting status: [OWNER TO CONFIRM. Neither is established by this repository.]
Assistance with data-subject requests, regulator enquiries, impact assessments, audits and incident handling: [OWNER TO COMPLETE with the verified process, contacts, scope and timelines.]
Return, export and deletion arrangements at the end of the service are not established in this repository. [OWNER TO COMPLETE the controller's choice, technical process, timing, backup treatment and any retention required by law.]
Governing law, venue, liability, precedence with the main service terms and amendment process: [OWNER TO COMPLETE with approved legal wording.]
Controller signature: [NAME / ROLE / DATE]
Processor signature: [NAME / ROLE / DATE]
Version: owner-completion draft. Review the privacy notice and terms of use in the app.