U.S. data processing addendum

Version 1.0 · In effect from 15 October 2026

This addendum adds the terms that U.S. state privacy laws require between a business and the company that processes personal information for it. It covers the personal information you process through Hypamoon in your project, where the California Consumer Privacy Act or a comparable state law applies to it.

1. Parties and how it applies

This addendum is between Hypamoon (KvK 42000833) (“we”, “us”) and the customer who holds a Hypamoon account (“you”).

It forms part of our terms of service, in particular article 13 on data and processing, and of the data processing agreement between you and us. It applies automatically to every customer for whom it is relevant; you do not have to sign anything. If you want a signed copy for your records, email hello@hypamoon.com. Where this addendum and those documents differ on customer personal information under a U.S. state privacy law, this addendum prevails.

2. Definitions

“Business”, “service provider”, “contractor”, “controller”, “processor”, “consumer”, “personal information”, “sell”, “share” and “business purpose” have the meaning given in the California Consumer Privacy Act as amended by the CPRA (“CCPA”), or in the comparable state law that applies (together with the CCPA, “U.S. privacy laws”).

“Customer personal information” is the personal information we process on your behalf to provide the service: the data of the people you serve through your project, such as your callers, the visitors and users of your sites and apps, your customers and their orders, as described under Data in your project in our privacy statement.

3. Roles

For customer personal information, you are the business or controller, and we are your service provider or processor. You decide why and how it is processed; we act on your instructions.

4. Business purpose

We process customer personal information only for the limited and specified business purpose of providing the Hypamoon service to you: running your sites, apps, data, numbers, calls, texts, email, chats, payments and orders, as described in the terms and the docs, and as you instruct us through the portal, the API, the MCP server and in writing. That includes keeping the service secure, preventing fraud and misuse, finding and fixing errors, and other uses U.S. privacy laws allow a service provider for these purposes.

We process the types of personal information your project holds, about the people your project serves, for as long as you use the service, and afterwards for the periods in our privacy statement.

5. What we will not do

We will not:

• sell or share customer personal information;
• keep, use or disclose it for any purpose other than the business purpose in article 4, including for any other commercial purpose, or outside the direct business relationship between you and us;
• combine it with personal information we receive from or on behalf of anyone else, or collect ourselves from our own contact with the consumer, except where U.S. privacy laws allow a service provider to do so;
• use it to train AI models.

Everyone at Hypamoon who has access to customer personal information is bound to keep it confidential. If we receive deidentified information from you, we will not try to identify anyone in it.

6. Compliance and notice

We comply with the obligations that U.S. privacy laws place on service providers and processors, and we give customer personal information the same level of privacy protection those laws require of you. If we find that we can no longer meet these obligations, we tell you without undue delay. You can then take reasonable and appropriate steps to stop and remedy any unauthorized use, including stopping the processing.

7. Your right to check

You may take reasonable and appropriate steps to make sure we use customer personal information in line with your obligations under U.S. privacy laws. On request we give you the information you need to show that we comply with this addendum. Once a year, or after a security incident that affects your data, you may have our compliance assessed, by yourself or by an independent auditor bound to confidentiality, with 30 days' notice, during business hours and at your own cost. Instead of an assessment, we may offer you a recent report by an independent auditor, if it covers what you want to check.

8. Subprocessors

We use specialised suppliers for parts of the service, as listed under Suppliers we use in our privacy statement; email us for the list with names and locations. Each of them is bound by a written contract to the same obligations as in this addendum. We tell you by email before we add or replace a supplier that processes customer personal information, and you can object. If we cannot resolve your objection, you can stop using the part of the service involved.

9. Requests from consumers

We help you respond to requests from consumers to know, access, correct or delete their personal information, or to opt out. Much of this you can do yourself in the portal and through the API. If a consumer sends a request to us about customer personal information, we forward it to you and do not answer it ourselves unless you ask us to. When you instruct us to delete or correct customer personal information, we do so, and we pass the instruction on to our suppliers where needed.

10. Security and incidents

We protect customer personal information with appropriate technical and organizational measures, as described under Security in our privacy statement. If a security incident affects customer personal information, we tell you without undue delay, with what we know and what we are doing about it, so you can meet your own obligations.

11. End of the service

When you close your account or a project, we delete customer personal information in line with our retention periods, unless the law requires us to keep it. Before you leave, you can take your data with you through the portal and the API.

12. Certification

We certify that we understand the restrictions in this addendum and will comply with them.

13. Changes and the rest

We may update this addendum, for example when a U.S. privacy law changes. We announce changes that matter for you at least a month in advance by email; changes the law requires may apply sooner. Each version carries a number and a date, and earlier versions stay available. Everything not covered here follows the terms of service.