Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Geared Like A Machine LLC ("Processor", "we") and the tenant using Production Engine ("Controller", "you"). It describes how we process personal data on your behalf as part of providing the Production Engine service, and reflects the actual technical measures described on our Security page. Where a term isn't defined here, it has the meaning given in applicable data protection law.

For the personal data you or your team enter into your Production Engine workspace, such as client, crew, cast, and vendor contacts, you are the Controller and we are the Processor. We process that data only to provide the service, on your instructions as expressed through your use of the product, and not for our own independent purposes.

• Subject matter: hosting and operating the Production Engine workspace on your behalf.
• Duration: for as long as your subscription is active, plus the retention period described in our Privacy Policy.
• Nature and purpose: storage, retrieval, and display of the records you create (contacts, estimates, schedules, documents, and financial workflow), sending the transactional email your workflow triggers, and, where you use it, generating AI estimates.
• Categories of data subjects: your workspace users, and the crew, cast, clients, and vendors whose contact and production information you store.
• Categories of personal data: names, contact details, production-related records, uploaded documents (which may include tax forms such as a W-9), and technical data such as IP addresses in request logs.

We use the subprocessors listed on our Privacy Policy to provide the service: currently Vercel (hosting and file storage), Neon (database), Resend (transactional email), Stripe (billing), the Vercel AI Gateway and its underlying model providers (AI estimate generation), and, if configured, PostHog (analytics). You authorize our use of these subprocessors. If we add or replace a subprocessor that materially changes how your data is processed, we will update that page and, where practical, notify you.

We maintain the technical and organizational measures described on our Security page, including AsyncLocalStorage-scoped tenant context, a database-layer scoping extension that fails closed, static analysis in CI that blocks known bypasses, scrypt password hashing, and signed, HttpOnly session cookies.

Anyone we permit to access tenant data to operate or support Production Engine is bound by confidentiality obligations covering that data.

Where your workspace users, or the crew, cast, clients, or vendors in your records, exercise a data subject right against you (such as access, correction, or deletion), we will provide reasonable assistance, including through the account tools available in the product and by responding to a request routed to us.

If we become aware of a breach affecting your personal data, we will notify you without undue delay after we confirm it, with the information we have available at the time.

Our subprocessors may process data in the United States and other countries where they operate, as described in our Privacy Policy. Where applicable law requires a specific transfer mechanism, such as standard contractual clauses, we rely on the mechanism our subprocessor makes available for that transfer.

On reasonable written request, and no more than once per year absent a specific security concern, we will provide the compliance information necessary to demonstrate our obligations under this DPA, which may take the form of this page, our Security page, and our subprocessors' own published compliance documentation.

On termination of your subscription, your workspace becomes read-only rather than being deleted immediately, so you can still export your records. On your written request, we will delete your data, subject to what we are required to retain for security, billing, or legal reasons.

This DPA is governed by the laws of the State of Texas, without regard to its conflict-of-law rules, and by the same governing law as our Terms of Service.

This page is our standing DPA. If your organization requires a signed, executed copy for its own records, email legal@production-engine.com.