1. Roles
You act as controller or processor (depending on your relationship with end users) and we act as processor. We process personal data only on your instructions and for the purposes in this addendum, not for our own (except where law requires).
2. Scope of processing
| Item | Detail |
|---|---|
| Data subjects | Your account members and end users |
| Data categories | Account identifiers, session and file content, runtime logs, usage counts |
| Purpose | Providing the runtime, isolated execution, quotas and security auditing |
| Duration | For the life of the service, cleaned up per the retention table |
3. Technical and organisational measures
- Storage isolation: tenant_id plus database row-level security; cross-tenant access requires an audited channel.
- Encryption: TLS in transit; model keys and tokens envelope-encrypted (AES-GCM with rotatable DEK/KEK).
- Access control: least privilege by role; every administrative action is logged for 180 days.
- Execution isolation: commands run in disposable sandboxes reclaimed after the task.
- Backups: object-storage backups retained for 7 days.
4. Subprocessors
The list and purposes are on the Subprocessors page. New subprocessors are announced in the changelog 7 days in advance; if you object on reasonable grounds you may stop using the service and request deletion.
5. International transfers
Some subprocessors are outside your jurisdiction. We obtain separate consent at sign-up and list recipient countries here; if your law requires an additional mechanism (e.g. standard contractual clauses), email us to sign one.
6. Assisting data subject requests
Self-service export and deletion are available in the app. If your end users contact us directly, we refer them to you and do not act on the request ourselves unless legally required.
7. Security incidents
We notify you within 72 hours of confirming a personal data breach, including scope, categories of data, measures taken and what we recommend you do.
8. Deletion and return
On termination or account deletion, data is hard-deleted at the end of the 30-day cooling-off period; backups become unrecoverable after 7 days. Exports can be requested at any time before deletion.
9. Audit
You may verify compliance once a year via questionnaire or video call; an on-site audit requires 30 days’ written notice and covers costs.
10. Signing and contact
For a countersigned copy, email legal@holomer.space; we provide a signable PDF with the same text as this page.
This page forms part of the contract text; the signed PDF prevails in case of conflict.