Data Processing Agreement

1. Parties and roles

• Processor: Larksong sp. z o.o., ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland, KRS 0001275290, NIP 7011337480, REGON 546037291 (“we”).
• Controller: the business user that accepted the Terms (“you”).

When you upload documents or enter data into fenfill that contain other people's personal data, you are the controller of that data and we process it on your behalf. We act as an independent controller only for our own account, billing and security data about you, which our Privacy Policy describes.

Words such as “personal data”, “processing”, “controller”, “processor”, “supervisory authority” and “personal data breach” have the meaning given in Regulation (EU) 2016/679 (the GDPR). Where the UK GDPR or Swiss law applies, references to the GDPR include those laws.

2. Subject matter, duration, nature and purpose

We process personal data only to provide fenfill to you under the Terms: storing the documents you upload, detecting form fields in them, building and serving your forms and share links, and keeping the service secure. Processing lasts as long as your account exists, plus the deletion periods in section 9. Annex I gives the details.

What we never process. The answers typed into a fenfill form stay in the browser of the person filling it, and the finished PDF is generated there. Form answers never reach our servers, so this DPA does not cover them: we never receive them.

3. Your instructions

We process personal data only on your documented instructions. The Terms, this DPA and your use of fenfill's features and settings are your complete instructions. We do not process it for our own purposes, and we do not sell it. We tell you promptly if we believe an instruction breaks data protection law. If EU or Member State law requires us to process data otherwise, we tell you first, unless that law forbids it.

4. Confidentiality

Everyone we authorise to process the data is bound by a duty of confidentiality, either contractual or statutory. Access is limited to what is needed to run, support and secure the service.

5. Security

We implement the technical and organisational measures in Annex II (GDPR Art. 32). We may update them, but never in a way that lowers the overall level of protection.

6. Subprocessors

You give us general authorisation to use subprocessors. The current list is in section 7 of our Privacy Policy and forms Annex III.

• We bind each subprocessor to data protection obligations at least as protective as this DPA, and we remain responsible to you for its performance.
• We give you at least 30 days' notice before adding or replacing a subprocessor. We do this by updating the list on /privacy and by email to the account owner.
• You may object on reasonable data protection grounds within that period by writing to support@fenfill.com. If we cannot address the objection, you may end your subscription before the change applies, and we refund the unused part of any prepaid period.

7. International transfers

Your documents and database records are stored in the EU, and our processing servers are in the EU. Where a subprocessor processes personal data outside the European Economic Area, we rely on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission's Standard Contractual Clauses, together with the measures in Annex II.

8. Assistance

Taking into account the nature of the processing, we help you with:

• data subject requests. Most can be handled directly in fenfill: you can download or delete forms and documents, and you can delete the account. We forward to you any request we receive that concerns your data, and we do not answer it ourselves unless you ask us to;
• security, breach notification, data protection impact assessments and prior consultation (Art. 32–36), using the information available to us.

Personal data breaches. We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data. We tell you what we know, and we add to it as we learn more.

9. Deletion at the end

When you delete a form, or your account is deleted, we delete the related documents, layouts and share links from the live systems. Copies in routine backups age out within 30 days. When your subscription ends, your account stays available on the free plan until you delete it. Forms above the free plan's limit are frozen and then deleted 60 days later, as the Terms explain. Documents uploaded through the API without saving them as a template are deleted within 1 hour after the result is fetched, and in any case within 24 hours. We keep data longer only where the law requires it.

10. Audits

We make available the information you reasonably need to show compliance with GDPR Art. 28, including this DPA, our Security page and written answers to reasonable questionnaires. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit us once a year. The audit needs at least 30 days' notice, happens during business hours, and is at your cost.

11. Liability and precedence

Each party's liability under this DPA follows the liability section of the Terms, as far as the law allows. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. This DPA follows the governing law and courts of the Terms. We may update this DPA under the change rules in the Terms, but not in a way that reduces the protection of personal data.

Annex I: Details of processing

Data subjects

People whose personal data appears in the documents you upload. Your users and workspace members. Recipients of your share links.

Categories of personal data

Whatever the blank documents and templates you upload contain (usually little: names or labels printed on a form, logos). Page preview images and the field layout built from them. The names and labels you give share links. Two content-free timestamps per per-recipient link (first opened, finished). Account data of your users (email address, name and profile picture from the sign-in provider). Technical and log data (IP address, user agent, request metadata).

Special categories

None intended. A blank form can contain such data only if you upload it, and form answers never reach us.

Nature of processing

Encrypted storage; field detection (pages you choose are sent to Google Gemini each time you run detection); serving forms and share links; error monitoring; backup.

Purpose

Providing fenfill under the Terms.

Duration

The term of the Terms, plus the deletion periods in section 9.

Frequency

Continuous while the account exists.

Annex II: Technical and organisational measures

1. Data minimisation by design. Form answers and the finished PDFs are produced only in the filler's browser, and no upload path exists for them. An automated test fails our build if any form value is passed to a network call.
2. Encryption at rest. Each uploaded document is encrypted in the browser with its own AES-256-GCM key before upload. That key is wrapped by a master key held server-side, separately from the storage. The storage bucket is private, and every read goes through our servers. Drafts saved during filling are encrypted with a key that exists only on that device.
3. Encryption in transit. TLS on every connection.
4. Access control. Database row-level security limits every request to the workspaces the user belongs to. Our processing API requires a signed-in session and checks workspace membership. Share links use signed, revocable tokens, and revocation and expiry are checked on every request. API keys are stored only as hashes and are scoped to one workspace.
5. Sign-in. Through Google or Microsoft only. We do not store passwords.
6. Application security. A strict, nonce-based Content Security Policy; server-side validation of every schema write; bounded input sizes; continuous dependency vulnerability gates in CI.
7. Abuse and cost limits. Per-workspace and per-job limits on field detection; per-key and per-IP limits on the API.
8. Error reporting without personal data. Backend error reports exclude user emails, IP addresses, request headers and request bodies, and URLs are cut before they leave the server. Our website and fill pages run no analytics, advertising or tracking scripts.
9. Infrastructure. Production is separated from development (separate projects, credentials and keys). Production databases and storage are in the EU (Stockholm), and processing servers are in the EU (Helsinki). Servers are hardened and patched. Deployments are health-checked and roll back automatically on failure.
10. Backups and deletion. Nightly database backups. Deleting a form or an account purges its stored documents from storage.
11. Organisation. Access to production is limited to the people who run the service. A security contact is published at security@fenfill.com and in /.well-known/security.txt.

Annex III: Subprocessors

The current list, with what each provider does, what it can see and where, is section 7 of our Privacy Policy. At the date above it covers Supabase (database, storage, sign-in; EU), Google (Gemini API, field detection; Google Cloud regions), Vercel (website hosting; primary region EU), Hetzner (processing servers; EU), Sentry (backend error monitoring; EU) and Postmark (service email; US). Stripe, through its merchant of record Sold through Link, LLC (Stripe Managed Payments), and the sign-in providers act as independent controllers, not as our subprocessors.

Contact

Larksong sp. z o.o.
ul. Stefana Batorego 18/108, 02-591 Warszawa
Poland
KRS 0001275290, NIP 7011337480, REGON 546037291
Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy KRS
Share capital: PLN 5,000.00
support@fenfill.com