1. Roles
This Addendum forms part of the Terms of Service. Where you store personal data about third parties — collaborators, customers, people mentioned in your notes — you act as controller and clusterhack acts as processor on your documented instructions.
For your own account data we act as controller, and the Privacy Policy governs it.
2. Subject matter of processing
| Item | Detail |
|---|---|
| Subject matter | Hosting a project knowledge base and making it available to the AI tools you connect |
| Duration | For as long as your account is open, plus the retention windows in the Privacy Policy |
| Nature and purpose | Storage, structuring, retrieval, display, export, transmission to model providers you trigger, backup and deletion |
| Types of personal data | Whatever you choose to put into projects, notes, tasks, ideas and comments, plus collaborator account identifiers |
| Categories of data subject | Your collaborators, and any individual you write about in your workspace |
3. Our obligations
- Process personal data only on your instructions, which the use of the product constitutes, unless the law requires otherwise.
- Keep personnel with access bound to confidentiality.
- Apply the technical and organisational measures described in the security overview.
- Help you respond to data subject requests, and give you export and deletion tools that let you handle most of them yourself.
- Notify you without undue delay after becoming aware of a personal data breach affecting your content, with the information you need to meet your own notification duties.
- Delete or return personal data on termination, subject to backup expiry and legal retention.
- Make available the information needed to demonstrate compliance and allow an audit, no more than once a year unless a regulator requires more, on reasonable notice and at your cost.
4. Your obligations
- Have a lawful basis for the personal data you put into the Service, and give the notices your own users are owed.
- Do not store special-category data without the safeguards it requires.
- Configure sharing, tokens and integrations so that data reaches only the recipients you intend.
- Understand that triggering an AI feature discloses the relevant context to the model provider handling it.
5. Subprocessors
You give general authorisation for us to engage the subprocessors listed on the subprocessors page. We stay responsible for their performance and impose equivalent data protection obligations on them. We will announce a new or replacement subprocessor before it starts processing, and you may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate and receive a pro-rata refund of prepaid fees.
6. International transfers
Where personal data leaves the European Economic Area, the transfer relies on an adequacy decision or on Standard Contractual Clauses agreed with the relevant subprocessor, together with any supplementary measures required at the time.
7. Contact and signature
This Addendum applies automatically to every account that stores third-party personal data; no signature is required. If your organisation needs a countersigned copy, write to legal@nibvine.com with your entity details.
Questions about this document? Write to legal@nibvine.com.