Data Processing Agreement

1. Definitions

Term	What It Means
Controller	Your campaign or organization. You decide what personal data to collect and what to do with it.
Processor	TurfRunner. We store and process personal data on your behalf, as you direct us to.
Personal Data	Any information that relates to an identifiable person. In the TurfRunner context this includes voter names, addresses, phone numbers, email addresses, and any support or issue data your volunteers log.
Processing	Anything done with personal data: collecting it, storing it, reading it, using it, sharing it, or deleting it.
Sub Processor	A third party service that TurfRunner uses and that may handle personal data as part of delivering the platform.
Data Breach	A security incident that results in unauthorized access to, disclosure of, or destruction of personal data.
Election Cycle	The period from the day your paid plan is activated to the day your election is completed.

2. What TurfRunner Processes and Why

TurfRunner processes personal data on behalf of your campaign for the following purposes:

• Storing and displaying voter contact records logged by your volunteers
• Giving authorized team members access to campaign data within the platform
• Generating AI Campaign Briefings from your aggregated field data
• Showing canvass coverage on the map view
• Enabling CSV export of your campaign data
• Facilitating SMS communications that your campaign initiates

TurfRunner processes personal data only based on what you and your volunteers do inside the platform. We do not use it for any other purpose.

3. Your Responsibilities as Controller

By using TurfRunner, your campaign agrees to:

• Have a lawful basis for collecting voter contact data under the laws of your jurisdiction
• Comply with all applicable privacy, elections, and data protection laws
• Obtain any required consents from individuals whose data is collected
• Ensure your volunteers understand their obligations when handling personal data
• Not direct TurfRunner to process data in a way that would violate applicable law
• Notify us promptly if you become aware of any issue with how personal data is being processed

4. TurfRunner's Responsibilities as Processor

TurfRunner agrees to:

• Process personal data only as directed by your campaign's use of the platform
• Ensure that anyone at TurfRunner who accesses personal data is bound by confidentiality obligations
• Maintain appropriate security measures to protect the data (see Section 5)
• Notify you before engaging any new sub processor that handles personal data (see Section 6)
• Help you respond to data subject rights requests where technically feasible
• Notify you of any data breach affecting your data within 72 hours of becoming aware of it (see Section 7)
• Delete all personal data at the end of your election cycle (see Section 8)

5. Security

TurfRunner maintains the following measures to protect personal data:

• All data transmitted between users and TurfRunner is encrypted using HTTPS
• Data stored in our database is encrypted at rest
• Row level security ensures each campaign's data is accessible only to that campaign's authorized users
• Volunteer accounts have restricted permissions: they can log contacts but cannot export data or access the full admin dashboard
• User authentication uses secure verified sessions managed through Supabase
• Each campaign exists in a logically isolated environment at the database level

6. Sub Processors

TurfRunner uses the following services to operate the platform. By agreeing to these terms, your campaign consents to their use:

Service	What They Do	Location
Supabase	Database hosting and authentication	USA
Stripe	Payment processing	USA
Resend	Transactional email delivery	USA
Anthropic	AI briefing generation	USA
Twilio*	SMS delivery	USA
Google Maps*	Canvass map display	USA

* Twilio and Google Maps require API credentials that you supply from your own accounts. You have a direct relationship with these providers and are subject to their terms independently of TurfRunner.

We will give active campaign administrators reasonable notice before adding any new sub processor that handles personal data.

7. If a Breach Happens

If TurfRunner becomes aware of a data breach affecting your campaign's personal data, we will:

• Notify your campaign administrator by email within 72 hours of becoming aware
• Tell you what happened: the nature of the breach, what categories of data were affected, and how many records were involved
• Describe what we have done or are doing to address it

You are responsible for any notifications to affected individuals or regulatory authorities that your jurisdiction requires.

8. Keeping and Deleting Your Data

Personal data is kept for the duration of your active election cycle. When your election is complete:

• Your campaign is marked as finished and data becomes read only
• You have 30 days to export your data using the CSV export feature
• After 30 days, all personal data associated with your campaign is permanently and irreversibly deleted from TurfRunner's systems and sub processors

You can request immediate deletion at any time by emailing vazirk@gmail.com. Please be aware this cannot be undone.

9. When a Voter Contacts Us Directly

If an individual contacts TurfRunner directly to exercise their privacy rights (such as asking to access or delete their information), we will forward the request to the relevant campaign administrator within 5 business days. Responding to that request is your responsibility as the data controller. We will provide whatever technical assistance we reasonably can to help you fulfill it.

10. Data Crossing Borders

TurfRunner's infrastructure is primarily hosted in the United States through Supabase. Canadian campaigns should be aware that their personal data is stored in the US. We take steps to ensure our sub processors maintain data protection standards consistent with Canadian PIPEDA requirements.

11. Reviewing Our Practices

Once per calendar year, you may request a written summary of TurfRunner's data processing activities and security measures. Send your request to vazirk@gmail.com and we will respond within 30 days.

12. How Long This Agreement Lasts

This agreement is in effect from the day you create your TurfRunner account and remains active until all personal data associated with your campaign has been permanently deleted as described in Section 8.

13. Questions

If you have any questions about how your data is processed, please reach out at vazirk@gmail.com.