Data Processing Agreement (DPA)
Last Updated: November 3, 2025
This DPA has two parts:
- The Key Terms outlined below
- The Common Paper DPA Standard Terms Version 1.0 posted at commonpaper.com/standards/data-processing-agreement/1.0 ("DPA Standard Terms"), which is incorporated by reference
If there is any inconsistency between the Key Terms and the DPA Standard Terms, the Key Terms will control. Capitalized and highlighted terms have the meanings given here. If omitted, the default meaning will be "none" or "not applicable," and the correlating clause, sentence, or section will not apply to this Agreement.
Agreement Information
Agreement Reference
Reference to sales contract will be set when sending agreement
Provider Security Contact
Security Policy
As defined in the Agreement
Approved Subprocessors
| Name | Country | Processing Task |
|---|---|---|
| Amazon Web Services (AWS) | United States of America | VMs, Cron job processing, and storage |
| Supabase | United States of America | Postgres database, authentication and blob storage |
Annex I(A): List of Parties
Data Exporter
- Name: the Customer signing this DPA
- Activities relevant to transfer: See Annex 1(B)
- Role: Controller
Data Importer
- Name: the Provider signing this DPA
- Contact person: Jay Ram, CEO
- Address: 2261 Market Street STE 86509, San Francisco, California 94114, USA
- Activities relevant to transfer: See Annex 1(B)
- Role: Processor
Annex I(B): Description of Transfer and Processing Activities
Service
HUD provides an AI agent evaluation platform that enables customers to test, analyze, and improve their AI agents through comprehensive evaluation metrics and insights.
Processing Activities
- Receiving Data: Collection, access, retrieval, recording, and entry
- Holding Data: Storage, organization, and structuring
- Using Data: Analysis, consultation, testing, automated decision-making
- Updating Data: Corrections, adaptation, alignment, and combination
- Protecting Data: Restricting, encrypting, and security testing
- Sharing Data: Disclosure, dissemination, or granting access
- Returning Data: Delivery back to the data exporter or subject
- Erasing Data: Destruction and deletion
Duration of Processing
Provider will process Customer Personal Data as long as required to:
- Perform processing activities as instructed
- Comply with Applicable Data Protection Laws
Categories of Data and Subjects
| Categories of Data Subjects | Categories of Personal Data |
|---|---|
| Customer's end users or customers | Contact information such as email, phone number, or address |
| Customer's employees | User activity and analysis such as device information or IP address |
Special Category Data: No special category data (as defined in GDPR Article 9) will be processed.
Frequency of Transfer: Continuous
Service Provider Relationship
Under the California Consumer Privacy Act (CCPA), HUD is a service provider receiving Personal Data from the Customer solely to provide the agreed-upon Service. HUD:
- Will not sell or share any Customer-provided Personal Data
- Will not retain, use, or disclose Customer-provided Personal Data except as required to deliver the Service or comply with Applicable Data Protection Laws
- Certifies understanding and compliance with CCPA restrictions
- Will notify Customer promptly if it can no longer meet its obligations under CCPA
Contact Information
Human Union Data, Inc.Attn: Data Protection Officer
2261 Market Street STE 86509
San Francisco, CA 94114
privacy@hud.ai
(785) 383-1887
Data Processing Agreement (Version 1.0). Free to use under CC BY 4.0.