Fumana Pilot Data Processing Addendum
Roles
For pilot purposes, the client organisation determines the purpose, lawful basis, authorisation, and permitted source media for its sermon archive and related personal information.
Fumana/Looped Tech acts as an operator or processor by processing that data to provide the Fumana Cloud service, subject to the client pilot arrangement.
Categories And Purposes
Categories of data may include user account data, organisation membership data, Google Drive metadata, sermon/media metadata, transcripts, transcript chunks, AI summaries, key moments, Clip Lists, processing jobs, and operational logs.
Processing purposes include authentication, access control, Drive scanning, media pairing, waveform sync, transcription, search indexing, AI-assisted summaries, Clip List workflow, support, debugging, and security/audit readiness.
Confidentiality And Security
Fumana will take reasonable steps to keep client content confidential and restrict operational access to what is needed to provide and support the service.
Pilot security measures include tenant-based organisation access, Supabase Auth, role-based permissions, server-side secret handling, worker-based processing, and logs designed to avoid tokens, secrets, and unnecessary content.
Sub-Processors
Fumana may use sub-processors for hosting, database, authentication, Google Drive API access, local/cloud worker execution, transcription, embeddings, reranking, summaries, and related service operations.
Fumana should maintain a current sub-processor list before broad commercial rollout.
Security Compromises, Return, And Deletion
Fumana will make reasonable efforts to notify the client organisation of confirmed security compromises affecting client data without undue delay after discovery and assessment.
After the pilot, Fumana will return, export, delete, or disable access to client data on written request where reasonably practical, subject to backups, legal requirements, and operational retention needs.
Data Use Limits
Fumana does not sell client data.
Client content is not intended to be used for public model training. AI providers should only receive bounded data needed for enabled service features.