Last updated: November 6, 2026
Effective: October 28, 2026
This Data Processing Agreement (“DPA”) forms part of the Pasturly Terms of Service (the “Terms”) between Nature’s Grove Farm LLC (“Pasturly,” “Processor”) and the Farm (“Controller”). Words defined in the Terms have the same meaning here. If this DPA and the Terms conflict on personal data, this DPA controls.
1. Definitions
- “Data Protection Law” means every United States federal and state law on personal data that applies to the processing under this DPA, which may include the California Consumer Privacy Act as amended (the “CCPA”), the comprehensive privacy laws of other states, and state data-breach and data-security laws. The Service is offered in the United States only.
- “Personal Data” means information about an identified or identifiable person that Pasturly processes for the Farm under the Terms (“Farm Personal Data”), as described in Annex I.
- “Processing,” “Controller,” “Processor,” “Data Subject,” “Business,” “Service Provider,” “Sell,” “Share” have the meanings given in the applicable Data Protection Law.
- “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Farm Personal Data.
- “Sub-processor” means a third party Pasturly engages that processes Farm Personal Data.
2. Roles
2.1 For Farm Personal Data, the Farm is the Controller (or “Business”) and Pasturly is its Processor (or “Service Provider”).
2.2 For personal data about the Farm’s own account holders and staff as users of the Service (their names, sign-in emails, sessions, and support correspondence), and for Pasturly’s billing of the Farm, Pasturly is a Controller, and its Privacy Policy applies, not this DPA.
2.3 Stripe processes payment data on the Farm’s own Stripe account under the Farm’s own agreement with Stripe, as an independent party to the Farm. Google and Meta, if the Farm turns on Google Analytics or the Meta Pixel, receive data under the Farm’s own agreements with them. None of them is Pasturly’s Sub-processor for that data.
3. Instructions
3.1 Pasturly processes Farm Personal Data only on the Farm’s documented instructions. The Farm’s instructions are: the Terms and this DPA; the Farm’s settings and use of the Service (including what it publishes, whom it emails, which charges it sets up and which tools it turns on); a grant of support access; and any other written instruction the parties agree.
3.2 Requests from Data Subjects through the Service. The Farm instructs Pasturly to give each Customer, through their own sign-in page on the Farm’s website, the means to download the data the Farm holds about them and to ask to be forgotten, and to carry out that request: at once, or after any open order, membership, subscription or charge has finished. When a Customer is forgotten, their orders, payments and shares of an animal are kept with their name, email, phone and address removed, as the Farm’s financial and animal records.
Only a Customer signed in by an emailed link to their own address can make such a request. The Farm is emailed when a request to be forgotten is completed.
3.3 Pasturly will tell the Farm if, in its opinion, an instruction breaks Data Protection Law, and may decline to follow it.
3.4 Pasturly may process Farm Personal Data where the law requires it, and will tell the Farm first unless the law forbids that.
4. Restrictions (US state law service-provider terms)
4.1 Pasturly will not:
- sell or share Farm Personal Data (including for cross-context behavioral advertising);
- retain, use or disclose it for any purpose other than providing the Service to the Farm (the “business purpose”), including for Pasturly’s own marketing;
- retain, use or disclose it outside the direct business relationship between Pasturly and the Farm;
- combine it with personal data Pasturly receives from or on behalf of another person, or collects itself, except as Data Protection Law permits a service provider to do;
- use it to train or improve machine-learning models for anyone; or
- attempt to re-identify de-identified data.
4.2 Pasturly certifies that it understands and will comply with these restrictions, and will tell the Farm if it can no longer meet its obligations under Data Protection Law. The Farm may then take reasonable steps to stop and remedy unauthorized use.
4.3 Each Farm’s data is separate. Pasturly will not show one Farm’s Personal Data to another Farm. A person who is a customer of two Farms is two separate records, and Pasturly does not link them.
4.4 Aggregate figures. Pasturly may derive and keep de-identified counts and totals across all Farms that contain no Data Subject-level fields and cannot reasonably be linked to any Data Subject (for example: orders per day, sales totals, emails sent, active farms), for operating, securing and improving the Service and its own business reporting. Pasturly will take reasonable measures to keep them de-identified, will not attempt to re-identify them, and will require the same of anyone it shares them with.
5. Confidentiality and staff
5.1 Pasturly limits access to Farm Personal Data to personnel who need it to provide, secure or support the Service, each bound by a written duty of confidentiality before receiving access.
5.2 Support access. Pasturly staff view a Farm’s account only as Section 10 of the Terms allows: when the Farm grants support access, read-only, for the period it chooses; or, without a grant, by Pasturly’s owner alone, for up to one hour, to stop fraud or harm, to keep the Service secure, or when the law requires it, with the Farm emailed at once. Every visit and every page seen is recorded in the Farm’s access log and Support screen and in Pasturly’s audit log. A support session the Farm enables is a documented instruction under Section 3.1. A Farm owner who has lost access to their email is helped by verified account recovery, not by staff viewing the account.
6. Security
6.1 Pasturly implements and maintains the technical and organizational measures in Annex II, appropriate to the risk, and will not materially reduce the overall protection they give during the term.
6.2 The Farm is responsible for the security of its own staff’s email accounts, devices, PINs, links and phones, and for choosing who has access to its account (Terms, Section 4.2).
7. Sub-processors
7.1 The Farm gives general authorization for Pasturly to use Sub-processors. The current list is in Annex III and at pasturly.com/legal/subprocessors.
7.2 Pasturly will email the Farm’s owner at least 30 days before adding or replacing a Sub-processor. The Farm may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Farm may end the Terms and receive a refund of the unused part of any prepaid fees.
7.3 Pasturly imposes on each Sub-processor, by written contract, data protection obligations no less protective than this DPA, as far as applicable to the service it provides, and remains responsible for its Sub-processors’ performance.
7.4 In an emergency (for example, a provider’s sudden failure or a security need), Pasturly may replace a Sub-processor with shorter notice, and will tell the Farm as soon as it can.
8. Helping the Farm
8.1 Data Subject requests. The Service lets the Farm view, correct, download and erase a Customer’s data, and lets Customers download and erase their own (Section 3.2). Pasturly will give the Farm reasonable further help in answering requests it cannot answer with those tools. If Pasturly receives a request directly about a Farm’s Customer, it will refer the person to the Farm and tell the Farm, and will not answer it itself unless the Farm asks.
8.2 Assessments. Pasturly will give reasonable information and help for any data-protection assessment the Farm is required to make about the Service.
8.3 Audit. Pasturly will make available the information reasonably necessary to show it complies with this DPA. The Farm may ask for an audit no more than once in any 12 months (or after a Security Incident), on 30 days’ written notice, at its own cost, under a confidentiality agreement, during business hours, and in a way that does not disrupt the Service or reveal other Farms’ data. Pasturly may meet a request with written answers, documents or an independent report where one exists.
9. Security Incidents
9.1 Pasturly will notify the Farm without undue delay, and within 72 hours after Pasturly confirms a Security Incident affecting the Farm’s Personal Data.
9.2 The notice will be emailed to the Farm owner’s sign-in address and will include, as far as known: what happened and when; the categories and approximate number of Data Subjects and records involved; the likely consequences; what Pasturly has done and will do; and a contact. Pasturly will give what it knows when it knows it, and will not wait to finish an investigation before notifying.
9.3 Pasturly will help the Farm meet its own notification duties, including by providing the list of affected Customers and their contact details, and, if the Farm asks and the law allows, by sending notices to its Customers in the Farm’s name at Pasturly’s cost where the incident was caused by Pasturly’s breach of this DPA.
9.4 Pasturly’s notice is not an admission of fault.
10. Return and deletion
10.1 While the account is open (and while it is suspended), the Farm can export all of its data in a machine-readable format, and can erase individual Customers, or reset all of its data, from its admin.
10.2 When the account closes, Pasturly offers the Farm a full export first, then keeps Farm Personal Data out of use for a 30-day grace period in which the Farm may reopen the account or download the export, and then deletes all Farm Personal Data from the live Service, unless the law requires Pasturly to keep something longer. Pasturly does not keep the Farm’s orders or financial records after that; keeping its sales records is the Farm’s own responsibility.
10.3 Backups. Deleted data can remain in backups until those backups expire, which is no more than 35 days after deletion, for both Pasturly’s nightly export of each Farm’s data (kept 30 days) and its hosting provider’s database backups and point-in-time recovery. Backups are not edited, are not used to bring deleted data back into the live Service, and anything restored from one is deleted again under this Section.
11. Data location and transfers
Pasturly stores Farm Personal Data in the United States. The Service is offered to farms in the United States only.
12. Liability
Each party’s liability under this DPA is subject to the limits in Section 15 of the Terms, except where Data Protection Law does not allow it to be limited.
13. Term
This DPA lasts as long as Pasturly processes Farm Personal Data, including after the Terms end, until deletion under Section 10.
Annex I — Details of processing
A. Parties. Controller: the Farm named on its Pasturly account. Processor: Nature’s Grove Farm LLC, operating Pasturly, 138 Penns Grove Lane, Latrobe, PA 15650, admin@pasturly.com.
B. Subject matter and duration. Providing the Service to the Farm for the term of the Terms, then deletion under Section 10.
C. Nature and purpose of processing. Running the Farm’s website, online shop and checkout; taking and recording orders by hand, online, and at market; telling Stripe what to charge on the Farm’s own account, including authorizing and capturing holds for items sold by the pound, deposits and balance invoices, renewing boxes, month-by-month CSA payments and CSA payment plans; recording payments, refunds and disputes the Farm’s Stripe account reports; working out which pickup points, delivery routes and shipping serve an address and on what dates; packing, weighing and labeling; recording handovers at pickups, markets and deliveries; placing delivery addresses on a map and planning routes; running CSA seasons, farm boxes and shares of an animal with their cut sheets; sending email in the Farm’s name (receipts, bills, reminders, sign-in links, customer updates and marketing campaigns) and recording what happened to it; keeping the Farm’s customer list, tags, groups and marketing consent; letting Customers sign in, see their orders, fill in cut sheets, manage their card, boxes and plans, download their data and ask to be forgotten; receiving the Farm’s contact-form messages; counting visits to the Farm’s website; logging access to Customer data; backing up the Farm’s data; and support.
D. Categories of Data Subjects.
- The Farm’s Customers and prospective customers, including people who join a waitlist, sign up for news, write through the contact form, or start a cut sheet.
- The Farm’s staff, drivers and market hands, as people the Farm records or gives PINs, links and phones to.
- People named in delivery or pickup details (for example, someone collecting for a Customer), where the Farm records them.
E. Categories of Personal Data.
- Identity and contact: name, email address, phone number, postal and delivery addresses (with the map point a delivery address geocodes to), other addresses a Customer has.
- Orders and fulfillment: what was ordered, when and where it is collected or delivered, prices, discounts, pack weights, handovers and who made them, order history and edits, the referring website (for example “Google”), and the campaign that led to an order.
- Payments (metadata only): amounts, method (card, cash, check, reader), status, Stripe’s ids for the payment, customer and saved card, and the card’s brand, last four digits and expiry as Stripe reports them. No full card numbers or security codes.
- CSA, boxes and shares: memberships, groups, pickups, answers to the season’s questions, box contents, skips, pauses, missed boxes, waitlists, payment plans and their schedule, shares of an animal, cut sheet choices, and activity logs.
- Marketing: whether the Customer has subscribed to the Farm’s news, when and how; tags and groups; emails sent to them and their delivery, bounce, spam-report and unsubscribe events; for campaigns only, opens and link clicks.
- Messages: contact-form messages (name, email, message, answers to the Farm’s questions), and a one-way hash of where a message came from to limit abuse (never the IP address itself).
- Accounts: a Customer’s sign-in links and sessions on the Farm’s site (kept as one-way hashes), and their browser type.
- Staff: names, roles, PINs and device tokens stored only as one-way hashes, sign-in times, shifts, and what they did (for example, handed over an order).
- Access log: who opened a Customer’s record, order or membership, and when.
- Point-of-sale: sales made on the phone (items, weights, amounts, payment method), the shift that made them, and an email address the Customer gives for a receipt. Card details, device identifiers and precise location are collected by Stripe’s Terminal software for the card payment and go to Stripe, not Pasturly.
F. Special categories. None intended. The Service is not designed for sensitive data, and the Farm must not ask for it in questions, notes or forms (for example, health conditions or allergies tied to a person’s health).
G. Frequency. Continuous, while the Farm’s account is open.
H. Retention. As in the Pasturly Data Retention Schedule, summarized in Section 10.
I. Point-of-sale location. Stripe’s Terminal software on the Farm’s phone collects precise location and device identifiers for each card payment, for fraud prevention and payment compliance, and sends them to Stripe under Stripe’s privacy policy. Pasturly does not receive them.
Annex II — Security measures
These describe what is in place on October 28, 2026.
Separation of farms
- Every table a farm owns carries the farm’s id, and every query filters on it. The list of those tables is derived from the database schema, not written by hand, so erasure and backup cannot fall behind it.
- A farm’s website runs on its own host; Pasturly’s admin refuses requests from a farm’s website host, and forms posted from another site are refused.
Access control
- Farm staff sign in by single-use emailed links valid for 15 minutes (24 hours to start a new farm; invitations, 7 days), stored only as one-way hashes. There are no passwords. Sessions last up to 60 days and can be ended.
- Driver, market and phone PINs are stored only as one-way hashes; repeated wrong PINs lock the link or phone.
- Pasturly’s own staff use a separate owner console on its own host, with an emailed link followed by a passkey or authenticator app every time, recovery codes, roles, sessions that end after 30 minutes idle or 12 hours, and a fresh second step for sensitive actions.
- Support access to a farm is read-only, enforced at the one entry point to the admin, and limited in time.
Logging
- Every view of a Customer, order or member in the admin, on the market and driver pages and on the phone is recorded in the farm’s access log, kept 12 months, which the farm can read.
- Every action in the owner console and every console view of a farm is recorded in an audit log that a database trigger makes append-only.
Encryption
- All traffic to the Service is over TLS.
Payments
- Card details are entered into Stripe’s own fields and readers and go directly to Stripe; Pasturly never receives full card numbers.
- Every call about a farm’s customers is made on the farm’s own Stripe account through one function, so a charge cannot land on another account by omission.
- Live payment keys are refused until Pasturly switches them on deliberately.
Environments and secrets
- Development and production are separate Railway projects with separate databases. Production personal data is not copied to development. Automated tests run against their own database and refuse any other.
- Secrets are held in Railway’s environment variables, not in source code.
- Webhooks from Stripe and Postmark are verified and refused without their secrets.
Resilience
- A nightly export of each farm’s data to a separate storage bucket, kept 30 days.
People and process
- Written confidentiality agreements before anyone else receives console access.
- A written incident response policy (internal).
Annex III — Sub-processors
As published at pasturly.com/legal/subprocessors. On October 28, 2026:
| Sub-processor | What it does for the Service | Personal Data involved | Location |
|---|---|---|---|
| Railway Corporation | Hosts the application, its database and backups, and its file storage buckets (photos and nightly exports) | All Farm Personal Data | United States |
| ActiveCampaign, LLC (“Postmark”) | Sends email in Pasturly’s and each Farm’s name, and reports deliveries, bounces, spam complaints, unsubscribes and (for campaigns) opens and clicks | Recipients’ email addresses and names, email content, delivery events | United States |
| Stripe, Inc. | Pasturly’s own billing of the Farm; and, as the Farm’s own processor, the Farm’s card payments, saved cards, Terminal and Stripe Tax | For Pasturly’s billing: the Farm’s billing contact. For the Farm’s payments: Stripe processes under the Farm’s own Stripe agreement | United States and elsewhere |
Other recipients that are not Sub-processors:
- US Census Bureau Geocoder (a free public service of the US government): delivery street addresses only, with no name, email, phone or order, to place stops on a map.
- Google Maps: when a driver opens turn-by-turn directions, the driver’s own phone passes the stop addresses to Google Maps. Pasturly sends nothing to Google.
- Google Analytics and Meta: only when the Farm turns them on and the visitor accepts, under the Farm’s own agreements.