Data Processing Agreement
Annex to the HumanKey Terms of Service · Version 2026-10 · Governing law: Poland
How this agreement is concluded. This Data Processing Agreement is an annex to the Terms of Service on every plan. It is concluded electronically when the account holder accepts the version of the Terms that contains it; we record who accepted it, when and which version. A copy of the same text signed by us is available on request through the contact form.
§Article 1 — Parties and Definitions
1.1 Controller
The customer that holds the HumanKey account and has accepted the Terms of Service that contain this DPA (for a team, the account owner). Notices: the e-mail address of that account. (hereinafter “Controller” or “you”)
1.2 Processor
Robert Pałka ChainGuard, Zawiercie, Poland · Tax ID (NIP) 6492230699 · contact@humankey.io. HumanKey is the name of the service. Notices: contact@humankey.io. Service: HumanKey (AI Traffic Intelligence): detection and classification of AI crawlers and other automated visitors, and traffic analytics. Website: humankey.io. Primary storage: EU (Germany, Netherlands); transfers outside the EEA: see 5.4. (hereinafter “Processor”; where this DPA refers to HumanKey as a party, it means the Processor)
1.3 Definitions
Terms used in this DPA have the meanings set out in the GDPR (EU) 2016/679: "personal data", "processing", "data subject", "supervisory authority", "controller", "processor", "sub-processor". “Service” means HumanKey as described in the Terms of Service. “Terms” means the HumanKey Terms of Service, of which this DPA is an annex.
§Article 2 — Subject Matter and Duration
2.1 Subject Matter
The Processor processes personal data on behalf of the Controller to provide the Service as described in the Terms.
Scope. This DPA covers personal data processed through the Service on the Controller's behalf: data of visitors to the Controller's websites, reports and alerts derived from it, and the data described in the next paragraph. Data about the Controller's own users of the Service, including persons invited to a team, and billing data are not covered; they are described in the Privacy Policy.
Public pages and data provided for analysis. Also processed: the content of public web pages and files at the Controller's domains or at addresses the Controller submits, fetched when the dashboard or a check needs it, and used to compute the result. The content itself is not kept; for a checked llms.txt file, its address and a fingerprint of its content are recorded in the account's activity log, which is deleted together with the account; computed results are normally cached for about a day. For features that use an AI model, the content (for example the text of a robots.txt file) is passed to the AI sub-processor listed under 5.4. Data the Controller enters into the Service to generate a draft or a check (for example the fields of a structured-data generator) is processed only to produce that result and is not stored.
2.2 Duration
This DPA applies from the moment the Controller accepts the version of the Terms that contains it until the Controller's account is deleted and the deletion described in 5.7 has taken place.
§Article 3 — Nature and Purpose of Processing
| Nature | Collection, storage, classification, analysis, and deletion of visitor traffic data from the Controller's website(s). Processing is automated. |
| Purpose | Detecting and classifying AI crawlers and bots visiting the Controller's website, including keeping the list of known crawlers up to date (User-Agent strings recorded for the Controller's website are read to find and check crawlers and other automated visitors that are not yet on that list; the list is the same for all HumanKey customers, and an entry holds the crawler's name, its operator, its purpose and a pattern that recognises its User-Agent — not visit records); generating analytics reports; computing statistics across all customers' websites that do not name the Controller's website or any visitor (Terms, Section 10); using the User-Agent strings of visits classified as automated, from all customers' websites, to recognise crawlers for the shared list of known crawlers, which does not name the Controller's website (Terms, Section 10); checks of public pages and files and the drafts described in 2.1; geographic traffic analysis via GEO Analytics; providing bot blocking API responses; traffic verification labeling (admin classification override of borderline ML predictions stored with a hashed admin ID, and automated ground-truth bot-classification labels from internal signals stored with a hashed IP address — informational only); maintaining timestamped records for the Controller's compliance and legal purposes. |
| Legal basis | The Controller determines the legal basis for the processing (Article 6 GDPR). The Processor processes the data only on the Controller's documented instructions (5.1). |
§Article 4 — Types of Personal Data and Categories of Data Subjects
4.1 Types of Personal Data Processed
| Data Field | Format Stored | Retention |
|---|---|---|
| IP Address | Cryptographic hash with rotating salt — pseudonymized | Per plan (7–365 days) |
| HTTP User-Agent | Truncated to 200 characters | Per plan (7–365 days) |
| Page URL | Full URL path (no query parameters containing PII) | Per plan (7–365 days) |
| HTTP Referrer | Domain and path only | Per plan (7–365 days) |
| Timestamp | UTC datetime of request | Per plan (7–365 days) |
| GEO Location Data | Country code derived from the IP address with a third-party IP-location database (local lookup; no data sent to the database provider) | Per plan (7–365 days) |
| Bot classification result | Boolean flag + bot identifier (non-personal) | Per plan (7–365 days) |
| Network metadata | Network operator (ASN organisation) and a hosting-network flag derived from the IP address | Per plan (7–365 days) |
| Session identifier and visit duration | Identifier generated in the browser for the visit; duration in seconds | Per plan (7–365 days) |
| Interaction metrics | Aggregate measures of pointer movement, typing rhythm and scrolling, click coordinates and clicked element type, linked to the visit | Per plan (7–365 days) |
| Heatmap data (where active) | Click and scroll coordinates, movement samples, viewport dimensions, linked to the visit | Per plan (7–365 days) |
| Content of public pages and files (2.1) | Not stored; for a checked llms.txt file, its address and a fingerprint in the activity log | Activity log: deleted together with the account; computed results: normally about a day |
| Data the Controller enters to generate a draft or a check (2.1) | Processed only to produce that result | Not stored |
Retention periods by plan: Free = 7 days, Pro = 30 days, Business = 90 days, Enterprise = 365 days. Automated deletion runs daily at 03:00 UTC.
4.2 Categories of Data Subjects
Visitors (human or automated) to the Controller's website(s) registered with HumanKey. The data subjects are not identified by name or contact details; they are represented only by the pseudonymized data fields listed above. Also: persons whose personal data may appear in the public pages or files checked under 2.1.
Verified Badge embed surface (additional category): Where the Controller has elected to embed the public HumanKey Verified Badge on their site(s), visitors of those sites who load the badge image are an additional category of data subjects: the HTTP request for the image carries their IP address and User-Agent and, optionally, a Referer header, and is processed by HumanKey to deliver the image and to protect the service, including rate limiting. This processing surface is described in HumanKey's DPIA summary at /legal/dpia §6.2 under Art. 6(1)(f) GDPR legitimate-interest basis; for clarity, this distinct surface does not change the Processor obligations of this DPA for primary detection and analytics data.
§Article 5 — Processor Obligations (Art. 28(3) GDPR)
The Processor agrees to all of the following obligations:
5.1 Process only on documented instructions
The Processor processes personal data only on documented instructions from the Controller. The Controller's documented instructions are the Terms, this DPA and the settings the Controller makes in the Service; they include transfers to the sub-processors listed under 5.4 on the transfer basis shown for each. If the Processor is required by EU or Member State law to process data beyond the Controller's instructions, it informs the Controller before processing, unless that law prohibits it. The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.
5.2 Confidentiality
The Processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.3 Security measures
The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR). Current measures include:
- Encryption in transit; the primary database is encrypted at rest by its hosting provider
- IP pseudonymization: cryptographic hash with rotating salt
- Cryptographic access controls for API authentication
- Short-lived access tokens with automatic rotation
- Abuse prevention measures enforced in production
- Automated retention enforcement: daily automated process
- Error monitoring: PII stripping configured
- Access restrictions and audit trail for administrative functions
5.4 Sub-processors
The Controller gives general written authorisation for the sub-processors listed in the table below, which is the “Sub-processors of Controller data” table of the register at humankey.io/legal/sub-processors. The Processor engages sub-processors only under the conditions of Article 28(2) and (4) GDPR. Before adding or replacing a sub-processor in that table, it informs the Controller in advance, by e-mail to the account address and on the register page, giving the Controller the opportunity to object; if the Controller objects and the change goes ahead, the Controller may cancel the subscription and end the contract by deleting the account. Corrections of a description in the register that add or replace no sub-processor are published on the register page with its date and do not change this DPA.
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Railway Corp. | Application compute and request routing for the HumanKey API. | 🇳🇱 EU (Netherlands — Amsterdam region) | EU data residency (Netherlands) for production workload; Standard Contractual Clauses 2021/914 cover control-plane access from US. |
| Databricks, Inc. (parent company of Neon, LLC) | Managed PostgreSQL hosting for account data, site configuration, and analytics aggregates. | 🇩🇪 EU (Germany — Frankfurt) | EU data residency (AWS Frankfurt) for production database; Standard Contractual Clauses 2021/914 cover control-plane access from US. |
| Vercel Inc. | Frontend hosting, edge routing, and CDN delivery for humankey.io. | 🇩🇪 EU (Germany) + 🌐 global edge (SCCs) | Standard Contractual Clauses 2021/914. |
| Cloudflare, Inc. | Network security and content delivery for the HumanKey website and service; forwarding of e-mail sent to HumanKey addresses. | 🌐 Global edge network (SCCs) | Standard Contractual Clauses 2021/914. |
| Resend, Inc. | Transactional and service email delivery on HumanKey's behalf. Categories include: account and authentication messages (address verification and e-mail-address change confirmation, magic-link sign-in, password reset and password-change notices); account, team and site administration (team invitations, domain-claim notices, site disable and deletion notices); billing and subscription notices (receipts, invoices, payment and refund outcomes, plan, quota and downgrade notices); onboarding and installation instructions, including messages sent at the account holder's request to a technical contact whose address the account holder supplies; periodic reports and alerts derived from the customer's own site analytics (AI-crawler and bot digests, new-crawler alerts); and support responses. HumanKey composes every message; Resend transmits it. Resend does not receive inbound mail for HumanKey: contact-form submissions are written directly to HumanKey's own database (Neon, EU), and e-mail sent to humankey.io addresses is routed by Cloudflare (see the Cloudflare entry). These are categories of message, not an exhaustive list. | 🇺🇸 US (SCCs) | Standard Contractual Clauses 2021/914. |
| Functional Software, Inc. d/b/a Sentry | Application-error monitoring and diagnostic capture for the HumanKey API and dashboard. | 🇩🇪 EU (Germany — Sentry EU region) | EU data residency (Sentry EU region, Frankfurt); no international transfer occurs. Standard Contractual Clauses 2021/914 cover control-plane access from US. |
| Anthropic, PBC | Large-language-model inference powering: (a) the public AI Assistant chatbot, (b) automated audit summarisation, (c) admin-only AI Insights advisory analytics and automated bot research, (d) customer-facing advisory features (traffic insights, crawler recommendations, the daily-report sentence) and (e) where the customer uses them on a plan that includes them, optional texts drafted with an AI model for the customer's own website (for example page descriptions, answers to frequent questions or a summary for an llms.txt file), shown as drafts for the customer to review before use. All outputs are advice or drafts; the customer decides what to publish; no automated decision under GDPR Art. 22. | 🇺🇸 US (SCCs; 30-day retention, no model training) | Standard Contractual Clauses 2021/914. |
Primary storage is in the EU. For each sub-processor outside the EEA, the transfer basis is shown in its row. The register also lists recipients that are not our sub-processors and sources we only download data from.
5.5 Assist the Controller with data subject rights
The Processor shall assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) to the extent technically possible. HumanKey provides automated data export and deletion endpoints accessible via the dashboard and API.
Deletion of the Controller's data when the account is deleted is described in 5.7. Requests concerning data of the Controller's own users of the Service, including persons invited to a team, are handled under the Privacy Policy.
5.6 Assist with security obligations
The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to the Processor. The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning the Controller's data (Article 33(2) GDPR). A DPIA summary is published at /legal/dpia.
5.7 Deletion or return upon termination
When the Service ends for the Controller, the Processor, at the Controller's choice, deletes or returns all personal data and deletes existing copies, unless EU or Member State law requires storage. The Controller can download its account, site and traffic data in JSON from the dashboard at any time before deleting the account. When the account is deleted, the personal data processed under this DPA is deleted from the Service in the same operation; copies in backups expire on the database provider's backup cycle, and copies held by the sub-processors listed under 5.4 (for example e-mails sent or inputs to the AI model) are kept by them under the retention shown for each in the register.
5.8 Provide information and enable audits
The Processor shall make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and shall allow for and contribute to audits conducted by the Controller or a mandated auditor, with reasonable notice (minimum 30 days) and during normal business hours. Audit costs are borne by the Controller.
§Article 6 — Controller Obligations
The Controller agrees to:
- Provide lawful instructions for processing and update them as needed
- Ensure a valid legal basis exists for the processing (Art. 6 GDPR)
- Fulfill obligations toward data subjects (privacy notice, DSR handling)
- Notify HumanKey promptly of any changes to instructions
- Maintain the confidentiality of API keys and access credentials
§Article 7 — Liability and Indemnification
Each party shall be liable for damages caused by its own breach of this DPA and the GDPR. The Processor shall not be liable for processing performed in accordance with documented Controller instructions. Liability is subject to the limitations set forth in the HumanKey Terms of Service.
§Article 8 — Governing Law and Jurisdiction
This DPA is governed by Polish law. Disputes are resolved by the court named in Section 17 of the Terms. The competence of supervisory authorities follows from the GDPR.
§Article 9 — Version and Changes
This DPA carries the version of the Terms it is annexed to and changes only with a new version of the Terms, which applies to the Controller's account only from its acceptance (Terms, Section 18). Updates of the register under 5.4 are not changes of this DPA.
This DPA is an annex to the HumanKey Terms of Service and has the same version (2026-10). Last updated: October 2026.