Hiro Data Processing Agreement

Last updated: [DATE]

This Data Processing Agreement (“DPA”) is part of the Terms of Service between Hiro LLC (“Hiro,” “Processor”) and the customer who holds a Hiro creator account (“Customer,” “Controller”). It applies whenever Hiro processes personal data on Customer’s behalf and Data Protection Law applies to that processing.

By using the Service, Customer accepts this DPA. If Customer needs a signed copy, email [email protected].

1. Definitions

• Data Protection Law means all laws that apply to the processing of personal data under this DPA, including the GDPR, UK GDPR, the UK Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and other US state privacy laws.
• Customer Data means personal data that Customer uploads to or collects through the Service, including listener contact details, purchase records, consent records, listening data, tags and message history.
• Personal data, processing, controller, processor, sub-processor, data subject, supervisory authority and personal data breach have the meanings given in Data Protection Law.
• Standard Contractual Clauses or SCCs means the clauses approved by the European Commission in Decision 2021/914, and UK Addendum means the UK ICO’s International Data Transfer Addendum.
• Service means the Hiro website, web app, mobile apps, API, connectors and related services.

2. Roles

Customer as controller. Customer is the controller of Customer Data. Customer decides which listener data to collect, what to do with it, and who to message. Customer is responsible for having a lawful basis, providing notices, obtaining consents, and responding to data subjects.

Hiro as processor. Hiro processes Customer Data only on Customer’s documented instructions, as set out in this DPA, the Terms, and Customer’s use of the Service’s features and settings.

Hiro as controller. Hiro is an independent controller for Customer’s own account and billing data, for Hiro’s own website analytics, and for aggregated or de-identified service data. That processing is governed by the Privacy Policy, not this DPA.

3. Customer’s instructions and obligations

Customer instructs Hiro to process Customer Data to provide the Service, including hosting and delivering content, running sales pages and checkouts, sending messages Customer initiates, running automations Customer configures, generating analytics, and powering AI features Customer uses.

Customer warrants that:

• It has all consents and lawful bases needed for Hiro to process Customer Data as instructed, including consent for marketing messages and for any tracking pixels Customer installs.
• Its instructions comply with Data Protection Law.
• It won’t upload Customer Data that Hiro isn’t permitted to process, including data of children under 13 without verifiable parental consent, or special category data unless Customer has a lawful basis and has told Hiro in writing.

Hiro will tell Customer if, in Hiro’s opinion, an instruction violates Data Protection Law, and may suspend processing of that instruction.

4. Hiro’s obligations

Hiro will:

• Process Customer Data only on Customer’s documented instructions, unless required by law. If law requires other processing, Hiro will inform Customer before processing unless the law prohibits it.
• Ensure that people authorized to process Customer Data are bound by confidentiality.
• Implement the technical and organizational measures in Annex 2.
• Assist Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting Customer’s obligations on security, breach notification, data protection impact assessments and prior consultation.
• Delete or return Customer Data at the end of the Service as described in Section 9.
• Make available the information necessary to demonstrate compliance and allow for audits as described in Section 8.
• Not sell Customer Data, share it for cross-context behavioral advertising, retain, use or disclose it outside the direct business relationship with Customer, or combine it with personal data from other sources except as permitted by Data Protection Law. Hiro certifies that it understands these restrictions.

5. Sub-processors

Customer authorizes Hiro to use the sub-processors listed in Annex 3 and at [/subprocessors].

Hiro will notify Customer at least 14 days before adding or replacing a sub-processor, by email to the account address or by notice in the Service. Customer may object in writing on reasonable data protection grounds within that period. If the parties can’t resolve the objection, Customer may terminate the affected Service and receive a pro-rated refund of prepaid fees for the unused period.

Hiro will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for sub-processors’ performance.

Services Customer connects. Where Customer connects its own accounts with third parties (for example its own Stripe, PayPal, Twilio, Telnyx, WhatsApp Business, Gmail, Outlook, SMTP, Zapier, Pabbly, Go High Level, Facebook pixel, Google Analytics, or Customer’s own Anthropic or ElevenLabs API key), those third parties are Customer’s processors or independent controllers, not Hiro’s sub-processors. Customer is responsible for its agreements with them.

6. AI processing

When Customer uses AI features, Hiro sends the relevant Customer content and any Customer Data included in it to the AI sub-processors in Annex 3 to generate the requested output.

• Hiro doesn’t use Customer Data to train machine learning models.
• Hiro uses AI sub-processors under commercial terms that prohibit training on Customer Data and limit retention to what’s needed to provide the service and for abuse monitoring.
• Customer controls what content and data goes into AI features and is responsible for not including personal data it isn’t permitted to process.

7. Security and breach notification

Hiro maintains the measures in Annex 2 and may update them provided the overall level of protection isn’t reduced.

Hiro will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, and measures taken or proposed. Hiro may provide information in phases as it becomes available. Hiro will cooperate with Customer’s investigation and any notifications Customer is required to make.

Customer is responsible for notifying data subjects and supervisory authorities where Data Protection Law requires it.

8. Audits

On written request no more than once per year (or more often after a personal data breach or where a supervisory authority requires), Hiro will make available documentation demonstrating compliance with this DPA, including summaries of any third-party audits or certifications Hiro holds.

If that documentation isn’t sufficient to demonstrate compliance, Customer or an independent auditor bound by confidentiality may audit Hiro’s relevant systems and records during business hours, on 30 days’ notice, in a manner that doesn’t disrupt Hiro’s business or compromise other customers’ data. Customer bears the cost of audits unless the audit reveals a material breach of this DPA.

9. Data subject requests

Hiro will, to the extent legally permitted, promptly forward to Customer any request from a data subject relating to Customer Data. Hiro won’t respond to the data subject except to acknowledge receipt and direct them to Customer, unless Customer instructs otherwise or law requires it.

The Service includes tools for Customer to access, export, correct and delete listener records. Hiro will provide reasonable additional assistance at Customer’s request, and may charge a reasonable fee for assistance that goes beyond what the Service provides.

10. Return and deletion

Customer can export Customer Data from the Service at any time during the term.

On termination or expiry of the Service, Hiro will retain Customer Data for [30] days so Customer can export or reactivate, then delete it from active systems. Backups are purged on a rolling [35]-day cycle. Hiro may retain Customer Data where required by law, in which case Hiro will protect it and process it only for that purpose.

On written request within the [30]-day window, Hiro will confirm deletion.

11. International transfers

Hiro is located in the United States and processes Customer Data in the US and in the countries where its sub-processors operate.

For transfers of Customer Data from the EEA to a country without an adequacy decision, the parties enter into the SCCs, Module Two (controller to processor), which are incorporated by reference, with these selections: Clause 7 (docking) included; Clause 9 Option 2 (general authorization) with the notice period in Section 5; Clause 11 optional language not included; Clause 13 supervisory authority as determined by Annex I.C; Clause 17 Option 1 with the law of Ireland; Clause 18 courts of Ireland. Annex I and II of the SCCs are completed by Annexes 1 and 2 of this DPA.

For transfers from the UK, the UK Addendum applies to the SCCs, with the tables completed by reference to this DPA and the parties’ details, and with the option that neither party may end the Addendum under section 19.

For transfers from Switzerland, the SCCs apply with the adaptations required by the FADP, including references to the Swiss Federal Data Protection and Information Commissioner as competent authority and Swiss law where FADP applies.

If Hiro becomes certified under an approved transfer framework, Hiro may rely on that framework in place of the SCCs for the transfers it covers.

Hiro will inform Customer if it can no longer comply with its transfer obligations, and the parties will cooperate on measures to address it, up to and including suspension of the affected processing.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law doesn’t allow those limits to apply. Nothing in this DPA limits either party’s liability to data subjects under Data Protection Law.

13. General

• This DPA takes precedence over the Terms and the Privacy Policy to the extent of any conflict about processing of Customer Data.
• Where the SCCs apply, they take precedence over this DPA to the extent of any conflict.
• This DPA lasts for as long as Hiro processes Customer Data.
• Hiro may update this DPA to reflect changes in Data Protection Law or the Service, with notice to Customer, provided the update doesn’t reduce the protection of Customer Data.
• This DPA is governed by the law in the Terms, except where Data Protection Law or the SCCs require otherwise.

Annex 1: Details of processing

Parties

• Data exporter (controller): Customer, at the name and address on Customer’s Hiro account. Contact: the email on Customer’s account. Role: controller.
• Data importer (processor): Hiro LLC, 2601 S. Minnesota Ave Ste 105-308, Sioux Falls, SD 57105, USA. Contact: [email protected]. Role: processor.

Subject matter. Hiro’s provision of the Service to Customer under the Terms.

Duration. The term of the Service plus the retention period in Section 10.

Nature and purpose. Hosting and delivering Customer’s audio content; collecting and storing listener contacts and consent records; processing purchases through Customer’s connected payment accounts; sending email, SMS, WhatsApp and push messages Customer initiates; running automations Customer configures; generating listening and engagement analytics; generating transcripts, cover art, show plans, posts and newsletters through AI features Customer uses; providing the Public API and Claude connector; and related support, security and backup.

Categories of data subjects. Customer’s listeners, subscribers, customers and prospects; Customer’s team members and sub-account users.

Categories of personal data. Name, email address, phone number, postal or billing address where collected; purchase and subscription history; consent records including IP address and timestamp; tags and categories; listening and download data including IP-derived approximate location, device and app; message content, delivery status and engagement; push notification tokens and device identifiers; form submissions; any other data Customer chooses to collect.

Special category data. None intended. Customer must not upload special category data unless it has a lawful basis and has notified Hiro in writing.

Frequency. Continuous.

Retention. As set out in Section 10 and the Privacy Policy.

Competent supervisory authority (Annex I.C). The authority of the EU member state where Customer is established, or if Customer isn’t established in the EU, the authority of the member state where Customer’s EU representative is established or where its data subjects are located.

Annex 2: Technical and organizational measures

• Encryption. TLS 1.2 or higher for data in transit. Encryption at rest for databases, object storage and backups. Customer API keys and connected-service credentials stored encrypted with keys managed separately from the data.
• Access control. Role-based access to production systems limited to personnel who need it. Multi-factor authentication for all administrative access. Access reviewed at least quarterly and revoked on role change or departure.
• Authentication. Hashed passwords, optional two-factor authentication for Customer accounts, session expiry, rate limiting on authentication endpoints.
• Tenant isolation. Logical separation of Customer Data by account. Authorization checks on every data access path, including the API and Claude connector.
• Infrastructure. Hosted with [cloud provider(s)] in [regions], which maintain SOC 2 and ISO 27001 certifications. Network segmentation, firewalls, and managed patching.
• Logging and monitoring. Centralized logs of access and administrative actions. Alerting on anomalous activity. Logs retained [12] months.
• Backups. Automated encrypted backups with [daily] frequency and [35]-day rolling retention. Restore procedures tested [quarterly].
• Vulnerability management. Dependency scanning, regular patching, and [annual] third-party penetration testing. A responsible disclosure channel at [email protected].
• Development. Code review before deployment, separate development, staging and production environments, no production Customer Data in non-production environments.
• Personnel. Confidentiality obligations for all staff and contractors. Security awareness training at onboarding and [annually].
• Incident response. Documented incident response procedure with defined roles, containment, notification and post-incident review.
• Sub-processor management. Due diligence before engagement, contractual data protection terms, and periodic review.
• Data deletion. Account deletion workflow that removes Customer Data from active systems within the period in Section 10; backups expire on the rolling cycle.
• Customer controls. Export tools for contacts, episodes and analytics; per-contact deletion; GDPR consent tool for sales pages; opt-out handling for messaging; team member permissions.

Annex 3: Sub-processors

The current list is maintained at [/subprocessors].