datatomcp
Sign inStart free

Data processing agreement

Version 1.0, 6 November 2026

This agreement applies when the datasets you put into datatomcp contain personal data. It is part of our terms of service and applies automatically to every workspace, on every plan, without signing anything. If your company needs a countersigned copy, write to [email protected] and we send one back.

1. Who is who

  • You (the controller): the customer who holds the datatomcp account or workspace and decides which data goes in and why.
  • Us (the processor): datatomcp, operated by Killian Helf, The Hague, the Netherlands.
  • For your own account data (your email, sign-in, billing), we are a controller ourselves; that is covered by the privacy policy, not by this agreement.

2. What we process, and why

We process the personal data in your datasets only to provide the service you use: storing and versioning datasets, importing and refreshing them from your files, Google Sheets and connected sources, and answering queries from you, your team, your API keys and the AI tools you connect. Annex 1 describes the processing in detail.

3. Our commitments

  • Only on your instructions. Your instructions are this agreement, the terms, and what you do in the app (adding, querying, sharing and deleting data). We never use your data for anything else, never sell it, and never use it to train AI models. If we think an instruction breaks data protection law, we tell you.
  • Confidentiality. Only the operator of datatomcp can access the servers, only to run and support the service, and under a duty of confidentiality.
  • Security. We apply the measures in Annex 2 and keep them at least at that level.
  • Sub-processors. You authorise the sub-processors in Annex 3. We announce a new one on this page and the privacy policy at least 14 days before it starts; if you object on reasonable grounds and we can't address it, you can leave and delete your data. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.
  • Transfers. Datasets are stored in the EU and are not transferred outside it by us. Where a sub-processor processes data outside the EU (Annex 3), it relies on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. Query results you send to an AI tool you connect go to that tool's provider under your own agreement with them.
  • Helping you. We help you answer requests from the people in your data (access, correction, deletion, export), mostly through the app itself, and with security, impact assessments and consultations with a regulator where you need our information.
  • Breaches. If we become aware of a breach affecting your data, we tell you without undue delay and at the latest within 48 hours, with what we know, and keep you updated.
  • End of service. When you delete a dataset or your account, the data is removed at once and from backups within 14 days. Before that you can export your data from the app or your original sources at any time.
  • Audits. On request we give you the information needed to show we meet this agreement, including answers to your security questionnaire. If that isn't enough, you or an auditor bound by confidentiality may audit us once a year, with 30 days' notice, at your cost.

4. Liability, duration and law

Liability under this agreement follows the terms of service. It lasts as long as we process personal data for you, and its deletion and confidentiality commitments survive it. Dutch law applies. If this agreement and the terms conflict on personal data, this agreement wins.

Annex 1: Details of the processing

  • Subject matter and nature: hosting, versioning, importing, refreshing and querying tabular datasets; computing totals and counts; keeping an audit of agent and API calls.
  • Duration: for as long as the dataset or account exists, plus up to 14 days in backups.
  • Categories of people: decided by you; typically your customers, prospects, suppliers or employees as they appear in your spreadsheets and connected tools.
  • Types of personal data: decided by you; typically names, email addresses, company names, order, invoice and contract data. You agree not to upload special categories of data (such as health data) or criminal records.
  • Agent call log: the queries agents send (filters, columns, grouping), which may contain values from your data, kept 30 days (90 on Pro). Query results themselves are never stored.

Annex 2: Security measures

  • Location: datasets and account data on our server in the EU (Contabo); encrypted backups in Cloudflare R2, Western Europe.
  • In transit: HTTPS (TLS) for all traffic to the site, the app, the API and MCP.
  • Credentials: passwords, keys and tokens for connected databases and apps, and AI provider keys, are encrypted with AES-256-GCM, never shown again and never given to agents. Database connections run in read-only transactions.
  • Access control: every request needs a sign-in, an OAuth token issued to a tool you approved, or an API key; every dataset access goes through one authorisation check (workspace membership, role, private datasets, per-tool workspace limits). There are no public links.
  • Least access for agents: agents use a few validated, read-only tools; they can't change or delete data or run raw SQL.
  • Server hardening: key-only SSH, firewall, intrusion blocking, containers with only the needed ports exposed.
  • Google: the drive.file scope only, so we can read only the spreadsheets you pick.
  • Logging: an audit of every agent and API call and an activity log of every change, visible to the workspace.
  • Resilience: continuous database replication and daily dataset backups, with restore tested.

Annex 3: Sub-processors

  • Contabo GmbH (Germany; server in the EU): hosting of all datasets and account data.
  • Cloudflare, Inc. (R2 storage in Western Europe): encrypted backups; website hosting.
  • Resend (USA): sending account and invitation emails; processes email addresses and email content.
  • Mistral AI (France, EU processing): only if a workspace owner turns on AI cleaning suggestions, a column profile and at most 50 sample rows of the dataset an editor asks about.
  • Google and GitHub: sign-in, and reading the Google Sheets you choose.

Polar handles payments as merchant of record, an independent controller for billing data, so it is not a sub-processor of your datasets.

Questions about this agreement, or a security questionnaire: [email protected]. See also Security and data.