Data Processing Agreement
Last updated: October 10, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Data Controller”) and OurFamilyLineage (“Data Processor”) in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
1. Scope & Purpose
OurFamilyLineage processes personal data on your behalf to provide family tree building, media storage, collaboration, and related services. This DPA applies to all personal data processed through the platform.
2. Categories of Data
- Account data: Name, email, authentication credentials
- Family tree data: Names, dates, relationships, biographical notes of family members
- Media: Photos, documents, audio/video recordings
- Usage data: IP address, browser information, access logs
3. Our Obligations as Processor
- Process personal data only on your documented instructions
- Ensure persons authorized to process data are bound by confidentiality
- Implement appropriate technical and organizational security measures
- Assist you in responding to data subject access requests
- Delete or return all personal data upon termination of services
- Make available all information necessary to demonstrate compliance
- Notify you without undue delay (within 72 hours) of any personal data breach
4. Sub-processors
We use the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase (AWS) | Database, authentication, file storage | US (us-east-1) |
| Stripe | Payment processing | US |
| DreamHost | Transactional email delivery | US |
| Redis Cloud | Job queue & rate limiting | US (us-east-1) |
| PayPal | Payment processing | US |
| OpenAI | Biography and story writing, record transcription, photo restoration and colourisation, spoken narration | US |
| Anthropic | Long-form family narrative writing | US |
| Higgsfield AI | Portrait animation and short-film generation from photographs | US |
| HeyGen | Talking-portrait lip-sync, multi-scene films, video translation | US |
| Stability AI | Alternative engine for photo restoration and colourisation | UK / US |
The AI sub-processors above receive data only when you actively use an AI feature, and only the specific photograph, document or text that feature needs. None of them are permitted to retain your data or train on it. Which vendor serves a given feature can change — see section 3 of our Privacy Policy for what each category of feature sends.
We will notify you before adding or replacing sub-processors and give you the opportunity to object.
5. International Transfers
Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) as adopted by the European Commission.
6. Security Measures
See our Security page for details on technical and organizational measures.
7. Duration
This DPA remains in effect for the duration of our processing of your personal data. Upon account termination, we will delete all personal data within 30 days unless retention is required by law.
8. Contact
For DPA inquiries: contact@ourfamilylineage.com