Data Processing Addendum

This addendum forms part of the Terms of Service at https://firaq.space/terms. It is between the organization that uses Firaq (the customer, the controller of its team's personal data) and Firaq, Cairo, Egypt (the processor). It applies to the personal data Firaq processes for the customer through the service.

1. Scope

• Subject matter: providing Firaq, a tool for async standups, retros, planning poker, blockers and a cross-squad view.
• Duration: while the customer's organization has a Firaq account, and until its data is erased as section 6 describes.
• People whose data is processed: the customer's admins and members, and anyone they name in what they write.
• Personal data: names, email addresses, roles, organization and squad membership, out-of-office days, sign-in and security records, and whatever personal data members put into standups, blockers, retro notes, action items, planning poker, the squad charter and sprint reports.
• Firaq's own data: Firaq is the controller, not the processor, for the data it needs to run its own business: account security records, billing details once paid plans start, and the waitlist and demo request forms on firaq.space. The Privacy Policy at https://firaq.space/privacy covers those.

2. The customer's instructions

Firaq processes the customer's personal data only to provide the service, following the customer's documented instructions. These terms and the way the customer's admins configure and use Firaq are those instructions. If Firaq believes an instruction breaks the law, it tells the customer.

3. Firaq's duties

• Everyone at Firaq who can reach the customer's data is bound to keep it confidential.
• Firaq protects the data with the measures in section 4.
• Firaq helps the customer answer requests from the people whose data it holds (to see, correct or erase their data), as far as the service allows.
• Firaq tells the customer without undue delay after it becomes aware of a personal data breach that affects the customer's data, with what it knows about the breach and what it is doing about it.
• Firaq helps the customer meet its own duties under Egypt's Personal Data Protection Law (Law No. 151 of 2020) where Firaq's part of the processing is involved.

4. Security measures

• Each organization and each squad sees only its own data. Firaq enforces this on every database query.
• Passwords are hashed with argon2id. Slack tokens are stored encrypted.
• Session cookies are HttpOnly, and Secure in production.
• Login and signup attempts are rate limited.
• Only the people who run Firaq can reach the production database, and only to operate the service.

5. Sub-processors

The customer authorizes these sub-processors:

• Our hosting provider: the servers, database and backups that run Firaq.
• Slack: only if the customer connects a Slack workspace.
• Anthropic: only if the customer's admin turns AI on in Settings. That day's standup answers go to Anthropic to generate the daily summary. Firaq does not store the summary.

Firaq tells customer admins by email before it adds or replaces a sub-processor, and the customer may object by writing to pr@firaq.space. Each sub-processor is bound to protect the data at least as well as this addendum requires. These sub-processors process data outside Egypt; the Privacy Policy explains that transfer and the consent it rests on.

6. Retention and deletion

The customer's data is kept while its organization has an active account. An admin closes the account by emailing pr@firaq.space, and Firaq erases the organization's data 30 days later. Backups roll off on the hosting provider's schedule. On request before erasure, Firaq gives the customer a copy of its data.

7. Audits

On request, Firaq gives the customer the information it reasonably needs to show that this addendum is being met.

8. Changes

Firaq posts each new version on this page with the date it takes effect. For a change that matters, Firaq emails customer admins before it applies.

9. Contact

Data protection questions and requests: pr@firaq.space.