Data Processing Agreement

1. Parties and roles

Processor: GadeWeb ApS (CVR 38989960), Artillerivej 112 st th, 2300 København S, Denmark, operating stackgate.ai.

Customer: the organization that registers for or uses stackgate.ai under a company workspace, including its authorized users.

Customer is the controller of personal data it submits to or configures in stackgate.ai. Processor processes that data solely on Customer’s documented instructions to provide the service.

2. Subject matter, duration, and nature of processing

Processor hosts stackgate.ai, an AI infrastructure platform that connects authorized AI clients to integrations Customer enables. Processing continues for the subscription term and until Customer deletes relevant data or closes its account, subject to the retention rules below.

Processing activities include hosting, authentication, credential storage, MCP gateway execution, audit logging, billing, and support.

3. Categories of data and data subjects

• Data subjects: Customer’s employees, contractors, and other authorized users.
• Account data: name, email address, organization details, roles.
• Integration data: encrypted OAuth tokens, API keys, and configuration needed to call services Customer connects.
• Usage and audit data: MCP tool calls, authentication events, operational logs.
• Billing data: subscription and payment metadata processed through Stripe.
• Optional banking data: if Customer connects Open Banking, account information Customer’s users authorize through Enable Banking.

Data exchanged directly between Customer’s users and third-party services they connect (for example Gmail or Trello) is governed by those providers. Processor facilitates access according to Customer’s configuration but does not control those providers’ processing.

4. Processor obligations

Processor shall:

• process personal data only on documented instructions from Customer, including as necessary to provide stackgate.ai, maintain security, and comply with applicable law;
• ensure persons authorized to process personal data are bound by confidentiality;
• implement appropriate technical and organizational measures described in Section 9;
• assist Customer with data subject requests where technically feasible;
• notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data;
• delete or return Customer personal data when no longer required to provide the service, except where retention is required by law;
• make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.

5. Customer obligations

• ensure it has a lawful basis to provide personal data to Processor and to instruct processing;
• configure integrations, permissions, and API tokens responsibly;
• inform its users about processing and, where required, obtain necessary consents;
• comply with applicable law when using connected third-party services.

6. Subprocessors

Customer authorizes Processor to engage the subprocessors listed below. Processor remains liable to Customer for subprocessor performance of data protection obligations.

Processor will notify Customer of material changes to subprocessors by updating this page. Customer may object on reasonable grounds relating to data protection by contacting andreas@gwdhost.dk within 14 days of notice. If the parties cannot resolve the objection, Customer may terminate the affected service.

7. International transfers

Where subprocessors process personal data outside the European Economic Area, Processor relies on appropriate safeguards, including the European Commission Standard Contractual Clauses where applicable (for example Stripe in the United States). Primary application hosting is in the United Kingdom (LON1), which is subject to an adequacy decision for GDPR purposes.

8. Security incidents

Processor will notify Customer without undue delay after confirming a personal data breach affecting Customer data, and will provide information reasonably available to assist Customer in meeting breach notification obligations.

9. Technical and organizational measures

• encryption of integration credentials at rest and TLS for data in transit;
• role-based access controls and least-privilege credential resolution;
• structured audit logging for MCP, authentication, and integration events;
• tenant scoping by company workspace and environment;
• upstream OAuth token revocation on disconnect where supported;
• regular backups and infrastructure monitoring.

10. Data subject requests

Processor will assist Customer, taking into account the nature of processing and information available to Processor, with requests from data subjects to exercise their rights under applicable data protection law. Customer should submit assistance requests to andreas@gwdhost.dk.

11. Deletion and return

Upon termination of the service or upon Customer request, Processor will delete Customer personal data within a reasonable period, except where retention is required by law or legitimate security purposes (for example anonymized audit records retained for company security). Details are described in our Privacy Policy.

12. Audit

Processor will make available this DPA, subprocessors list, and reasonable compliance information on request. On-site audits may be conducted no more than once per year on 30 days’ written notice, during business hours, without disrupting operations, and subject to confidentiality obligations.

13. Liability and order of precedence

Liability under this DPA is subject to the limitation of liability in the Terms and Conditions. If this DPA conflicts with the Terms on data protection matters, this DPA prevails.

14. Governing law

This DPA is governed by the laws of Denmark. Disputes shall be subject to the exclusive jurisdiction of the courts of Copenhagen, Denmark, unless mandatory law provides otherwise.

Contact

Data protection inquiries and DPA requests: andreas@gwdhost.dk