Data processing agreement: Attachment Exporter

Version 1.0, 12 November 2026.

This data processing agreement (DPA) is part of the terms of service for Attachment Exporter (the App) and applies when the App processes personal data on behalf of a customer. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. It takes effect when the customer installs the App; no signature is needed. A countersigned copy is available on request from support@kayabyte.dev.

1. Parties and roles

• Controller: the customer that installs the App in its HubSpot account (you).
• Processor: Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we).

2. Subject, duration, nature and purpose

• Subject: providing the App’s functions: scanning records for attached files, copying those files from your HubSpot account into zip files, writing a manifest and an audit of them, and letting you download the result.
• Duration: while the App is installed, plus the deletion periods in section 8.
• Nature: collection through HubSpot’s APIs, temporary storage of files, manifests and job data, and delivery to you by a signed download link and, if enabled, an email.
• Purpose: only to provide the App to you, to apply your credits and to give support.

3. Personal data and data subjects

• Data subjects: users of your HubSpot account (installing user, admins), and the people whose records and files are in your HubSpot account (contacts, customers, tickets’ requesters, employees named in files).
• Personal data: the installing user’s HubSpot user ID and email address and the email address of the person who starts an export; the names, email addresses and IDs of the records you export; the names, sizes and types of files; the content of the files you export, which can contain any kind of personal data, including special categories, depending on what is attached in your HubSpot account.
• The App does not read the text of notes, emails, calls or meetings, only the IDs of their attachments and their dates. Audit mode works from file names and types and does not read file contents.

4. Our obligations

We will:

1. process personal data only on your documented instructions, which are these terms and your use of the App, unless the law requires otherwise, in which case we tell you first unless the law forbids it;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. take the security measures described on the security page and in section 5;
4. use sub-processors only as described in section 6;
5. help you, as far as possible and considering the nature of the processing, to answer requests from data subjects exercising their rights;
6. help you meet your obligations on security, breach notification, impact assessments and prior consultation, considering the information available to us;
7. delete the data at the end of the service as described in section 8;
8. make available the information needed to show compliance with Article 28, and allow and contribute to audits by you or an auditor you appoint, with reasonable notice, at most once a year unless there has been a breach.

5. Security

Measures include: encryption in transit (TLS) for all connections; OAuth tokens encrypted at rest with AES-256-GCM and bound to your account ID; verification of HubSpot’s request signature on every request from the App’s settings page and card; strict separation of data by HubSpot account ID; zips and manifests in a private storage bucket with signed, expiring download links tied to your account and the export; read-only access to your HubSpot account; logs without file contents, file names or record names; only app admins can scan, export and buy; access to the hosting account limited to Kayabyte.

6. Sub-processors

You give general authorisation to the sub-processors listed on the sub-processors page: Cloudflare, Resend and Stripe. We tell you about new sub-processors by updating that page at least 30 days before the change; you can object by email, and if we cannot resolve the objection, you can stop using the App. We bind each sub-processor to data protection terms that are at least as protective as this DPA and remain responsible for them.

7. Transfers

Data is hosted by Cloudflare with the database in Europe. Where a sub-processor processes data outside the EEA, the transfer relies on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

8. Deletion and return

• Zips and their manifests are deleted 7 days after an export finishes, and job data (records, references, files) 30 days after the job was created, in any case. You can delete a job, with its zip and manifest, in the App at any time.
• When you uninstall the App in HubSpot or disconnect it in the App, running jobs stop and all zips, manifests, job data and settings of your account are deleted and the tokens are removed. An uninstall in HubSpot is normally picked up within an hour. The remaining account record is deleted after 30 days; where the free export had been used, only the account ID and that fact stay, so the free export cannot be used twice.
• The credit ledger (purchases, reservations and refunds, without file or record names) is kept so a reinstall finds your credits; we delete it on request. Billing records that the law requires us to keep are kept by Stripe and us for the period the law requires.
• Files you downloaded are yours and are outside our control once downloaded.

9. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties. We also notify HubSpot within 24 hours of technical issues affecting the integration, as our HubSpot partner agreement requires.

10. Liability and precedence

Liability follows the terms of service. If this DPA and the terms conflict on personal data, this DPA prevails.

11. Contact

Data protection questions: support@kayabyte.dev.