Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Privacy Policy and Terms of Service for Daily Steak ("we", "us", "the Controller"), a social debate application operated by Oskari Lähde, Finland.

This DPA describes how personal data is processed by our third-party sub-processors on behalf of the Controller, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable data protection laws.

2. Definitions

• Controller - Daily Steak / Oskari Lähde, the entity that determines the purposes and means of processing personal data.
• Processor - A third-party service provider that processes personal data on behalf of the Controller.
• Sub-processor - A third party engaged by a Processor to assist in processing personal data.
• Data Subject - An identified or identifiable natural person whose personal data is processed (i.e., our users).
• Personal Data - Any information relating to a Data Subject, as defined by Article 4(1) of the GDPR.
• Processing - Any operation performed on personal data, including collection, storage, use, transmission, and deletion.
• Supervisory Authority - The independent public authority responsible for monitoring GDPR compliance. For Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

3. Scope and Purpose of Processing

The Controller engages third-party Processors to provide the following services necessary for operating the Daily Steak application and website:

• User authentication and account management
• Database storage for user-generated content (votes, comments, profiles)
• Serverless backend logic (Cloud Functions)
• Application analytics and crash reporting
• Push notification delivery
• Rewarded advertisement display
• Subscription and in-app purchase management
• Payment processing
• Transactional email delivery
• Website analytics

Processing is carried out solely for the purposes described above and in accordance with the Controller's documented instructions. Processors shall not process personal data for any other purpose.

4. Sub-Processors

The following sub-processors are authorized to process personal data on behalf of the Controller. Each sub-processor has entered into its own Data Processing Agreement or equivalent contractual commitments with the Controller.

4.1 Sub-Processor List

Sub-Processor	Purpose	Data Processed	Location	DPA
Firebase (Google Cloud)	Authentication, Firestore database, Cloud Functions, Analytics, Crashlytics, Cloud Messaging	Email address, display name, user ID, votes, comments, profile data, usage analytics, crash reports, push notification tokens	EU (europe-west1)	Google Cloud DPA
AdMob (Google)	Rewarded advertisements	Device advertising ID, IP address, device information, ad interaction data (views, clicks)	EU / US	Google Ads DPA
RevenueCat	Subscription and IAP management	App user ID, purchase history, subscription status, store transaction IDs	US	RevenueCat DPA
Stripe	Payment processing (web purchases)	Payment card details, billing address, transaction details (processed by Stripe, not stored by us)	EU / US	Stripe DPA
SendGrid (Twilio)	Transactional email delivery	Email addresses, email content, delivery status	US	Twilio DPA
Google Analytics 4	Website analytics	Anonymized IP address, page views, browser events, device and browser information	EU / US	Google Ads DPA

4.2 Sub-Processor Details

Firebase (Google Cloud)

Firebase provides the core infrastructure for the Daily Steak application. All Firebase data is stored in the europe-west1 (Belgium) region. Firebase services used include:

• Firebase Authentication - Manages user accounts, login sessions, and identity verification. Stores email address, display name, and authentication provider data.
• Cloud Firestore - Primary database storing user profiles, votes, comments, community data, virtual currency balances, and all user-generated content.
• Cloud Functions - Serverless backend for business logic including content moderation, notifications, and data migrations. Processes data transiently.
• Firebase Analytics - Collects anonymized usage statistics to understand app behavior and improve the user experience. Consent-based collection.
• Firebase Crashlytics - Collects crash reports and stack traces to diagnose and fix application errors. No personal data is intentionally included in crash reports.
• Firebase Cloud Messaging (FCM) - Delivers push notifications. Stores device tokens (not linked to personal identity).

Google Cloud's Data Processing Addendum applies to all Firebase services. Google is certified under the EU-US Data Privacy Framework. See Firebase Privacy for details.

AdMob (Google)

Google AdMob serves rewarded advertisements to free-tier users. AdMob processes device identifiers and ad interaction data to deliver relevant advertisements. GDPR consent mode is enabled: personalized ads are only shown after explicit user consent. Users who do not consent receive non-personalized ads only. Premium subscribers do not see advertisements.

The Google Ads Data Processing Terms apply. See Google Privacy Policy.

RevenueCat

RevenueCat manages premium subscriptions and in-app purchases across Apple App Store and Google Play Store. RevenueCat receives an anonymous app user ID, purchase receipts, and subscription status. Payment details (credit card numbers, billing addresses) are handled exclusively by Apple and Google, not by RevenueCat or by us.

See RevenueCat Privacy Policy and RevenueCat DPA.

Stripe

Stripe processes payments for web-based purchases (ember shop). Payment card details (card number, expiry date, CVC) are submitted directly to Stripe via their secure Elements SDK and are never transmitted to or stored on our servers. Stripe is PCI DSS Level 1 certified, the highest level of payment security certification.

See Stripe Privacy Policy and Stripe DPA.

SendGrid (Twilio)

SendGrid delivers transactional emails including password reset links, email verification, and notification digests. SendGrid processes the recipient's email address and email content. Emails are sent over TLS-encrypted connections. SendGrid does not use email addresses for marketing purposes.

See Twilio/SendGrid Privacy Policy and Twilio DPA.

Google Analytics 4 (Website Only)

Google Analytics 4 (property ID: G-Q5LRTW48VG) is used exclusively on the Daily Steak website (dailysteak.app), separate from Firebase Analytics in the mobile app. GA4 operates in GDPR consent mode: analytics data collection defaults to denied and is only activated after the user explicitly accepts cookies via the consent banner. IP addresses are anonymized.

See Google Privacy Policy.

5. Data Subject Rights

Data Subjects have the following rights under the GDPR, which the Controller and all Processors are obligated to support:

• Right of Access (Art. 15) - Data Subjects may request a copy of all personal data we hold about them.
• Right to Rectification (Art. 16) - Data Subjects may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17) - Data Subjects may request deletion of their personal data ("right to be forgotten"). This can be exercised directly in the app (Profile > Settings > Delete Account) or by emailing us.
• Right to Restriction of Processing (Art. 18) - Data Subjects may request limitation of how their data is processed.
• Right to Data Portability (Art. 20) - Data Subjects may request their data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21) - Data Subjects may object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent (Art. 7(3)) - Where processing is based on consent, Data Subjects may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@dailysteak.app. We will respond within 30 days. If we need to involve a sub-processor to fulfill a request, we will instruct them promptly and ensure compliance within the statutory timeframe.

Data Subjects also have the right to lodge a complaint with their local Supervisory Authority. In Finland, this is the Office of the Data Protection Ombudsman.

6. Security Measures

The Controller and all Processors implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include:

6.1 Technical Measures

• Encryption in transit - All data transmitted between the app, website, and backend services is encrypted using TLS 1.2 or higher.
• Encryption at rest - All data stored in Firebase/Google Cloud is encrypted at rest using AES-256.
• Authentication security - Firebase Authentication enforces secure password policies, supports multi-factor authentication, and provides secure session management.
• Firestore Security Rules - Database access is controlled by granular security rules that enforce data isolation between users and restrict write operations.
• Payment security - Stripe is PCI DSS Level 1 certified. Payment card data never touches our servers.
• Consent management - GDPR consent mode is implemented for both Firebase Analytics and Google Analytics 4, defaulting to denied.
• Input validation - All user inputs are validated and sanitized. File uploads are restricted to 5MB maximum.

6.2 Organizational Measures

• Access control - Access to production systems is restricted to authorized personnel only.
• Principle of least privilege - Service accounts and API keys are scoped to minimum necessary permissions.
• Logging and monitoring - Firebase and Google Cloud provide audit logging for administrative actions.
• Vendor assessment - All sub-processors have been evaluated for GDPR compliance and appropriate security certifications (SOC 2, ISO 27001, or equivalent).
• No sensitive data in logs - Personal data (such as FCM tokens, email addresses) is excluded from application logs.

7. Data Breach Notification

In the event of a personal data breach, the following procedures apply in accordance with Articles 33 and 34 of the GDPR:

• Processor to Controller - Each Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's data.
• Controller to Supervisory Authority - The Controller shall notify the competent Supervisory Authority (Office of the Data Protection Ombudsman, Finland) within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of Data Subjects.
• Controller to Data Subjects - Where a breach is likely to result in a high risk to the rights and freedoms of Data Subjects, the Controller shall notify affected individuals without undue delay.

Breach notifications shall include:

• The nature of the breach, including categories and approximate number of Data Subjects affected
• The name and contact details of the data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach and mitigate its effects

8. Data Retention and Deletion

Personal data is retained only for as long as necessary to fulfill the purposes described in this DPA and the Privacy Policy.

8.1 Retention Periods

• Account data (email, display name, profile) - Retained while the account is active. Deleted within 30 days of account deletion.
• User-generated content (votes, comments) - Retained while the associated debate exists. Anonymized or deleted upon account deletion.
• Analytics data (Firebase Analytics, GA4) - Aggregated data retained for up to 14 months, then automatically purged.
• Crash reports (Crashlytics) - Retained for 90 days.
• Payment records (Stripe) - Retained by Stripe as required by financial regulations (typically 7 years for tax purposes).
• Email delivery logs (SendGrid) - Retained by SendGrid for up to 30 days.
• Push notification tokens (FCM) - Automatically expire when a user uninstalls the app or revokes notification permissions.

8.2 Deletion Procedures

When a Data Subject requests account deletion (either in-app or via email), the Controller shall:

1. Delete or anonymize the user's data in Cloud Firestore within 30 days.
2. Delete the user's Firebase Authentication record.
3. Instruct sub-processors to delete associated data where technically feasible and not conflicting with legal retention requirements.
4. Confirm deletion to the Data Subject upon request.

9. International Data Transfers

The Controller's primary data storage is in the European Union (Firebase europe-west1, Belgium). However, some sub-processors are based in or transfer data to the United States.

9.1 Transfer Mechanisms

International data transfers to the United States are protected by the following legal mechanisms:

• EU-US Data Privacy Framework (DPF) - Google (Firebase, AdMob, GA4) and Stripe are certified under the EU-US Data Privacy Framework, providing an adequate level of data protection as recognized by the European Commission (Adequacy Decision of July 10, 2023).
• Standard Contractual Clauses (SCCs) - Where the DPF does not apply, transfers are governed by Standard Contractual Clauses approved by the European Commission (Decision 2021/914), incorporated into sub-processor DPAs.
• Supplementary measures - All transfers include encryption in transit and at rest as supplementary technical safeguards, consistent with EDPB Recommendations 01/2020.

9.2 Transfer Details by Sub-Processor

Sub-Processor	Primary Location	Transfer Mechanism
Firebase (Google Cloud)	EU (europe-west1, Belgium)	Data stored in EU; DPF + SCCs for any ancillary US processing
AdMob (Google)	EU / US	EU-US Data Privacy Framework + SCCs
RevenueCat	US	Standard Contractual Clauses
Stripe	EU / US	EU-US Data Privacy Framework + SCCs
SendGrid (Twilio)	US	EU-US Data Privacy Framework + SCCs
Google Analytics 4	EU / US	EU-US Data Privacy Framework + SCCs; consent-based collection only

10. Obligations of the Controller

• Ensure that processing is lawful and based on a valid legal basis (consent, legitimate interest, or contractual necessity).
• Provide clear and transparent information to Data Subjects about data processing activities.
• Respond to Data Subject requests within the statutory timeframe (30 days).
• Conduct data protection impact assessments where required.
• Maintain records of processing activities in accordance with Article 30 of the GDPR.
• Ensure that sub-processors are bound by contractual obligations consistent with this DPA.
• Notify sub-processors of any changes to processing instructions.

11. Obligations of Processors

Each Processor engaged by the Controller is contractually bound to:

• Process personal data only on documented instructions from the Controller.
• Ensure that persons authorized to process personal data are subject to confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Not engage further sub-processors without the Controller's prior written authorization.
• Assist the Controller in fulfilling Data Subject rights requests.
• Assist the Controller in ensuring compliance with breach notification obligations.
• Delete or return all personal data upon termination of the service agreement, unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with GDPR obligations.

12. Audit Rights

The Controller has the right to audit or inspect Processors to verify compliance with this DPA. Processors shall:

• Make available relevant compliance documentation, certifications (SOC 2, ISO 27001), and audit reports upon request.
• Allow and contribute to audits conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality protections.
• Immediately inform the Controller if, in their opinion, an instruction from the Controller infringes the GDPR or other data protection provisions.

13. Changes to Sub-Processors

The Controller shall inform Data Subjects of any changes to the list of sub-processors by updating this DPA. Material changes to sub-processors will be communicated via the app or email. Data Subjects who object to a new sub-processor may contact us at privacy@dailysteak.app.

14. Term and Termination

This DPA is effective as long as the Controller processes personal data through any of the listed sub-processors. Upon termination of the relationship with any sub-processor, the Controller shall ensure that all personal data held by that sub-processor is deleted or returned, in accordance with Section 8.

15. Governing Law and Jurisdiction

This DPA is governed by the laws of Finland and the European Union. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of Finland. Nothing in this DPA limits the rights of Data Subjects to lodge complaints with their local Supervisory Authority.

16. Contact Information

For questions about this Data Processing Agreement, data protection inquiries, or to exercise your rights:

• Controller: Oskari Lähde / Daily Steak
• Email: privacy@dailysteak.app
• Website: https://dailysteak.app
• Supervisory Authority: Office of the Data Protection Ombudsman, Finland
• Response time: Within 30 days

See also: Privacy Policy | Terms of Service