Data processing agreement
Under Article 28 GDPR, for the data you store in your backends as a business. As of 28 September 2026.
The German version governs. This English version is a translation of the German version. This agreement is concluded when a business accepts the terms. No signature is needed. A signed copy is available on request to hello@typestate.com.
between the customer as controller ("client") and Lütfi Demirci, trading as "Typestate", Neckarstr. 21, 12053 Berlin, Germany, as processor ("contractor").
Section 1 Subject and term
(1) The contractor runs the Typestate platform for the client under the terms (the "main contract"). In doing so, the contractor processes personal data that the client stores in its backends or processes through them.
(2) This agreement applies as long as the contractor processes such data, and at least for the term of the main contract.
Section 2 Nature, purpose, data, data subjects
(1) Nature of the processing: storing, running, reading, displaying in the cockpit, transmitting to the client's endpoints, logging and deleting.
(2) Purpose: providing the client's backends, websites and tools under the main contract.
(3) Types of data: the data the client defines in its record types, typically contact data, sign-in data of its users (email address, password hash, sessions), content, order and contract data, payment data under paragraph 6, usage and log data (IP address, time, address requested) and uploaded files. The client stores special categories under Article 9 GDPR only after prior agreement in text form.
(4) Data subjects: users, customers, prospects, employees and contact persons of the client.
(5) Not covered: the client's descriptions and tests. They are sent to language model providers for translation and are not to contain personal data of the client's users (terms, section 8(4)). If they do contain such data, the language model providers in the list under section 6 count as subprocessors for that data.
(6) Payments. If the client uses the payment function, its backend stores orders, subscriptions, payments, refunds and cancellations of its buyers. The buyer enters card and bank details only at the payment provider; they do not reach the contractor. The client chooses the payment provider and concludes its own contract with it. The provider is a recipient the client designates and not a subprocessor of the contractor. The same applies to the provider through which a backend of the client sends email.
Section 3 Instructions
(1) The contractor processes the data only on documented instructions from the client. Instructions are the main contract, this agreement, and the settings the client makes in the cockpit or through its agent, for example retention periods, access rules and the deletion of records. The client gives further instructions in text form.
(2) If the contractor considers an instruction unlawful, the contractor says so without undue delay. The contractor may suspend carrying it out until it is confirmed.
(3) If Union or Member State law requires the contractor to process differently, the contractor says so in advance, unless that law prohibits it.
Section 4 Confidentiality
The contractor uses only persons who are bound to confidentiality or are under a statutory duty of secrecy. Today only the contractor has access.
Section 5 Security of processing
The contractor takes the technical and organisational measures in the annex (Article 32 GDPR). The contractor may adapt them to the state of the art, as long as the level of protection does not fall.
Section 6 Subprocessors
(1) The client authorises the subprocessors named on the subprocessors page.
(2) The contractor informs the client in text form at least 30 days in advance of any intended addition or replacement. Within that period the client can object for an important reason under data protection law. If the parties do not agree, the client can terminate the main contract as of the time of the change.
(3) The contractor imposes on each subprocessor the same data protection obligations as this agreement.
Section 7 Transfers to third countries
A transfer to a third country takes place only under Articles 44 to 49 GDPR. The basis for each subprocessor is in the list under section 6.
Section 8 Assistance to the client
(1) The contractor assists the client with requests from data subjects (Articles 12 to 22 GDPR). The client can read, correct and delete records in the cockpit, through its agent and through its own endpoints. If a request reaches the contractor, the contractor forwards it without undue delay.
(2) The contractor assists with the obligations under Articles 32 to 36 GDPR.
(3) The contractor notifies the client of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information under Article 33(3) GDPR as far as known.
Section 9 Deletion and return
(1) After the main contract ends, the contractor provides the client on request with the records of its backends in a common, machine-readable format, and then deletes all of the client's data within the periods in section 7 of the terms, unless Union or Member State law requires storage.
(2) The contractor confirms the deletion in text form on request.
Section 10 Evidence and audits
(1) The contractor provides the information needed to demonstrate compliance with the obligations under Article 28 GDPR.
(2) The client can carry out audits, or have them carried out by an auditor bound to confidentiality, after giving at least 14 days' notice, during normal business hours and without disturbing operations. For the data centres, the evidence of the subprocessors is enough, for example ISO/IEC 27001 or SOC 2.
Section 11 Liability
Article 82 GDPR applies. Otherwise the liability rule of the main contract applies.
Section 12 Final provisions
In case of conflict, this agreement takes precedence over the main contract in matters of data protection. German law applies. The place of jurisdiction is Berlin, where permitted.
Annex: Technical and organisational measures (Article 32 GDPR)
Confidentiality
- Data centres: Hetzner in Germany and Cloudflare. Evidence through their certificates. The contractor runs no premises of its own with servers.
- Access to the server: only over SSH with a key, only for the contractor.
- Access to the cockpit: email address and password. Passwords are stored only as a salted hash. The session cookie is signed and valid for at most 7 days.
- Access for agents: OAuth with PKCE, or API keys. Keys and tokens are stored only as hashes and can be revoked at any time.
- Access control: every access to an account's data names the account, and membership is checked on every request. The backends enforce the access rules the client sets for each record type.
- Separation: each backend runs as its own script with its own database, separated into Sandbox and Live. No backend can read another's database. The separation is logical; all backends run in one Cloudflare account of the contractor.
- Encryption: transmission only over TLS. Customers' secret values (environment variables, credentials for third-party systems) are stored encrypted with AES-GCM.
- No outside code: the contractor accepts no program code from customers. The generated code is checked before each deployment.
Integrity
- Input control: every change to descriptions, record types and settings is stored as a version. Changes for Live go through an approval. Every action of an agent is logged with its time.
- Transfer control: transmission only encrypted, and to subprocessors only under section 6.
Availability and resilience
- Live backends run at Cloudflare and stay reachable if the server at Hetzner fails.
- The platform's database is backed up every night. Backups are overwritten after at most 30 days.
- Monitoring of servers and logs.
Regular review
- Automated tests before each deployment. A deployment without these checks is recorded on the server.
- The client can set a retention period for each record type, after which its backends delete records.
Organisation
- The contractor is a sole proprietorship. Only the contractor has access to the server, the database and the accounts at the subprocessors.