Data Processing Addendum

The customer using the Services determines why and to whom its application events are sent, and ordinarily acts as data controller or as a processor acting for another controller. The Hookstride contracting operator provides the transmission service and ordinarily acts as processor or subprocessor for customer-controlled personal data. These roles may be different for Hookstride's own account, security, billing and support records; those are covered by our Privacy Policy.

The subject matter is the provision of authenticated event ingestion, temporary storage, signing, routing, delivery, retries, observability, support and deletion. Processing continues while the customer uses the Services and for any remaining lawful retention, recovery, or contractual purpose after closure, as described below. The customer controls the event types, recipient destinations, payload fields and instructions within the supported configuration.

Data may concern the customer's users, employees, contractors, customers, end users, or other people represented in an event. Depending on customer choices, data types can include identifiers, contact details, event metadata, transaction references, task or device identifiers, and JSON fields supplied by the customer. The service does not require sensitive categories, special personal data, payment-card details, government identity images or biometric information for normal operation. Customers must not submit such data unless they have a lawful basis and an agreed, supported processing arrangement.

Hookstride will process customer-controlled personal data for the purpose of providing the Services according to these Terms, the authenticated API requests, configured endpoints, project settings, and other lawful written customer instructions. We will not independently use payload content for advertising or unrelated purposes. If an instruction appears unlawful or technically incompatible with the Services, we may decline it and explain the concern where permitted.

The customer is responsible for lawful collection, consent or another valid legal ground, notices to data subjects, authorization to use receivers, accuracy, minimization and the instructions given to its own processors or downstream providers.

We restrict access to personal information to people and service providers who need it for authorized operations, support, security or legal compliance, under appropriate confidentiality duties. Customers must manage their own workspace roles, credentials and access control. We do not grant one project access to another project's event history.

Reasonable technical and organizational measures used by the Services include authenticated API access, project-scoped authorization, signed outbound deliveries, provider signature verification where supported, restrictions for privileged actions, credential handling controls, logging and rate limits, safe destination validation and egress isolation in configured backend environments.

Encryption or hashing is applied to particular secrets and tokens as implemented; these terms do not imply that every event payload, log or destination secret is separately encrypted at the application layer. Customers must encrypt data in transit to their receivers, verify signatures, implement idempotency and control their own device/backend security.

Customers authorize Hookstride to use the service-provider categories and named providers disclosed in the Service Providers and Subprocessors notice as needed to deliver the Services. We seek appropriate confidentiality, security and processing commitments from providers handling customer personal data. We will update the public notice when material providers or purposes change and offer a channel for reasonable, documented data-protection concerns.

Where the customer has an express written requirement for advance notice, approval, or an objection period, that signed agreement governs. If an objection cannot be reasonably resolved, the parties may discuss termination of the affected processing, subject to any agreed conditions and applicable law.

Transfers or remote access across national borders may occur depending on the hosting and processor arrangements. Each party will implement the transfer safeguards legally required for its role. If a particular legal framework calls for standard contractual clauses or other instruments, those must be completed separately where required; publishing this DPA does not itself execute a regulator-specific transfer instrument or establish a local data residency guarantee.

We will investigate reasonably suspected incidents involving customer-controlled personal data and notify the affected customer without undue delay after confirming an incident that requires notice, consistent with applicable law and the applicable agreement. The notice will include information reasonably available about the nature, potential impact, containment, and recommended steps, with further updates as material facts are established.

The customer remains responsible for determining whether and how to notify its own end users, data-protection authority or other parties, unless the law assigns that obligation differently. We may require independent identity verification before disclosing sensitive investigation details.

To the extent reasonably possible and technically available, Hookstride will assist the customer with requests to access, correct, restrict, delete or otherwise exercise applicable rights over customer event data, and with appropriate risk assessment or regulator enquiries. Customer administrators should provide the relevant project and event references through privacy support. We will not disclose another customer's data without proper authorization.

Customers may retrieve available event history through supported APIs during the applicable retention period. The normal terminal-event retention setting is 30 days; associated incoming payload cleanup follows eligible delivery cleanup. Minimal payload-free replay receipts may remain for a longer default of 365 days. Pending events, invoices, audit records, backups or records preserved for a lawful reason follow separate schedules.

Following closure or a valid deletion instruction, Hookstride will delete or de-identify customer payload data within applicable operational schedules, except where retention is necessary by law, for security or for an unresolved legal claim. Backups may age out under their separate lifecycle and remain restricted from ordinary access.

We will make available reasonable information necessary to demonstrate applicable processor obligations where legally required, subject to confidentiality, security, the rights of other customers, and technical feasibility. Any formal audit, penetration test, onsite inspection or third-party assurance engagement must be agreed in advance in writing and cannot compromise other tenants or production availability.

When this DPA conflicts with the Terms over required processing of personal data, this DPA controls to that limited extent. An executed enterprise agreement or specific legally mandated processing clause takes priority according to its own provisions. Liability and remedies remain subject to the Terms, the relevant written agreement and rights that cannot lawfully be excluded.

Changes to subprocessor usage, processing purposes or security practices that materially affect customer obligations will be reflected in the relevant public notice and communicated where applicable law or a written contract requires. Submit DPA, legal or privacy questions through privacy supportbefore processing sensitive or specially regulated information.