Data Processing Addendum

Last updated: 26 October 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service between the customer ("Customer", "you") and 11924109 Canada Inc. ("Provider", "we"). It applies whenever Content you put into Herald contains personal data that you are responsible for under data protection law. It takes effect automatically; no signature is needed. If you need a signed copy for your records, email support@getherald.ai and we'll return one.

Words like "personal data", "controller", "processor", "processing" and "data subject" mean what they mean in the GDPR. "Data protection law" means Canada's PIPEDA and Quebec's Act respecting the protection of personal information in the private sector, the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA, and any other law that applies to the personal data in question.

1. Roles

For personal data in your Content, you are the controller (or a processor for your own customer) and we are your processor. For the account data we hold about your users, we are an independent controller, and the Privacy Policy applies instead of this DPA.

2. What we process, and why

Subject matter	Hosting, indexing, searching and serving the Content you store in Herald to the people and agents you authorise
Duration	For as long as your account exists, plus the deletion period in section 9
Nature and purpose	Storage and backup; indexing for search; using AI models to organise, describe, retrieve and check Content; returning Content to the people and agents you authorise; keeping activity logs
Types of personal data	Whatever you choose to write into pages, tables and files. Typically business contact details, names, job titles, quotes and notes about customers, prospects, partners and colleagues. You agree not to store special categories of data, payment card data, government identifiers or credentials (Terms, section 5).
Data subjects	Your customers, prospects, partners, employees and contractors, and anyone else your Content describes

3. Your instructions

We process personal data only on your documented instructions. Those instructions are: the Terms, this DPA, and the way you and your authorised users and agents use the Service (what you store, who you give access to, what agents request). We'll tell you if we think an instruction breaks data protection law, but we aren't obliged to check.

You are responsible for the lawfulness of the personal data you store, for having a lawful basis to share it with us and with everyone you give access to, and for the instructions you give.

4. Confidentiality

Everyone we authorise to access personal data, including our own staff and contractors, is bound by a duty of confidentiality and gets access only when needed to support you, investigate a problem, secure the Service or comply with the law.

5. Security

We maintain the technical and organisational measures in Annex 1, and we won't reduce the overall level of protection they provide during the term. We may improve or replace individual measures.

6. Subprocessors

Current list. You authorise us to use the subprocessors on our subprocessors page, which says what each one does and where it processes data.

Changes. We'll give you at least 30 days' notice before adding or replacing a subprocessor, by updating that page and emailing the owners of your organization. If you have a reasonable, data-protection-related objection, tell us within that period. We'll try to find a way to meet it; if we can't, you may close your account before the change takes effect, and we'll delete your Content as in section 9.

Our responsibility. Each subprocessor is bound by a written contract with data-protection terms at least as protective as this DPA, and we stay responsible for their performance. None may use your Content to train machine-learning models.

7. Helping you with your obligations

Data subject requests. The Service lets you find, correct and delete personal data in your Content yourself, and read it out over the API. If a data subject contacts us directly about your Content, we'll pass the request to you without responding on the merits, and help you answer it where you can't do so through the Service.

Assessments and consultations. We'll give you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities, to the extent it concerns our processing.

Security incidents. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to your personal data, we'll notify the owners of your organization without undue delay, and no later than 72 hours after becoming aware. We'll tell you what we know: what happened, what data and roughly how many people are affected, what we've done about it, and who to contact. We'll update you as we learn more. Our notice isn't an admission of fault.

8. Audits

Once a year, or after a security incident affecting your data, you can ask us for the information you reasonably need to confirm we're meeting this DPA: a description of our measures, the results of any third-party assessments we hold, and answers to a reasonable security questionnaire. If that isn't enough to satisfy a legal requirement, we'll agree a scope for an audit by you or an independent auditor you appoint, on at least 30 days' notice, during business hours, no more than once a year, at your cost, and under confidentiality.

9. Return and deletion

You can read all your Content over the REST API and MCP at any time, request a full export in open formats (Markdown, CSV, original files), and delete any Content yourself. When your account is closed, or on your written request at any time, we delete all Content and personal data in it within 30 days, except for copies in backups, which expire within 7 days, and anything we must keep by law. Deleted data in backups stays protected by this DPA until it expires. We'll confirm deletion in writing if you ask.

10. International transfers

We are a Canadian company and our subprocessors process data in the United States. Canada holds adequacy decisions from the European Commission and the UK for personal data handled by organisations subject to PIPEDA, so transfers to us from the EEA or UK need no further safeguard. Where personal data protected by the GDPR or UK GDPR then goes on to our US subprocessors, the transfer is covered by:

• the subprocessor's certification under the EU-US Data Privacy Framework (and its UK Extension and Swiss-US DPF, as applicable), or
• the European Commission's Standard Contractual Clauses (Module 3, processor to processor, or Module 2 where we are the data exporter), with the UK International Data Transfer Addendum where UK data is involved, and the Swiss amendments where Swiss data is involved.

If you are outside the EEA, UK and Switzerland and transfer data to us from a jurisdiction with its own transfer rules, the Standard Contractual Clauses (Module 2, controller to processor) are incorporated between you as exporter and us as importer, with the details in section 2 and Annex 1 filling in their annexes, and with these choices: the optional docking clause applies, option 2 of clause 9 applies with the 30-day notice in section 6, the optional language in clause 11 doesn't apply, the governing law and courts are those of Ireland for the EU SCCs, and the UK Addendum's tables are completed with the same details.

11. California

Where the CCPA applies, we act as a service provider. We won't sell or share your personal data, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal data we receive from others, except as the CCPA allows. We certify that we understand these restrictions, and we'll tell you if we can no longer meet them.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms. Where this DPA and the Terms differ on the processing of personal data, this DPA wins. Where this DPA and the Standard Contractual Clauses differ, the Clauses win.

Annex 1: Security measures

These are the measures in place at the date above.

Access control

• Every person and API key is scoped to an organization, and within it to the workspaces, folders and pages it's allowed to see. An agent never gets more than the person or key behind it.
• Partner and workspace keys are read-only unless edits are explicitly allowed when the key is created. Keys can be revoked instantly, and show when they were last used.
• Only published pages are visible to agents. Agent edits land as drafts and need a person's publish action to reach other agents.
• Sign-in is handled by WorkOS AuthKit (email, social sign-in and single sign-on as configured). We never hold passwords. MCP connections use OAuth with per-user tokens, or workspace API keys.
• Our own staff access production only for support, incident response, security or legal reasons, through named accounts.

Infrastructure

• The application runs on Vercel; the database (Postgres) and file storage run on Supabase. Both providers hold SOC 2 Type II reports and encrypt data at rest.
• All traffic is over TLS. The database accepts connections only over TLS with credentials held by the application.
• The application connects to the database as a least-privilege role that can read and write application tables and nothing else: no schema changes, no role management. Row-level security is enabled on every table, which keeps the provider's generic REST API out.
• Attached files live in a private bucket; agents get time-limited (2-minute) signed links.
• Secrets are stored as sensitive environment variables on the hosting platform and rotated after any suspected exposure.

Software

• Code is in a private repository with protected branches, required review checks, and automated dependency updates and vulnerability alerts.
• Every deployment is reversible with a one-click rollback, and database migrations are written to be rollback-safe.
• AI model providers receive only the Content and requests needed for the task, over API, under terms that prohibit training on the data.

Logging, retention and deletion

• Every agent request is logged for the customer's own review (Activity) and kept 90 days; refused requests and access checks one year; page revisions one year; deleted content 90 days in Recently deleted. Scheduled jobs purge expired data daily.
• Product analytics never receive Content: no task or search text, titles, bodies, file names or email addresses.

Resilience

• The database is backed up daily by the provider; each backup is retained for 7 days.
• Hosting and database providers run on redundant infrastructure in the United States.

Incident response

• Security contact: support@getherald.ai. We investigate reports promptly and notify affected customers as in section 7.

Annex 2: Subprocessors

See the subprocessors page, which is incorporated here as updated from time to time under section 6.