Data Processing Addendum

This Data Processing Addendum ("DPA") is between the customer ("Customer") and Halmos Labs, Inc., a Delaware corporation ("Provider"). It is part of the Terms of Service (the "Agreement").

Effective date: 2026-10-22. Accepting the Terms accepts this DPA.

Provider processes personal data in Customer Data to provide ADoor. ADoor is a PostgreSQL database the customer, people the customer invites, and the assistants and apps the customer connects use inside the grant the customer sets.

Definitions

The following terms apply in this DPA. Capitalized terms that are not defined here have the meaning given in the Terms.

• Affiliate means an entity that controls, is controlled by, or is under common control with a party.
• Applicable Data Protection Laws means privacy and data-security laws that apply to Provider's processing of personal data under the Agreement, including, where they apply, U.S. state privacy laws, the EU GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP").
• Controller means the entity that determines the purposes and means of processing, including a "business" under the California Consumer Privacy Act ("CCPA").
• Customer Data means information Customer, or someone on Customer's behalf, makes available to Provider for processing to perform the Service.
• Data Subject means the identified or identifiable person the personal data is about.
• EEA means the European Economic Area.
• GDPR means, as applicable, Regulation (EU) 2016/679 and that Regulation as it forms part of UK law, including implementing legislation, and any successor.
• Information Security Incident means a breach of Provider's security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data in Provider's possession. It does not include unsuccessful attempts that do not compromise personal data, such as failed sign-in, pings, port scans, or denial-of-service attacks.
• Personal Data means Customer Data that is personal data or personal information under Applicable Data Protection Laws. It does not include contact details of Customer's own personnel that Provider handles as a controller for the account itself, or information Provider collects independently of the Service. Account email and name are described in the privacy policy.
• Process means any operation on Personal Data, whether or not automated.
• Processor means the entity that processes Personal Data on behalf of the Controller, including a "service provider" or "contractor" under the CCPA.
• Services means ADoor, as described in the Terms.
• Subprocessor means Provider's Affiliate or a third party Provider engages to process Personal Data for the Services.

Duration and scope

This DPA lasts for as long as Provider processes Personal Data, including after the Terms end.

Processing subject to the GDPR is also subject to the international transfers annex below. Processing subject to U.S. state privacy laws, where Customer is a business, controller, processor, or service provider under those laws, is also subject to the state privacy annex below.

Customer instructions

Provider will process Personal Data only on Customer's documented instructions. Those instructions are this DPA, the Terms, and Customer's use of the Service, including the grants, queries, and writes Customer and Customer's connections make. If Provider believes an instruction infringes the GDPR, Provider will tell Customer.

By accepting this DPA, Customer instructs Provider to process Personal Data to provide the Service. If Customer asks for processing outside the Service, the parties will agree to that in writing before Provider does it.

Security

Provider will keep technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in the security annex. Provider may update those measures, including to respond to the law or to improve security, if the update does not materially decrease the overall protection.

Provider will require people who are authorized to access Personal Data to keep it confidential.

Provider will notify Customer without undue delay after becoming aware of an Information Security Incident. The notice will describe, to the extent then known, what happened, the steps taken to mitigate it, and the steps Provider recommends. Notification is not an admission of fault. Customer is responsible for notices to supervisory authorities and to Data Subjects that the law places on Customer. Where a notice identifies Provider and the law allows it, Customer will tell Provider in advance and consider corrections that are accurate and lawful.

Customer is responsible for its use of the Service, for protecting its sign-in, for the grants it approves, and for keeping its own copies of data it cannot afford to lose. Retained history is not a backup. There is no point-in-time restore. Nightly encrypted backups are kept for 30 days, as the privacy policy describes.

Data subject requests

Provider will, taking into account the nature of the processing, give Customer the assistance that is reasonably necessary and technically feasible for Customer to respond to Data Subject requests about Personal Data Provider holds.

If Provider receives a Data Subject request, Provider will tell Customer promptly, unless the law forbids that, and will point the person to Customer. Customer is responsible for the reply, unless the law requires Provider to reply.

Privacy requests about the account itself (the controller processing described in the privacy policy) go to support@halmoslabs.com.

Customer responsibilities

Customer is responsible for having a lawful basis, and for giving the notices and obtaining the permissions Applicable Data Protection Laws require, so that Provider can process Personal Data as this DPA describes.

Customer decides what to store in the database. Provider does not require government identification numbers, payment card numbers, health information, or personal data of children. Stripe collects payment card details for a paid plan. Provider does not store card numbers. The Service does not block other categories of information. If Customer stores them, Provider processes them only to provide the Service, and Customer is responsible for having a lawful basis to do so. The Terms require users to be at least 16 years old.

Customer will have, for the term of the Agreement, a valid legal basis for Provider's processing, including Articles 6 and, where they apply, 9 and 10 of the GDPR.

Subprocessors

Customer authorizes Provider to use the Subprocessors in the subprocessor annex, and generally authorizes Provider to engage further Subprocessors on the terms of this section.

Provider will bind each Subprocessor to data-protection obligations that are no less protective than this DPA, to the extent those obligations fit the Subprocessor's service. Provider remains liable for the Subprocessor's processing to the same extent Provider would have been had it done the processing itself.

When Provider engages a new Subprocessor, Provider will update this page and email the address on the customer's account, or another address the customer has given for service notices. The notice will name the Subprocessor, its location, and what it will do. Customer may object in writing within 15 days, on reasonable grounds related to the protection of Personal Data, by email to support@halmoslabs.com. The parties will try in good faith to resolve the objection. If they cannot, Customer may stop using the Service and cancel, and will pay amounts already due. That is Customer's sole remedy for the objection.

Audits

Customer may audit Provider's compliance with this DPA once a year, and more often only if Applicable Data Protection Laws or a competent supervisory authority requires it. Customer will send a written request with the reason. If a third party will audit, Provider may object where the auditor is not independent, is a competitor, or is otherwise unsuitable, and Customer will then appoint another auditor or audit itself.

Customer will send a proposed plan at least two weeks before the proposed date. A third-party auditor must sign a confidentiality agreement that is reasonable for both parties. The audit will happen in regular business hours, will follow the agreed plan and Provider's security rules, and will not unreasonably interfere with the Service. Customer pays for the audit.

Nothing in these audit rules requires Provider to break a duty of confidentiality.

Customer will tell Provider of any non-compliance it finds and will share the report with Provider, unless the law forbids that. Customer will use the report only to meet a regulatory audit requirement or to check compliance with this DPA.

Return and deletion

When the Service stops processing Personal Data (the "Cessation Date"), Provider will stop processing it except to store it while it is returned, deleted, or anonymized, or as this DPA or the law allows.

If it is technically feasible, and Customer asks in writing within 30 days after the Cessation Date, Provider will, within a commercially reasonable time, either return a copy by a secure method and then delete or anonymize other copies, or delete or anonymize the Personal Data, as Customer chooses in that request.

If Customer does not choose within those 30 days, Provider will delete or anonymize the Personal Data within a commercially reasonable time after that, to the extent technically feasible.

Provider may retain Personal Data where the law requires it, only for that period, protected by the security measures, and will delete or anonymize it when the law no longer requires retention. Nightly encrypted backups are kept for 30 days and then expire. Undo history covers row inserts, updates, and deletes. It does not cover schema changes. Retained history is capped by size: 2 MiB on the Free plan and 64 MiB on a paid plan. When the cap is reached, the oldest history entries are dropped. There is no point-in-time restore.

Artificial intelligence

Provider will not use Personal Data to train, fine-tune, develop, or improve an artificial intelligence or machine learning model, Provider's own or a third party's, unless Customer has agreed to that in writing. We do not use your data to train models.

Provider will not authorize a Subprocessor to use Personal Data for that Subprocessor's own model training, except where Customer has agreed in writing.

The Service does not make automated decisions that produce legal or similarly significant effects. If that changes, Provider will tell Customer before using Customer Data that way, explain the logic to the extent it can do so without disclosing trade secrets, and help Customer honor Data Subject rights the law provides.

Miscellaneous

The Terms stay in effect except as this DPA changes them. If this DPA and the Terms conflict about processing of Personal Data, this DPA controls.

Provider's access to Personal Data is not part of the consideration for the Terms.

Notices under this DPA may be sent as the Terms provide, to the contact in the details annex, or to the email address on the customer's account. Customer will keep that address current.

Provider may change this DPA on written notice where that is necessary to stay compliant with Applicable Data Protection Laws, if the change does not materially reduce protection for Personal Data or materially increase Customer's obligations without Customer's written agreement.

To the extent Applicable Data Protection Laws allow, each party's total liability under this DPA is subject to the cap and the exclusions in the Terms. Our liability is limited to the fees you paid us in the last 12 months.

Annex 1. Data processing details

Provider

• Name: Halmos Labs, Inc., a Delaware corporation.
• Data protection contact: support@halmoslabs.com. The same address is for privacy requests and security reports.
• Activities: ADoor, the database described at the top of this DPA.
• Role: Processor for Customer content (tables, rows, row history, and invitation email addresses the customer submits). Controller for the account email and name, sign-in, the billing ids the privacy policy lists, support email, and usage records. That controller processing is described in the privacy policy.

Customer

• Name: the person or entity that accepts the Terms.
• Address: the billing address the customer gives Stripe, if the customer has a paid workspace. Otherwise Provider does not collect a postal address. The email address on the ADoor account is the contact address.
• Data protection contact: the email address on the ADoor account.
• Activities: using ADoor under the Terms.
• Role: Controller, or Processor where the customer is itself processing for someone else.

Details of processing

• Data subjects: the customer, people the customer invites into a workspace, and people whose information the customer stores in the database.
• Personal data: name and email; tables, rows, and row history the customer stores; invitation email addresses; sign-in cookies described in the privacy policy; usage records such as storage size and request metadata. Row contents and query text are not sent to analytics. Stripe customer id, subscription id, subscription item id, plan, storage ceiling, measured usage, and status. Payment card numbers are collected by Stripe and are not stored by Provider.
• Sensitive data: not required. The customer may store information that Applicable Data Protection Laws treat as sensitive. Safeguards are the security annex. Provider does not use that information to infer characteristics for advertising.
• Frequency: ongoing, as the customer uses the Service.
• Nature and purpose: providing ADoor and following the customer's instructions under this DPA and the Terms.
• Duration: as the privacy policy and the return and deletion section describe.
• Transfers to subprocessors: the subprocessor annex.

Annex 2. International transfers

Where the law requires a safeguard for a transfer of Personal Data, the transfer uses an appropriate safeguard.

Where Provider receives an instruction it reasonably believes infringes the GDPR, Provider will tell Customer. Customer will give instructions that comply with the GDPR.

Provider will, on written request, give reasonable assistance with a data protection impact assessment or a prior consultation under Articles 35 and 36 of the GDPR, to the extent the processing by Provider makes that necessary and the information is available to Provider. A request for help with a Data Subject request under the EU GDPR can be emailed to support@halmoslabs.com.

Annex 3. U.S. state privacy laws

For this annex, "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider," and "contractor" have the meanings in the applicable state privacy laws. "Personal information" means Personal Data that those laws cover.

Provider is a service provider, contractor, or processor, as those laws apply. Provider acknowledges that Customer discloses personal information only for the limited purposes in the Terms and this DPA. Provider will comply with the obligations those laws place on a service provider or processor and will give personal information the level of protection those laws require. Customer may take reasonable steps to help ensure Provider's processing is consistent with Customer's obligations. Provider will tell Customer in writing if Provider determines it can no longer meet those obligations. Customer may then take reasonable steps to stop and remediate unauthorized use.

Provider will not sell or share personal information. Provider will not retain, use, or disclose it except to provide the Service, as the state privacy laws otherwise permit. Provider will not retain, use, or disclose it outside the direct business relationship with Customer. Provider will not combine it with personal information from another customer, or with personal information Provider collected from its own interaction with the Data Subject, except as those laws allow and as providing the Service requires. Provider certifies that it understands these restrictions and will comply with them.

Notice of Subprocessors under this DPA satisfies any duty under those laws to give notice and an opportunity to object. Audits under this DPA are the audits Customer may use to check these duties. The processing this DPA authorizes is part of providing the Service.

Annex 4. Security measures

These measures apply to the Service and to the infrastructure in the subprocessor annex.

• Someone is assigned responsibility for the information security program.
• Risks to the Service are reviewed, and the condition of security is reported to senior management.
• Customer data is logically separated. Access is limited by role. Personal Data is encrypted in transit over public networks. Nightly backups are encrypted.
• Access to production systems is limited to people who need it for their job, with separate credentials, and is removed when that need ends.
• There is no admin console. A security operator can open an audited, read-only view of workspace data for at most 15 minutes.
• Grants are enforced in the database. An assistant cannot do more than the person who connected it.
• Sign-in cookies are HttpOnly, as the privacy policy describes.
• Provider and the subprocessors log and monitor access appropriate to their systems.
• Physical security of the data centers is the responsibility of the subprocessors that operate them (Cloudflare and Supabase, in the locations in the subprocessor annex). Provider does not operate its own data center.
• Systems and media are disposed of so that data is not readily recoverable.
• Material changes that affect the security of Personal Data are tested and approved.
• Information Security Incidents are handled as the security section describes.
• Networks are segmented and protected against intrusion in line with the hosting providers' controls.
• Vulnerabilities are patched on a schedule appropriate to the risk.
• The nightly encrypted backup, kept for 30 days, is the documented recovery copy. There is no point-in-time restore. Retained history is not a backup.

Annex 5. Subprocessors

Customer approves these Subprocessors:

• Cloudflare (hosting, Western Europe, plus a global edge). Hosting of the application, the global edge, encrypted backups in R2, and in-flight transfer files. The backup bucket is in Western Europe.
• Supabase (database, AWS eu-west-1, Ireland). The PostgreSQL database.
• WorkOS (sign-in, United States). Sign-in.
• Resend (invitation email, United States). Invitation email, and account email for an address change or deletion confirmation.
• PostHog (product analytics, United States). Server-side only, with no cookies and no full IP address. Product analytics and the plan-limits flag. Row contents and query text are not sent.
• Stripe (payments, United States). Payment method, invoices, and the billing contact. Provider does not store card numbers.

This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.