Data Processing Agreement

Last updated: May 14, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Homemade Software Inc. ("Processor", "we") and the Customer ("Controller", "you") that has accepted those Terms. It applies where you submit personal data subject to the GDPR, UK GDPR, or equivalent data-protection law in the course of using the Service.

1. Roles

You are the data controller and we are the data processor in respect of the personal data you submit to the Service.

2. Subject matter & duration

We process personal data only to provide the Service to you, and only for as long as our agreement is in effect plus any retention period described in our Privacy Policy.

3. Categories of personal data

Account data (name, email, organization), payment-related metadata (Stripe customer IDs only — we never see card numbers), and the content you choose to send through the Service (prompts, datasets, run inputs/outputs). You determine what that content contains.

4. Categories of data subjects

Your end users, team members, customers, or other individuals whose data you choose to process via the Service.

5. Sub-processors

We engage the sub-processors listed in our Privacy Policy. We will notify you of any new sub-processor at least 30 days before they begin processing, and you may object during that period.

6. Security

• Data encrypted at rest (managed Postgres on Supabase) and in transit (TLS 1.2+).
• Row-level security policies isolating organizations at the database layer in addition to application-layer tenant scoping.
• Access to production limited to a small number of named operators, authenticated via SSO.
• Audit logging of staff impersonation actions.
• Daily managed backups via Supabase plus periodic off-platform backups.

7. International transfers

We are established in the United States. Where personal data of EEA, UK, or Swiss data subjects is transferred to us, that transfer relies on the EU Standard Contractual Clauses (Module 2: Controller → Processor) and the UK Addendum, which are deemed incorporated into this DPA by reference.

8. EU and UK representative

We are not currently established in the EU or UK. We are appointing a representative in the EU under Article 27 GDPR and a representative in the UK under Article 27 UK GDPR; their contact details will be added to our Privacy Policy once appointed. Until then, you and your data subjects may contact us directly at privacy@completionkit.com for any matter that would otherwise be directed to a representative.

9. Data-subject requests

If we receive a request from a data subject relating to your data, we will refer them to you and assist you in responding insofar as the request relates to personal data we process on your behalf. You can fulfil most access/portability requests yourself via Account → Data export.

10. Incident notification

We will notify you without undue delay (and in any case within 72 hours) of becoming aware of a personal-data breach affecting your data.

11. Return or deletion

On termination, you may export your data via the account-page data export. Within 30 days of termination, we will delete your personal data from production, subject to backup retention windows and any legal obligation to retain.

12. Contact

DPA questions: privacy@completionkit.com.

If you require a counter-signed DPA on your paper, email us — we'll honour reasonable redlines for paid plans.