Pete the Pigeon

All Ohio’s Data, All the Time.

Data Processing Addendum

Draft for counsel review — part of Pete the Pigeon’s Trust page, Fugio Consulting, LLC

Data Processing Addendum

DRAFT v0.1 for counsel review — September 9, 2026. Not yet executed or offered for signature. Every factual claim below about how Pete the Pigeon handles data is sourced to the product’s published Privacy Policy, its code, or a named vendor document; anywhere that isn’t yet confirmed is marked [VERIFY WITH CHRIS] rather than guessed.

This Data Processing Addendum (“DPA”) is entered into between Fugio Consulting, LLC, an Ohio limited liability company doing business as Pete the Pigeon (petethepigeon.com) and the Pete the Pigeon Outlook add-in (“Processor,” “Fugio,” “we”), and the customer identified in an Order Form, subscription confirmation, or account sign-up that references this DPA (“Controller,” “Customer,” “you”) — a legislative office, an organization, or an individual subscriber using the Service. This DPA supplements and is incorporated into the Terms of Service at petethepigeon.com/terms and is governed by the Privacy Policy at petethepigeon.com/privacy, which describes in plain language what Pete collects and for how long. Where this DPA and the Privacy Policy differ on a factual point, the Privacy Policy’s published, dated text controls, since it is what Customer’s end users and constituents see.

1. Definitions

• “Controller” means the party that determines the purposes and means of processing Personal Data — here, the Customer.
• “Processor” means the party that processes Personal Data on the Controller’s behalf — here, Fugio Consulting, LLC.
• “Personal Data” means any information relating to an identified or identifiable natural person that Fugio processes in connection with the Service, including the categories described in Section 3 and Annex A.
• “Data Subject” means the natural person to whom Personal Data relates, including the categories described in Section 3.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, and deletion.
• “Sub-processor” means a third party engaged by Fugio to process Personal Data in order to provide the Service, listed in Section 5.
• “Service” means Pete the Pigeon as defined in the Terms of Service: the chat at petethepigeon.com, Pete by email, the Claude and ChatGPT connectors, and the Pete the Pigeon Outlook add-in.
• “Data Protection Laws” means all data protection and privacy laws applicable to the processing of Personal Data under this DPA, to the extent they apply to Controller or Processor.

2. Scope and roles

Controller determines the purposes and means of processing its own account data and any correspondence, notes, or records it chooses to send through the Service. Processor processes Personal Data solely to provide the Service, and solely on Controller’s documented instructions as set out in the Terms of Service, the Privacy Policy, this DPA, or Controller’s own configuration of the Service (for example, what a staffer chooses to open in the Outlook pane, or turning on the zero-retention setting described in Section 6). Processor will not process Personal Data for any purpose other than providing, securing, and improving the Service as described in the Privacy Policy, and will not sell Personal Data.

3. Processing details

Subject matter: provision of the Pete the Pigeon AI assistant and the Pete the Pigeon Outlook add-in.

Duration: for as long as Controller maintains an account or an active subscription, and thereafter only as needed to complete a deletion request or as described in Section 10.

Nature and purpose of processing: answering questions about the Ohio General Assembly from public legislative records; summarizing an email a Controller’s staff member has open; drafting a reply to that email; matching a new email against a learned office reply pattern (“Train Pete”); keeping constituent notes and AI-written sender summaries under the account; and administering the account, billing, and usage limits.

Categories of data subjects:

• Controller’s own office staff who use the Service (the account holders);
• constituents who write to the office — data subjects who never signed up for Pete; per the Privacy Policy, Controller’s office is responsible for any notice it owes them, and Processor deletes everything keyed to a constituent’s address on request;
• public figures named in Ohio’s public legislative record — bills, votes, committee proceedings, campaign finance and lobbying disclosures — that the Service is built from. This is public-record data, not correspondence, and is not the subject of this DPA in the same sense as the two categories above.

Categories of Personal Data:

• Account data — name, email, office or organization, sign-up date, who referred the account, and the account’s connector key.
• Correspondence the user chooses to process — the subject, body text, and sender address of an email a staff member opens in the Outlook pane, or pastes/asks about in chat. Under the current build this is held in memory for the request and is not stored, with one narrow exception: the first 600 characters of the draft Pete writes appear in Processor’s application log for 30 days (Annex B).
• Notes and summaries — constituent notes a staffer types, AI-generated sender summaries, the “Train Pete” training set (up to 30 real sent emails, each trimmed to 6,000 characters), response templates, and custom drafting instructions, all stored under the account.
• Usage counters — drafts, questions, shares, referrals, credits, and Email Efficiency Index totals. These are operational counts only and carry no message content.

4. Processor obligations

1. Documented instructions only. Processor will process Personal Data only on Controller’s documented instructions (the Terms of Service, the Privacy Policy, this DPA, and Controller’s own use of the Service’s controls), unless otherwise required by law, in which case Processor will inform Controller before processing unless the law prohibits doing so.
2. Confidentiality. Processor limits access to Personal Data to personnel who need it to operate the Service, and any such personnel are bound by confidentiality obligations.
3. Security measures. Processor implements the technical and organizational measures described in Annex B, and will not materially decrease the overall security of the Service during the term of this DPA.
4. Assistance with data-subject requests. Processor will assist Controller in responding to requests from data subjects to access, correct, or delete their Personal Data, including constituent data, by acting on requests sent to hello@petethepigeon.com or via the admin deletion tool described in Annex B.
5. Deletion. Processor will delete Personal Data within 30 days of a verified deletion request or of Controller’s account termination, matching the timeline published in the Privacy Policy (“we complete deletion requests within 30 days”), except where a short backup-cycle lag applies as described in Section 10.
6. Sub-processors. Processor will only engage the sub-processors listed in Section 5, under a written agreement that imposes data protection obligations materially no less protective than this DPA.

5. Sub-processors

These are every third party that receives Customer Personal Data in connection with the Service, matching the table published at petethepigeon.com/privacy (“Where your data goes”). The current list is also maintained at petethepigeon.com/trust.

New sub-processors. Processor will give Controller at least 30 days’ advance notice before engaging a new sub-processor to process Customer Personal Data, by posting the update to petethepigeon.com/trust. Controller may object on reasonable data-protection grounds within that window by writing to hello@petethepigeon.com; the parties will work in good faith to resolve the objection.

6. AI provider terms

• No model training. Neither Fugio nor any AI provider listed in Section 5 trains a model on Customer’s Personal Data. This matches the Privacy Policy’s short version: “No AI model is trained on your data — not by us, and not by our providers.”
• Retention per provider, as published. Anthropic does not retain API inputs/outputs by default for the models Pete uses, and in every case deletes them within 30 days; Google retains prompts and responses from the free tier for 55 days for abuse monitoring only. Neither uses the content to train models. See the sub-processor table above for citations.
• Zero-retention setting available per office, on request. An administrator may ask Fugio to turn on zero retention for their office’s account (POST /admin/zero-retention); while on, no question text, conversation history, or answer is written to Processor’s own conversation log for that account (usage counts like model, duration, and cost are still recorded so limits keep working). This does not change what the AI provider itself retains under its own published policy above — it stops Processor’s own logging.
• Fugio’s own quality review. Separately from the above, Fugio staff read a sample of chat questions and answers (not the Outlook add-in’s email content, which is not saved with the question) to check accuracy and catch abuse, per the Privacy Policy. This is disclosed here for completeness and is not an AI-provider activity.

7. Security incident notification

Processor will notify Controller without undue delay, and in any case within 72 hours of confirming a security incident that has resulted in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, by email to the contact Controller has on file. The notification will describe, to the extent then known, the nature of the incident, the categories and approximate volume of data and data subjects affected, and the steps Processor is taking in response. Processor will provide reasonable additional information as it becomes available.

8. Audits and information

On reasonable written request, no more than once per 12 months absent cause, Processor will make available the pre-filled security questionnaire at petethepigeon.com/trust/security-questionnaire and copies of the sub-processor certifications cited in Section 5 and Annex B (Railway and Resend: SOC 2 Type II; Chargebee and Stripe: PCI DSS Level 1). Processor does not yet hold its own SOC 2 report (Section 8 of the questionnaire); where a customer requires one contractually, that is a separate conversation with Fugio, not something this DPA can represent today.

9. Data location

The Service is hosted by Railway in the region published at petethepigeon.com/trust. That region is expected to change in the near term as part of a planned infrastructure move; this DPA intentionally does not assert a specific country of processing so that it does not go stale the moment that move completes — Controller should check the published region for the current answer at any given time.

10. Term, termination, and return or deletion of data

This DPA remains in effect for as long as Processor processes Personal Data on Controller’s behalf under the Terms of Service. On termination of the Service (by cancellation or otherwise), Processor will delete Controller’s Personal Data within 30 days, consistent with the Privacy Policy, except: (a) data in Processor’s hosting provider’s deleted-volume backups, which Railway destroys within 48 hours of volume deletion, and (b) a nightly database snapshot Processor keeps on a company workstation for disaster recovery, whose own deletion cadence and disk-encryption status are [VERIFY WITH CHRIS] and will be stated plainly here once confirmed rather than assumed. Processor does not currently offer a self-service data export; an export or transfer of a departed staff member’s account data can be requested at hello@petethepigeon.com.

11. Governing law

This DPA is governed by the laws of the State of Ohio, without regard to its conflict-of-law principles, matching the governing-law clause of the Terms of Service.

12. Signature block

This is a draft for counsel review and is not a binding agreement until signed by both parties.

Annex A — Processing details

Annex B — Technical and organizational measures

Every measure below is limited to what is directly verifiable in Pete’s code (repo /Users/claw/pete-worktrees/gapclass-merge, branch pete-trust) or in the audit files under pushback/. Nothing here is asserted from memory or general practice.

• Encryption in transit. All traffic to the Service is served over TLS (observed TLS 1.3) terminated at Railway’s edge; there is no plain-HTTP path to the application.
• Administrative routes require authentication. Every /admin endpoint — including the retention sweep, the erase tool, and the zero-retention toggle described below — requires a bearer token or a signed admin session before it will run.
• Session cookie is HttpOnly. The signed-in session cookie (pete_session) is set HttpOnly and Secure with SameSite=Lax, so it cannot be read by page JavaScript and is only sent over HTTPS.
• Sign-in and password-reset tokens are stored hashed. Magic-link sign-in tokens and password-reset tokens are stored as a SHA-256 hash, never in raw form, so a database read alone cannot be used to sign in as someone else.
• IP addresses are hashed before storage, with two disclosed exceptions. Chat conversation logs and the embed-widget demo log store a one-way SHA-256 hash of the visitor’s IP address, never the raw address. Two free-tier trial-gating tables (daily_questions and device_trial_state) still store the raw IP address; this gap is disclosed rather than hidden, and those rows are purged after 7 days.
• Daily automated retention sweep. An automated job runs once a day and deletes conversation, address-lookup, embed-demo, and email-form records older than 30 days, and free-trial counters older than 7 days.
• Erase tool. An administrator can delete everything Pete has stored locally under one email address — conversations, the Outlook add-in’s per-account store, and pending/scholarship request rows — on request, with a dry-run preview before anything is deleted.
• Zero-retention setting available per office. An administrator can turn on zero retention for a specific account; while on, no question text, history, or answer is written to Pete’s conversation log for that account.
• No email content in application logs beyond a disclosed 600-character draft snippet. The function that writes a draft reply or summary makes no database writes; the only record of its work anywhere in the logs is the first 600 characters of the draft Pete wrote, for debugging, kept 30 days by the hosting log.
• Sub-processor certifications. Railway and Resend are each SOC 2 Type II certified (Railway also holds SOC 3); Chargebee and Stripe are each PCI DSS Level 1 certified, the highest tier of card-industry certification. Fugio itself does not yet hold a SOC 2 report (Section 8, and the security questionnaire at petethepigeon.com/trust/security-questionnaire).