Community Agreement and Data Processing Addendum

01Who is agreeing, and who must be an adult

This Community Agreement (the "Agreement") is between TeamALA Ltd Liability Co., a Wyoming limited liability company ("TeamALA"), and the adult individual (the "Community Owner" or "you") who onboards a Roblox group and/or Discord server (the "Community") at onboarding.teamala.org.

By accepting, you promise that:

1. you are at least 18 years old;
2. you are the verified owner or authorised legal representative of the Community; and
3. you bind yourself and the Community to this Agreement, the Terms of Service and the Acceptable Use Policy.

02Your community's duties

1. Vetting only. You and your Screening Officers may use screening.teamala.org only to vet people who are applying or waiting to join your Community. Curiosity lookups, personal disputes, stalking, harassment and lookups for third parties are not allowed.
2. Tell applicants first. Before you screen anyone, show a clear notice in your Discord waiting room, verification channel or application form. You agree to include something very close to the text below.

Our community uses TeamALA (teamala.org) to check applicants' public Roblox and Discord accounts and partner safety registries before granting access. By applying or verifying to join our community, you authorize this safety check. See how your data is handled and how to exercise your privacy rights at https://teamala.org/legal/privacy.

1. Adult officers, supervised minors. Everyone you give the Screening Officer permission must be at least 18. If you give Manager or Member permissions to people aged 13 to 17, you take full legal and supervisory responsibility for their following TeamALA's policies.
2. Partner records. When your Screening Officers see records from our safety-data partner Okappiki, you must follow its rules: use them only to vet your own applicants, never label anyone "Safe", never run curiosity lookups, never publicly shame, brigade or harass anyone over a partner record, and keep the source and its appeal route (okappiki.com) attached when you talk about a finding.
3. No credit, jobs or housing decisions. You may not use TeamALA screening results to decide eligibility for paid employment, credit, insurance, housing or anything else covered by the U.S. Fair Credit Reporting Act (15 U.S.C. § 1681 and following).
4. Sub-communities. If your Community oversees sub-communities on TeamALA, you control them, can see their 90-day screening access logs to check compliance, and answer for their following this Agreement.

03Notices, suspension and leaving

1. Notices. By default we send service and security notices to Community Owners as a Discord direct message from TeamALA's bot. You can opt in to the same notices by email (never marketing) and withdraw in one click at any time.
2. Suspension. If we receive credible reports of screening misuse, harassment, doxxing or other policy violations, we may suspend your Community straight away. That blocks the Services but does not delete your data.
3. Leaving. When your Community leaves TeamALA or is deleted at manage.teamala.org, you get a 30-day grace period to export your data. After that, all Community rows, encrypted secrets, short links, forms, responses, documents, spreadsheets and files are permanently deleted from active storage, and they expire from our 7-day rolling database backups shortly afterwards.

04If your community's misuse causes a claim

You agree to defend and compensate TeamALA Ltd Liability Co., its owners and its staff against third-party claims, regulatory penalties, damages, losses and reasonable legal fees arising from: (a) your Community's breach of this Agreement or the Acceptable Use Policy; (b) your officers sharing or misusing copied screening case notes outside TeamALA; or (c) your Community's failure to give applicants and members the notices this Agreement requires.

05Governing law and venue

This Agreement is governed by the laws of the State of Wyoming, USA. The exclusive venue is the state courts of Sheridan County, Wyoming or the United States District Court for the District of Wyoming.

06Annex A: Data Processing Addendum

This Data Processing Addendum (the "DPA") applies wherever TeamALA processes personal data on behalf of the Community as a processor (a "service provider" under U.S. state privacy laws).

A1. Who is the controller

• Community as controller, TeamALA as processor for: running live, in-memory screening checks that your officers start; storing your access rules that name user IDs or group roles; hosting your forms, responses and reviewer notes; and hosting your documents, spreadsheets, comments and files.
• TeamALA as independent controller for: user sign-in accounts, platform security and rate-limit logs, abuse and rights reports, and the 90-day screening access log we keep to prevent abuse and to answer questions from people who were screened.

A2. What TeamALA promises as your processor (GDPR Article 28)

• Process personal data only on your documented instructions as given through the Services.
• Keep staff to confidentiality, and require staff to record a reason in the audit log before they open any Community configuration or record.
• Keep strong technical and organisational security: database row-level security that separates each Community's data, TLS and HSTS in transit, and AES-256-GCM application-level encryption for secrets and tokens.
• Tell the Community Owner without undue delay once we confirm a personal data breach affecting the Community's data.
• Help you answer data subject requests, using the Report and Rights page.
• Permanently delete all Community-controlled data after the 30-day grace period that follows termination.

A3. Sub-processors and international transfers

You authorise TeamALA to use the infrastructure sub-processors listed in section 5 of the Privacy Notice. Where EU GDPR or UK GDPR data is processed in the United States, Module Two (controller to processor) of the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum are part of this DPA by reference.