1. Parties, scope, and activation
This Data Processing Agreement (“DPA”) is offered by Yeetum LLC, 600 Bryan Ave Ste 220, Fort Worth, TX, 76104, United States, operator of SweatFam, a Vaquero Labs product supporting family and community health. It applies only when Yeetum LLC and an organization (“Customer”) enter a written or electronically signed service agreement expressly incorporating this DPA and complete the processing schedule described below. Publication alone does not execute it. Contact support@sweatfam.app to arrange an agreement.
Ordinary consumer accounts and personal family or friend groups are governed by the Terms and Privacy Policy. An organizer is not automatically a data controller for other members. This DPA does not enable employer surveillance, school or child accounts, clinical records, or a HIPAA business associate relationship. Those uses are outside the current service.
For covered Customer personal data, Customer determines the lawful purposes and instructions and acts as controller (or as a processor authorized by its controller); Yeetum LLC acts as processor or subprocessor. Yeetum LLC remains independently responsible for processing it determines for account administration, billing, fraud prevention, legal compliance, and its ordinary consumer relationship. Actual purposes and applicable law determine the roles.
2. Documented instructions and Customer duties
We will process covered data only on Customer’s documented instructions in the service agreement, completed schedule, and authorized service settings, including instructions about transfers, unless applicable law requires otherwise. We will inform Customer of a legal requirement before processing unless prohibited, and promptly flag an instruction we believe violates applicable data-protection law. We may suspend the affected processing while it is resolved.
Customer must have authority to provide the data and instructions, provide required notices, establish a lawful basis and any required sensitive-data consent, and honor individuals’ rights. Customer may not override a member’s health-sharing choices, supply prohibited data, or use the service for a purpose outside the agreed scope.
3. Confidentiality and security
We will restrict access to authorized persons bound by confidentiality and maintain technical and organizational safeguards appropriate to the data and risk. These include encrypted transport, access controls, separation of community access, credential protection, restricted media access, vulnerability handling, and procedures for incident response and deletion. The signed security schedule must describe the applicable controls and backup arrangements; this DPA does not assert a SOC 2, ISO, or HIPAA certification.
We will not materially reduce the agreed security protections during the processing term. Customer is responsible for its own users, devices, permissions, lawful instructions, and exported copies.
4. Subprocessors
Customer authorizes only the subprocessors identified in the completed schedule. We will impose written data-protection obligations at least equivalent to those applicable here and remain responsible to Customer for their performance. Before adding or replacing a subprocessor for covered data, we will give at least 30 days’ written notice and an opportunity to object on reasonable data-protection grounds.
If we cannot resolve an objection through an alternative or other safeguards before the proposed processing, Customer may terminate the affected service without penalty and receive a prorated refund of prepaid unused fees for it. The proposed subprocessor will not receive the affected data while the objection remains unresolved.
The current product uses Cloudflare for infrastructure and media, PlanetScale for database storage, Resend for email, Expo with Apple/Google push delivery for notifications, and PostHog for limited analytics and submitted feedback. Their inclusion and roles for a particular Customer must be specified in the schedule. Payment, store, and sign-in providers may be independent controllers; being named in the Privacy Policy is not automatic authorization for them as a subprocessor.
5. Rights requests and assistance
Taking account of the processing and information available, we will reasonably assist Customer with access, correction, portability, restriction, objection, consent withdrawal, and deletion requests, and with required security assessments, impact assessments, and regulator consultations. We will promptly forward requests concerning covered data and follow Customer’s lawful directions, unless a direct response is required by law or concerns our independent processing.
We will provide information necessary to demonstrate compliance and permit and contribute to audits by Customer or an independent auditor bound by confidentiality. The parties will agree reasonable notice, scope, and safeguards for other customers’ data. Routine document review may be used first; restrictions may not prevent a legally required audit, regulator inspection, or investigation of a credible incident.
6. Personal data breaches
We will notify Customer without undue delay after becoming aware of a personal data breach affecting covered data. Notice will include available details about the incident, affected data and individuals, likely consequences, mitigation, and a contact for follow-up. We may supply information in phases as it becomes available and will cooperate with containment and legally required notifications.
Customer is responsible for its controller notifications, with our assistance. Neither party will delay a legally required notice while awaiting the other’s approval. Notification is not an admission of liability.
7. Purpose restrictions and U.S. state requirements
We will not sell covered Customer personal data, share it for cross-context behavioral advertising, or retain, use, or disclose it outside the specified business purposes and direct business relationship except as applicable law permits. We will not combine it with data from other customers or independent sources except as permitted for the agreed service and by applicable law.
Where service-provider or contractor requirements apply under U.S. state law, we will provide the same required level of privacy protection, notify Customer if we can no longer meet those obligations, and allow reasonable steps to monitor compliance and stop or remediate unauthorized processing. We understand and will comply with these restrictions.
8. Processing locations and international transfers
The service is currently offered to U.S. adults. The completed schedule must identify processing locations and any authorized transfers. We will not initiate a restricted international transfer of covered data without the mechanism required by applicable law and Customer’s documented authorization.
This page alone does not execute the EU Standard Contractual Clauses, the UK Addendum or IDTA, or an adequacy or certification arrangement. If needed, the parties must execute the appropriate instrument and complete its annexes, assess the transfer and safeguards, and confirm lawful delivery before that processing starts. This DPA is not a claim that an international or regulated deployment is already approved.
9. Return, deletion, and duration
This DPA lasts for the agreed processing and any permitted retention. At the end of service, we will, at Customer’s choice, return covered data in an available standard format and delete it, or delete it, including copies, unless retention is required by applicable law. The completed schedule must set the return window, active deletion deadline, backup expiry, and any legal-retention exceptions before processing begins.
Data retained under a legal obligation or pending agreed backup expiry remains protected, isolated from ordinary use, and deleted when that basis ends. If a backup is restored, applicable deletions must be reapplied before ordinary processing resumes. We will confirm completion on request. The consumer service’s unverified backup-erasure maximum is not replaced by an invented deadline in this DPA.
10. Required processing schedule
Before activation, the parties must record Customer’s legal name, address, authorized signatory, privacy and incident contacts, agreement and effective date, and the specific service and instructions. Subject matter and purpose: delivery of the expressly agreed private community wellness features. Nature of processing: collection, organization, hosting, retrieval, member-directed sharing, support, export, and deletion. Frequency: ongoing during authorized service use. Duration: the agreed service term and limited retention specified in the schedule.
Potential data subjects: eligible adult members, Customer’s authorized administrators, and support contacts. Potential data categories: account identifiers, contact details, community roles, user-submitted photos and text, goals, attendance, interactions, authorized support records, and, only if expressly included with necessary individual consent, daily step totals and sharing settings. Collect only categories needed for the agreed features. Clinical records, financial account credentials, child accounts, and unrelated sensitive records are excluded.
The schedule must also list each authorized subprocessor’s legal entity, function, data categories, and countries; security measures; return and deletion deadlines including backup expiry; any required transfer instrument; and any agreed assistance arrangements. Neither party may treat missing schedule details as permission to process additional data. Both parties’ authorized representatives must sign or otherwise validly execute the incorporating agreement and completed schedule before covered processing starts.
11. Priority and contact
This DPA controls over conflicting service terms for covered data protection; mandatory law and any valid applicable transfer instrument control over this DPA. Liability and governing law follow the signed service agreement to the extent permitted by law, without restricting individuals’ or regulators’ mandatory rights. Changes to an executed DPA require the parties’ agreement, except for the expressly authorized subprocessor notice process.
For an execution copy, privacy assistance, or notices, contact support@sweatfam.app or Yeetum LLC, 600 Bryan Ave Ste 220, Fort Worth, TX, 76104, United States.