Data Processing Agreement

Subject-matter of the Processing

The subject-matter of the Processing is the provision of the Services by ToolPool.Garden to the Customer, as detailed in the Principal Agreement.

Duration of the Processing

The Processing will continue for the duration of the Principal Agreement, and until the data is deleted in accordance with the terms of this DPA.

Nature and Purpose of the Processing

The purpose of the Processing is to enable ToolPool.Garden to provide the Services, which include: enabling the Customer to create and manage pools, their membership, and their settings; inviting people to join a pool; listing tools and skills into pools, coordinating borrows and teaching through one-on-one chats, and letting members of a pool message one another directly; managing each pool's recurring subscription, its designated subscriber, and payment records; and operating, securing, and improving the Service.

Categories of Data Subjects

• Pool admins and members
• People invited to join a pool and people who request an invitation
• People who submit a community that is not on the Garden map or list
• Tool owners and borrowers
• Skill teachers and learners
• The designated subscriber who pays for a pool
• Visitors who use the anonymous 3D sign generator
• Visitors who use the QR code generator
• People who file reports, people a report is about, and people who process them

Types of Personal Data

• Anonymous Sign Generator Data: The PNG or JPG artwork and settings a visitor submits, the generated STL and 3MF models, preview, filament-change instructions, job status and timestamps, and a hash of the job's access token. The source image is cleared when success or failure is recorded. A completed zip remains accessible for 1 hour after the result is saved. Each saved outcome schedules row cleanup for 1 hour later, and a recovery sweep runs every 15 minutes to remove expired rows missed by scheduled cleanup; an outage can delay deletion. The row has no account identifier or IP address. Separate in-memory rate-limit counters hold the proxy-provided IP address, route, count, window, and expiry through their minute or daily window and for no more than 10 minutes afterward.
• QR Code Generator Data: The text a visitor types, and an image they add to the middle of the code, for the page to draw a QR code. Both are held in memory while that page is open. They are not written to the database. The image is reduced to a small PNG while it is in memory. An error report can include that text when the page crashes. The image is not in that report. If the visitor is signed in, that report includes the account id and email.
• Community Submission Data: The community name, the person's name, email address, and optional phone number, when the confirmation email was sent, and when the person confirmed. The confirmation token is stored only as a hash and is cleared on confirmation. Staff use a confirmed submission to contact that person about setting the community up. The submission is deleted when an account with that current email address is deleted, or when that person asks us to remove it.
• Account and Profile Data: Name, display name, email address, hashed password, two-factor authentication settings (chosen method and, for the authenticator-app method, the verification secret and the time the last code was accepted; emailed login codes are stored only as short-lived hashes, and one-time recovery codes only as hashes), the Google account identifier of a user who has chosen to log in with Google, a record that the 18+ age check passed (the birth date used for the check is not stored), and optional profile details such as avatar, bio, and social links.
• Pool Data: Pool name, description, an optional logo image, pinned geographic location, membership, roles, and settings, including the date the pool was created (shown as a month and year on the pool's page and wherever it is listed) and the date each membership and each tool or skill share began (which a pool's own members see as its activity feed).
• Session Data: For each browser a user is signed in on, the time they signed in, the time that device was last used, and the browser identification string their browser sends, which names the browser and its operating system. It is shown back to that user in their own account settings so they can log a device out, and is deleted when the session is logged out, or within a day of its sixty-day expiry.
• Device Location: Where a user presses the pool list's "Sort by distance" button, the coordinates their browser's geolocation prompt supplies, received solely to order that list by proximity and held in memory for the life of that page; it is not stored, associated with the account, or included in the page's web address.
• API Token Data: For each token a user creates so that a program can act as their account, the name they gave it, when it was created, and when it was last used; the token itself is held only as a hash and is shown to the user once, at creation. A token is revoked by its own user in their account settings and does not expire on its own. Where a user gives a token to an outside program, that program acts with the user's own access and is that user's own choice of processor rather than a Sub-processor engaged by ToolPool.Garden.
• Connected App Data: Where a program obtains access by asking the user to allow it on a page here rather than by taking a token, a record of which program the user allowed: the name and web address it supplied when it registered itself, neither of which is verified, together with when they allowed it and when it last acted. The credentials it uses are held only as hashes, are short-lived, and are renewed as it works. The user disconnects it in their account settings, which stops its access at once. Such a program acts with the user's own access and is that user's own choice of processor rather than a Sub-processor engaged by ToolPool.Garden.
• Chat App Connection Data: Where a user connects a Slack or Discord account, the identifiers that platform uses for the user, its workspace or server, and the group channel if they connected from one; its name; when they connected and when it last acted; whether request posts are on; and whether the platform reports permission to post. Separately, when a Slack workspace installs the app, ToolPool.Garden stores the workspace identifier and name, the permissions it granted, and its encrypted bot token. The one-use link that creates a connection is held only as a hash, lasts fifteen minutes, and unfinished links are deleted daily. A connected chat app can search public tools, skills, and requests shared with public pools among the user's selected pools. It also posts new public requests from those public pools to the saved group channel by default; the user can move or turn off those posts. Searches and automatic posts carry no owner's identity, and an automatic request post leaves out the poster's identity too. Search words, replies, and automatic posts pass through Slack or Discord, which are the user's own choice of platform rather than Sub-processors engaged by ToolPool.Garden. The user can disconnect it in account settings or from the chat app, which stops its access at once.
Photo Upload Link Data: Where a program acting as a user asks for a link to upload a photo to one of that user's own listings, a record of the link: a hash of it, which listing it is for, how many uploads remain on it, and when it expires. A link lasts about fifteen minutes, covers a small number of photos on that one listing, and permits nothing else. Revoking a token, disconnecting an app, or connecting that app again cancels every upload link on that user's account, because a link does not record which app asked for it. Expired links are deleted daily.
• Tool, Skill, Request, and Borrow Data: Tool and skill listings and member requests (names/titles, descriptions, photos, pool visibility, and each request's status in each pool); each pool's custom status labels and their order; borrow, teaching, and request-response chat messages; direct and pool-admin messages between members of a pool; discussion checklist state; reveal and hide records; and reviews. Embedded metadata such as EXIF and GPS location is stripped from uploaded photos during processing, and the original is not retained. Supply unit suggestions: the supply name, sent to TypeSafe while it is typed and when an existing supply or its stock is edited. TypeSafe receives that name and no account identifier. The name is kept in memory for 6 hours so the same name is not sent again, and it is not written to the database for this.
• Payment Data: Stripe and Dodo Payments customer, subscription, payment, and discount references, the raw event payload from the payment provider, amounts, pool ledger entries including subscription charges and refunds, and the email address and pool and account identifiers shared with the payment provider to initiate a subscription checkout.
• Legal Records: Terms of Service and Liability Waiver acceptances, comprising the document version, the typed signature, and timestamps.
• Notification Data: Per-user delivery preferences for each notification type (email on or off, browser push on or off where supported; maintenance reminders use email only), and, for each browser where the user has turned browser notifications on, the push-service address that browser supplied, the two keys used to encrypt notifications to it, and a browser description. The do-not-email list holds a keyed fingerprint of each address that has opted out of email, with no account reference and no expiry. It is kept after an account with that address is deleted, and a confirmed account holding the address can remove it.
• Announcement Read Data: For each platform announcement a user marks read on their home page, a record that they marked it and when. It orders that user's own view of the announcement carousel and is not shown to anyone else. Unmarking a card removes the record, and it is deleted with the account or with the announcement it refers to.
• Export Data: Data exports initiated by users, including status, expiration, the data for export, a token for access, and the stored archive the export is delivered as, which holds that data as a JSON file together with a copy of each image it refers to. The archive is stored privately, is downloadable only by the user it belongs to while signed in, and is deleted with the export record when it expires, which takes a day.
• Invite Data: Email addresses and optional first and last names for invitations, invite tokens, per-pool join codes, and associated pool and user IDs. An accepted invitation is retained, stamped with the date it was accepted, and where an account was created from one, the account records which invitation that was. The name on an invitation is the one the inviter supplied, and is not reconciled with the name the invitee later registers under.
• Join Request Data: The submitted email address, pool ID, submission and verification timestamps, and hashes of the verification token and any pool join code used, including requests from people without accounts. Only verified requests are visible to pool admins. Verification tokens expire after 24 hours and are cleared on use. Requests are deleted on acceptance, decline, pool deletion, or deletion of the account holding the current address. A daily cleanup removes requests older than 90 days and unverified requests more than 24 hours after the last confirmation email. Contact support to delete a request made without an account or under a previous email address.
• Report and Moderation Data: Reports filed about users, chat messages, pools, reviews, tools, supplies, skills, requests, or maintenance items, including the reporter's identity, the free-text reason, a reference to the reported content and its author, and processing notes and outcomes. A report about a tool, a supply, a skill, or a maintenance item names the item and does not name its owner. A report is disclosed to the admins of the pools it is routed to and to ToolPool.Garden, and to no one else. It is not included in a copy of a data subject's data, including in response to an access request, under Article 15(4): a report written about someone would in many cases identify its author to that person however it were redacted, and the people who file reports do so in confidence.
• Audit and Usage Data: Audit-log events (such as moderation actions, legal acceptances, and reveal events), IP address, browser type, pages visited, and interaction data.
• Error and Session Diagnostics: Application error reports (browser and request details, the account identifier and email address of a signed-in user, recent in-page actions and submitted form values with credentials removed, connection reports (no browser error reports from an embedded pool, the page that confirms a request to join, the page that confirms a community submission, or the unsubscribe page; sent every time for a live page still connecting after 10 seconds or for a user leaving after 4 seconds while the page is still connecting; sent once more with the same details if the page connects after the first report; including how long the browser waited, whether it used a WebSocket or long polling, how many times the connection failed, how many times it closed, the code from the last close, whether the browser was online, whether the tab was visible, how long the server took to send the first byte, how long the page took to arrive from the server, and the page address with the query string, the fragment, and any password-reset, confirmation, account-deletion, unsubscribe, invite, join, or data-export code removed), and, with consent, IP address), performance measurements (server-side request timings for a sample of requests; a server timing sent every time for a live click or page change of 1 second or longer, covering the callback, the template render, and the database queries; a browser timing sent every time for a click or page change that is already waiting on a live page, when the wait finishes after 1 second or longer or when the connection times out or drops (including a shorter wait, and including after the page has already connected), recording how long the browser waited, whether it used a WebSocket or long polling, and whether the wait finished, timed out, or the connection dropped, with no cookies and no close reason, with no IP address unless cookie consent was given, and with no report when the connection drops while nothing is waiting; and, with consent, page-load and navigation timings measured in the browser), and, with consent, masked session replays reconstructing page interactions, processed by Sentry.
• Advertising Measurement Data: Only for data subjects who have given advertising consent, the click identifier carried by an ad they arrived through (the Reddit identifier stored on the account for 28 days from the click, the Google identifier for 90 days, each being that provider's attribution window), the record that consent was given and when, and the lifecycle events reported to Reddit and to Google, comprising the event type and time, the click identifier, the amount for a subscription charge, and the data subject's email address and account identifier in irreversibly hashed form. The events are registration, email confirmation, joining or creating a first pool, setting up a subscription, and a subscription charge. Google receives all five; Reddit receives four, email confirmation being withheld from it because Reddit offers no means of acting on that event. A data subject may withdraw this at any time from the 'Ad measurement' setting on their account, which stops further reporting and erases both stored click identifiers and the consent record. Where a provider offers a means of erasing what it already holds, the request is also forwarded to it: Reddit exposes a data deletion interface, so the request is submitted automatically and resolved within thirty days. Google provides no means of deleting an advertising event once sent, so no request is forwarded there, and ToolPool.Garden raises one with Google directly on a data subject's request. Reddit and Google Ads are advertising partners rather than Sub-processors: each determines its own purposes for this data, so neither is processing it on ToolPool.Garden's behalf. (Google Workspace, listed as a Sub-processor, is a separate relationship with the same company.)
• Supply listings: amounts, capacities, units, usage chats, and owner-only links to tools. Maintenance tasks, schedules, the points on each task and automation, selected pool shares, completion permissions, supply stock thresholds and rearming state, completing account identifiers and timestamps, last processed reminder due times, checkout counts on maintenance automations, and private calendar link secrets.

Sub-processors

The Sub-processors engaged by ToolPool.Garden are listed in the ToolPool.Garden Privacy Policy. That list also names Reddit and Google Ads, which are identified there as advertising partners rather than Sub-processors and are not engaged to process Customer Personal Data on ToolPool.Garden's behalf.