Floorline Data Processing Agreement (Organization Data Terms)

Effective date: Oct 8, 2026 Last updated: Oct 23, 2026

This Data Processing Agreement ("DPA") is part of the Floorline Terms of Service ("Terms"). It applies between Michael Strange, sole proprietor, d/b/a Floorline ("Floorline," "we"), and each organization that uses Floorline ("Organization," "you"). It is accepted when the Organization accepts the Terms. Capitalized terms not defined here have the meanings given in the Terms.

1. Scope and roles#

1.1 Scope. This DPA covers personal data within Organization Data that Floorline processes on the Organization's behalf ("Organization Personal Data"). Typical data subjects and data types are:

• Employees and crew: name, preferred name, email, phone, emergency contact, trade, shirt size, dietary notes, city, bio, role, pay rate, schedules, assignments, and activity such as inventory scans.
• Client contacts: names, emails, phone numbers, and correspondence details.
• Venue contacts: names, contact details, and addresses.
• Other individuals: individuals who appear in uploaded manuals, PDFs, or photos.

1.2 Roles. The Organization is the controller (or "business"). Floorline is the processor (or "service provider" / "contractor" under US state privacy laws). Floorline acts as an independent controller only for its own account, security, and Service-operations data, as described in the Privacy Policy.

1.3 Purpose and duration. Floorline processes Organization Personal Data only to provide, secure, and support the Service. Processing continues for as long as the Organization uses the Service, plus the return and deletion period in Section 9.

2. Instructions#

2.1 Floorline processes Organization Personal Data only on the Organization's documented instructions. Those instructions consist of the Terms, this DPA, and the Organization's configuration and use of the Service (for example, inviting users, sending invite emails, setting roles, and triggering alerts). Floorline may also process the data where the law requires it, in which case Floorline will tell the Organization first unless the law forbids it.

2.2 Floorline will tell the Organization if it believes an instruction violates applicable law.

2.3 Service-provider commitments. Floorline will not: (a) sell or share Organization Personal Data (as those terms are defined in US state privacy laws); (b) keep, use, or disclose it for any purpose other than providing the Service, including any commercial purpose outside the Service; (c) use it outside the direct business relationship with the Organization; or (d) combine it with personal data from other sources, except as permitted by law to provide the Service. Floorline will comply with applicable US state privacy laws and will notify the Organization if it can no longer meet its obligations under them.

3. Separation between organizations#

Floorline commits to strict logical separation of each Organization's data. Access to Organization Data is limited to users who are members of that Organization, according to the roles and permissions set by its admins. Floorline will not intentionally disclose one Organization's data to another Organization. If Floorline discovers a defect that exposes one Organization's data to another, it will treat the defect as a Security Incident under Section 6.

4. Confidentiality#

Floorline keeps Organization Personal Data confidential. Administrative access to production systems is limited to the operator, Michael Strange, plus the automated development tools he operates. Anyone else Floorline later authorizes to access the data, such as contractors or employees, will be bound by written confidentiality obligations and will receive access only as needed.

5. Security#

5.1 Floorline maintains reasonable technical and organizational measures appropriate to the risk. They include:

• encryption in transit (TLS) and encryption at rest through Floorline's hosting and database providers;
• passwords stored only as one-way hashes;
• organization-scoped access checks on data requests;
• role-based permissions within each Organization;
• password reset links that expire after 1 hour, and invite links that expire after about 14 days;
• email alerts sent only to people who have claimed their account, with user-controlled alert preferences and quiet hours;
• Sentry privacy filtering is on, with the data scrubber and IP-address scrubbing enabled;
• limited, credentialed administrative access to production systems; and
• use of established infrastructure providers (see Section 7).

5.2 Floorline may update these measures as long as the update does not materially reduce overall security.

5.3 Beta. The Organization acknowledges that the Service is in beta (see the Terms) and is responsible for deciding whether the Service is appropriate for the data it chooses to enter.

6. Security incidents and breach notification#

6.1 A Security Incident is a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Organization Personal Data.

6.2 Floorline will notify the Organization without undue delay and in any event within 72 hours after becoming aware of a Security Incident affecting its data. The notice will go by email to the Organization's owner and admins.

6.3 The notice will include, as far as is then known: what happened; the categories and approximate number of individuals and records affected; the likely consequences; the steps taken or proposed to contain the incident; and a contact for more information. Floorline will send updates as it learns more.

6.4 Floorline will take reasonable steps to contain and investigate the incident and to reduce its effects. It will reasonably assist the Organization with any notices the Organization must give to regulators or individuals. Floorline's notice is not an admission of fault.

7. Subprocessors#

7.1 The Organization authorizes Floorline to use the subprocessors listed at floorline.live/subprocessors, which currently include Vercel, Neon, Resend, Mapbox, PostHog, Inc. (product analytics, US, in use since Oct 13, 2026), Sentry (Functional Software, Inc.; error monitoring, US, with privacy filtering and IP-address scrubbing on, under Sentry's Data Processing Addendum, in use since Oct 13, 2026), Intuit Inc. (QuickBooks Online, accounting integration, US, only when an organization connects QuickBooks), and xAI Corp. (model processing at https://api.x.ai/v1, with Zero Data Retention enabled on Floorline's xAI team). OpenAI, L.L.C. is the email importer's hot backup, used only if the xAI call fails, and its default model is gpt-6-luna.

7.2 Floorline will bind each subprocessor to written data-protection terms that provide at least the same level of protection as this DPA for the services it performs. Floorline remains responsible for its subprocessors' performance.

7.3 Changes. Subprocessors may change at any time without notice. Floorline updates the list at floorline.live/subprocessors when the list changes.

7.4 Model subprocessors. xAI is the model subprocessor, and Zero Data Retention is enabled for Floorline's xAI team, so xAI does not store prompts or outputs after returning the result. OpenAI, L.L.C. is the email importer's hot backup, used only if the xAI call fails, and its default model is gpt-6-luna. Before Organization Data is sent to a model subprocessor, Floorline masks Wi-Fi passwords and pay or day rates. Floorline does not send prompt or reply text to its usage log. That log keeps the organization, model, token counts, duration, and status. Each organization has a monthly token quota. Floorline instructs these subprocessors not to use Organization Data to train their models.

8. Assistance#

8.1 Data subject requests. If Floorline receives a request from an individual about Organization Personal Data, it will forward the request to the Organization without undue delay and will not respond directly, except to direct the person to the Organization, unless the Organization authorizes it. Taking into account the nature of the processing, Floorline will help the Organization respond to access, correction, deletion, export, and similar requests. It will do so through Service features (admins can edit and remove people and records) or, where those are not enough, on request to support@floorline.live.

8.2 Other assistance. Floorline will provide reasonable information to help the Organization with data protection impact assessments and with regulator inquiries about the Service.

8.3 Audits. On written request no more than once a year, Floorline will answer a reasonable security questionnaire and provide information needed to show compliance with this DPA. Any further audit must be agreed in writing in advance. It must be at the Organization's expense, on reasonable notice, and must not compromise other Organizations' data.

9. Return and deletion#

9.1 During use. Admins can delete records within the Service at any time.

9.2 On cancellation or termination. The Organization may request an export of its Organization Data, in a commonly used format such as CSV plus the original uploaded files, within 30 days after cancellation. After that window, Floorline will delete Organization Personal Data from active systems within 30 days. It will be removed from backups as they are overwritten in the normal cycle (up to 7 days). Floorline will confirm deletion in writing on request.

9.3 Floorline may keep data where the law requires it, and will protect it under this DPA for as long as it is kept.

10. International transfers#

Organization Personal Data is stored and processed in the United States, mainly in Ohio, with a separate testing database in Virginia (aws-us-east-1).

11. Liability; order of precedence#

11.1 Each party's liability under this DPA is subject to the limitation of liability in the Terms, to the extent the law allows.

11.2 If this DPA conflicts with the Terms about the processing of Organization Personal Data, this DPA controls.

12. Contact#

Data-protection contact: Michael Strange, support@floorline.live, 660 Kinderhook Rd., Columbia, PA 17512. Support: support@floorline.live.

Annex A: Details of processing#

Changes to this page#

• Oct 23, 2026: Section 7.3 updated: subprocessors may change at any time without notice. This replaces the 14-day advance-notice commitment. The Processor contact is support@floorline.live.
• Oct 14, 2026: Added PostHog (product analytics, US) and Sentry (error monitoring, US) as subprocessors. Added a separate testing database in Virginia (aws-us-east-1) as a secondary data location. Updated the privacy contact. Clarified that xAI Zero Data Retention is enabled for Floorline's xAI team.
• Oct 10, 2026: Previous version.
• Oct 8, 2026: First published.