This agreement is part of the Terms of service between Aaron Girard, who runs General Manager (“General Manager”, “we”, “us”), and the business that uses General Manager (“you”). It covers the personal data we handle for you, mainly your members’, and applies from the day your business starts using General Manager. Where it and the terms disagree about personal data, this agreement wins.
It’s meant to give you what data protection laws such as the GDPR, the UK GDPR and California’s privacy law require from a business’s processor or service provider.
1. Who’s who
- You are the controller of your members’ data: you decide what to collect about them and why.
- We are your processor (your “service provider”, in California’s terms): we handle that data only to provide General Manager to you.
- For your admins’ own accounts (their names, emails and sign-ins), we’re the controller, under our Privacy policy.
2. The data
Why we handle it
To provide General Manager: to store your business’s records and show them to your admins; to run your public pages (your join page, waiver links and calendar); to send emails to your members for you (waiver links, copies of signed waivers, and a note when someone who’s already registered tries to join again); and to keep the history of changes to your records. We do this for as long as your business uses General Manager, then delete the data (section 7).
Whose data
- Your members, past and present, and people who join through your join link or sign your waiver.
- Your admins, and people you invite to be admins.
- Anyone you name in a member’s notes or in your calendar.
What data
- Members’ names, email addresses and phone numbers, and the notes you write about them.
- Their home location, the date they became a member, their plans and memberships: status and its dates, pauses, and cancellation reasons and notes.
- Waiver signatures: the waiver’s text as it was signed, the typed name, the name and email at signing, the time and time zone, the IP address and the browser.
- Paper waiver records: the date signed and any note.
- Online joins: when, the location, and the IP address.
- Waiver links sent to members, with the email address they went to.
- Invitations: the invited person’s email address.
- The history of changes to your records: who changed what, and when.
- Your calendar’s events, as you write them.
- Members’ payments through Stripe, once online member payments exist.
General Manager isn’t built for sensitive data: health information, payment card numbers, government ID numbers, or the special categories of data in the GDPR. You agree not to put any in it.
3. What we promise
- Your instructions. We handle your data only on your instructions: the terms, this agreement, and what your admins do in General Manager. If the law requires us to do anything else, we’ll tell you first, unless the law forbids it. If we think an instruction breaks the law, we’ll tell you.
- Nothing else. We don’t sell your data or share it for advertising, use it for our own purposes, or combine it with data from anywhere else.
- Confidentiality. Only the people who run General Manager can reach your data, only when they need to, and each is bound to keep it confidential.
- People’s requests. Your admins can see, correct, erase and delete a member’s data in the app (below). For anything a request needs that the app can’t do, we help. If someone sends their request to us, we pass it to you.
- Other help. We give you the information you reasonably need for a data protection impact assessment, for a regulator, or to show that this agreement is kept.
- Audits. We answer your reasonable written questions about how we handle your data. If those answers aren’t enough, or a regulator asks, you may audit us, with 30 days’ notice, at your cost, at most once a year unless there’s been a breach. We don’t hold security certifications of our own, such as SOC 2 or ISO 27001; Cloudflare and Neon publish their own security reports.
Erasing and deleting a member
- Erase personal details replaces a member’s name, email address, phone number and notes everywhere General Manager holds them: in their record, in the history of changes, in their waiver signatures (the typed name, the name and email at signing, the IP address and the browser), in their paper waiver note, in their waiver links and in their online joins’ IP addresses. The record stays, as “Removed member”, with its status and dates, and the history still shows that things happened, without saying who to.
- Delete member erases them in the same way, then removes their record, with their memberships, signatures, paper record, waiver links and joins.
4. Security
We protect your data with these measures, as General Manager is built today:
- Encryption. Connections to General Manager are encrypted with HTTPS. Our providers encrypt the connections between their systems and the data they store for us, including backups, as they provide it.
- A closed database. Nothing reaches the database but General Manager’s own server: its public data interface is off, and row-level security on every table lets in only the server’s own database role, which has only the permissions it needs and can’t change the database’s structure.
- Access checked on every request. Each request must carry a valid sign-in, and General Manager checks that the person is an admin of the business whose data they ask for. Public pages reach only what their own link points to, and their forms are rate-limited and protected by a human check.
- Separate, closed test environments. Our development and test environments have their own databases and are closed to everyone but our team (Cloudflare Access).
- No members’ details in logs. Our error logs leave out the values in your records.
- A history that can’t be rewritten. Every change to your records is recorded, and the database refuses to change or delete those entries, except to erase a member’s details from them.
- Backups. The live database is backed up daily, and backups are kept for 7 days.
We’ll keep these measures at least this strong as General Manager changes.
5. Sub-processors
You agree that we use these sub-processors:
- Cloudflare, Inc. (United States): runs General Manager on its worldwide network, with the server code placed in the eastern United States next to the database; sends our emails; provides the human check; stores the database’s backups; and closes our test environments.
- Neon, a Databricks company (United States): the database, which holds sign-in details too, in Amazon Web Services’ us-east-1 region (Northern Virginia, United States).
- PostHog, Inc. (United States): product analytics of how your admins use the app, and reports of errors in it, on its US servers. It gets your business’s id and your admins’ account ids, and no member’s or admin’s name, email, phone or anything typed (our Privacy policy says what it records). It never runs on your public pages.
- Stripe, Inc. (United States): payments, once Pro billing and online member payments exist. Not in use yet.
Each is bound by data protection terms that protect your data at least as well as this agreement, and we’re responsible to you for what they do with it. Before we add or replace one, we’ll email your business’s admins at least 30 days ahead. If you object for a reasonable data protection reason and we can’t resolve it, you may stop using General Manager and we’ll refund any fees you’ve paid for time you haven’t used.
6. Breaches
If we learn of a breach of security that affects your data, we’ll tell your business’s admins by email without undue delay, and within 72 hours. We’ll say what happened, what data and roughly how many people it affects, what it’s likely to mean, and what we’re doing about it, and we’ll keep you informed as we learn more, so you can tell your members and any regulator if you need to.
7. At the end: deletion or return
- You can export your business’s data at any time. Until the app can do it, ask us and we’ll send it.
- When your business is deleted, whether you delete it, it’s deleted for inactivity under the terms, or our agreement ends, we keep its data for 30 days, in case it was a mistake, then delete all of it. Copies in our backups expire within a further 7 days.
- We keep nothing afterwards, unless the law requires us to.
8. International transfers
Your data is stored in the United States. If the GDPR, the UK GDPR or Swiss law applies to any of it, the European Commission’s Standard Contractual Clauses (Decision 2021/914, Module Two: controller to processor) are part of this agreement, with you as the data exporter and us as the data importer. Clause 7 (the docking clause) applies; under Clause 9, option 2 applies, with the notice period in section 5; Clause 11’s optional wording doesn’t apply; and Clauses 17 and 18 choose the law and courts of Ireland. Sections 2, 4 and 5 of this agreement are the Clauses’ Annexes I to III. For UK data, the UK Information Commissioner’s International Data Transfer Addendum applies to those Clauses as well. Where the Clauses and the rest of this agreement disagree, the Clauses win.
9. Everything else
- This agreement lasts as long as we handle your data.
- Each side’s liability under it is limited as in section 8 of the Terms of service, where the law allows.
- We may update it as the terms say; changes that matter to you get 30 days’ notice by email.
Contact
Aaron Girard, General Manager: generalmanagersoftware@gmail.com.