Data Processing Agreement

Effective October 12, 2026 · Version 1.3

Contents

1. Scope and roles
2. Processing on your instructions
3. Confidentiality
4. Security
5. Subprocessors
6. Data subject requests
7. Personal data breaches
8. Impact assessments and authorities
9. Deletion and return
10. Information and audits
11. International transfers
12. US state privacy laws
13. Liability and precedence
14. Annex I: Description of processing
15. Annex II: Security measures
16. Annex III: Subprocessors

1. Scope and roles

This Data Processing Agreement ("DPA") is between Honeyp AI, Inc., which operates honeyp.ai ("honeyp.ai", "we"), and the customer that agreed to our Terms of service ("Customer", "you"). It applies whenever we process personal data on your behalf in providing the service ("Customer Personal Data").

For Customer Personal Data, you are the controller (or a processor acting for your own controller) and we are your processor. Under the California Consumer Privacy Act ("CCPA") and similar US state laws, you are the business or controller and we are your service provider or processor. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR, the UK GDPR, or the applicable law ("Data Protection Laws").

This DPA doesn't cover data we handle as a controller for our own purposes, such as your team members' sign-in emails, billing details and support history; our privacy notice covers those.

2. Processing on your instructions

• We process Customer Personal Data only on your documented instructions, which are: the Terms, this DPA, your settings in the dashboard (such as mode, thresholds and retention), and your API calls. We'll process it only for the purposes in Annex I, unless the law requires otherwise, in which case we'll tell you first unless the law forbids it.
• We'll tell you if we believe an instruction breaks Data Protection Laws.
• You're responsible for the lawfulness of the data you send us and of your instructions, including having a lawful basis, giving your users notice of the check, and meeting any consent requirement for the browser snippet that applies to you (for example under the EU ePrivacy rules).
• We may create aggregated, de-identified statistics about how the service performs, which can't be used to identify you or any person, to run, secure and improve the service. We never sell Customer Personal Data or use it for advertising, profiling for other customers, or training models for other purposes.

3. Confidentiality

Everyone at honeyp.ai and our subprocessors who can access Customer Personal Data is bound by confidentiality and only accesses it as needed to provide, secure or support the service.

4. Security

We implement and maintain the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update them as long as the overall level of protection doesn't decrease.

5. Subprocessors

• You give us general authorisation to use the subprocessors in Annex III.
• We'll give at least 30 days' notice by email to account owners before adding or replacing a subprocessor that will process Customer Personal Data. You may object on reasonable data-protection grounds within that period; if we can't resolve the objection, you can end the affected service and receive a refund of prepaid fees for the remaining period.
• We bind each subprocessor to data-protection terms at least as protective as this DPA, and remain responsible for its performance.

6. Data subject requests

Taking into account the nature of the processing, we help you respond to requests from your users to exercise their rights. You can do this yourself: the dashboard's Privacy tab and our API let you look up, export and delete a person's data by email address or account ID. If a person contacts us directly about Customer Personal Data, we won't respond on the merits ourselves (other than to say we're passing the request on); we'll forward it to you without undue delay.

7. Personal data breaches

We'll notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. We'll give you the information you reasonably need to meet your own obligations, as it becomes available: what happened, the data and approximate number of people affected, likely consequences, and what we've done or will do. We'll take reasonable steps to contain and fix it. Telling you about a breach isn't an admission of fault.

8. Impact assessments and authorities

We'll give you reasonable help, using information we have, with data protection impact assessments and prior consultations with supervisory authorities about the service, and cooperate with authorities as Data Protection Laws require.

9. Deletion and return

• During the agreement, signup-check records are deleted automatically after the retention period you choose (up to 90 days on Trial and Starter, 180 on Growth and 365 on Enterprise; 30 by default; at most 90 for a service used by children), and you can delete a person's data or export your data at any time.
• When the agreement ends, you can export your data from the dashboard first. We delete Customer Personal Data within 30 days after termination, unless the law requires us to keep it. Backup copies are overwritten on their normal cycle, within a further 30 days, and are protected meanwhile.

10. Information and audits

• We'll make available the information reasonably needed to show we comply with this DPA, including answers to a reasonable security questionnaire once a year and any third-party audit reports we hold.
• If that isn't enough, or a supervisory authority requires it, you (or an independent auditor bound by confidentiality) may audit our compliance, no more than once every 12 months, with at least 30 days' notice, during business hours, without disrupting the service or accessing other customers' data, and at your cost.

11. International transfers

We're based in the United States and process Customer Personal Data there. Where Data Protection Laws restrict transferring it from the European Economic Area, the United Kingdom or Switzerland to us:

• EEA: the European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated into this DPA: Module 2 (controller to processor) where you're a controller and Module 3 (processor to processor) where you're a processor. You're the data exporter and we're the data importer. The optional docking clause (clause 7) applies; under clause 9, option 2 (general authorisation) applies with the notice period in section 5; the optional wording in clause 11 doesn't apply; clauses 17 and 18 are governed by the law and courts of Ireland; Annexes I to III of the clauses are completed by the annexes to this DPA, and the competent supervisory authority is the one identified under clause 13.
• United Kingdom: the UK International Data Transfer Addendum to the Standard Contractual Clauses (issued by the Information Commissioner) applies, with the tables completed by the information in this DPA; either party may end it as allowed in its section 19.
• Switzerland: the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as a competent authority.

If these clauses conflict with this DPA, the clauses win. We'll cooperate on a different lawful transfer mechanism if one becomes necessary.

12. US state privacy laws

Where the CCPA or another US state privacy law applies, we:

• won't sell or share Customer Personal Data (as those terms are defined in the CCPA);
• won't keep, use or disclose it for any purpose other than the business purposes in Annex I, or outside our direct business relationship with you;
• won't combine it with personal data we receive from anyone else, except as Data Protection Laws allow for service providers;
• will comply with the obligations that apply to us as a service provider or processor, give it the level of privacy protection those laws require, and tell you if we can no longer meet them;
• accept that you may take reasonable and appropriate steps to make sure we use it consistently with your obligations, and to stop and fix any unauthorised use.

We certify that we understand and will comply with these restrictions.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the Standard Contractual Clauses don't allow it. If this DPA conflicts with the Terms on how personal data is handled, this DPA wins. It lasts as long as we process Customer Personal Data. We may update it to reflect changes in law or the service, with notice under the Terms, as long as protection for Customer Personal Data doesn't decrease.

Annex I: Description of processing

Annex II: Security measures

• Data minimisation: emails stored only as a keyed hash unique to each customer; IP addresses shortened before storage; no keystroke content; customer-set retention with automatic daily deletion.
• Encryption: HTTPS (TLS) for all traffic; customer credentials for connected tools encrypted at rest; API keys, sign-in links and sessions stored only as hashes.
• Access control: customers are isolated from each other in every query; staff access only through a separate, email-verified sign-in with short sessions, optionally limited to approved networks; least-privilege access to production.
• Accountability: an audit log of staff and customer administrative actions; a privacy log of data-subject requests that contains no raw identifiers.
• Application security: strict content security policy, CSRF protection, single-use sign-in links, rate limits, origin restrictions for the browser snippet, and automated tests (including browser tests) on every change.
• Resilience: managed hosting with health checks and automatic restarts; the service is designed to fail open so an outage doesn't block the Customer's users.
• Incident response: documented process to contain, assess and notify within the timelines in section 7, and to review afterwards.
• Vendors: subprocessors chosen for their security practices and bound by data-protection terms.

Annex III: Subprocessors

Paddle, our reseller and merchant of record, processes billing details for paid plans as its own controller and receives no Customer Personal Data. Tools you connect yourself (such as your own Jira, Asana or webhooks) act on your instructions and aren't our subprocessors.