Roles in short
- Who this addendum is for: Business Customers who act as controllers. If you are a Consumer (Terms of Service, section 1.3), this addendum does not apply to you; we process your data, including your Workspace Data, as controller under our Privacy Policy.
- Workspace Data in Portal (configuration, agent cards, grants, settings, skill texts, deployment records, bridge status reports, audit log) and the deploy logs that Portal shows you during a deployment: you are the controller, Polygonface is your processor. This addendum applies.
- Account Data (sign-in, contact, billing, licences, orders): Polygonface is the controller. Our Privacy Policy applies.
- Customer Data in your own infrastructure (app content, tool calls, API keys entered in the bridge page): Polygonface does not store or process it. You choose your own processors, for example Railway.
1. Parties, roles and scope
1.1 This addendum applies only where the Customer is a Business Customer acting as controller. It is between the Customer (controller) and Polygonface s.r.o., Sládkovičova 60, 974 05 Banská Bystrica, Slovakia, company ID (IČO) 50187210 (“Polygonface”, “we”; processor), under Article 28 of Regulation (EU) 2016/679 (GDPR). Terms defined in the Terms of Service have the same meaning here.
1.2 In scope. “Customer Personal Data” means personal data in: (a) Workspace Data, which is all data that Portal stores for an Account or a Workspace, including canvas configuration and drafts, agent cards, grants, scopes and policies, skill texts, Mini App setting values, hook settings, deployment records, bridge status reports (including connection identifiers, client names and short status texts that apps write) and the Workspace audit log; and (b) deploy log lines that Portal reads from the Customer’s hosting provider and shows to the Customer during a deployment or update the Customer started. Portal removes recognisable secrets from each line and does not store the lines.
1.3 Polygonface is controller (out of scope). Account Data, support correspondence, records about the security and abuse of Portal itself, and records we must keep by law. Our Privacy Policy covers them.
1.4 No processing by Polygonface (out of scope). Customer Data in Customer Infrastructure: app content, documents, memories, agent inputs and outputs, tool calls and results, messages, connected third-party accounts, and API keys entered in the bridge page. Portal does not store this data. The Customer chooses its own processors for it (for example Railway, model providers, Composio). They are the Customer’s processors under the Customer’s own contracts, not our sub-processors.
1.5 Actions in the Customer’s hosting account. When the Customer starts an action in Portal (deploy, update, configure, remove, status check), Portal acts in the Customer’s hosting account with the authorisation the Customer gave (Terms, section 3.7). Any personal data that Portal handles while carrying out the action (for example a setting value, or a deploy log line under 1.2(b)) is Customer Personal Data, processed only to carry out and show the action.
2. Details of processing (Article 28(3) GDPR)
| Item | Content |
|---|---|
| Subject matter | Hosting and operating Portal as the control plane for the Customer’s Workspaces |
| Duration | The Term of the Terms of Service, plus the export and deletion periods in section 11 |
| Nature | Storage, structuring, retrieval, display, transmission to the Customer’s bridge and hosting account (signed configuration, setting values), transient display of deploy logs, anonymisation (section 3.4), deletion |
| Purpose | To provide, secure and support Portal for the Customer |
| Categories of data | Name, email and identifier of the Account Owner and of other people the Customer names in Workspace Data; agent names, purposes and identifiers; connection identifiers and client names; scope labels and app status texts; skill texts and setting values the Customer enters; action records (who, what, when) in the audit log; personal data that appears in deploy log lines. The audit log stores no IP addresses |
| Data subjects | The Account Owner; the Customer’s employees, contractors and clients whose names or identifiers the Customer puts in Workspace Data or whose data appears in deploy logs |
| Special categories | Not intended. The Customer must not put special categories of data or data about criminal convictions into Workspace Data, setting values or skill texts |
3. Instructions
3.1 We process Customer Personal Data only on the Customer’s documented instructions: the Terms of Service, this addendum, and the Customer’s use and configuration of Portal. This includes transfers to the sub-processors on the Subprocessors list. Further instructions must be in writing and consistent with the Service. We may charge for instructions that need extra work.
3.2 We tell the Customer immediately if, in our opinion, an instruction infringes data protection law. We may refuse to follow it.
3.3 If EU or member-state law requires other processing, we tell the Customer first, unless that law forbids it.
3.4 Anonymous statistics. The Customer instructs Polygonface to anonymise Customer Personal Data in order to produce statistics that identify no person, for operating and improving the Service. We use no other Customer Personal Data for our own purposes.
3.5 Customer’s duties. The Customer is responsible for the lawfulness of the processing it instructs, for its legal basis, for informing data subjects and for the accuracy of the data it enters.
4. Confidentiality
Only staff and contractors who need access to operate the Service may access Customer Personal Data. They are bound by confidentiality or are under an appropriate statutory duty of confidentiality.
5. Sub-processors
5.1 The Customer gives general authorisation for the sub-processors on the Subprocessors list, which forms part of this addendum.
5.2 We bind each sub-processor by a written contract with the data protection obligations required by Article 28(4) GDPR. We remain fully liable to the Customer for the performance of our sub-processors’ obligations, as Article 28(4) requires.
5.3 We give at least 30 days’ notice by email or in Portal before we add or replace a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may terminate the affected part of the Service, and we refund prepaid fees for any period after termination.
6. Security measures (Article 32 GDPR)
6.1 We take the technical and organisational measures below. We rely on our vendors for the security of their services. We may change measures if the overall level of protection does not fall.
| Area | Measure |
|---|---|
| Data minimisation by design | Portal does not store Customer Data, tool calls or bridge-page API keys. The bridge reports key names and presence flags, never key values. Deploy log lines are redacted and not stored. |
| Transport | HTTPS for all traffic. |
| Secrets | Hosting-account tokens and Portal signing keys are sealed with AES-256-GCM under a key held outside the database. Tokens are deleted on unlink and on Account deletion. |
| Agent access | Short-lived signed grants (agent access tokens 15 minutes; configuration at most 12 hours), verified locally by the bridge and the apps; per-Workspace authorisation. |
| Identity | Sign-in, multi-factor authentication (required for Account Owners), bot protection and sessions through Clerk. Clerk publishes information on its security programme at https://clerk.com/security. |
| Hosting | Railway, EU West region (Amsterdam, Netherlands). Railway publishes information on its security and compliance programme at https://docs.railway.com/maturity/compliance. |
| Backups | Daily snapshots kept 6 days, weekly snapshots kept 27 days, nightly database dumps kept 14 days, with Railway in the same project and region; nightly restore test. |
| Logging | Workspace audit log kept 365 days, then deleted automatically. |
| Error monitoring | Reports carry route, error code, exception type and stack frames only; personal data and IP addresses are removed before storage. |
| Release integrity | Portal deploys only releases recorded in our signed release registry. |
| Staff access | Limited to people who need it to operate the Service. |
6.2 The Customer is responsible for the security of its Account credentials, its bridge, its Customer Infrastructure and its Customer-Supplied Components.
7. Incidents
7.1 Personal data breaches. We notify the Customer without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data.
7.2 The notice describes, as far as known: the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences and the measures taken or proposed. We add information as it becomes available.
7.3 Our notice is not an admission of fault.
7.4 The Customer decides whether to notify authorities and data subjects for Customer Personal Data.
7.5 Incidents affecting Customer Infrastructure. If we become aware that a hosting-account token that Portal holds for the Customer, or our configuration signing keys, were accessed without authorisation, we: (a) tell the Customer without undue delay and in any case within 48 hours; (b) delete or revoke the affected tokens where we can, and rotate the affected keys; and (c) give the Customer the information it needs for its own notifications. This applies whether or not personal data is affected. Liability for such an incident follows section 17.5 of the Terms of Service.
8. Assistance
8.1 Taking into account the nature of the processing and the information available to us, we help the Customer with data subject requests and with its duties under Articles 32 to 36 GDPR, as far as they concern Customer Personal Data.
8.2 If a data subject contacts us about Customer Personal Data, we forward the request to the Customer and do not answer it ourselves, unless the Customer instructs us or the law requires it.
8.3 Requests about Customer Data must be handled by the Customer in its own infrastructure. We have no access to that data.
8.4 We may charge reasonable costs for assistance beyond self-service functions, unless the need results from our breach.
9. Information and audits
9.1 We make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. First, we provide this addendum, a description of our measures, and our vendors’ published security information.
9.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a breach affecting the Customer, we allow for and contribute to audits, including inspections, by the Customer or an independent auditor it mandates who is bound by confidentiality. The Customer gives at least 30 days’ written notice (shorter after a breach or where an authority requires it). Audits take place at most once in 12 months unless an authority requires more, during business hours, without access to other customers’ data or to our vendors’ premises. The Customer bears the cost of the audit, unless the audit shows a material breach by us.
10. International transfers
10.1 Portal is hosted in the EU. Some sub-processors process data outside the European Economic Area. Each transfer relies on an adequacy decision, the EU–US Data Privacy Framework or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), as stated on the Subprocessors list. If the Data Privacy Framework ceases to apply to a sub-processor, the Standard Contractual Clauses apply to it instead.
10.2 The Customer is responsible for transfers it causes through Customer-Supplied Components and its own hosting choices.
11. Export, return and deletion
11.1 Export. During the Term and for 30 days after the Account closes, the Customer may ask for a copy of its Workspace Data in a structured, machine-readable format (JSON). We provide it within 30 days of the request.
11.2 Deletion. After the export period we delete Customer Personal Data within 30 days, unless EU or member-state law requires us to keep it. Audit-log entries are deleted when their 365-day retention ends. Backups expire within 27 days.
11.3 On request we confirm deletion in writing.
11.4 Deleting the Account does not delete anything in Customer Infrastructure. The Customer deletes it there.
12. Liability and precedence
12.1 Liability under this addendum follows section 17 of the Terms of Service, except where Article 82 GDPR or other mandatory law provides otherwise.
12.2 If this addendum conflicts with the Terms of Service on personal data, this addendum prevails.
12.3 If the Service changes so that we would store or otherwise process Customer Data, we update this addendum before that processing starts.
Contact
Polygonface s.r.o., Sládkovičova 60, 974 05 Banská Bystrica, Slovakia, registered in the Commercial Register of the District Court Banská Bystrica, Section Sro, Insert No. 29301/S; company ID (IČO) 50187210, tax ID (DIČ) 2120203151, VAT ID (IČ DPH) SK2120203151.
Data protection questions: support@tealbrick.com. Security incidents: security@tealbrick.com. Tealbrick is a brand of Polygonface s.r.o.