Data Processing Agreement

Scope and parties#

This Data Processing Agreement (the "DPA") is entered into between Reveriext Inc., a Delaware corporation ("Reveriext"), and the Customer that has accepted the Keep Terms of Service (the "Terms"). It forms part of the Terms and applies whenever Reveriext processes Customer Personal Data in providing Keep. The Customer accepts this DPA by accepting the Terms; no separate signature is required.

This DPA applies in addition to the Terms. Capitalized terms that are not defined here have the meaning given in the Terms.

Definitions#

• "Data Protection Law" means all laws on the processing of personal data that apply to a party's processing under the Terms, including, where applicable, the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), the GDPR as retained in the law of the United Kingdom (the "UK GDPR") and the Data Protection Act 2018, the Swiss Federal Act on Data Protection (the "FADP"), the California Consumer Privacy Act as amended (the "CCPA") and other United States state privacy laws, and the Digital Personal Data Protection Act, 2023 of India (the "DPDP Act").
• "Customer Personal Data" means personal data contained in Customer Content that Reveriext processes on behalf of the Customer.
• "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR, and include the equivalent terms of other Data Protection Law, including "data fiduciary" and "data processor" under the DPDP Act and "business" and "service provider" under the CCPA.
• "Sub-processor" means a third party engaged by Reveriext that processes Customer Personal Data.
• "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021; "UK Addendum" means the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0.

Roles of the parties#

The Customer is the controller of Customer Personal Data, or a processor acting for its own controller, and Reveriext is its processor or sub-processor. Reveriext is the controller of Account Data, which it processes as described in the Privacy Policy, and this DPA does not apply to Account Data.

The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis for it and giving the notices that Data Protection Law requires to data subjects. In particular, where Customer Personal Data includes the time and work-activity records of the Customer's personnel, the Customer, as employer and controller, is responsible for informing them, for its lawful basis, and for any consultation with employee representatives that the law requires, as described in the Terms under "Time records and work-activity data".

Processing on documented instructions#

Reveriext processes Customer Personal Data only on the Customer's documented instructions, unless required to do so by law, in which case Reveriext informs the Customer of that legal requirement before processing, unless the law prohibits it. The Customer's documented instructions are the Terms, this DPA, and the configuration and actions that the Customer and its Authorized Users, including through their Connected Assistants, carry out in Keep. Reveriext informs the Customer if, in its opinion, an instruction infringes Data Protection Law.

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex I.

Confidentiality of personnel#

Reveriext ensures that the persons it authorizes to process Customer Personal Data are bound by appropriate obligations of confidentiality, and that they access Customer Personal Data only as necessary to provide support the Customer has requested, to investigate a reported problem, or to keep the service reliable and secure.

Security of processing#

Reveriext implements and maintains the technical and organizational measures described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. Reveriext may update these measures, provided that an update does not materially reduce the overall level of protection.

Sub-processors#

The Customer gives Reveriext general written authorization to engage Sub-processors. The Sub-processors engaged on the date of this DPA are listed in Annex III.

Reveriext informs the Customer of any intended addition or replacement of a Sub-processor by updating Annex III and emailing the owners of active workspaces at least 30 days before the change takes effect. The Customer may object to the change on reasonable grounds relating to data protection by writing to support@hykeep.app within that period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected plan before the change takes effect, and Reveriext refunds the fees prepaid for the unused part of the period.

Reveriext imposes on each Sub-processor, by written contract, data-protection obligations that provide at least the same level of protection as this DPA, to the extent applicable to the service the Sub-processor provides. Reveriext remains liable to the Customer for the performance of each Sub-processor's obligations.

Services that the Customer or its Authorized Users choose to connect, such as GitHub or an AI assistant, are not Sub-processors; they act under the Customer's own arrangement with them.

Assistance to the Customer#

Taking into account the nature of the processing, Reveriext assists the Customer by appropriate technical and organizational measures, insofar as this is possible, in responding to requests from data subjects to exercise their rights. Keep allows the Customer to access, correct, export and delete Customer Content itself. If Reveriext receives a request from a data subject concerning Customer Personal Data, it refers the request to the Customer and does not respond to it except as the Customer instructs or the law requires.

Reveriext provides reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities that relate to the Customer's use of Keep, taking into account the nature of the processing and the information available to Reveriext.

Personal data breaches#

Reveriext notifies the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification is sent to the owners of the affected workspace and describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where the information is not available immediately, Reveriext provides it in phases without undue delay. Reveriext's notification is not an acknowledgment of fault or liability.

Deletion and return of personal data#

The Customer may export Customer Content at any time during the agreement, and during the read-only and suspended periods that follow its end, with the workspace export. At the end of the agreement, Reveriext deletes Customer Personal Data by purging the workspace on the schedule described in the Terms and in the Privacy Policy under "Retention and deletion", unless the law requires its retention. Copies held in Cloudflare's point-in-time recovery for databases, which covers up to 30 days, expire on Cloudflare's schedule and are not used to restore a purged workspace. The Customer may request written confirmation of the purge.

Information and audits#

Reveriext makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including this DPA, the Trust page and its claim ledger, and the security and compliance documentation its Sub-processors publish. Where that information is not sufficient, the Customer may, at its own cost, on at least 30 days' written notice and not more than once in any twelve months, except after a personal data breach or where a supervisory authority requires it, conduct an audit by written questionnaire or, where required by Data Protection Law, by an independent auditor bound by confidentiality, at a time and in a manner that does not disrupt the service or compromise the security of other customers.

International transfers#

Reveriext is established in the United States, and Customer Personal Data may be processed in the United States and in other countries where Reveriext and its Sub-processors operate.

European Economic Area. To the extent the Customer transfers Customer Personal Data subject to the GDPR to Reveriext in a country that has not been found to provide adequate protection, the Standard Contractual Clauses are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor; the Customer is the data exporter and Reveriext is the data importer; the optional docking clause in Clause 7 applies; under Clause 9, option 2 (general written authorization) applies, with the notice period set out under Sub-processors; the optional wording in Clause 11 does not apply; under Clause 13, the competent supervisory authority is the one determined in accordance with that clause; under Clause 17, the clauses are governed by the law of Ireland; under Clause 18, disputes are resolved by the courts of Ireland; and Annexes I, II and III of the clauses are completed by Annexes I, II and III of this DPA.

United Kingdom. To the extent the transfer is subject to the UK GDPR, the UK Addendum is incorporated into this DPA by reference: Table 1 is completed with the parties' details in this DPA; Table 2 refers to the Standard Contractual Clauses as applied above; Table 3 is completed by Annexes I, II and III of this DPA; and, for Table 4, neither party may end the UK Addendum as permitted by its Section 19.

Switzerland. To the extent the transfer is subject to the FADP, the Standard Contractual Clauses apply as above with these amendments: the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; references to the GDPR are read as references to the FADP; and the term "member state" does not exclude data subjects in Switzerland from exercising their rights in their place of habitual residence.

Where Reveriext transfers Customer Personal Data onward to a Sub-processor, it does so under the Standard Contractual Clauses, the UK Addendum or another transfer mechanism recognized by Data Protection Law. If a court or supervisory authority invalidates a mechanism relied on here, the parties will cooperate in good faith to adopt an alternative.

United States privacy laws#

To the extent the CCPA or a similar United States state law applies, Reveriext acts as the Customer's service provider or processor. Reveriext does not sell or share Customer Personal Data; does not retain, use or disclose it for any purpose other than providing Keep under the Terms, or outside its direct business relationship with the Customer; does not combine it with personal information it receives from other sources, except as the law permits; complies with the obligations that apply to it and provides the same level of privacy protection that the law requires; and notifies the Customer if it determines that it can no longer meet its obligations. The Customer may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data.

India#

To the extent the DPDP Act applies, the Customer is the data fiduciary and Reveriext is its data processor. Reveriext processes Customer Personal Data only under this DPA, applies the security measures in Annex II, assists the Customer with requests from data principals, and deletes Customer Personal Data as described under Deletion and return of personal data. The grievance contact for India is Reveriext Solutions LLP, 5th Floor, WeWork, RMZ Spire, HITEC City, Hyderabad, Telangana 500081, India, reached at support@hykeep.app.

Liability#

Each party's liability arising out of or in connection with this DPA, including under the Standard Contractual Clauses to the extent the law permits, is subject to the limitations and exclusions of liability in the Terms. For breach of this DPA or of Data Protection Law, each party's total aggregate liability is limited to two times the cap set out in the Terms under "Limitation of liability". Nothing in this DPA limits a party's liability to data subjects under the Standard Contractual Clauses, or liability that cannot be limited under applicable law.

Term and precedence#

This DPA applies for as long as Reveriext processes Customer Personal Data, and continues after the Terms end until the workspace has been purged. In the event of conflict concerning personal data, the Standard Contractual Clauses and the UK Addendum prevail over this DPA, and this DPA prevails over the Terms. Reveriext may update this DPA as described in the Terms under "Changes to these Terms", provided that an update does not reduce the protection of Customer Personal Data, except where Data Protection Law requires the change.

Annex I. Details of the processing#

A. List of parties

• Data exporter: the Customer, as identified in its Keep account, acting as controller (or processor); its contact person is the owner of the workspace. Activities: use of Keep under the Terms.
• Data importer: Reveriext Inc., 8 The Green, STE R, Dover, Delaware 19901, United States of America, acting as processor (or sub-processor); contact: support@hykeep.app. Activities: provision of Keep under the Terms.

B. Description of the processing

• Categories of data subjects: the Customer's Authorized Users (personnel, contractors and the Customer's own customers with customer-role access); persons named in Customer Content; visitors to the Customer's websites who send reports through the feedback widget; and authors of commits in repositories the Customer connects.
• Categories of personal data: names, email addresses, roles and organization membership; the content of records, comments, files and conversations with Keep's in-product AI; time and work-activity records (time entries, work sessions, the times of acts in a work session, agent runs and reported token usage); GitHub logins, linked GitHub accounts and commit metadata; feedback reports, including page details, browser details, screenshots and, where given, the reporter's name and email address; and technical identifiers such as the user agent.
• Sensitive data: none. The Terms prohibit special categories of personal data and regulated data such as health information, payment card numbers and government identification numbers.
• Frequency of the transfer: continuous, for the duration of the Terms.
• Nature of the processing: hosting, storage, indexing for search, display, transmission, computation of time figures by fixed rules, processing by AI models at the request of Authorized Users, export and deletion.
• Purpose of the processing: to provide, secure and support Keep for the Customer under the Terms.
• Duration and retention: for the term of the Terms and until the workspace is purged, as described in the Privacy Policy under "Retention and deletion".
• Transfers to Sub-processors: as listed in Annex III, for the services and duration stated there.

C. Competent supervisory authority

The supervisory authority determined in accordance with Clause 13 of the Standard Contractual Clauses; for the UK Addendum, the UK Information Commissioner; for the FADP, the Swiss Federal Data Protection and Information Commissioner.

Annex II. Technical and organizational measures#

• Workspace separation. Each workspace is provisioned with its own Cloudflare D1 database, R2 bucket and its own Worker, with bindings that point only at that workspace's resources. The workspace's Worker runs in Cloudflare's isolated execution environment. These are dedicated application resources on Cloudflare's shared infrastructure.
• Encryption. Cloudflare encrypts D1 databases and R2 objects at rest with AES-256 under keys managed by Cloudflare, and data is encrypted in transit with TLS.
• Access control. Access to records is determined by workspace membership and roles (workspace owner, workspace administrator, project owner, project manager, member, viewer and customer), checked on every request, including requests from Connected Assistants. A person's own vault is private, enforced by the database. Decisions, updates and share links written by a member are placed in the Queue for approval.
• Connected Assistants. Assistants connect through an OAuth authorization flow, never with a stored API key. Access tokens expire after one hour. Each connection can be revoked by the person, with immediate effect in every workspace. In Code Mode, each call in an assistant's script passes the same membership, permission and rate checks as a direct call, and consequential actions are never part of a script.
• Audit and records of processing. Changes to records, approvals, rejections and direct writes are recorded with the person, the time and the channel (the application, an assistant or the system). Reads of repository code are recorded in the project's activity.
• Personnel access. Access to production systems is limited to personnel who need it for their role, who are bound by confidentiality.
• Abuse prevention. Rate limits, sign-up verification with Cloudflare Turnstile, one free trial per person, and spend limits on AI features.
• Recovery. Deleted records are kept in a recycle bin for 30 days and can be restored. Cloudflare provides point-in-time recovery for D1 databases. The Customer can export its workspace at any time.
• Data minimization. Keep does not store copies of source code; it stores IP addresses only as salted hashes in sign-up records; and operational records of connector calls and error reports are deleted after 7 days.
• Incident response. Personal data breaches are notified as described under Personal data breaches.

The measures are described further on the Trust page.

Annex III. Sub-processors#

• Cloudflare, Inc. (United States; global network). Hosting and execution (Workers, Workers for Platforms, Durable Objects, Queues and Workflows); storage (D1 databases, R2 file storage and KV); the search index (Vectorize); in-product AI (Workers AI and AI Gateway); email that Keep sends (Email Service); request logs and analytics; Turnstile. Each workspace's D1 database is located in the data region selected for it; other services are placed by Cloudflare. The AI models in use are open models served on Workers AI and run on Cloudflare's infrastructure, from the DeepSeek, Kimi, GLM, Qwen, Gemma, gpt-oss and Llama families, and BGE for search; their developers receive no data.
• Clerk, Inc. (United States). Authentication, organization membership, invitation and sign-in email, and subscriptions and billing (Clerk Billing). Processes names, email addresses, sessions and membership.
• Stripe, Inc. (United States), through Clerk Billing. Card payments; card details are entered into Stripe's own fields.
• Google LLC (United States). Google Workspace mailboxes for support and billing correspondence, which can include Customer Personal Data that the Customer sends to Reveriext; Google Fonts, which receives the IP address and browser details of a person viewing a rendered artifact or a share page.
• Slack Technologies, LLC (United States). Operational alerts to Reveriext's team, which identify a workspace by its short name and may include user identifiers; no workspace content.

Contact#

Questions about this DPA, objections to a Sub-processor and requests for assistance go to support@hykeep.app, or by post to Reveriext Inc., 8 The Green, STE R, Dover, Delaware 19901, United States of America.