Data Processing Agreement (DPA)

• Version: 0.1 (draft)
• Date: 2026-10-14
• Applies from: [[PLACEHOLDER: effective date]]

1. Parties and when this DPA applies

This DPA is between you, the owner of one or more apps on hyad ("Customer"), and [[PLACEHOLDER: legal entity name]] ("hyad"). It is part of the Terms of Service and applies automatically when your apps store or process personal data of other people, as far as you are the controller of that data. That includes sole traders, and consumers whose app is not purely personal or household use (Art. 2(2)(c) GDPR).

• For App Data (section 2), you are the controller and hyad is your processor. If you act as processor for someone else, hyad is your sub-processor and you pass on these terms.
• hyad is an independent controller, not processor, for the global hyad identity: each person's account, credentials, sessions and sign-in (also when they sign in to your app), and for security, billing and platform logs. That is covered by the Privacy Policy. When someone signs in to your app, hyad discloses their user id, email address and role in your app to you; from then on that data is App Data.
• Who may use your app (its access list, roles and invitations) is App Data: you decide it, and hyad processes it for you.

2. Details of the processing (Art. 28(3))

Subject matter	Hosting and running the Customer's apps on hyad
Duration	As long as the Customer has apps on hyad, plus the deletion periods in section 9
Nature	Storage, retrieval, transmission, serving over the internet, execution of the Customer's server code, backup (database recovery points; hourly backup copies of app files, kept 30 days), deletion
Purpose	Providing the hyad service to the Customer under the Terms, and nothing else
Data subjects	Visitors and users of the Customer's apps; people the Customer invites to or gives roles in an app, including people who have no hyad account yet; anyone else the Customer stores data about
Categories of personal data ("App Data")	Whatever the Customer's apps store or process: documents and tables in the app database, app files, data handled by the app's server code while a request runs (including the user id, email address and role hyad passes to the app at sign-in); the app's access list and roles (user ids, roles) and invitations (email addresses the Customer enters, also before that person has an account); app source code and environment variables if they contain personal data. Not App Data: the hyad accounts, credentials and sessions of the people who sign in (hyad is controller, section 1)
Special categories	Not intended. The Customer must not store special categories of data (Art. 9) or criminal data (Art. 10) unless it has assessed that hyad's measures (Annex A) are appropriate

3. Instructions

hyad processes App Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the hyad portal, API and MCP server (including actions by AI tools the Customer connects) are those instructions. hyad informs the Customer if it believes an instruction infringes data protection law. hyad does not process App Data for its own purposes, except as required by EU or member state law (and then informs the Customer unless the law forbids it).

4. Confidentiality

Only people who need access to run hyad may access App Data, and they are bound to confidentiality. [[PLACEHOLDER: who these are, e.g. "the founder and named contractors"]] hyad's staff do not look at App Data except to provide support the Customer asks for, to investigate abuse or security incidents, or where the law requires.

5. Security (Art. 32)

hyad implements the measures in Annex A. hyad may change them as long as the level of protection does not decrease.

6. Sub-processors

The Customer gives general authorisation for the sub-processors in Annex B. hyad informs the Customer by email at least 30 days before adding or replacing a sub-processor that receives App Data. The Customer may object on reasonable data protection grounds. If we cannot resolve it, the Customer may end the affected service with immediate effect, before the new sub-processor receives any App Data: hyad then deletes the affected App Data, after an export if the Customer wants one (Terms, section 10), and refunds unused purchased credits. Customers on the Free plan have the same exit (export and deletion). hyad imposes the same data protection obligations on each sub-processor by contract and remains responsible for them.

7. International transfers

App databases, files and account data are stored at rest in Cloudflare data centres in the EU; requests are handled worldwide at Cloudflare's network edge [[CHECK: lawyer: exact location wording]]. Where App Data is transferred outside the EEA (for example to Cloudflare's or GitHub's US operations), the transfer is covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses [[CHECK: per sub-processor]].

8. Assistance

1. Data subject requests. The Customer can read, change, export and delete App Data itself through the database and files APIs, and delete an app with all its data. hyad forwards any request it receives about App Data to the Customer and does not answer it itself.
2. Security, breaches, DPIAs. hyad helps the Customer with Art. 32 to 36 GDPR as far as reasonable, taking into account the information available to hyad.
3. Breach notification. hyad notifies the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting App Data, with what it knows then (nature, categories and approximate numbers, likely consequences, measures taken) and more as it learns it. Notification goes to the Customer's account email.

9. Deletion at the end

• When the Customer deletes an app, hyad deletes its files, database, environment variables, pending uploads and access list at once. Backup copies of its files are deleted 30 days later at the latest. Database recovery points may keep data for up to 30 days [[CHECK: whether point-in-time recovery data survives a database wipe]]. The app's source repository is archived for 30 days, so that an accidental deletion can be undone, and then permanently deleted.
• When the Customer's account ends, hyad deletes all its apps and their App Data within 30 days, unless EU or member state law requires storage.
• The Customer can export App Data before deleting it, in one step in the portal or the API (files, database dump, configuration and access list, source repository; Terms, section 10).

10. Audits

hyad makes available the information needed to show compliance with Art. 28 (this DPA, Annex A, and sub-processors' certifications and reports where available, for example Cloudflare's). The Customer may audit hyad, or have an independent auditor bound to confidentiality do so, once a year on 30 days' notice and at its own cost, or at any time after a breach or if a supervisory authority requires it. If an audit finds that hyad materially breached this DPA, hyad bears the costs of that audit.

11. Liability and order of precedence

Liability is as set out in the Terms. If the Terms and this DPA conflict on data protection, this DPA prevails.

---

Annex A: Technical and organisational measures

Area	Measures (from the code on v2)
Isolation	Each app has its own database (a separate SQLite Durable Object) and its own file prefix; app server code runs in its own isolate and receives only capabilities for its own app; apps never see platform sessions or other apps' tokens
Encryption	TLS 1.2+ for all traffic, HSTS, DNSSEC on hyad.app; environment variables encrypted at rest with AES-256-GCM, each value bound to its app and name; storage encryption at rest by Cloudflare [[CHECK]]
Access control	Sign-in by password (breached-password check, minimum length), GitHub, Google or passkey; email confirmation required; per-app roles (owner, admin, member) and visibility (private, signed-in, public), re-checked every 60 seconds; short-lived app tokens (5 minutes)
Platform admins	Admin role, with every admin change requiring a fresh passkey confirmation (15 minutes) on the portal or an explicit human confirmation over MCP; every admin action audited
Logging	Append-only audit log of every change to apps, access, env vars, domains, billing and admin actions (names only, never secret values)
Abuse and availability	Rate limits on sign-in, sign-up, password reset and the API; Cloudflare Turnstile on sign-up and reset; per-request CPU and sub-request limits per app
Resilience (Art. 32(1)(c))	Cloudflare R2 (files) and D1 / Durable Objects (databases) store data redundantly, so it survives hardware and technical failures [[CHECK: Cloudflare's own durability wording]]
Recovery after deletion by the Customer	App databases: point-in-time recovery for 30 days, restorable by the app owner. App files: copied every hour to a second storage bucket in the same jurisdiction; a copy of a changed or deleted file is kept for 30 days (at most 48 earlier versions per file); restorable by the app owner
Data minimisation	Usage statistics hold only app name, request type, outcome, status and size; IP addresses in sign-up counters are stored as keyed hashes
Deletion	App deletion removes files, database, env vars, uploads, domains and access list in one operation (repeatable on partial failure)
Organisation	[[PLACEHOLDER: confidentiality undertakings, incident response procedure, key management, who has production access]]

Annex B: Sub-processors

Sub-processor	Service	Receives App Data?	Location	Transfer safeguard
Cloudflare, Inc. (US)	All hosting: Workers (app code), Durable Objects (app databases), R2 (app files, their backup copies, and bundles), D1 (access lists), DNS, TLS, custom hostnames, Turnstile, logs; Email Service for hyad's own sign-in and notice mails (apps cannot send mail through it)	Yes, all App Data	EU for storage at rest (section 7); processing at the edge worldwide	DPF / SCCs [[CHECK]]
GitHub, Inc. (US)	Private source repository for each app	Only if the app's source code or files in it contain personal data	US [[CHECK]]	DPF / SCCs [[CHECK]]
Mail provider	Cloudflare Email Service (above). The documented fallback, Resend, is not in use	No	—	—

Not sub-processors, because they receive no App Data: Stripe (payments; hyad is controller for billing data) and Google's Gmail, to which support@hyad.app is forwarded. Support is account support, for which hyad is controller (see the Privacy Policy). Do not send App Data to support by email; if support needs to look at App Data, it does so inside hyad. [[CHECK: if support ever receives App Data by email, Google (Gmail) must be listed here as a sub-processor again]]

The current list is published at https://hyad.app/legal/subprocessors. hyad emails every Customer at least 30 days before a change (section 6).