# Personal Data Processing Agreement, Annex 1 to the Terms of Service

 

Agreement drawn up in accordance with Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). It binds from the moment the contract for the Service is concluded, without a separate signature, as part of the Terms. Version 1.2. Effective from 2026-11-01.

## § 1. Parties and subject matter

1. **Controller**: the customer within the meaning of § 2(1) of the Terms.
2. **Processor**: VIGELION Tomasz Czubkowski, ul. Wiosenna 25, 60-185 Skórzewo, Poland, tax ID (NIP) 973-024-00-52 (“featureloom”, “we”). 
3. Subject matter: entrusting us with the processing of personal data to the extent needed to provide the featureloom Service described in the Terms (§ 5). This agreement does not cover data for which we are the controller (§ 10(1) of the Terms).

## § 2. Nature, purpose and duration of the processing

1. Nature: storage with version history, organizing, making available to the Controller's people, agents and automations, generation of documents using a language model on the Controller's instruction, export, deletion.
2. Purpose: performing the Service.
3. Duration: for the term of the contract for the Service and the period of data deletion after it ends (§ 9).

## § 3. Type of data and categories of data subjects

| category of data subjects | data |
|---|---|
| Users | the author name, the dates and content of their entries  |
| persons named in Organization Content (customers, co-workers, third parties) | first names and surnames, job titles, contact details and any other information entered in Organization Content; incidentally also special categories of data (§ 5(2)) |

## § 4. Our obligations (Article 28(3) GDPR)

1. We process the data solely on the Controller's documented instruction, including as regards a transfer of data to a third country. The instruction consists of the Terms, this agreement, and the actions and settings of the Controller's people, agents and automations in the Service. If Union or Member State law imposes on us an obligation to process, we inform of this before the processing, unless the law prohibits it (point (a)).
2. The persons authorized to process have committed themselves to confidentiality (point (b)).
3. We apply the measures under Article 32 GDPR described in § 6 (point (c)).
4. We assist in meeting the obligations under Articles 32 to 36 GDPR: we report breaches (§ 10) and supply information for the data protection impact assessment (point (f)).
5. We make available the information necessary to demonstrate compliance with the obligations and allow audits (§ 11) (point (h)). We immediately inform if, in our opinion, an instruction infringes the GDPR or other data protection provisions.

## § 5. The Controller's obligations

1. The Controller is responsible for the lawfulness of the processing of the entrusted data.
2. The Controller must not direct the Service at obtaining special categories of data and must not select for generation content that contains such data (Articles 9 and 10 GDPR).

## § 6. Technical and organizational measures (Article 32 GDPR)

1. **Isolation of Organizations in the database**: plans, prompts, epics, projects, teams, source material, questions, versions, generation requests and the integration and model settings have an enforced rule in the database separating the data of Organizations; invitations, memberships, accounts, consoles and automation keys are isolated by an Organization condition in every query, checked by tests that every code change passes. 
2. **Authentication**: we store passwords only as cryptographic hashes; sessions are revocable, expire 14 days after signing in and after 3 days without use; after 5 failed attempts within 15 minutes sign-in is delayed; the Organization Administrators of an Organization that has more than one person must have two-step sign-in; anyone can turn it on, and an Organization Administrator may require it of all members. We inform the person concerned by email of a sign-in from a new browser (not used for 90 days) and of a new place where a console is used, and the Organization Administrators of a new place where an automation key is used, once a day. 
3. **Machine access**: consoles and automation keys have expiry dates and limits (§ 4(6) and (7) of the Terms) and are revocable. 
4. **Encryption in transit**: on the public network HTTPS only (to Cloudflare and onward to our proxy server); encryption ends at our proxy server, and from there to the application the traffic goes over our internal network without encryption, on the premises referred to in paragraph 9. Integration and two-step sign-in secrets are encrypted in the database. 
5. **Data at rest**: the database disk is not encrypted today at the level of the storage medium; its medium is under our exclusive control, on the premises and on the hardware referred to in paragraph 9. 
6. **Deletion with a register**: deletion of source material and automatic deletion of an Organization removes the content and leaves a register entry without content. 
7. **Logs**: from the log of our proxy server we remove credentials and mask the codes from invitation and password-reset links; the application does not write the content of plans, passwords or secrets to the logs. 
8. **Releases and database changes**: we deploy changes from tagged versions and check that the program being deployed is exactly the one from the tagged version; we make changes to the database structure after a backup has been made and after an independent review of the change. 
9. **Backups and location**: a nightly backup of the database (with Organization Content), kept for at most 6 months; we check every backup when it is made, and we rehearse restoration. Places of processing: the production server, the proxy server (several of the owner's services share it), the internal server and the backup store are in Poland, on featureloom's hardware and premises, with no hosting provider. We keep an additional, encrypted backup separately. 
10. **Personnel and operator**: administrative access is held solely by the owner and the persons the owner has authorized. The operator panel shows the counters and metadata of Organizations, not Content; the operator is technically able to issue an invitation to an Organization and reset a person's two-step sign-in, and does so only at the Controller's request or under a legal obligation. 

## § 7. Sub-processors

1. The Controller gives general authorization for the use of the entities listed in Annex 3 part 1 (a public list with the date of the last change) and of their sub-processors listed on their public lists indicated in Annex 3.
2. We inform the Organization Administrators by email of an intention to add or change an entity in part 1 at least 30 days in advance; of a change at a provider that itself gives us shorter notice, we inform within 3 business days of its notice. The Controller may object within that period; if we cannot accommodate the objection, either party may terminate the contract for the Service with effect on the day of the change, with a refund for the unused period and, where we terminate, also of the payment for the unused, paid-for part of the balance together with the tax, within 14 days. 
3. We impose on every such entity, by contract, the same data protection obligations as referred to in Article 28(3) GDPR (Article 28(4)); the time limits and procedure follow from the contracts indicated in Annex 3, which lists the differences from this agreement. We are liable to the Controller for the performance of those obligations.
4. Our transfer of data to a third country takes place solely to an entity listed in Annex 3 part 1 on the basis stated there: an adequacy decision or the Commission's standard contractual clauses.
5. Data reaches the recipients chosen by the Controller (Slack and MCP clients, Annex 3 part 2) solely on the Controller's documented instruction; the basis for a transfer outside the EEA is provided by the Controller's contract with that recipient.

## § 8. Assistance with data subjects' rights

1. A data subject's request addressed to us that concerns entrusted data we forward to the Controller within 3 business days, without replying on the merits.
2. The Controller handles requests with the tools of the Service: editing and deleting a plan, a prompt, source material, removing a person from the Organization, export of all of the data. Editing a plan or a prompt does not delete its earlier versions (Annex 2); permanent deletion of a fragment requires saving the content without it and deleting the earlier versions in the Service (this does not apply to the reasons of a verdict) or deleting the plan or prompt together with its history or, where that is impossible, an instruction to us (paragraph 3). 
3. Actions that the Controller cannot perform itself in the Service we perform on its instruction within 14 days; remuneration only where the request is excessive and the parties so agree.

## § 9. End of processing

1. After the end of the contract for the Service the export works throughout the retrieval period (§ 13(2) and § 14(1) of the Terms), and then we delete all entrusted data, also from the backups in their retention cycle under Annex 2 (at most 6 months), and on request we confirm the deletion in writing, with the date on which the last backup disappears. Data retained by the model provider on the basis of its usage policies or the law (Annex 3) we cannot delete ourselves.

## § 10. Personal data breaches

1. We report a personal data breach concerning the entrusted data to the Controller without undue delay, no later than 48 hours from the moment we become aware of the breach, also from a sub-processor's notice, to the email addresses of the Organization Administrators, with the information under Article 33(3) GDPR to the extent available, supplemented progressively.

## § 11. Audit and information

1. At the Controller's request, no more often than once every 12 months, unless a personal data breach concerning the entrusted data has occurred, there are indications of a breach of this agreement or a supervisory authority requires it, we make available the results of our own reviews and the deletion register concerning its Organization.
2. An audit, including an inspection, is carried out by the Controller or by an auditor authorized by it and bound by confidentiality, on site after a date has been agreed (at least 14 days in advance), during working hours, without access to other customers' data, at the Controller's expense, unless the audit reveals a breach of this agreement.

## § 12. Liability and final provisions

1. The mutual liability of the parties is governed by § 9 of the Terms.
2. In the event of a conflict with the Terms in data protection matters, this agreement prevails.