Data Processing Addendum
Last updated 11 November 2026. Part of the Terms of Service.
This addendum applies when nerdsystem (HikerNerd LLC, the "Processor") processes personal data of End Users on behalf of a Customer (the "Controller") in connection with the Service, and the GDPR, the UK GDPR, or a similar law applies to that processing.
1. Subject matter, duration, nature, and purpose
The Processor hosts the Controller's applications and provides them with authentication, authorization, a database, file storage, and deployment tooling. Processing lasts for the term of the Customer's use of the Service and the retention periods in the Privacy Policy. The purpose is to run the Controller's applications as the Controller instructs through its configuration, code, and use of the Service.
2. Categories of data subjects and data
Data subjects: End Users of the Controller's applications. Categories of personal data: email address, name, salted password hash, roles, login timestamps, session and refresh tokens, IP address and request metadata in logs, any personal data the Controller's application stores in its database or file storage, and the application source code uploaded with deploys and saves, including any personal data it contains. Special categories of data are not intended to be processed; the Controller must not store them unless its application and lawful basis require it, and must tell the Processor in advance.
3. Controller instructions
The Processor processes personal data only on the Controller's documented instructions, which are given through the Controller's use of the Service, its application code, and this addendum, unless the law requires otherwise, in which case the Processor will inform the Controller before processing unless the law forbids it. The Processor will tell the Controller if it believes an instruction infringes data protection law.
4. Confidentiality
The Processor ensures that people authorized to process personal data are bound by confidentiality obligations.
5. Security
The Processor implements the technical and organizational measures described in the Security Overview, including isolation of each application, hashed storage of passwords and tokens, encryption in transit, per-deployment rotation of application secrets, and least-privilege access to infrastructure. The Processor may update those measures provided the overall level of protection is not reduced.
6. Subprocessors
The Controller authorizes the Processor to use the subprocessors listed on the Subprocessors page, currently Cloudflare, Inc. (hosting, databases, storage, builds), GitHub, Inc. (source control integration), Stripe, Inc. (billing, which does not involve End User data), Resend, Inc. (transactional email, including End User password reset emails), Anthropic, PBC (review of application code and screening of application page text; no End User data), and DigitalOcean, LLC (the server that forwards a bare domain name to an application's www address; it sees the visitor's IP address and the address requested). The Processor will give at least 14 days' notice of any new subprocessor by updating that page and notifying the Controller by email or in the dashboard. The Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected Service. The Processor remains responsible for its subprocessors' performance.
7. Assistance to the Controller
Taking into account the nature of the processing, the Processor assists the Controller with End User rights requests through the dashboard, API, and command-line tools, which allow the Controller to export, correct, disable, and delete End User records, and on request by email. The Processor assists with security, breach notification, impact assessments, and consultations with supervisory authorities as reasonably required, and may charge for assistance beyond what the Service provides.
8. Personal data breaches
The Processor notifies the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's End User data, and provides information reasonably needed for the Controller to meet its own obligations.
9. Deletion and return
The Controller can export and delete End User data at any time through the Service. On termination the Processor deletes the Controller's personal data within the retention periods in the Privacy Policy, unless the law requires storage.
10. Audit
The Processor makes available the information necessary to demonstrate compliance with this addendum, including its Security Overview and, on request no more than once a year, written answers to reasonable security questionnaires. Where that is insufficient, the Controller may conduct an audit at its own cost, on 30 days' notice, during business hours, without disrupting the Service, and subject to confidentiality.
11. International transfers
Where the Processor or its subprocessors transfer personal data outside the EEA or the UK, the transfer is covered by the European Commission's standard contractual clauses or the UK International Data Transfer Addendum, as incorporated in the subprocessors' terms, or another lawful mechanism. Module Two (controller to processor) applies, with the Customer as data exporter and HikerNerd LLC, established in the United States, as data importer; the parties' details are those on the Customer's account.
12. Liability and precedence
Liability under this addendum is subject to the limitations in the Terms of Service. If this addendum conflicts with the Terms, this addendum prevails for the processing of End User personal data.