Data Processing Addendum

1. What this addendum is and how it takes effect

This Data Processing Addendum (the "DPA") forms part of the Terms of Service (the "Terms") between you (or the organization you represent) and Hedgeling LLC, a Utah limited liability company ("Hedgeling", "we", "us"). It applies whenever we process Customer Personal Data on your behalf while providing the Service.

You do not need to sign anything for this DPA to apply. It takes effect automatically when you accept the Terms and lasts for as long as we process Customer Personal Data. If your organization needs a countersigned copy, email support@thehedgeling.com and we will send one.

If you have an Enterprise contract or another signed agreement with us that contains its own data processing terms, those terms apply instead of this DPA. Otherwise, if this DPA and the Terms conflict about the handling of personal data, this DPA controls.

2. Definitions

• Customer Content has the meaning given in the Terms: the source strings, code context, translations, glossaries, personas, style guides, documents, and other material you submit to the Service.
• Customer Personal Data means personal data contained in Customer Content that we process on your behalf.
• Data Protection Laws means the laws that apply to the processing of Customer Personal Data under this DPA. Depending on where you and the individuals concerned are located, these may include the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.
• Sub-processor means a third party we engage to process Customer Personal Data.
• Standard Contractual Clauses means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner.

The terms "controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws, such as "business" and "service provider". Other capitalized terms have the meanings given in the Terms.

3. Roles

For Customer Personal Data, you are the controller and Hedgeling is your processor. If you are yourself a processor acting for someone else, Hedgeling is your sub-processor, and you confirm that your instructions to us are authorized by the controller.

This DPA does not cover the data we handle as a controller in our own right: account data, usage and billing records, credentials, logs and security records, and website analytics. The Privacy Policy describes what we do with that data.

If you connect your own AI provider key, that provider processes your data under your agreement with it. It is your provider, not our Sub-processor. When you run the command-line package on your own machine with your own key, the data goes directly from your machine to that provider and we do not process it at all.

4. Details of the processing

• Subject matter and purpose: providing the Service to you: extracting, storing, translating, reviewing, and delivering your strings, and securing and supporting the Service.
• Nature of the processing: hosting and storage, sending strings and context to AI providers for translation and chat, showing content to the users you authorize, reading from and writing to repositories you connect, backup, and deletion.
• Duration: for as long as your workspace exists, and then until deletion is complete as described in section 11.
• Types of personal data: whatever personal data you include in Customer Content. Customer Content is mostly interface text, so this is normally limited to names, email addresses, and similar identifiers that appear in source strings, code context, glossaries, imported documents, review comments, or console chat messages.
• Data subjects: the individuals that personal data relates to, for example your employees, contractors, and the end users of your products.
• Sensitive data: the Service is not designed for special categories of personal data, health data, payment card data, or government identifiers, and you agree not to include them in Customer Content.

5. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and the way you and your users configure and use the Service are your complete instructions. If you need something outside them, ask us at support@thehedgeling.com and we will tell you whether we can do it.

We will tell you if we believe an instruction breaks Data Protection Laws, and we may pause that processing until you confirm or change the instruction. If a law requires us to process Customer Personal Data in some other way, we will tell you before we do so unless that law forbids it.

We do not sell or share Customer Personal Data, we do not use it to train AI models, and we do not keep, use, or disclose it for any purpose other than providing, securing, supporting, and improving the Service for you as described in the Terms.

6. Confidentiality

Access to Customer Personal Data is limited to people who need it to run and support the Service, and everyone we authorize to process it is bound by a duty of confidentiality.

7. Security measures

We protect Customer Personal Data with encryption in transit (HTTPS) and at rest, role-based access control, tenant isolation, encrypted storage of provider keys, hashed storage of service credentials, signed short-lived entitlement leases, rate limiting, and audit logging.

We may change these measures as the Service develops, but we will not materially reduce the overall level of protection. You are responsible for how you use the Service, including choosing what to submit, managing who has access to your workspace, and keeping your credentials and API keys safe.

8. Sub-processors

You give us general authorization to use Sub-processors, including those listed in section 17. We use each Sub-processor under a written agreement that requires it to protect personal data, and we remain responsible to you for the work our Sub-processors do for us.

Before we add or replace a Sub-processor, we will update the list in section 17 and notify your workspace owner by email or in the console at least 30 days before the new Sub-processor starts processing Customer Personal Data. If we have to replace a Sub-processor urgently for security or continuity reasons, we will give notice as soon as we reasonably can.

You may object to a new Sub-processor on reasonable data protection grounds by writing to support@thehedgeling.com within that notice period. We will work with you in good faith to find an alternative, such as a way to use the Service without that Sub-processor. If we cannot find one, you may stop using the affected feature or cancel the Service as described in the Terms.

9. Requests from individuals and other assistance

You can view, correct, export, and delete Customer Content in the console at any time, and you can use those tools to answer requests from individuals who want to exercise their rights. If an individual contacts us about Customer Personal Data, we will pass the request to you, or ask the individual to contact you, and we will not answer it ourselves unless the law requires us to.

Taking into account the nature of the processing and the information available to us, we will also give you reasonable help with data protection impact assessments and with consulting regulators where Data Protection Laws require them.

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify your workspace owner by email without undue delay. We will tell you what we know about what happened, the data involved, the likely consequences, and what we are doing about it, and we will update you as we learn more. We will take reasonable steps to contain the breach and limit its effects.

Notifying you of a breach is not an admission of fault or liability. You are responsible for any notifications you owe to regulators or individuals; we will give you the information we have to help you make them.

11. Deletion and return

You can export your catalogs at any time. Ending a subscription does not delete your data: you keep read and verified-export access for a grace period of at least 30 days, and we keep Customer Content until deletion is requested.

Deletion starts when an authorized user requests deletion of a project or organization in the console. That request opens a 30-day export-only window. After that window we purge the content: source strings, translations, context, glossaries, prompts, personas, imported documents, chat and AI payloads, and content snapshots in audit records. Purged content may remain in encrypted database backups for a short period (currently up to seven days) before those backups expire.

After the purge we keep only the minimal billing, security, and audit records described in the Privacy Policy, with content removed. If you cannot use the console to export or delete your data, email support@thehedgeling.com and we will help.

12. Information and audits

On written request, we will give you the information reasonably needed to show that we meet our obligations under this DPA, including answers to a reasonable security questionnaire. Unless a regulator requires more or there has been a personal data breach affecting your data, you may ask for this once in any 12-month period.

If Data Protection Laws entitle you to more than that information, you may ask for an audit. An audit needs at least 30 days' written notice and an agreed scope, takes place during normal business hours, is at your expense, is subject to confidentiality, and must not expose other customers' data or disrupt the Service. The Service runs on infrastructure operated by Amazon Web Services, so we cannot give you physical access to data centers.

13. International transfers

The console is hosted on AWS in the United States, and our Sub-processors may process data in the United States and other countries. By using the Service you instruct us to process Customer Personal Data in those locations.

Where you transfer Customer Personal Data to us that is protected by the GDPR, and the transfer is not covered by an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor.
• You are the data exporter and Hedgeling is the data importer.
• The optional docking clause (Clause 7) and the optional wording in Clause 11 do not apply.
• For Clause 9, general written authorization applies, with the notice period set out in section 8.
• For Clauses 17 and 18, the governing law is that of Ireland and the courts are the courts of Ireland.
• Annex I is completed with the information in sections 1, 3, and 4, Annex II with section 7, and Annex III with section 17. The competent supervisory authority is the one determined under Clause 13.

For transfers protected by the UK GDPR, the UK Addendum is incorporated into this DPA and its tables are completed with the same information; neither party may end the UK Addendum under its section 19. For transfers protected by Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.

If the Standard Contractual Clauses or the UK Addendum conflict with the rest of this DPA or with the Terms, the Standard Contractual Clauses or the UK Addendum control.

14. Your responsibilities

You are responsible for the Customer Personal Data you submit: for having a lawful basis and any notices or consents needed to submit it, for its accuracy, and for making sure your instructions to us comply with Data Protection Laws. Please keep personal data out of Customer Content where you can.

15. Liability and governing law

Each party's liability under this DPA is subject to the limitation of liability in section 15 of the Terms. Nothing in this DPA limits the rights of individuals under the Standard Contractual Clauses or any liability that cannot be limited by law.

This DPA is governed by the law that governs the Terms, and disputes are handled as the Terms describe, except where the Standard Contractual Clauses or the UK Addendum require otherwise.

16. Changes to this addendum

We may update this DPA when the Service, our Sub-processors, or the law changes. Each version carries a version date at the top of this page. For material changes we will give at least 30 days' notice by email or in the console before the new version takes effect. Changes to Sub-processors follow section 8.

17. Current sub-processors

These are the providers we currently use to run the Service, and what each one does.

• Amazon Web Services (AWS): hosting, databases, storage, and backups for the console, and Amazon Cognito for account creation, sign-in, password storage, and verification email. Located in the United States.
• Google (Gemini): AI inference. When you use managed AI on our platform key and Gemini is the selected provider, the strings, context, and chat messages in the request are sent to its API.
• Meta (Llama): AI inference. When you use managed AI on our platform key and Llama is the selected provider, the strings, context, and chat messages in the request are sent to its API.
• GitHub: when you connect a repository, we read the source files you choose and, at your request, open pull requests with translations, using the access you grant.
• Stripe: checkout, payment methods, invoices, and the customer billing portal.
• Google Workspace: email you send to our support and sales addresses.

Stripe and Google Workspace handle billing details and correspondence, not Customer Content. They are listed here so that the list matches the Privacy Policy. AI providers you connect with your own key are not on this list because they act for you, not for us.

18. Contact

Questions about this DPA, requests for a countersigned copy, and objections to a Sub-processor: support@thehedgeling.com.