Data Processing Agreement

How we process personal data in your content on your behalf, under Article 28 of the GDPR.

Effective 1 December 2026

1. Parties and scope

1. This Data Processing Agreement (“DPA”) is part of the Terms of Service between the Customer (controller) and Daniel Vančo, Company ID (IČO) 50676750 (“Mergehand”, processor). Terms defined in the Terms of Service have the same meaning here.
2. It applies to personal data in Customer Content and Output that Mergehand processes on the Customer's behalf (“Customer Personal Data”). It is concluded electronically by accepting the Terms, as Article 28(9) GDPR allows.
3. The Customer's instructions are the Terms, this DPA and the Customer's settings and actions in the Service. Mergehand tells the Customer if it believes an instruction breaks data protection law.

2. Mergehand's obligations

Mergehand:

• processes Customer Personal Data only on documented instructions, unless EU or Slovak law requires otherwise, in which case it tells the Customer first if the law allows;
• ensures that people authorized to process it are bound by confidentiality;
• takes the measures in Annex 2 (Article 32 GDPR);
• engages subprocessors only under section 3;
• helps the Customer, taking into account the nature of processing, to answer requests of data subjects and to meet its obligations under Articles 32 to 36 GDPR;
• deletes or returns Customer Personal Data at the end of the contract under section 6;
• makes available the information needed to demonstrate compliance and allows audits under section 7.

3. Subprocessors

1. The Customer gives general authorization to engage subprocessors. Current subprocessors are on the subprocessors page.
2. Mergehand emails owners and admins of the Customer's Organization at least 14 days before it adds or replaces a subprocessor. The Customer may object on reasonable data protection grounds before that date. If the parties don't find a solution, the Customer may end the contract without a fee before the change, and Mergehand refunds prepaid fees for the unused period.
3. Mergehand imposes the same data protection obligations on each subprocessor by contract and remains responsible to the Customer for them.

4. Anthropic and other services the Customer connects

1. The Agent runs on the Customer's Runners and sends prompts and code context to Anthropic under the agreement between the Customer (or its Member) and Anthropic. Anthropic is not Mergehand's subprocessor, and Mergehand is not responsible for Anthropic's processing.
2. The same applies to code hosts, issue trackers, chat webhooks and other services the Customer connects.
3. The Customer is responsible for having suitable agreements with these services. For business code, plans under Anthropic's commercial terms (Claude Team, Claude Enterprise or an API key) include Anthropic's data processing terms and exclude training on the data.

5. Personal data breaches

1. Mergehand notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay and no later than 48 hours after becoming aware of it, by email to owners and admins of the Customer's Organization.
2. The notice includes what Article 33(3) GDPR requires as far as it is known: the nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact. Information that isn't available yet follows as soon as it is.
3. Mergehand documents every breach and helps the Customer notify the supervisory authority and data subjects where needed.

6. Retention and deletion

1. Runs, their logs, artifacts and outputs are deleted 12 months after the run. Code review diffs are deleted 5 days after the merge request is closed. Other Customer Personal Data is kept while the project exists, unless the Customer deletes it earlier.
2. After the contract or a trial ends, the Customer can ask for an export under section 17 of the Terms. Mergehand then deletes Customer Personal Data as described there, at the latest 90 days after the end or after the export retrieval period, whichever is later. Backups roll off within 14 days after that.
3. Mergehand confirms the deletion in writing on request.

7. Information and audits

1. Mergehand answers reasonable written questions and security questionnaires about its processing.
2. If that is not enough, the Customer or an auditor bound by confidentiality may carry out an audit, at most once a year, with 30 days' notice, at the Customer's cost and without disrupting the Service, unless a breach or a supervisory authority requires otherwise.

8. Transfers outside the EEA

Mergehand hosts Customer Personal Data in the European Union. Where a subprocessor is outside the EEA or has a parent company outside it, transfers rely on an adequacy decision, the EU–US Data Privacy Framework or the European Commission's standard contractual clauses, as listed on the subprocessors page.

9. Liability and order of precedence

Liability under this DPA is subject to section 19 of the Terms, except where the law does not allow it to be limited. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

Annex 1 – Description of processing

Annex 2 – Technical and organizational measures

• Encryption: TLS for all connections, with HSTS. Integration tokens, OAuth and webhook secrets and two-factor secrets are encrypted with AES-256-GCM. Passwords are hashed with scrypt; session, runner and invitation tokens are stored only as hashes.
• Access control: roles for the service, organizations and projects; row-level security in the database by project; two-factor authentication available to every user; session limits and rate limits on sign-in and sign-up; content security policy.
• Isolation of runs: runs take place on the Customer's Runners in a fresh container that is removed afterwards, as an unprivileged user without access to Docker, with outbound network limited to an allowlist (no run starts if the firewall can't be set up), a time limit on each agent step and masking of known tokens in output. The server has no clones of Customer repositories.
• Infrastructure: servers at Hetzner in Germany; firewall open only for SSH, HTTP and HTTPS; administrative access only with SSH keys; automatic security updates.
• Availability: daily database backups kept for 14 days and daily server snapshots kept for 7 days, both at the hosting provider. An encrypted copy of each database backup is kept in object storage separate from the database server; the decryption key is held offline by the operator and is not stored on any server. Restoring from this copy has been tested.
• Logging and response: record of actions, sign-in history, server logs and error tracking; a written incident response procedure.
• Organization: access to production limited to the operator; confidentiality; code review of changes before deployment.

Annex 3 – Subprocessors

See the subprocessors page.