Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between OpenPasture ("Processor") and you ("Controller") and governs the processing of personal data in connection with the OpenPasture Service.

This DPA applies to customers subject to GDPR, CCPA, or similar data protection regulations.

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Farm Data" means livestock records, animal identification data, premises information, and related operational records entered into the Service.
• "Processing" has the meaning given in applicable data protection law.

You are the Controller of Personal Data you submit to the Service. OpenPasture is the Processor, processing Personal Data only on your instructions.

OpenPasture will process Personal Data only:

• To provide the Service as described in the Terms of Service
• As required by applicable law
• As otherwise agreed in writing

OpenPasture will not process Personal Data for its own commercial purposes.

OpenPasture will assist you in responding to data subject rights requests (access, correction, deletion, portability). We verify and review requests individually; no processing deadline has been established. Send requests to howdy@openpasture.ai.

The following providers receive data for the indicated parts of the Service. Their participation depends on which features you use. We have not established a fixed advance-notice period for changes:

The Service and its providers may process data in the United States. A specific transfer mechanism for EEA/UK data has not been verified for this agreement; contact us before relying on one.

Contact howdy@openpasture.ai about applicable transfer terms.

OpenPasture uses administrative, technical, and organizational safeguards designed to protect information, including:

• HTTPS/TLS for application traffic
• Server-side operation-scoped access checks and team roles
• Provider-managed infrastructure and storage controls; no application-wide encryption algorithm is promised here
• Security incidents are assessed individually; there is no verified fixed assessment or notification schedule

Cancellation does not trigger automated account-wide deletion. We review verified deletion requests individually; no fixed period for active-system deletion or provider backup/snapshot expiry has been established. Individual records cannot be selectively removed from an existing database snapshot. Limited records may remain for legal, accounting, security, or dispute purposes. For an export or deletion request, contact howdy@openpasture.ai.

Send requests for compliance information to howdy@openpasture.ai. We review requests individually; no fixed audit schedule or notice period has been established.

We can share only reports actually available to us, subject to applicable confidentiality and provider restrictions.

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.

A governing-law jurisdiction for this DPA has not been designated in this public document; applicable law may depend on the parties and circumstances.