Last updated: October 24, 2026
This Data Processing Agreement ("DPA") forms part of the FreshRally Terms of Service (the "Agreement") between Reshapify, LLC, doing business as FreshRally ("FreshRally," "we," "us"), and the club, association, village, or other organization that uses FreshRally (the "Club," "you"). It applies automatically when the Club accepts the Agreement. Capitalized terms not defined here have the meanings given in the Agreement.
1. Definitions
Applicable Data Protection Laws means the privacy, data protection, and data security laws that apply to FreshRally's Processing of Personal Data under the Agreement, including the comprehensive privacy laws of U.S. states ("State Privacy Laws") and, for Clubs in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws.
Club Data means information the Club, its administrators, or its members and website visitors provide to FreshRally through the Services on the Club's behalf.
Data Subject means the identified or identifiable person to whom Personal Data relates, such as a member, family member, donor, event attendee, volunteer, or Club administrator.
Information Security Incident means a breach of FreshRally's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in FreshRally's possession or control. It does not include unsuccessful attempts that do not compromise Personal Data, such as failed sign-in attempts, pings, port scans, or blocked network attacks.
Personal Data means Club Data that is "personal data," "personal information," or "personally identifiable information" under Applicable Data Protection Laws.
Process or Processing means any operation performed on Personal Data, such as collecting, recording, organizing, storing, changing, retrieving, using, disclosing, combining, restricting, deleting, or destroying it.
Subprocessor means a third party FreshRally engages to Process Personal Data in providing the Services.
2. Roles and scope
The Club decides why and how its members' Personal Data is Processed and is the "business" or "controller" (in Canada, the organization accountable for the information). FreshRally Processes that Personal Data on the Club's behalf as its "service provider" or "processor."
FreshRally is separately responsible, as a controller, for the information it collects for its own purposes, such as Club administrators' account details, billing records, and visitors to freshrally.com. Our Privacy Policy covers that information; this DPA does not.
This DPA stays in effect for as long as FreshRally Processes Personal Data for the Club, even after the Agreement ends.
3. Processing on the Club's instructions
FreshRally will Process Personal Data only to provide the Services and as the Club instructs. The Agreement, this DPA, and the Club's use and configuration of the Services (for example, importing members, sending email, publishing a directory, or connecting an integration) are the Club's complete instructions. Instructions that would require work outside the Services must be agreed in writing.
FreshRally will tell the Club if it believes an instruction violates Applicable Data Protection Laws. The details of the Processing are in Annex 1.
4. Confidentiality and personnel
FreshRally will limit access to Personal Data to personnel and contractors who need it to provide, support, or secure the Services, and will require them to keep it confidential. FreshRally personnel access a Club's data only to provide support the Club asks for, to fix problems, to keep the Services secure, or as required by law.
5. Security
5.1 FreshRally's measures. FreshRally will maintain the technical and organizational measures described in Annex 2 to protect Personal Data. We may update them over time, but not in a way that materially reduces the overall protection of Personal Data.
5.2 Information Security Incidents. FreshRally will notify the Club without undue delay, and in any event within 72 hours, after confirming an Information Security Incident affecting the Club's Personal Data. The notice will include, as far as then known, what happened, the categories and approximate number of people and records affected, the likely consequences, and the steps taken or proposed to contain it. FreshRally will update the Club as more becomes known and will reasonably help the Club meet any obligation it has to notify regulators or individuals. Notifying or responding to an incident is not an admission of fault.
5.3 The Club's responsibilities. The Club is responsible for how it uses the Services, including deciding who gets administrator access and with what permissions, removing access when officers change (the board handoff tool helps), keeping its administrators' email accounts secure, and reviewing what it publishes (for example, which fields appear in the member directory).
6. Data Subject requests
The Services let the Club view, correct, export, and delete its members' Personal Data, and let members update their own details. If FreshRally receives a request directly from a Data Subject about the Club's Personal Data, we will refer the person to the Club and tell the Club, unless the law prohibits it. FreshRally will reasonably help the Club respond to requests the Club cannot handle through the Services.
7. The Club's responsibilities for Personal Data
7.1 Notices and consent. The Club is responsible for having a lawful basis for the Personal Data it puts into FreshRally, for giving its members any required privacy notice, and for obtaining any consents the law requires, including consent to receive email where the law requires it (for example, under Canada's Anti-Spam Legislation, CASL).
7.2 Minors. The Club may record information about people under 18, such as family members on a household membership or participants in youth events, only if a parent or guardian provides it or consents, and only as needed for the Club's activities.
7.3 Restricted Data. The Club will not put the following into FreshRally: Social Security numbers, Social Insurance Numbers, or other government ID numbers; health or medical information beyond a voluntary emergency contact; payment card or bank account numbers (card and bank payments are handled by Stripe and never stored by FreshRally); passwords for other services; or other categories of sensitive information under Applicable Data Protection Laws. FreshRally has no obligations under this DPA for Restricted Data the Club enters in breach of this section, beyond keeping it secure as part of the Services.
8. Subprocessors
8.1 Authorization. The Club authorizes FreshRally to use the Subprocessors listed in Annex 3, and generally authorizes new Subprocessors under this section.
8.2 Obligations. FreshRally will have a written agreement with each Subprocessor that protects Personal Data at least as well as this DPA, to the extent relevant to its services, and remains responsible for its Subprocessors' Processing.
8.3 Changes. FreshRally will email the Club's account contact at least 15 days before adding a Subprocessor that will Process the Club's Personal Data, and will update the list at freshrally.com/legal/dpa. If the Club objects on reasonable data protection grounds within those 15 days, we will work with the Club in good faith to address the concern. If we cannot, the Club may end the Agreement and receive a pro-rated refund of any prepaid fees for the remaining term.
9. Audits and information
FreshRally will make available the information reasonably needed to show compliance with this DPA, including written answers to reasonable security questionnaires, once per year or more often if a regulator requires it. If that is not enough to meet a legal requirement, the Club may arrange an audit at its own cost, with at least 30 days' notice, during business hours, by an independent auditor bound by confidentiality, and in a way that does not compromise other customers' data or FreshRally's security.
10. Return and deletion
10.1 Export at any time. The Club can download its data at any time from the admin console, including a complete export of the organization.
10.2 After the Agreement ends. FreshRally will keep the Club's data available for export for 30 days after the Agreement ends. After that, FreshRally will delete the Club's Personal Data from its live systems within a further 30 days. Copies in backups are deleted as backups expire, within 90 days. FreshRally may keep Personal Data where the law requires (for example, financial records of fees we charged), protected under this DPA and used only for that purpose.
11. No selling, no advertising, no AI training
FreshRally will not sell or share Personal Data, use it for targeted advertising, combine it with personal information from other sources except as needed to provide the Services, or use it for any purpose other than providing the Services, keeping them secure, and complying with law. FreshRally will not use Personal Data to train, fine-tune, or improve artificial intelligence or machine learning models, and will not allow Subprocessors to do so. FreshRally may create aggregated, de-identified statistics (for example, average renewal rates across all Clubs) that do not identify any person or Club.
FreshRally understands and will comply with these restrictions, and will notify the Club if it can no longer meet its obligations under State Privacy Laws.
12. Location of Processing
FreshRally stores Club Data in the United States. Requests are served through Cloudflare's global network, so data may be briefly processed in other countries while in transit. Clubs in Canada acknowledge that their Personal Data will be stored in the United States and may be accessible to U.S. authorities under U.S. law, and are responsible for telling their members so where required.
13. General
If this DPA conflicts with the rest of the Agreement, this DPA controls for the Processing of Personal Data. Each party's liability under this DPA is subject to the limitations of liability in the Agreement. FreshRally may update this DPA to keep up with changes in law, without materially reducing the protection of Personal Data, by giving the Club notice as described in the Agreement.
Annex 1: Details of Processing
FreshRally: Reshapify, LLC, doing business as FreshRally. Data protection contact: hello@freshrally.com.
Club: The organization that accepted the Agreement. Contact: the account owner's email address in FreshRally.
Nature and purpose: Hosting and operating membership management, renewals and invoicing, event registration and check-in, waivers, email to members, the Club's website, member directory, donations, volunteer scheduling, reports, exports, integrations the Club enables, and related support.
Data Subjects: The Club's members and former members, household members, company seat holders, applicants, donors, event attendees and their guests, volunteers, newsletter subscribers, website visitors who submit forms, and the Club's administrators and officers.
Personal Data: Names, email addresses, phone numbers, mailing addresses, membership levels, dates, and history; invoices and payment records (amounts, dates, methods, and Stripe references, not card numbers); donation records; event registrations and check-ins; waiver signatures (name, time, IP address, and document version); volunteer shifts and hours; custom fields the Club defines; member photos and files the Club uploads; directory privacy choices; email delivery records; and sign-in records.
Sensitive data: None intended. See section 7.3.
Frequency and duration: Continuous, for the term of the Agreement and the deletion period in section 10.
Annex 2: Security measures
- Encryption: All traffic to FreshRally uses TLS (HTTPS) with HSTS. Data is encrypted at rest by our hosting and database providers.
- Separation between clubs: Every request is scoped to one organization, and every database query filters by that organization. Automated tests check that one club cannot read another's data.
- Access control: Role-based permissions within each Club (for example, the treasurer can manage payments without editing the website), with a preview of access changes when officers change.
- Authentication: No passwords to steal. People sign in with one-time email codes or passkeys. Sign-in attempts are rate limited.
- No card data: Card and bank payments are entered on Stripe's pages and never reach FreshRally's servers.
- Audit trail: Changes to members, money, roles, and settings are recorded with who made them and when.
- Application security: Content Security Policy and other security headers; uploaded files are type-checked and served in a way that can't run code; outgoing requests to user-supplied addresses are restricted to public addresses; webhook payloads are signed.
- API access: API keys are stored only as hashes, are limited to one organization and to chosen permissions, can be revoked, and are rate limited.
- Backups and recovery: The database is backed up continuously with point-in-time recovery.
- Personnel: Production access is limited to the people who operate FreshRally, using multi-factor authentication on infrastructure accounts.
- Incident response: Incidents are investigated and Clubs notified as described in section 5.2.
Annex 3: Subprocessors
- Cloudflare, Inc. (United States): application hosting, file storage, email sending, network security, and request logs.
- Neon, Inc. (United States): managed PostgreSQL database.
- Stripe, Inc. (United States): payment processing and FreshRally's subscription billing. For payments members make to a Club, Stripe also acts under its own agreement with the Club.
Integrations the Club chooses to connect (for example, Zapier) receive data under the Club's own agreement with that provider and are not FreshRally's Subprocessors.