Data Processing Agreement

Draft 0.2 · 12 October 2026.

1. Parties and scope

This agreement is between the customer that installs Alikely ("Customer", the controller) and Lucas Rehn, sole trader (enskild firma), trading as Alikely, Linköping, Sweden, privacy@alikely.app ("Alikely", the processor).

It applies to personal data that Alikely processes on the Customer's behalf when the Customer's users use Alikely in the Customer's HubSpot account ("Customer Personal Data"). It forms part of the Terms of Service and applies from installation for as long as Alikely processes Customer Personal Data. Personal data for which Alikely is itself the controller (correspondence, the install record, security logs, website visitors) is covered by the Privacy Policy, not by this agreement.

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 ("GDPR").

2. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3. Instructions

3.1 Alikely processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires otherwise; in that case Alikely informs the Customer of that legal requirement before processing, unless the law forbids it.

3.2 The Customer's documented instructions are this agreement, the Terms of Service, and the Customer's use and configuration of Alikely — which objects, fields and filters its users put in profiles, and which record views show the card.

3.3 Alikely informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.

3.4 The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for the data in its HubSpot account, and for not configuring profiles to compare special categories of personal data (Art. 9) or data about criminal offences (Art. 10).

4. Confidentiality

Alikely ensures that every person it authorises to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to run the service. At the date of this agreement that is one person, Lucas Rehn.

5. Security

Alikely implements the technical and organisational measures in Annex 2, which are designed to meet Art. 32. Alikely may change them as technology develops, provided the overall level of security does not decrease.

6. Subprocessors

6.1 The Customer gives general authorisation for Alikely to engage the subprocessors listed in Annex 3.

6.2 Alikely gives at least 30 days' notice before adding or replacing a subprocessor, by updating Annex 3 on this page and by email to the address the Customer used to ask for Alikely. During that period the Customer may object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may stop using the service and uninstall it without penalty before the change takes effect.

6.3 Alikely imposes on each subprocessor, by contract, data protection obligations that offer at least the protection of this agreement, and remains fully liable to the Customer for each subprocessor's performance.

7. Transfers

Alikely processes Customer Personal Data in the EU/EEA. It does not transfer it outside the EU/EEA, or allow a subprocessor to, except in accordance with Chapter V GDPR (an adequacy decision or the Commission's Standard Contractual Clauses) and after notice under section 6.

8. Assistance

8.1 Taking into account the nature of the processing, Alikely assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. Because Alikely keeps no copy of the Customer's records, requests about record data are fulfilled by the Customer in HubSpot. Profiles can be read, changed and deleted by the Customer's users in the profile editor; Alikely helps with anything they cannot do there.

8.2 Alikely assists the Customer in meeting its obligations under Art. 32–36 (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available to it.

8.3 Alikely forwards to the Customer without undue delay any request from a data subject about Customer Personal Data that it receives, and does not answer it itself unless the Customer asks.

9. Personal data breaches

9.1 Alikely notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available is provided as it becomes available.

10. Deletion and return

10.1 When Alikely is uninstalled, Alikely deletes the stored access token within 24 hours after it detects the uninstall, in practice within minutes, and deletes the Customer's profiles and each user's last chosen profile within 31 days after the uninstall. Reinstalling within 30 days restores them. On request to support@alikely.app after the uninstall, Alikely deletes them at once, together with the install record.

10.2 While Alikely is installed, a user's personal profiles and last chosen profile are deleted at the first daily check after that user has not been an active user of the Customer's HubSpot account for 30 days in a row, and only when HubSpot's answer about active users is complete.

10.3 Records are never stored, so there is nothing further to return. On request to support@alikely.app, while Alikely is installed or within the 30 days after an uninstall, Alikely provides the Customer's profiles in a machine-readable format (JSON) within 30 days of the request, as a read-only link that expires after 7 days; the file is deleted after 7 days.

10.4 Copies in database backups — the database server's point-in-time backups and Alikely's own nightly copy — are kept for at most 35 days and then deleted. They are not restored except to recover the service.

10.5 The install record (HubSpot account ID and dates) is Alikely's own record as controller (Privacy Policy §6), not Customer Personal Data under this agreement. The installer's user ID in it is cleared when the profiles are deleted after an uninstall.

11. Audit

Alikely makes available to the Customer all information necessary to demonstrate compliance with Art. 28, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates. An audit is first satisfied by documentation: written answers to a security questionnaire and a description of the measures in place (Annex 2). Where that is reasonably shown not to be enough, an inspection may take place on at least 30 days' written notice, no more than once a year unless a breach or a supervisory authority requires otherwise, during normal business hours, without disrupting the service and subject to confidentiality, at the Customer's own cost.

12. Liability

Each party's liability under this agreement follows the Terms of Service (§12), except that nothing limits either party's liability towards data subjects under Art. 82 GDPR or for fines imposed on that party by a supervisory authority.

13. Term and precedence

This agreement lasts as long as Alikely processes Customer Personal Data, including the 30 days after an uninstall. Where it conflicts with the Terms of Service on the processing of personal data, this agreement prevails. It is governed by Swedish law, with the forum stated in the Terms of Service.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

Data minimisation by design

• Records are read per request and never written to the database, a cache or a log. The database has no table for record values or similarity results.
• Only the fields a profile names are read from the viewed record, and only each match's name and compared fields are returned (a whitelist).
• Read-only HubSpot permissions; the app has no write permission.

Encryption

• HubSpot refresh tokens are encrypted at rest with AES-256-GCM, bound to their HubSpot account; access tokens live only in memory, for at most 30 minutes.
• Keys and secrets are held in Azure Key Vault (role-based access, soft delete and purge protection); the application reads them with its managed identity, and nothing secret is in its configuration.
• TLS for all traffic: HTTPS to the application, TLS with certificate verification to the database, HTTPS to HubSpot.

Separation of customers

• Row-level security in PostgreSQL, enforced on every table that holds a customer's data, keyed on the HubSpot account of the verified request. The application checks at start-up that its database role cannot bypass it, and does not take traffic otherwise.
• Every request from the card is signed by HubSpot and verified; the HubSpot account and user come only from the verified signature. The profile editor receives a single-use launch token valid for 60 seconds, exchanged for a session of at most 30 minutes; no cookies.
• Personal profiles are not visible to other users; who may change shared profiles is decided on the server.

Shared infrastructure

• The application runs in a Microsoft Azure Container Apps environment, and its database on an Azure Database for PostgreSQL server, that are shared with another service operated by the same person (Rehnable). Alikely has its own database, its own database role, its own Key Vault, its own container registry and its own application; Alikely's database accepts connections only from its own role and the server administrator. The application's logs go to a Log Analytics workspace shared with that service.

Least privilege and access

• One person operates production. The application's identity holds exactly two roles (pull its image; read its secrets). The backup job's identity holds three: pull its image, read the database address from Key Vault, and write to its own backup container only. The database role is not a superuser and cannot bypass row-level security.
• Deployments are built only from a committed, clean version of the code, and each image is immutable once pushed.

Logging

• Logs record method, path, status, timing, request ID, HubSpot account ID and error details. Request headers, query strings, tokens, IP addresses, names and record values are not logged (structured logging with redaction, covered by tests). Logs are kept in Sweden Central for 30 days, with no archive.

Deletion

• Access token wiped when the uninstall is detected (HubSpot's uninstall event, checked every minute, or a refused token refresh).
• Profiles and last chosen profiles deleted within 31 days after an uninstall by a daily job, and the installer's user ID cleared; on request, at once after the uninstall.
• A user's personal profiles and last chosen profile deleted after 30 days in a row of not being an active user, by a daily job that acts only on a complete answer from HubSpot.
• Expired one-time tokens pruned daily.

Backups

• The database server keeps point-in-time backups for 35 days.
• Alikely's own database is also copied every night to a storage account of its own (Sweden Central, zone-redundant, encrypted at rest, no anonymous access, no account keys, TLS 1.2). A lifecycle rule deletes each copy after 35 days. A restore has been tested.

Resilience and testing

• Hosted on Azure Container Apps with health checks, with at least one instance always running; alerts on errors and outages go by email to the operator.
• Automated tests cover tenant separation, log redaction and the uninstall and purge paths.

What we do not have

• No ISO 27001 or SOC 2 attestation.

Annex 3 — Subprocessors

HubSpot, Inc. and its affiliates are not subprocessors: HubSpot is the Customer's own provider, and Alikely reaches the Customer's account with the authorisation the Customer grants.