Data Processing Addendum

1. How this addendum applies

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Terms”) between SoftHawker LLC (“SoftHawker”, “we”, “us”), which operates FireFunc, and the business that accepted them (“you”, the “Customer”). SoftHawker LLC is a limited liability company organized under the laws of the State of Delaware. It takes effect when you accept the Terms, needs no separate signature, and lasts for as long as we process Customer Personal Data.

It applies whenever we process Customer Personal Data in providing the Service and Data Protection Law applies to that processing. Words defined in the Terms have the same meaning here.

If this DPA conflicts with the Terms, this DPA governs the processing of Customer Personal Data. If the SCCs apply and conflict with this DPA or the Terms, the SCCs govern.

2. Definitions

Customer Personal Data: personal data in Customer Data that we process on your behalf in providing the Service, as described in Annex I.
Data Protection Law: the laws that apply to that processing, including, where they apply, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
Controller, processor, data subject, personal data, processing and supervisory authority: as the GDPR defines them, or the equivalent terms in other Data Protection Law.
Personal Data Breach: a breach of the security of the Service that leads to the accidental or unlawful destruction, loss or alteration of Customer Personal Data, or to its unauthorized disclosure or access.
Subprocessor: a third party we engage to process Customer Personal Data on our behalf.
Customer-Directed Service: a service you choose to connect or run with FireFunc under your own account — the tools you connect, such as GitHub, Jira, Linear, Sentry, Slack, Figma, Microsoft Teams, custom MCP servers and webhooks, and the AI engines you use, whether on your machines, such as Claude Code, Codex, Copilot CLI, Gemini CLI, Cursor CLI and Antigravity, or in their vendor’s cloud, such as GitHub Copilot’s coding agent, Cursor’s cloud agents and Claude Code routines.
SCCs: the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

3. Roles

You are the controller of Customer Personal Data and we are your processor. Where you process it as a processor for someone else, we are your subprocessor, and you confirm that your controller has authorized your instructions and our appointment.

Customer-Directed Services are not our Subprocessors. When you connect a tool or run an engine, data moves between FireFunc and that service, or between your machine and that service, because you directed it, under your own agreement with its vendor. That agreement governs the vendor’s processing, and your relationship with the vendor is yours.

For the personal data we handle to run our own business — the accounts of your users, the early access form, our security records and logs — we are a controller, and the Privacy Policy applies instead of this DPA.

4. Processing on your instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we tell you first, unless the law forbids it. Your instructions are the Terms and this DPA; your configuration and use of the Service, such as the tools you connect, the agents you set up and the settings you choose; and any other written instruction we agree to.

We tell you promptly if we believe an instruction infringes Data Protection Law, and we need not follow it.

FireFunc runs no AI models. We do not use Customer Personal Data to train AI models, and we do not give it to anyone else to do so.

You are responsible for the lawfulness of your instructions and of Customer Personal Data: for its lawful basis, for the notices data subjects need, and for any consents.

5. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality, and has access to it only as needed to provide, secure and support the Service.

6. Security

We maintain the technical and organizational measures in Annex II. We may change them over time, but not in a way that lowers the overall protection of Customer Personal Data.

You are responsible for what you control: the machines you pair, the engines and tools you run on them and their accounts, and who has access to your workspaces and with which role.

7. Subprocessors

7.1 Authorization

You give us general authorization to engage Subprocessors. The current list is in Annex III and on the Subprocessors page. We bind each Subprocessor to data protection obligations no less protective than this DPA’s, and we remain responsible to you for its performance of them.

7.2 Notice of a new Subprocessor

We tell you at least 30 days before a new Subprocessor begins to process Customer Personal Data, by email to your organization’s owners and on the Subprocessors page.

7.3 Your right to object

If you have a reasonable data protection concern about a new Subprocessor, you may object to it by writing to admin@firefunc.com within those 30 days. We will discuss your concern in good faith. If we cannot resolve it, for example by offering a way to use the Service without that Subprocessor, you may end the Terms by written notice, and we refund any fees you prepaid for the time after they end.

8. Requests from data subjects

If a data subject asks us to act on their rights over Customer Personal Data and we can tell that the request concerns you, we pass it to you promptly and do not answer it ourselves, except to tell the person that we have passed it on.

Taking into account the nature of the processing, we help you answer such requests. Where you cannot do what a request needs in the product — a copy of a workspace’s data, or its erasure — write to admin@firefunc.com and we act within 30 days.

9. Personal Data Breaches

We notify you without undue delay, and in any case within 72 hours, after we confirm a Personal Data Breach. We send the notice by email to your organization’s owners.

The notice describes, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures we have taken or propose to take. What we cannot say at once, we send in stages without further undue delay.

We take reasonable steps to contain and investigate the breach and to limit its effects, and we help you meet your own duties to notify supervisory authorities and data subjects. Our notice is not an admission of fault or liability.

Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as failed sign-ins or network scans, are not Personal Data Breaches.

10. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we give you reasonable help with data protection impact assessments, and with prior consultations with supervisory authorities, that concern the Service — mainly by providing the information in this DPA and answering your questions about it.

11. Deletion and return

Annex I sets out how long each kind of Customer Personal Data is kept while you use the Service.

Return. At any time, including after the Terms end, you can ask for a copy of your Customer Personal Data by writing to admin@firefunc.com. There is no export screen; we send the copy within 30 days of the request.

Erasure. Deleting a workspace in the product pauses its agents and archives it; it does not erase its data. To restore an archived workspace, or to have a workspace’s Customer Personal Data erased, write to admin@firefunc.com. We erase it within 30 days of the request; restoring and erasing are both done by hand. Once the Terms have ended, we may also erase it after giving you at least 30 days’ notice. Erased data can remain in database backups for up to 7 more days.

Where the law requires us to keep some Customer Personal Data, we keep only that, only for as long as required, and this DPA continues to protect it.

12. Audits and information

FireFunc holds no security certifications of its own. The certifications of Amazon Web Services cover its infrastructure layer only.

We make available the information needed to show that we meet this DPA. On request to admin@firefunc.com, we answer your security questionnaire and your reasonable written questions about our processing. What we tell you is our Confidential Information under the Terms.

We do not host on-site audits or inspections. Where the SCCs give you a right to audit, you agree that it is exercised through the information and answers described here, unless a supervisory authority with jurisdiction over you requires otherwise.

13. International transfers

We store and process Customer Personal Data in the United States, with Amazon Web Services in its us-east-1 region, in Northern Virginia. You instruct us to transfer it there by using the Service. If a transfer mechanism below stops being valid, we will work with you to put a lawful alternative in place.

13.1 From the European Economic Area

Where Customer Personal Data subject to the GDPR is transferred to us, the SCCs are incorporated into this DPA by reference and completed as follows:

Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) where you are a processor. You are the data exporter and SoftHawker the data importer.
Clause 7, the docking clause, applies.
Clause 9: Option 2, general written authorization, applies, with the 30 days’ notice in Subprocessors.
Clause 11: the optional language does not apply.
Clause 13: the supervisory authority is the one that clause determines.
Clause 17: Option 1 applies, and the governing law is that of Ireland.
Clause 18: disputes are resolved by the courts of Ireland.
Annexes I and II of the SCCs are completed by Annex I and Annex II of this DPA, and the list of subprocessors by Annex III.

13.2 From the United Kingdom

Where the UK GDPR applies, the UK Addendum is incorporated by reference and amends the SCCs as completed above. In it, Table 1 is completed with the parties’ details in Annex I; Table 2 with the modules and choices above; Table 3 with Annexes I to III of this DPA; and in Table 4, both the importer and the exporter may end the UK Addendum as its Section 19 allows.

13.3 From Switzerland

Where the FADP applies, the SCCs as completed above apply with these changes: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and “Member State” in Clause 18(c) includes Switzerland, so that data subjects habitually resident there can bring claims there.

14. US state privacy laws

Where the CCPA or a similar US state law applies, we act as your service provider or processor. We do not sell or share Customer Personal Data, as those laws define those words; we do not keep, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you; and we do not combine it with personal data we receive from anyone else, except as those laws allow. We give it the level of privacy protection those laws require, and we tell you if we can no longer meet these obligations. You may then take reasonable steps to stop and put right any unauthorized use.

15. Liability

Each party’s liability arising out of or relating to this DPA, including under the SCCs as between the parties, is subject to the Limitation of liability in the Terms. This does not limit a party’s liability to data subjects under their rights as third-party beneficiaries of the SCCs, or any liability that Data Protection Law does not allow to be limited.

16. Changes to this DPA

We may update this DPA as the Terms describe, with at least 30 days’ notice of a material change, by email or in the product. We will not change it in a way that lowers the protection of Customer Personal Data, unless Data Protection Law or a supervisory authority requires it. The SCCs, the UK Addendum and the Swiss amendments change only as their own terms allow.

17. Annexes

17.1 Annex I: Description of the processing

Item	Detail
Data exporter	The Customer: the business that accepted the Terms, as identified in its FireFunc organization. Contact: the owners of that organization, at the email addresses on their accounts. Role: controller, or processor on behalf of its own controller. Activities: using FireFunc to hand work from its tools to agents that run under its own AI accounts. Signature and date: its acceptance of the Terms, which include this DPA.
Data importer	SoftHawker LLC, which operates FireFunc. Contact: admin@firefunc.com. Role: processor, or subprocessor. Activities: providing the Service. Signature and date: the Customer’s acceptance of the Terms.
Data subjects	The Customer’s staff and contractors who use FireFunc or appear in its tools, and anyone else who appears in the data the Customer’s tools send — for example, people who file, comment on or are assigned a ticket, write a commit or pull request, review code, or are named in an alert or message.
Categories of personal data	Names, usernames, user IDs and email addresses as they appear in the data below, and any personal data people write into it: Tickets and messages: titles, descriptions, comments, labels, assignees, and the attachments people add. Images and PDFs are stored; other files are kept as a link. From GitHub: repository names, pull request and issue numbers, titles and bodies, branch names, commit messages, the paths of changed files and how many lines changed, the names and results of CI checks, and review verdicts and review comments. From Sentry: issues and events as Sentry sends them — title, error type, the file, function and line where the error happened, and the tags, context and user details the Customer’s Sentry project records — without the source lines or local variables. Webhook deliveries, as they were sent. Each run: the task brief FireFunc writes for it; what started it (the tool event, the person or the agent, named as the tool or FireFunc names them) and the first line of what it was asked (a person’s instruction, the task’s own text or a hand-off’s note) — with, when someone asked in a comment, that comment’s link, its author and when it was written; its status, branch and pull request link, and, if it failed, the reason in one line; each step it took, as one line (a file path, a command’s name, a tool’s name, a website or search, or a remark from the agent), never a command’s arguments, a file’s contents or a command’s output; the summary the agent wrote; the verdict it reported (one word from the set its agent declares) and each thing it reported finding (a one-line title, a severity and, when it gave one, a link); and, from a paired machine, what the run used as its engine counted it (tokens by model, turns, time, the engine’s own estimate of their price, whether the engine was signed in to a plan or an API key and whether the plan drew on its extra usage, the engine’s version, and the plan’s usage readings when the engine reports them). Code is removed from the first line of what it was asked and from each finding’s title before they are stored, and from the summary, the reason and the steps a paired machine reports before they are stored. For an engine in its vendor’s cloud, code is removed from the summary, reasoning and failure reason it reports back before they are stored, and each removed block is marked “[code left out]”. Paired machines: host name, platform, runner version, the engines found, how much of an engine’s usage allowance is used where the runner can read it, and the names of the sign-ins the machine holds, never the tokens.
Sensitive data	None is intended. The Service is not designed for special categories of personal data or for data about criminal convictions, and the Customer should not route them through it. Where a ticket or message contains such data, the measures in Annex II apply to it.
Frequency	Continuous, for as long as the Customer uses the Service.
Nature of the processing	Receiving events from connected tools and storing them; writing a task brief for an agent; checking work against the rules the Customer sets; handing it to the Customer’s paired machines, or to the engine vendor the Customer chose; receiving what comes back; posting results to the Customer’s tools as its agents are set up to do; showing all of this to the Customer’s users; and deleting it on schedule or on request.
Purpose	Providing, securing and supporting the Service for the Customer under the Terms.
Retention	Raw events, each delivery as a connected tool or webhook sent it: 90 days, then deleted. Attachment files kept with a task (images and PDFs): 90 days, then removed; the task keeps the file’s name and link. What a run was handed (its brief, and the attachments and context sent with it): dropped 7 days after the run finishes; the first line of what the run was asked, with code removed, stays with the run. Everything else, including each task’s ticket details and the latest event about it: while the workspace exists. Deleting a workspace archives it; an archived workspace can be restored on request, and its data is erased within 30 days of a request to erase it (see Deletion and return). Database backups: up to 7 more days.
Transfers to subprocessors	Amazon Web Services hosts and stores all Service data in its us-east-1 region, for as long as the processing lasts. Google Workspace holds what you email to us at admin@firefunc.com, for as long as we keep that email. See Annex III.
Competent supervisory authority	The one determined under Clause 13 of the SCCs.

17.2 Annex II: Technical and organizational measures

These are the measures in place for the Service today.

Hosting. The Service runs on Amazon Web Services in one region, us-east-1. AWS’s own certifications cover its infrastructure layer; FireFunc holds none of its own.
Encryption in transit. Traffic to the Service is encrypted with TLS, through Amazon CloudFront and Amazon API Gateway.
Encryption at rest. The Postgres database (Amazon RDS) is encrypted at rest. The OAuth tokens of connected tools, and the other credentials the Customer gives FireFunc, are kept in AWS Systems Manager Parameter Store as SecureString values encrypted with AWS Key Management Service; the database holds only a pointer to each. The OAuth tokens of connected tools are never sent to Customer machines.
Network. The database is not reachable from the internet.
Separation of customers. Each workspace’s data is kept apart by Postgres row-level security, forced so that it binds the tables’ owner too.
Authentication. Passwords and multi-factor authentication are handled by Amazon Cognito. The staff console requires multi-factor sign-in. API keys and webhook tokens are stored only as hashes.
Accountability. An audit log records the changes made in each workspace: who made them, what changed, and when. Entries cannot be edited or deleted by the Service’s application or its staff console; only the database role that applies migrations, which owns the log, keeps that right, because the database needs it to unlink an entry from a workspace or account that is deleted.
Backups. Automated database backups are kept for 7 days. The database runs in a single availability zone.
The website. Responses served through firefunc.com carry security headers: HTTP Strict Transport Security, a refusal to be shown inside another site’s frame, and nosniff. The site loads no analytics or advertising trackers, and serves its own fonts.
Keeping less. FireFunc never clones, fetches or stores a repository. The parts of tool events that carry code (a review comment’s diff, a CI check’s output, a stack trace’s source lines and variables) are removed before an event is stored. The secret scan of an agent’s changes runs on the Customer’s machine. A run’s steps are recorded as one line each, without a command’s arguments or a file’s contents, and code is removed from the words an agent reports — its summary, its reasoning where it gives one, and why a run failed — before they are stored, whether a paired machine or an engine in its vendor’s cloud reported them. Raw events, attachment files and what a run was handed are deleted on the schedule in Annex I.

The machines the Customer pairs, the engines and tools it runs on them, and access to its workspaces are under the Customer’s control, and securing them is its responsibility.

17.3 Annex III: Subprocessors

The current list is kept on the Subprocessors page, where changes are announced. On the date at the top of this page, it is:

Subprocessor	What it does	Where
Amazon Web Services	Hosts the Service: AWS Lambda, Amazon API Gateway, Amazon CloudFront, Amazon S3, Amazon RDS for PostgreSQL, Amazon SQS, Amazon SNS, Amazon SES, Amazon Cognito for sign-in, AWS Systems Manager Parameter Store with AWS Key Management Service for secrets, Amazon CloudWatch for logs and alarms, and Amazon ECS on AWS Fargate for database migrations.	United States (us-east-1)
Google LLC (Google Workspace)	Hosts FireFunc’s email (admin@firefunc.com), where requests, security reports and questionnaires arrive.	Google’s data centers

Customer-Directed Services are not on this list: they are provided to you under your own accounts, as Roles explains.

Google Workspace is listed because email sent to admin@firefunc.com can contain personal data. The Service itself sends no Customer Personal Data there.