Data Processing Addendum

This Data Processing Addendum ("DPA") applies to Infrastructure Data: the service/container topology, dependency edges, host and container metrics, and log lines that your organization's own agent reports to Archynt, to the extent that data contains personal data of your end users or personnel.

For your Account, organization and billing data, Hexar is the data controller under our Privacy Policy. For Infrastructure Data, Hexar acts as your data processor ("encargado de tratamiento" under Law No. 25,326), processing it solely on your documented instructions as set out in this DPA and in the Terms of Service, Section 4.

This DPA is incorporated into and forms part of Archynt's Terms of Service and Privacy Policy. Where it conflicts with either regarding the processing of Infrastructure Data, this DPA prevails.

You instruct Hexar to process Infrastructure Data solely to: ingest it from your agent; correlate it with your static architecture graph; store, display and retain it according to your plan's limits; generate AI-assisted insights from a derived representation of it; and enforce the security and access controls described in our Privacy Policy.

Any additional processing instruction must be agreed in writing. Hexar will inform you if, in its assessment, an instruction would infringe applicable data protection law.

Hexar limits access to Infrastructure Data to personnel who need it to operate or support the Service, and requires them to be bound by confidentiality obligations covering that data.

You authorize Hexar to engage the following sub-processors for Infrastructure Data as of the date of this DPA: Anthropic (Claude, default AI provider) and OpenAI (fallback AI provider), for generating AI-assisted insights from a derived representation of your data; and the cloud infrastructure and storage providers hosting Postgres, Neo4j, VictoriaMetrics and Loki, for storing and serving that data.

Hexar will give you at least 15 days' notice, by email or an in-app notice, before adding a new sub-processor that will process Infrastructure Data. If you have a reasonable data protection objection to a new sub-processor, contact us at [email protected] within that window; we will work with you in good faith to address it, which may include not proceeding with that sub-processor for your organization.

Hexar applies the technical and organizational security measures described in our Privacy Policy, Section 7, to Infrastructure Data.

If Hexar becomes aware of a security incident affecting Infrastructure Data, it will notify you without undue delay, and in any case within 72 hours of confirming the incident, as described in our Privacy Policy, Section 8. This notice is provided to support your own obligations, if any, toward your end users or personnel and toward your applicable data protection authority.

If Hexar receives a request from one of your end users or personnel concerning Infrastructure Data (for example, a request to access or delete data appearing in a log line), Hexar will promptly forward it to you and will reasonably assist you, at your cost if the assistance requires material effort, in responding to it. Hexar will not itself directly resolve requests from your end users, since it holds no direct relationship with them.

You may export your organization's architecture graph, findings and dashboard configuration at any time while your account is active, as described in the Terms of Service, Section 9.

On termination of your account, or upon your explicit written request, Hexar will delete or irreversibly anonymize Infrastructure Data within 30 days of the end of the applicable grace period described in the Terms of Service, Section 9, except to the extent a longer retention period is required by applicable law or to resolve a pending claim.

Infrastructure Data may be transferred to sub-processors located outside Argentina, as listed in Section 4. Hexar relies on the international-transfer mechanisms described in the Privacy Policy, Section 5 — the model clauses approved by Argentina's AAIP, or your informed consent to the specific transfer — for those transfers.

On reasonable written request, no more than once per calendar year absent a security incident affecting your data, Hexar will provide you with information reasonably necessary to demonstrate its compliance with this DPA, such as a summary of the security measures in place and confirmation of the current sub-processor list.

This DPA applies for as long as Hexar processes Infrastructure Data on your behalf. It survives termination of the Terms of Service to the extent necessary to give effect to Section 8 (data export and deletion).