Legal
Data Processing Addendum
For customers who need a written agreement on how we process personal data for them. It's part of our terms of service.
Last updated: October 13, 2026
1. Roles
The customer that installs Pointd Pal is the controller of the personal data in its workspace. Tuatha Tech LLC is the processor and processes it only on the customer's behalf. This addendum supplements our terms of service; where the two conflict about personal data, this addendum wins.
2. Subject matter and duration
We process personal data to provide Pointd Pal to the customer, for as long as it's installed, and then until the data is deleted as described in section 9.
3. Data and people
- Data subjects: members of the customer's Slack workspace, including employees, contractors and guests.
- Categories of data: Slack user IDs, names, titles, time zones, avatar links, workspace roles, user-group memberships, recognitions and their reasons, reward requests, celebration dates added by members or imported by admins, feedback members send, and admin activity. No special categories of data are intended, and no email addresses are collected from Slack.
4. Instructions
We process the data only on the customer's documented instructions. The terms, this addendum and the customer's configuration of Pointd Pal are those instructions. We'll tell the customer if we believe an instruction breaks data protection law.
5. Confidentiality
Everyone who can access the data is bound to keep it confidential.
6. Security
We keep appropriate technical and organizational measures in place, including:
- encryption in transit, and encryption at rest for Slack tokens and backups;
- least-privilege Slack permissions and verified requests from Slack and Stripe;
- access to production data limited to the people who run the service;
- nightly encrypted off-site backups and regular restore tests;
- rate limiting, security headers, and automated scanning for vulnerable dependencies and leaked secrets.
More detail is on our security page.
7. Subprocessors
The customer authorizes the subprocessors listed on our subprocessors page. We'll update that page at least 30 days before adding or replacing a subprocessor, and the customer may object on reasonable data protection grounds. We hold each subprocessor to data protection terms at least as protective as these and remain responsible for them.
8. Assistance
We help the customer respond to people exercising their rights, mostly through features already in Pointd Pal: export me, erase me, opt out, and the admin panel's export and erase tools. We also give reasonable help with security, impact assessments and regulator questions about our processing.
9. Personal data breaches
We'll notify the customer without undue delay, and within 72 hours, after becoming aware of a breach affecting its personal data, with what we know and what we're doing about it, and keep it updated.
10. Deletion
When the customer uninstalls Pointd Pal, its data is deleted 30 days later; when an admin deletes the workspace's data from the admin panel, within a day. Encrypted backups expire within 12 months. The customer can export its data before either.
11. Information and audits
We'll make available the information reasonably needed to show compliance with this addendum, such as answers to security questionnaires. Audits beyond that are by agreement, at the customer's cost, with reasonable notice.
12. International transfers
Data is processed in the United States. Where the law requires a transfer mechanism, such as the EU Standard Contractual Clauses, we'll put one in place on request.
How to sign
This addendum applies automatically to customers who need it. For a countersigned copy, email privacy@pointdpal.com with your organization's legal name and Slack workspace.