PlaceCommand is a product of Redfish Labs LLC.
Data Processing Agreement
Last updated August 25, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Redfish Labs LLC ("Processor") for PlaceCommand.
1. Roles
The Controller determines the purposes and means of processing personal data contained in Customer Data. The Processor processes that data only on the Controller's documented instructions, which include use of the Service and its configured integrations.
2. Subject matter and duration
The subject matter is the provision of property operations software. Processing continues for the term of the subscription plus the export window described below.
3. Nature and purpose of processing
Storing and organizing reservations, guest communications, work orders, vendor records, and property information; generating message drafts for human review; delivering transactional email; and producing reports for the Controller.
4. Types of personal data
- Guest contact details, reservation details, and message content
- Property owner contact details and approval decisions
- Vendor contact and business details
- Authorized User account details
5. Categories of data subjects
- Guests of the Controller's properties
- Property owners
- Vendors and contractors
- The Controller's personnel
6. Processor obligations
- Process only on documented instructions from the Controller
- Ensure personnel with access are bound by confidentiality
- Implement appropriate technical and organizational measures, including per-organization row-level isolation, encryption of integration credentials, and restricted production access
- Assist the Controller in responding to data subject requests, taking into account the nature of the processing
- Notify the Controller without undue delay after becoming aware of a personal data breach
7. Subprocessors
The Controller authorizes the Processor to engage subprocessors for hosting and application delivery, managed database and authentication, transactional email, payment processing, and AI draft generation. The Processor remains responsible for their performance and will give notice before adding a subprocessor that materially changes the processing.
8. International transfers
Processing takes place in the United States. Where required, transfers rely on an appropriate transfer mechanism.
9. Audit
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will respond to reasonable security questionnaires no more than once annually, absent an incident.
10. Return and deletion
On termination the Controller may export Customer Data for thirty days. After that period the Processor will delete it, except where retention is required by law.
11. Liability
Liability under this DPA is subject to the limitations in the Terms of Service.