Data Processing Addendum

What this addendum is

This addendum forms part of the Terms of Service. It applies whenever Hazelsong processes personal data on behalf of a business that uses it: the testimonials the business collects, the people who write them, the people it asks, and the people on its team. “You” is that business; “Hazelsong”, “we” and “us” mean the operator named in the Terms of Service. You accept it by creating a project or subscribing, on the same terms as the Terms of Service, and it needs no signature; the law allows such a contract in electronic form. Personal data that Hazelsong decides about for its own purposes, such as your account, billing, security and content notices, is described in the Privacy Policy and is not covered here.

It is written to cover what the EU General Data Protection Regulation (Article 28) and the UK GDPR ask of a contract with a processor, the California Consumer Privacy Act's terms for a service provider, and what Canada's PIPEDA and Quebec's private-sector privacy act ask of a contract with a service provider. It does not say that either party complies with any of those laws: each party remains responsible for its own obligations, and nothing here is legal advice.

Who decides and who acts

You decide why and how your customers' personal data is collected, published and kept: you are its controller, or, where you collect it for a client of yours, its processor. Hazelsong processes it only to provide the service to you, as your processor, or your sub-processor where you are a processor yourself. Permission a person gives to publish their testimonial is a permission to publish; it is not, by itself, your legal basis for processing their data, nor consent to anything stored on a visitor's device. Choosing and documenting that basis is yours.

What is processed

People concerned: people who write you a testimonial or are asked for one; buyers whose orders your store sends us; the people on your team who use a seat; readers of your walls and widgets, as counted figures.
Personal data: names, roles, companies, email addresses, the words written, ratings and scores, photographs, pictures, video and voice recordings, transcripts and translations, the permission given and when, answers to your questions, each testimonial's history, order ids and amounts, and one-way fingerprints of addresses. Recordings show faces and carry voices; Hazelsong does not use them to identify anybody. Do not collect other special categories of data through Hazelsong.
What is done with it: storing it, reading it for risk and, if you turn it on, moderating it with an AI model, transcribing and translating it, publishing it where you and its writer allowed, sending the emails you ask for, and counting what happened, all as the Privacy Policy describes in detail.
For how long: while the project exists, and then as under “At the end” below.

Our commitments as your processor

Point by point, in the order of Article 28(3) of the GDPR and of the UK GDPR:

(a) Only on your instructions. Your instructions are these terms, this addendum, and what you choose in your dashboard, through the API and through tools you connect. We process your customers' data for nothing else, including transfers to another country, unless a law we are subject to requires it, in which case we tell you first unless that law forbids it. If we believe an instruction breaks data protection law, we tell you, and we may decline to carry it out.
(b) Confidentiality. Everybody we authorize to process your customers' data is bound to keep it confidential. We open a dashboard only to answer a request you made, to investigate a fault you reported, or where the law requires it.
(c) Security. The measures in place are described under “Security measures” below, and we keep measures appropriate to the risk.
(d) Other processors. We engage only the sub-processors listed below, on the conditions below, under written terms that protect your data in the same way, and we remain responsible to you for them.
(e) Requests from the people concerned. The dashboard lets you find, export, remove part of, take down and delete any testimonial, and delete a whole project. A writer who used your form has a private link to withdraw it. A request we receive about your data we pass to you, and we help you answer one where the dashboard is not enough.
(f) Your other obligations. We help you with security, with notifying a breach, and with an impact assessment or a prior consultation, using the information on this page, on the Privacy Policy and in our answers to your written questions.
(g) Deletion or return at the end. As under “At the end” below: you can take everything out at any time, and deletion removes it.
(h) Information and audits. As under “Information and audits” below.

Security measures

Every page and API is served over HTTPS.
Login links, withdrawal links, share links and API tokens are stored as one-way fingerprints, never as the links or tokens themselves; a share-link password is stored as a slow, salted hash.
Secrets you paste, such as a store's signing secret or a channel's webhook address, are shown back only by their host and last four characters.
Sign-ups, testimonials sent through a form and requests for a login link are limited per hour, counted under one-way fingerprints of network addresses that are dropped after an hour; starting a project and asking for a login link also need a check that a browser, not a program, sent them.
On public pages, recordings and pictures are served only through our own address and only where their writer allowed it; a link we are asked to fetch that points inside a private network is refused.
Emails carry no tracking pixel and no tracking link, and the dashboard link can be replaced at any time.

Sub-processors

You authorize us to use the companies below. Each processes personal data only to do what is listed for it, under its own written terms, which we read on the date given; what those terms say is quoted as the company states it, not as our finding. Companies marked “account only” receive your own account and billing data and nothing about your customers. A Slack, Discord or Microsoft Teams channel, a Zapier account, an analytics tool or a store that you connect is your own choice of vendor and is not our sub-processor.

Vercel — Hosting the site and every page, file storage for recordings and pictures, the check that a browser rather than a program sent a sign-up or login request, and a project's own domain. Receives: Every request to the site as it is served, including the visitor's network address; recordings, photographs, pictures and voice recordings as files; the cached copy of what a wall or widget shows; a project's own domain name. Based in: United States. Its terms, read October 17, 2026: Vercel's data processing addendum covers Pro and Enterprise teams; Hazelsong's team is on Pro. It gives 5 days to object to a new sub-processor of Vercel's, announced to those who subscribe by email. Updated March 17, 2026. Transfers: The 2021 EU standard contractual clauses and the UK IDTA, as Vercel's addendum states. Its terms
Upstash — The database every record other than a file is written to. Receives: Testimonials' words, names, roles, companies and ratings, permission records, histories, transcripts and translations, request lists, account records, counters and one-way fingerprints. Based in: United States. Its terms, read October 17, 2026: Upstash's data processing addendum gives prior written notice of a new sub-processor and 5 days to object. Updated April 2025. Transfers: The EU-U.S. Data Privacy Framework, or else the EU standard contractual clauses, as Upstash's addendum states. Its terms
Anthropic — Reading testimonials for risk, automatic moderation where the business turns it on, proposing a removal, pull quotes, reports and case studies, translation, suggested labels, answers to the owner's questions, drafted form questions, and the dashboard's help assistant. Receives: A testimonial's words with the name, role and company it was written under and its rating; for the owner's questions, published words of up to 200 testimonials with no names or addresses; for the help assistant, the question and, only after Allow, the report's health lines. Never a writer's email address. Based in: United States. Its terms, read October 17, 2026: Anthropic's data processing addendum is part of its Commercial Terms, with Anthropic as its customer's processor, breach notice within 48 hours, 15 days to object to a new sub-processor, and deletion within 30 days after the agreement ends. Effective February 24, 2025. Transfers: The EU standard contractual clauses (modules 2 and 3), with UK and Swiss addenda, as Anthropic's addendum states. Its terms
Deepgram — Transcribing a recording, when it is the speech service configured. Receives: The audio or video file of a recording sent for transcription. When: Only while Hazelsong is configured with a Deepgram key; the service that produced a transcript is stored with it. Based in: United States. Its terms, read October 17, 2026: No data processing addendum was found in Deepgram's Terms of Service (last updated August 6, 2026) or its master service agreement. Its terms allow it to use content sent to it to train its models unless a request opts out; every request Hazelsong sends carries that opt-out (mip_opt_out=true). Transfers: None named in the terms read. Its terms
OpenAI — Transcribing a recording with Whisper, when it is the speech service configured. Receives: The audio or video file of a recording sent for transcription. When: Only while Hazelsong is configured with an OpenAI key and no service before it in the order answered. Based in: United States. Its terms, read October 17, 2026: OpenAI's data processing addendum makes OpenAI its customer's processor, gives 30 days to object to a change of sub-processor and returns or deletes data on instruction. It is executed by the customer from that page. Effective January 1, 2026. Transfers: The EU standard contractual clauses, module 2 or module 3, as OpenAI's addendum states. Its terms
Google — Transcribing a recording with the Gemini API, when it is the speech service configured. Receives: The audio or video file of a recording sent for transcription. When: Only while Hazelsong is configured with a Gemini key and no service before it in the order answered. Based in: United States. Its terms, read October 17, 2026: The Gemini API's additional terms (last updated April 28, 2026) say that for Paid Services Google processes prompts and responses under its data processing addendum and does not use them to improve its products, and that only Paid Services may be used for people in the EEA, the UK or Switzerland. The addendum itself was not read. Transfers: Not read. Its terms
Resend — Sending the product's email, and reporting whether a message could be delivered or was marked as spam. Receives: Each email's recipient address, the name it is addressed to and its content: requests for a testimonial and their reminder, thank-yous, private replies, notices and summaries to the owner, login links. Based in: United States. Its terms, read October 17, 2026: Resend's data processing addendum announces a new sub-processor at least 14 days in advance. Updated December 31, 2025. Transfers: The EU standard contractual clauses and the EU-U.S. Data Privacy Framework, as Resend's addendum states. Its terms
Paddle (account only) — Taking payment as merchant of record, its billing page, and recovering a payment that did not go through. Receives: The business's own billing details, entered on Paddle's pages; the project's public address; the customer and subscription ids Paddle issues. Nothing about a testimonial or its writer. Based in: United Kingdom. Its terms, read October 17, 2026: Paddle's data processing addendum names Paddle the processor and its customer the controller, gives 14 days to object to a new sub-processor and notice of a breach without undue delay. Last updated February 1, 2023. Its role as merchant of record is not addressed there. Transfers: The EU standard contractual clauses of Decision 2021/914 and the UK Addendum, as Paddle's addendum states. Its terms
Stripe (account only) — Taking payment for plans and packs once Stripe is switched on, sales tax where collected, and its billing page. Receives: The plan chosen and the project's public address; the card, billing address and tax id, entered on Stripe's own pages; the customer and subscription ids Stripe issues. Nothing about a testimonial or its writer. When: Only once Stripe's variables are set; until then Paddle takes every payment. Based in: United States. Its terms, read October 17, 2026: Stripe's data processing agreement makes Stripe a processor for some data and a controller for other data, gives notice of a breach no later than 48 hours for GDPR data, and announces a new sub-processor 30 days ahead to those who subscribe. Last updated September 28, 2026. Transfers: Its Data Transfers Addendum: the Data Privacy Framework, the EEA standard contractual clauses or the UK addendum, as Stripe's agreement states. Its terms

The regions in which our database and file storage hold your data are set in those providers' accounts and are not yet stated in this addendum. Each provider's own sub-processors are listed by that provider.

Before a new sub-processor receives any of your customers' data, we add it to this list, and to its machine-readable copy at /dpa/subprocessors.json, with the day it was announced and the day it starts, at least 30 days apart. You may object in writing to support@hazelsong.com within that time, on reasonable data protection grounds. If we cannot resolve it, you may stop using Hazelsong for the data concerned and delete the projects that hold it, and the Terms of Service and the Refund Policy apply to the subscription as they always do.

Transfers to other countries

Most of our sub-processors are based in the United States. Where you are subject to the EU GDPR and sending your customers' data to us is a transfer to a country without an adequacy decision, the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 of June 4, 2021 are incorporated into this addendum by reference, with you as data exporter and us as data importer: Module Two where you are a controller, Module Three where you are a processor. For them: Clause 7 (docking) applies; Clause 9 takes Option 2, general written authorization, with the notice above; the optional wording of Clause 11 does not apply; Clause 13 applies as it provides for your situation; under Clause 17 Option 2, the law of the Member State where you are established governs, and Ireland's where that law does not allow third-party beneficiary rights or you are not established in the EU; under Clause 18, its courts. Their annexes are completed by “What is processed”, “Security measures” and “Sub-processors” on this page, and the parties are you and us, at the contact details in your account and support@hazelsong.com.

The European Commission has said that those clauses do not work for an importer whose processing is itself subject to the GDPR under its Article 3, and that it is preparing other clauses for that case. Where that is our situation for your data, the clauses above apply only as far as they can.

Where you are subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force March 21, 2022) is incorporated in the same way, with Table 1 as the parties above, Table 2 as the modules and clauses above, Table 3 as this page, and under Table 4 either party may end it when the Information Commissioner changes it. Our own transfers to our sub-processors rely on the mechanism each one names above.

Personal data breaches

If we become aware of a breach of security that leads to your customers' data being destroyed, lost, altered, disclosed or accessed without authorization, we tell you without undue delay, and in any event within 48 hours, by email to the address on your account: what happened, which projects and data are affected as far as we know, what we have done, and who to contact. What we learn later, we send as we learn it. Telling you is not an admission of fault.

At the end

You can take everything out at any time, on every plan: the CSV export holds every testimonial with its permission sentence and date, and every original recording and picture can be downloaded at the quality it arrived at. Deleting a testimonial removes it and its files at once. Deleting a project closes it to new testimonials first and then removes every record and every file it holds; if that stops part-way, the rest is deleted automatically within a day. When a paid plan ends and none is started again, its projects are deleted the same way 30 days later, after emails when it ends, 14 days before and 7 days before. Cached copies of what your walls and widgets showed are discarded with the project. Copies a provider keeps for its own resilience, such as backups, are deleted on that provider's own schedule. We keep nothing of your customers' data after that, unless a law requires us to.

Information and audits

This page, the Privacy Policy and each feature's page say what Hazelsong does with personal data, and we answer your written questions about it. Once in any 12 months, or after a breach affecting your data, you may have an independent auditor, bound to confidentiality and paid by you, examine how we meet this addendum, on 30 days' written notice and without access to other customers' data. A supervisory authority's request is answered as the law requires.

California: service provider terms

Where you are a business under the California Consumer Privacy Act, we are your service provider, and personal information you give us is processed for one business purpose: providing Hazelsong as described on this site and in your settings. We:

do not sell or share it;
process it only for that business purpose;
do not retain, use or disclose it for any other purpose, commercial or not;
do not retain, use or disclose it outside our direct business relationship with you, and do not combine it with personal information from other sources, except as that law allows;
comply with that law and give it the same level of protection it requires of you;
let you take reasonable steps to check that we do, as under “Information and audits”;
tell you if we decide we can no longer meet these obligations;
let you, on notice, stop and remediate any use of it you did not authorize;
help you answer consumers' requests, as under point (e) above.

Canada and Quebec

Where you are subject to PIPEDA, this addendum is the contract by which you keep comparable protection for the personal information you give us. Where you are subject to Quebec's Act respecting the protection of personal information in the private sector, it is the written mandate to us as your service provider: we take the measures above to protect the information's confidentiality, use it only to carry out that mandate, do not keep it once the mandate ends except as under “At the end”, tell you without delay of any violation or attempted violation of those obligations, and let you check them as under “Information and audits”. Before personal information leaves Quebec you must assess the transfer; this page and the Privacy Policy give the vendors, their countries and the safeguards for it.

Order, and changes

Where they differ, the standard contractual clauses and the UK Addendum prevail over this addendum, and this addendum over the Terms of Service. Nothing here limits a right the law gives the people whose data it is. We may update this addendum; a change that reduces its protection is published here at least 30 days before it takes effect, with its new version date, and questions about it go to support@hazelsong.com.