1. Parties and scope
This DPA is between the customer organization that uses Boardmate (the "Customer", the controller) and Hardyson (Jesper Hardyson, sole proprietorship), Sweden ("Hardyson", the processor). It applies to personal data that Hardyson processes on the Customer's behalf to provide Boardmate (the "Customer Personal Data"), and implements Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Terms such as controller, processor, personal data, processing and personal data breach have the meanings given in the GDPR. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data.
A countersigned copy is available on request at support@hardyson.se.
2. Details of the processing
| Subject matter | Providing Boardmate, an AI-assisted extension for Azure DevOps Services, and its hosted backend. |
|---|---|
| Duration | For as long as the Customer uses Boardmate, and until the Customer Personal Data is deleted as described in section 10. |
| Nature and purpose | Reading Azure DevOps content with the user's own token to answer requests; sending the content needed to the Customer's chosen AI provider; writing changes to Azure DevOps that a user has approved; keeping settings, usage statistics, rate limits and the license state. |
| Data subjects | The Customer's Azure DevOps users, and people named or referred to in the Customer's work items, wiki pages, code and pull requests. |
| Categories of personal data | Content processed transiently and never stored (work items, comments, history, wiki pages, code, pull requests, names, identities and email addresses that appear in them); stored pseudonymized user ids (HMAC) in usage statistics and rate-limit counters; the pseudonym of the administrator who saved the AI provider settings. |
| Special categories | None intended. The Customer should not place special categories of personal data in content it asks Boardmate to process. |
| Retention | As stated in the Privacy Policy: content is not stored; usage statistics 183 days; rate-limit counters 2 days; runtime logs 1 hour; settings and license state until deletion. |
3. Instructions
Hardyson processes Customer Personal Data only on the Customer's documented instructions, which are these terms, the Customer's configuration of Boardmate and the actions its users take in it, unless required to do otherwise by EU or Member State law; in that case Hardyson informs the Customer before processing unless the law prohibits it. Hardyson informs the Customer if it believes an instruction infringes the GDPR.
4. Confidentiality
Hardyson ensures that every person authorized to process Customer Personal Data is bound by confidentiality. Access is limited to what is needed to operate and support the Service.
5. Security measures
Hardyson implements appropriate technical and organizational measures (GDPR Article 32), including:
- Encryption in transit (HTTPS) and at rest; AI provider keys encrypted with AES-256-GCM with additional data bound to the organization, provider and address.
- Isolation of every organization's data and caches by its verified organization id.
- Every Azure DevOps call made with the signed-in user's own token, through a fixed, server-defined list of allowed operations; destructive bulk operations are excluded; changes require the user's approval.
- No storage of Azure DevOps content, prompts, AI answers or tokens; pseudonymized user ids only.
- Logs restricted to metadata, with no content, tokens, keys, user ids or organization names.
- Protection against server-side request forgery for calls to AI providers; rate limits per organization and per user.
- Secrets kept only as encrypted environment variables; access to production limited to the owner.
6. Subprocessors
The Customer gives general authorization for Hardyson to use the following subprocessors:
| Subprocessor | Service | Location |
|---|---|---|
| Vercel Inc. | Backend hosting (serverless functions), edge network, logs | Frankfurt, Germany (fra1); global edge network for transit |
| Neon Inc. | Managed Postgres database and backups | Frankfurt, Germany (eu-central-1) |
Hardyson imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors. Hardyson gives at least 30 days' notice of a new or replaced subprocessor on this page; the Customer may object on reasonable data protection grounds within that period, and if no solution is found the Customer may terminate the affected subscription and receive a refund of prepaid fees for the remaining period.
Not subprocessors: the AI provider the Customer connects (the Customer's own processor under its own contract), Microsoft as the provider of Azure DevOps (the Customer's own platform), and Paddle, which acts as an independent controller for purchases.
7. International transfers
Customer Personal Data is processed and stored in the EU. Where a subprocessor could access it from outside the EU/EEA, the transfer is covered by the subprocessor's data processing agreement and the European Commission's Standard Contractual Clauses or another transfer mechanism under Chapter V of the GDPR.
8. Assistance and data subject requests
Taking into account the nature of the processing, Hardyson assists the Customer with responding to data subject requests, with security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36). If Hardyson receives a request directly from a data subject about Customer Personal Data, it refers the request to the Customer.
9. Personal data breaches
Hardyson notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes the nature of the breach, the likely consequences, the measures taken or proposed and a contact point, as far as the information is available.
10. Deletion and return
Content is never stored, so there is no content to return. On the Customer's request, or after the Customer stops using Boardmate and asks for it, Hardyson deletes all stored data about the Customer's organization within 30 days, unless EU or Member State law requires retention. Administrators can export usage statistics as CSV before deletion. Data in database backups and logs expires with their retention periods.
11. Information and audits
Hardyson makes available the information needed to demonstrate compliance with this DPA, including this page, the Privacy Policy and written answers to reasonable security questionnaires. Where that is not sufficient, the Customer may conduct an audit, at its own cost, with at least 30 days' notice, during business hours, no more than once a year (unless required by a supervisory authority or after a breach), and subject to confidentiality.
12. Liability and governing law
Each party's liability under this DPA is subject to the limitations in the Terms of Service, to the extent the GDPR allows. This DPA is governed by the laws of Sweden.
13. Contact
Data protection questions: support@hardyson.se, Hardyson (Jesper Hardyson, sole proprietorship), Sweden.