Data Processing Agreement

Last updated: October 19, 2026

This Data Processing Agreement ("DPA") is part of the Terms of Service. It applies when HONED processes personal data on your behalf, as required by Article 28 of the GDPR. You accept it when you accept the Terms.

1. Parties and roles

• Controller: you, the customer. If you are an agency and upload data of your own clients, you act as processor for them and we act as your subprocessor; you make sure your agreement with your client allows this.
• Processor: Filip Kustec.

2. Subject and duration

We process customer data only to provide HONED to you, for as long as you use the service and until the data is deleted under section 9.

3. Nature and purpose

Storing uploaded files; reading and masking tables; writing, labeling and splitting training data; training models; evaluating models against other models; running trained models in the app and through the API; exporting and deleting data on request.

4. Types of data and data subjects

You decide what you upload, so the data depends on your use. Typical examples are support tickets, emails, chat logs, invoices, forms and documents, which may contain names, contact details, customer numbers and message content of your customers, your clients' customers or your staff. You must not upload special categories of personal data or data of children.

5. Our obligations

• We process customer data only on your documented instructions. These Terms, your use of the service and your settings are your instructions. If we think an instruction breaks the law, we tell you.
• We do not use customer data for our own purposes or to train models for other customers.
• Filip Kustec and anyone authorized to access customer data are bound by confidentiality.
• We apply the security measures in section 7.
• We help you answer data subject requests, using the export and delete functions in Settings and, where needed, by email.
• We help you with security, breach notification, data protection impact assessments and prior consultation, as far as our role and the information we have allow.
• We give you the information you need to show compliance with Article 28 and allow audits as set out in section 10.

6. Subprocessors

You give general authorization for us to use the following subprocessors:

We bind each subprocessor to data protection obligations that are at least as protective as this DPA. We tell you at least 14 days before we add or replace a subprocessor, by updating this page and by writing to the email address of your account. You may object on reasonable data protection grounds; if we cannot solve the objection, you may close your account. We remain responsible for our subprocessors.

7. Security measures

• Encryption in transit (TLS) for all traffic.
• Datasets, test sets and calls encrypted at rest with AES-256-GCM.
• Data separated per account.
• File storage paths use a hash instead of the account identifier.
• Uploads through signed links that are valid for 10 minutes and bound to one file.
• Automatic masking of common identifiers (email, phone, IBAN, card and tax numbers, URLs) when tables are read. This reduces exposure but does not make data anonymous.
• API keys stored as hashes, with rate limits.
• Automatic deletion of uploaded files after use and at the latest after 7 days.
• Sign-in through Clerk with email codes and session management.

8. International transfers

Some subprocessors process customer data outside the European Economic Area, in the USA. PlanetScale and Cloudflare R2 store data in the EU. Transfers to the USA rely on:

• Vercel: EU–US Data Privacy Framework (certified).
• Clerk: EU–US Data Privacy Framework (certified).
• Thinking Machines (Tinker): Standard Contractual Clauses in its data processing agreement.
• Anthropic, OpenAI and Google: Requests reach them through Vercel AI Gateway. Google is certified under the EU–US Data Privacy Framework; Anthropic and OpenAI provide Standard Contractual Clauses in their data processing terms.

9. Deletion and return

Uploaded files are deleted after use and at the latest 7 days after upload. Other customer data is kept until you delete it. You can export all data as a ZIP of JSON files and delete it at any time in Settings. When your account is deleted, we delete customer data from our database and storage at once, unless the law requires us to keep it. Trained model weights stay with Thinking Machines and can no longer be called; on your written request, we ask Thinking Machines to delete them.

10. Audits

We answer reasonable written questions about our processing. If that is not enough, you may audit us once a year, with 30 days' notice, at your own cost, during business hours and under confidentiality, or through an independent auditor. Audits of subprocessors rely on their own certifications and reports.

11. Personal data breaches

We tell you at the email address of your account without undue delay, and where possible within 48 hours, after we become aware of a personal data breach that affects customer data. We give you the information you need to assess it and to notify authorities or data subjects.

12. Liability and order

The limits of liability in the Terms apply to this DPA. If this DPA and the Terms conflict on data protection, this DPA wins.

13. Contact

Questions about this DPA or requests for a signed copy: kustec.filip@icloud.com.