Legal

Data Processing Addendum

Archived version, published 13 October 2026 and replaced on 14 October 2026. The current version is at humfrid.com/legal.

Last updated October 13, 2026

This Data Processing Addendum ("DPA") is the processor agreement for Customer workspace content (Humfrid as processor under GDPR Article 28). It supplements the Humfrid Terms of Service or Master Service Agreement (the "Agreement") between Avery Intelligence, Inc. d/b/a Humfrid ("Processor") and the Customer organization ("Controller"). Account, billing and website data that Humfrid processes as a controller are described in the Privacy Policy. The Sub-processor list is at humfrid.com/subprocessors.

1. Definitions

TermDefinition
Personal DataAny information relating to an identified or identifiable natural person (GDPR Article 4(1))
ProcessingAny operation performed on Personal Data (GDPR Article 4(2))
Data SubjectThe identified or identifiable person to whom Personal Data relates
Sub-processorA third party engaged by Humfrid to process Personal Data on behalf of Customer
Data BreachA breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data

2. Scope

Subject Matter. Processing of Personal Data for the duration of the Agreement to provide the Services.

Purposes

PurposeDescription
Account managementAuthentication, team management, role-based access
Knowledge processingIngestion, embedding, and storage of organizational knowledge
AI analysisConflict detection, retrieval-augmented generation, document processing
CommunicationChat interactions, voice features, notifications
Audit and complianceActivity logging, security monitoring

Categories of Personal Data

CategoryExamples
IdentifiersName, email address, user ID
Professional informationJob title, department, team membership
Communication contentMessages, documents, meeting notes uploaded by users
Usage dataPlatform interactions, feature usage, timestamps
Derived dataAI-generated summaries and structured representations of Customer Content

Data Subjects: Customer employees, contractors, stakeholders referenced in uploaded content, and third parties referenced in organizational knowledge.

Excluded data. Customer will not submit special categories of personal data, payment card data, or information subject to statutory secrecy or security classification (for example under the Swedish Public Access and Secrecy Act), as set out in the Usage Policy.

3. Processor Obligations

Lawful Processing. Humfrid will:

  • Process Personal Data only on documented instructions from Customer
  • Not process Personal Data for any purpose other than providing the Services
  • Inform Customer if an instruction infringes applicable data protection law

Confidentiality. All persons authorized to process Personal Data are bound by confidentiality obligations.

CCPA / CPRA Service Provider Certification. To the extent Humfrid processes Personal Data subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA"), Humfrid certifies that it acts solely as a "Service Provider" (Cal. Civ. Code §1798.140) and will: (a) not "sell" or "share" Customer Personal Data; (b) not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement; (c) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Humfrid and Customer; and (d) not combine Customer Personal Data with personal data received from or on behalf of other persons, except as permitted by the CCPA.

Security Measures

Humfrid maintains the following technical and organizational measures (Annex II):

MeasureImplementation
Encryption at restAES-256 on all storage. Stored integration credentials are additionally encrypted by the application with AES-256-GCM.
Encryption in transitTLS on all connections
Database accessThe database accepts only encrypted connections from authorized identities
Workspace isolationLogical isolation between workspaces; every request is scoped to its workspace
Access controlRole-based access (owner, admin, member, guest); optional two-factor authentication
SessionsShort-lived signed access tokens; sessions expire after 30 days without use
Agent executionEach agent task runs in its own short-lived container
AI providersCustomer content is processed only to provide the Services, under provider terms that do not allow training on it
BackupsAutomated daily backups with point-in-time recovery, and encrypted off-site copies
Audit loggingAuthentication, configuration and administrative actions are recorded in each workspace activity log
Change managementCode changes go through pull requests with automated checks before deployment
InfrastructureGoogle Cloud and Cloudflare

More information is on our Security page.

4. Sub-processors

Humfrid engages the Sub-processors listed at humfrid.com/subprocessors to provide the Services. That page is the authoritative list (categories, data types, locations, and compliance posture) and is incorporated into this DPA by reference. The published list controls.

Humfrid will:

  • Not engage a new Sub-processor without providing 30 days' prior written notice to workspace administrators (via email and by updating the published list)
  • Impose data protection obligations on each Sub-processor that are at least as protective as those in this DPA
  • Remain liable to Customer for the acts and omissions of its Sub-processors, subject to the limitations of liability in the Agreement
  • Maintain the current Sub-processor list at humfrid.com/subprocessors

If Customer objects to a new Sub-processor within 30 days of notification, Humfrid will work with Customer to find an alternative. If no resolution is possible, Customer may terminate the affected Services with a pro-rata refund of prepaid fees for the unused term.

5. Data Subject Rights

Humfrid will assist Customer in responding to Data Subject requests:

  • Access (Article 15) — assistance via data export and verified written request
  • Rectification (Article 16) — Users can edit data in-platform; otherwise upon verified written request
  • Erasure (Article 17) — deletion upon a verified request, and self-serve workspace deletion
  • Portability (Article 20) — assistance via data export and verified written request
  • Restriction (Article 18) — upon a verified written request
  • Objection (Article 21) — upon a verified written request

Humfrid will provide reasonable assistance to Customer with data protection impact assessments (Article 35) and prior consultations with supervisory authorities (Article 36) where required.

6. Data Breach Notification

Humfrid will:

  • Notify Customer in writing without undue delay, and in any event no later than 72 hours after becoming aware of a Data Breach affecting Customer Personal Data, by email to the workspace administrators and to the security contact Customer has provided
  • Provide: the nature of the Data Breach, the categories and approximate number of Data Subjects affected, the categories and approximate volume of Personal Data records affected, the likely consequences, and the measures taken or proposed to address the Data Breach and mitigate its effects
  • Provide updates as additional facts are confirmed, and cooperate with Customer's reasonable investigation and remediation requests

Customer's responsibility for downstream notification. Customer is the Controller of the Personal Data and is solely responsible for: (a) determining whether the Data Breach requires notification to Data Subjects, supervisory authorities, attorneys general, or other regulators under applicable law, including the General Data Protection Regulation (Articles 33 and 34), the California Consumer Privacy Act and California Civil Code §1798.82 (as amended by SB 446 effective January 1, 2026, setting a 30-day outer limit for individual notification), other U.S. state breach-notification statutes, and sectoral laws; (b) preparing and delivering those notifications; and (c) maintaining a designated security contact in workspace settings so Humfrid can reach Customer promptly. Humfrid will provide commercially reasonable cooperation, including the information described above and additional information Customer reasonably requires to meet its notification timelines.

7. International Transfers

Personal Data is processed primarily in the United States. Some AI processing runs on our providers' global infrastructure. Locations per Sub-processor are listed at humfrid.com/subprocessors. For transfers from the EEA, the UK and Switzerland, Humfrid relies on:

  • EU Standard Contractual Clauses (Module 2: Controller to Processor), Commission Implementing Decision (EU) 2021/914 (text), incorporated into this DPA by reference
  • For the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses
  • For Switzerland, the EU Standard Contractual Clauses as adapted for the Swiss Federal Act on Data Protection
  • Supplementary measures including encryption, access controls and data minimization

SCC options. Clause 7 (docking) applies. Under Clause 9(a), Option 2 (general written authorization) applies, with the 30-day notice in §4. The competent supervisory authority under Clause 13 is the authority of the EU Member State in which Customer is established. Under Clauses 17 and 18, the Clauses are governed by the law of, and disputes are resolved by the courts of, the EU Member State in which Customer is established, or Ireland if Customer is not established in the EU. Annex I is §2 of this DPA together with the parties named in the Agreement, Annex II is the Security Measures in §3, and Annex III is the Sub-processor list. If this DPA conflicts with the Clauses, the Clauses prevail.

In the event of a government request for Customer Personal Data, Humfrid will notify Customer (unless legally prohibited) and disclose only the minimum data legally required.

8. Audits

Humfrid will make available to Customer the information necessary to demonstrate compliance with this DPA, including its security documentation and responses to a reasonable security questionnaire once per twelve-month period. Once available, Humfrid's SOC 2 Type II report may be used for this purpose.

Where that information is not sufficient, Customer, or an independent auditor bound by confidentiality, may audit Humfrid's compliance with this DPA on at least 30 days' written notice, during business hours, no more than once per twelve-month period (except after a Data Breach or where a supervisory authority requires it), at Customer's cost, and in a way that does not compromise the security or confidentiality of other customers' data.

9. Untrusted Inputs and Prompt-Injection Acknowledgment

Customer agrees to follow the untrusted-input and prompt-injection practices in the Usage Policy. Liability for a prompt-injection attack arising from data Customer ingested or directed an agent to ingest is Customer's, and is governed by the Agreement's cap and exclusions.

10. Litigation Hold and Compelled Disclosure

If Humfrid receives a subpoena, court order, government demand, or other legal process seeking Customer Personal Data, Humfrid will, unless legally prohibited from doing so: (a) promptly notify Customer; (b) provide Customer with a copy of the demand and a reasonable opportunity to seek a protective order, intervene, or assert objections; (c) limit any required disclosure to the minimum scope legally compelled; and (d) preserve attorney-client and work-product protections to the extent applicable. If Customer instructs Humfrid in writing to place a litigation hold on specified Customer Personal Data, Humfrid will use commercially reasonable efforts to suspend deletion of that data for the duration of the hold, at Customer's cost for any extraordinary preservation requirements.

11. Retention and Deletion

This table is the source of truth for Customer Content and related processor data. Controller-data retention (account identifiers, billing records, marketing analytics) is in the Privacy Policy.

Data TypeRetention
Active workspace data and context libraryDuration of the Agreement. Workspace owners can delete the entire workspace from settings once any active subscription is cancelled. A 7-day grace window allows export, or cancelling the deletion, before the workspace is deleted. Deleted data is removed from active systems within 30 days and from backups as they expire, within 35 days.
Individual context itemsUntil deleted by Customer in the platform
Security / audit logsUp to 7 years
Product usage telemetry24 months
SessionsExpire after 30 days without use
Deleted user or workspace dataDeleted on verified request or at the end of the grace window, as described above

Upon termination, Humfrid will:

  • Return or delete all Customer Personal Data within 30 days, at Customer's election (the 7-day in-product grace still applies if Customer deletes the workspace before the Agreement ends)
  • Provide a final data export upon request (before deletion)
  • Certify deletion in writing upon request

Audit logs may be retained for up to 7 years for compliance purposes.

12. Liability

Liability under this DPA is subject to the limitations of liability in the Agreement. This DPA does not create a separate or higher cap.

13. Governing Law

This DPA is governed by the laws governing the Agreement, except that the Standard Contractual Clauses are governed as set out in §7, and unless applicable data protection law requires otherwise.

14. Execution

This DPA is effective upon Customer's acceptance of the Terms of Service. No separate signature is required. Customer may request a countersigned copy by contacting [email protected].

Contact

Avery Intelligence, Inc. 1300 El Camino Real, Suite 100 #66, Menlo Park, CA 94025

Data protection, DPA and security questions: [email protected].