?

Data processing addendum (company buyers)

Draft for review by an Australian lawyer; not yet in force. Version 2026-10-27. Applies to buyers on Felag for a company. It is part of the terms.

1. Roles

  • For the account, billing, store and farm-detection data described in the privacy policy, Felag decides why and how it is processed and is the responsible party (an APP entity).
  • For the data an automation reads from and writes to your connected systems during a run, and for the inputs you give a hosted run, you decide why and how; Felag processes it only on your instructions, as a processor, through the automation you installed and configured.
  • The maker of an automation is not a party to your data. Makers never receive your connected data, your keys or your run inputs. They see aggregate results (pass counts, run counts, ratings) and the support tickets you open.

2. Instructions

Your instructions are: the listing you installed, its declared footprint, the sign-offs and thresholds you set, your setup answers, each run you start or approve, and each schedule or event trigger you enabled. Felag's runtime enforces them and does nothing else with the data. A change to any of them in the app is a change of instructions. Felag tells you if it believes an instruction breaks the law.

3. Sub-processors

The sub-processors, their locations and purposes are listed in the privacy policy. Felag gives 30 days' notice in the app before adding or changing one for run-time processing (currently Anthropic, Nango, Infisical, Neon, Vercel). If you object on reasonable data-protection grounds and Felag cannot offer an alternative, you may cancel the affected licences and receive a pro-rata refund of prepaid amounts.

4. Security measures, as built

  • Secrets are held in specialist vaults (Nango for OAuth tokens, Infisical for keys). Felag stores a reference, a masked tail and a keyed fingerprint.
  • Credentials are resolved for a run, passed to the sandbox as session secrets, and never written to logs or the database.
  • Hosted runs execute in a managed sandbox whose network egress is limited to the hosts of the providers the listing declares.
  • Every version is statically scanned and dynamically tested with canary tokens before it is listed; undeclared tool use or destinations block it.
  • Sign-offs are enforced server-side; a held action cannot proceed until a person in your organisation approves it in the app, and the approval is recorded with who and when.
  • Served cores are watermarked per licence; a leaked copy identifies the licence.
  • Access to production data is limited to named Felag staff, uses the same one-time-link sign-in, and is written to the audit log.
  • Database connections are encrypted; the database is hosted by Neon in [region] with daily backups kept [n] days. [Operator: confirm.]

5. Confidentiality

Felag staff and contractors who can reach your data are bound by confidentiality obligations and access only what a support request, an incident or a legal duty requires.

6. Assistance

Felag helps you answer access, correction and deletion requests about data processed through the service, within 10 business days of your request, using the audit log and run records.

7. Breach notice

Felag tells your organisation's owners within 72 hours of confirming a breach that touches your data: what happened, what data, what Felag has done and what you should do. Felag also meets its own obligations under the Notifiable Data Breaches scheme. Where a sub-processor is the source, Felag passes on what it is told as it learns it.

8. Deletion and return

When you remove an automation, its install state and setup answers are deleted at once. When you cancel or your account closes, run inputs are deleted within 30 days and the vaults' secrets with them; the metadata and financial records in the privacy policy's retention table are kept for the stated periods. You can export your run records, agreements and invoices from the app at any time before closure.

9. Audit

Once a year, or after a notified breach, you may ask Felag for a written summary of its security measures, sub-processor list and any third-party assessments its vendors publish (Stripe PCI DSS, vault providers' SOC 2 reports where Felag has them). On-site audits are not offered at this stage.

10. Liability

Liability under this addendum is subject to the caps and carve-outs in the terms, except that the cap does not apply to Felag's breach of section 4 or 7 caused by its own negligence. [Lawyer: confirm.]