Last updated: July 9, 2026
For Personal Data contained within Customer Data, Customer is the Controller (or Business, under CCPA), and HyveAI is the Processor (or Service Provider, under CCPA). HyveAI will process Personal Data only on Customer's documented instructions, including as set out in the Terms of Service, the account configuration, and this DPA, unless required to do so by applicable law.
This DPA applies only to Personal Data processed by HyveAI on Customer's behalf as part of Customer Data. HyveAI remains an independent controller for account registration, billing, customer relationship management, website analytics, security administration, and support communications, as described in the Privacy Policy.
Subject matter: provision of the HyveAI Service.
Duration: the term of the Customer's account, plus any post-termination retrieval and deletion period.
Nature and purpose: hosting, indexing, embedding, retrieval, AI inference, logging, analytics, support, and backup of Customer Data to deliver knowledge-intelligence features.
Categories of Data Subjects: Customer's employees, contractors, end users of the chat widget, API consumers, and any individuals referenced in documents Customer uploads.
Types of Personal Data (depending on Customer's configuration and content):
HyveAI does not require Customer to submit special categories of Personal Data (Art. 9 GDPR). Certain political, campaign, advocacy, voter, donor, or constituent use cases may involve sensitive or regulated data depending on jurisdiction. Customer is solely responsible for determining whether such data is submitted, establishing a valid legal basis, providing required notices and consents, and using appropriate safeguards. HyveAI may require additional written approval, configuration limits, or safeguards for such use cases.
Where Customer's product supports HyveAI's optional Federation program, Customer's own election to enable aggregate signal participation or to mark a knowledge-base entry as network-visible is Customer's documented instruction for purposes of Section 2 (Roles of the Parties) and does not make any other participating facility a joint controller or subprocessor of Customer's Personal Data. Aggregate signals are k-anonymized (minimum five contributing facilities) before disclosure, and a shared knowledge-base entry is disclosed only as HyveAI-generated retrieval output to another facility's agent, never as raw export. Federation is described in full in Section 14 of the Privacy Policy.
Customer authorizes HyveAI to engage the Subprocessors listed in Annex I to this DPA. HyveAI will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA.
HyveAI will notify Customer (e.g. by email or by updating this page) of any intended addition or replacement of Subprocessors at least 14 days in advance. Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection; if unresolved, Customer may terminate the affected portion of the Service as its exclusive remedy.
Where Personal Data originating in the EEA, UK, or Switzerland is transferred to a country that is not the subject of an adequacy decision, the parties agree that the relevant Standard Contractual Clauses published by the European Commission (Decision (EU) 2021/914) apply to the transfer, and are incorporated by reference into this DPA as follows:
For transfers from the UK, the International Data Transfer Addendum issued by the UK ICO applies to the SCCs. For transfers from Switzerland, references to the GDPR in the SCCs are deemed to include the Swiss FADP, and references to EU supervisory authorities include the Swiss FDPIC where applicable.
HyveAI maintains the security measures described in Annex II and will notify Customer without undue delay (and in any event within 72 hours where feasible) after becoming aware of a Personal Data Breach affecting Customer Data. The notification will include, to the extent known, the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.
HyveAI will make available on request the information necessary to demonstrate compliance with this DPA, including summaries of security measures, subprocessor controls, and — where available — third-party reports and certifications. Where Applicable Data Protection Laws require on-site audit rights, Customer may, with reasonable advance notice and no more than once per year (except following a confirmed Personal Data Breach), audit HyveAI's compliance at Customer's expense, subject to confidentiality and reasonable security constraints.
HyveAI will, taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures (including self-service tools within the Service) to fulfil Customer's obligation to respond to Data Subject requests under Applicable Data Protection Laws. If a Data Subject contacts HyveAI directly, HyveAI will refer them to Customer where the Personal Data relates to Customer's use of the Service.
Upon termination or expiration of the account, HyveAI will, at Customer's choice, delete or return all Personal Data in HyveAI's possession within 30 days, except to the extent retention is required by applicable law. Backups containing Personal Data will be overwritten in the ordinary course of HyveAI's backup rotation (see the Privacy Policy).
With respect to Personal Data subject to the CCPA, HyveAI is a Service Provider and will not (a) sell or share Personal Data, (b) retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Terms and this DPA, or (c) combine Personal Data received from Customer with Personal Data received from other sources, except as permitted by the CCPA. HyveAI certifies that it understands these restrictions.
Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. In the event of a conflict between this DPA and the Terms of Service, this DPA prevails with respect to the Processing of Personal Data. Where the SCCs apply, the SCCs prevail over any conflicting provision of this DPA.
HyveAI engages the following Subprocessors to provide the Service. The list is kept current; material changes will be notified as described in Section 5. Required Subprocessors are engaged for every Customer; Optional Subprocessors are engaged only where Customer enables the related feature. This list does not include social media platforms Customer connects as a Connected Account under the Privacy Policy, since Customer connects and controls those accounts directly.
Required Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | LLM inference and text embeddings | United States |
| Pinecone Systems, Inc. | Managed vector database for RAG retrieval | United States |
| Stripe, Inc. | Payment processing and subscription billing | United States |
| Functional Software, Inc. d/b/a Sentry | Application error and performance monitoring | United States |
| Dedicated-server hosting provider | Compute, storage, reverse proxy, encrypted backups for the core platform | Europe |
| SMTP email provider | Transactional email and alerting | United States / Europe |
Optional Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Hugging Face, Inc. | Optional SLM fine-tuning and model hosting | United States |
| Slack Technologies, LLC | Operational alerts and customer Slack integrations | United States |
| Twilio Inc. | SMS delivery for customers using the SMS channel | United States |
HyveAI implements and maintains technical and organizational measures designed to provide a level of security appropriate to the risk, as required by Article 32 GDPR. The measures below describe our current program; they are illustrative rather than an exhaustive or static specification, may be updated as our practices and the threat landscape evolve, and apply as applicable to the relevant part of the Service.
Questions about this DPA or requests to sign a countersigned version can be sent to loren@hyveappliedintelligence.com.