Effective October 23, 2026.
1. Parties and scope
This Data Processing Agreement ("DPA") is part of the Terms of Service between Underscore LLC ("Processor", "we") and the organization that owns a Hasarak workspace ("Customer"). It applies when we process personal data on the Customer's behalf in providing the Service, and is meant to meet Article 28 of the GDPR and the UK GDPR. If this DPA and the Terms conflict, this DPA wins for personal data.
2. Details of the processing
| Subject matter | Hosting and operating the Customer's Hasarak workspace. |
|---|---|
| Duration | For as long as the Customer uses the Service, plus the deletion period in section 9. |
| Nature and purpose | Storing, transmitting and displaying workspace content; authenticating members; delivering events to connectors and MCP clients the Customer enabled. |
| Data subjects | The Customer's workspace members and anyone mentioned in workspace content. |
| Categories of data | Names, email addresses, handles, titles, roles; messages, pages, reactions, uploaded files and other content members create; session and sign-in records; push tokens of members' mobile devices. The Customer should not put special categories of data in the workspace unless it has a lawful basis. |
3. Customer instructions
We process personal data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's use and configuration of the Service (for example installing a connector). We will tell the Customer if we believe an instruction breaks data protection law.
4. Confidentiality
Everyone we authorize to process the data is bound by confidentiality.
5. Security
We keep appropriate technical and organizational measures in place, including:
- TLS for all traffic to the web app, the marketing site and the API;
- passwords stored only as salted PBKDF2-SHA256 hashes, and session, invite and OAuth tokens only as SHA-256 hashes;
- sessions that expire after 30 days, OAuth access tokens that expire after an hour, and throttling of failed sign-ins;
- uploaded files kept in a private bucket and served only through the API after checking who may see them;
- backups encrypted before they leave the server;
- role-based access inside each workspace, and connector permissions the Customer's admins grant and can revoke;
- access to production limited to the people who operate it.
6. Subprocessors
The Customer authorizes the subprocessors below. We will give at least 30 days' notice of a new one on this page; the Customer may object on reasonable data protection grounds, and if we cannot address the objection it may end the affected part of the Service. We impose data protection terms on each subprocessor that are at least as protective as this DPA and remain responsible for them.
| Subprocessor | Purpose | Location |
|---|---|---|
| OVHcloud | Server that runs the Service and stores its data | United Kingdom |
| PostHog, Inc. | Product analytics (ids, counts and usage events; no workspace content) | EU |
| Cloudflare, Inc. (R2) | Stores encrypted backups of the Service's data | EU |
| Cloudflare, Inc. | Sends transactional email (invites, password resets): recipient address and message | United States |
| Apple (Apple Push Notification service) | Delivers push notifications to members' iOS devices, only for members who turn them on | United States, and other countries where Apple and Google operate, under their terms |
| Google (Firebase Cloud Messaging) | Delivers push notifications to members' Android devices, only for members who turn them on | United States, and other countries where Apple and Google operate, under their terms |
Services the Customer connects (such as GitHub, Linear, or an MCP client) act on the Customer's instructions under their own terms and are not our subprocessors. Polar, which handles payment for paid plans, processes billing data as an independent controller.
7. International transfers
Where personal data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) apply and are incorporated by reference.
8. Assistance, breaches and audits
- We will help the Customer answer data subject requests, taking into account that the Customer's admins can manage much of the data themselves. Requests we receive directly are passed on to the Customer.
- We will notify the Customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations.
- We will provide the information reasonably needed to show compliance with this DPA, and allow audits by the Customer or an auditor it mandates on 30 days' notice, at most once a year unless a breach or a regulator requires more.
- We will help with data protection impact assessments and consultations with authorities where they concern the Service.
9. Deletion and return
Before the Customer stops using the Service, its workspace admins can download an export of its workspace data (channels, direct messages, threads and pages) from Settings › General, or the Customer can ask for one by writing to support@underscore.am. We delete the Customer's personal data within 30 days after the end of the Service, unless the law requires us to keep it. Copies in our encrypted backups are deleted as those backups expire, at most 30 days later.
10. Contact
Data protection questions: support@underscore.am (Underscore LLC).