Data processing agreement
Version 1.2 · Effective October 15, 2026
What this is
You use Hunchwire to collect information about the people who visit your pages and sign up. You decide what to collect and what to do with it; we store and process it for you. This agreement sets out how. It’s part of our terms of service, between Kairic Studio Inc. and you, the account holder, and it applies whenever you have an account.
In the words of Canada’s privacy law (PIPEDA), you’re the organization responsible for the information and you transfer it to us for processing. Where the GDPR or the UK GDPR applies to it, you’re the controller, we’re your processor, and this agreement is the contract those laws require. Where this agreement and the terms differ about this information, this agreement wins.
Our own website, our own tests and your Hunchwire account are covered by our privacy policy instead.
The information
| Topic | Details |
|---|---|
| Whose | People who visit your pages, people who sign up through your forms, and people you invite |
| What | Email addresses, answers to your form’s questions, referral codes, pages viewed, time on page and scroll depth, clicks you track, the referring page and campaign tags, device type, browser, country and city. We don’t store visitors’ IP addresses or full User-Agents. |
| Why | To host your pages, collect sign-ups, show you your analytics and people, let your agents do the same, and send the emails you ask us to send |
| How long | Until you delete it, delete the project, or close your account |
What we promise
- We follow your instructions. Your instructions are what you and the agents you connect do in Hunchwire, and this agreement. We process the information only to run Hunchwire for you, or when the law requires it, and we’ll tell you if we think an instruction breaks the law.
- We don’t sell it, use it for advertising, or combine it with other customers’ information to profile people. We count how Hunchwire is used, without personal information, to run and improve it.
- Only people who need to can reach it, and they’re bound to keep it confidential.
- We keep one shared record so we never email someone who asked us not to. When a person unsubscribes or has their data deleted, we keep a keyed hash of their email, never the address, and Hunchwire won’t email that address from any customer’s project, unless the person signs up to that project again and confirms through the link we send.
Security
- All traffic is encrypted, and web traffic reaches our servers only through Cloudflare. Google Cloud encrypts our disks and backups at rest.
- Each account sees only its own projects, and an automated test checks every request an agent can make against that.
- Agents get only the permissions you approve. They see email addresses only if you allow it, and every change they make, and every time they read email addresses, is logged in Agents.
- Passwords are stored only as one-way hashes, and agent keys only as hashes.
- Our logs hold no email addresses, IP addresses or query strings, and are kept for 30 days. Backups are taken daily and overwritten after 14 days.
Who helps us
These providers process the information for us. Each is bound by contract to protect it and to use it only to serve us.
| Provider | What they do | Where |
|---|---|---|
| Google Cloud | Hosts our servers, database, backups and logs | Toronto, Canada |
| Cloudflare | Carries all traffic to your pages, so it sees visitors’ IP addresses; protects them from attacks, and reports each visitor’s country and city | Worldwide, including the United States |
| Amazon Web Services (Amazon SES) | Sends the emails you send your people through Hunchwire, such as confirmations and invites | United States (Ohio) |
| Google Workspace | Our email, when someone writes to us about your project | Worldwide, including the United States |
Before a new provider starts processing this information, we’ll update this list and email account holders at least 30 days ahead. If you object, tell us; if we can’t resolve it, you can close your account.
Where it’s kept
We store the information in Canada, on our servers in Toronto. The European Commission and the UK recognise Canada’s privacy law as giving adequate protection, so information can come here from the EU and the UK. Amazon SES processes the emails you send through Hunchwire in the United States (Ohio). Cloudflare and Google Workspace may process information in other countries, including the United States, under their data protection terms, which include the EU’s standard contractual clauses.
Helping you with people’s requests
- See and export: each person’s profile shows what we hold about them in a project, and People exports a CSV.
- Delete: deleting a person (on their profile, or through the API) removes their sign-ups, refused sign-ups, and the visits and clicks from their browser in that project. It works one project at a time; if the same person signed up for several of your projects, delete them in each.
- Unsubscribes: when someone uses the unsubscribe link in an email you send through Hunchwire, we delete their data in that project and don’t email them again.
- Requests that come to us: if someone writes to us about information in your project, we’ll tell you. Our privacy policy also lets them ask us directly, so we may delete it from Hunchwire ourselves.
- We’ll give you the information you reasonably need for a privacy impact assessment or a regulator’s questions.
If something goes wrong
If we learn of a breach of security that affects this information, we’ll tell you without undue delay, and within 72 hours of confirming it, with what we know: what happened, what information and how many people it affects, and what we’re doing about it. We’ll help you notify people and regulators where the law requires it.
Checking on us
Write to us with reasonable questions about how we protect this information, and we’ll answer in writing and share what you need to show that we keep this agreement. If a regulator needs to inspect us, we’ll cooperate.
When it ends
When you delete a project, its information is deleted. When you close your account, we delete your projects within 30 days, and send you your people as a CSV first if you ask. Backups age out 14 days after a deletion. We keep the do-not-email record above for as long as we send email.
Changes
When this agreement changes, we’ll update the version and date at the top, and tell account holders of any significant change by email before it applies. Past versions are listed here.
- Version 1.2, effective October 15, 2026: when an address signs up again after a deletion, we email it a confirmation link first, and nothing else until it’s clicked.
- Version 1.1, effective October 12, 2026: our email subprocessor, Amazon SES, processes in the United States (Ohio), not Montreal.
- Version 1, effective October 11, 2026: first version.
Contact
Our Privacy Officer, at privacy@hunchwire.com, or by mail to Kairic Studio Inc., 197 Yonge St, Ste 201 #1010, Toronto, ON M5B 0C4.