Data processing agreement

This agreement is between the customer, the business that holds an organisation on app.hetscale.com ("you", the controller), and Ahmet Bora, a sole proprietorship registered in Türkiye, Golden Tulips Residence No: 145/29, Kartal/İstanbul, Türkiye ("we", the processor). It covers the personal data we process for your organisation under the data protection law that applies to it, such as the GDPR, the UK GDPR or Switzerland's Federal Act on Data Protection.

You accept it together with the Terms of Service. Where the two differ on personal data, this agreement wins. If you need a signed copy, write tosupport@hetscale.com.

What we process for our own purposes, as the controller, is in theprivacy policy: your account and its sign-in, billing through Paddle and this website. What your members write to support about your organisation, and the problem reports they send from the panel, are covered by this agreement.

Purpose. To run Hetscale for you under the terms: to observe, scale and heal the server groups in your Hetzner projects, and to give you the panel, the API, the mails and integrations you set up, the audit log and support.

How. We collect, store, show, send and delete the data as the service needs, continuously while this agreement runs.

Whose data. Your members and the people you invite; the people who act through your API tokens; and anyone whose data appears in your infrastructure, for example in a server name or an IP address that points to a person.

Which data. Members' names, email addresses and roles, and the addresses and roles of the people you invite; what they do in the organisation, in the audit log and the timeline; the mail we send them, as recipient, subject and delivery state, never the text; what they write to support, by mail or through Report a problem; the names and use of API tokens; and your infrastructure data: server names, IP addresses, labels, metrics, events and the addresses of the integrations you add. We expect no special categories of data, and you put none in names, labels or server settings.

What we do not see. Your users' traffic never passes through Hetscale. We do not read the contents of your servers or of their snapshots.

How long. For as long as this agreement runs, and until the deletion described below. The audit log keeps each entry for a year, the servers' metric samples and the integration deliveries for 30 days; the rest stays while the organisation exists.

We process the data only on your instructions: these terms, what your members set and do in the panel and through the API, and what you ask of support. If the law requires other processing, we tell you first, unless the law forbids it. If an instruction seems to us to break data protection law, we tell you.

Hetscale is run by its founder, who is today the only person with access to your data and is bound to confidentiality. Anyone who joins later is bound before they get access. The founder can reach the servers and the database to run the service; an access path that is logged and delayed is planned, as the security page says.

The security page describes how Hetscale works. The measures in place for the data in this agreement are these.

The application and its database run in Germany, in a Hetzner data centre whose operation is certified to ISO/IEC 27001. Every web request reaches it over TLS through Cloudflare. The server's firewall admits web traffic only from Cloudflare and SSH only from the founder's IP address.

The Hetzner tokens and chat addresses you give us, and the signing secrets of your webhooks, are encrypted with a data key of your organisation, which a master key protects. Passwords are hashed, and API tokens and invitation links are kept only as hashes. Your organisation's records carry its id, and a read of them that names no organisation fails instead of returning rows; only the platform's own tasks, such as the scheduled jobs and the daily clean-up, read across organisations, each on purpose. Tokens and authorisation headers are removed from the logs.

Our accounts at Hetzner, AWS, Cloudflare and GitHub have two-factor sign-in. The audit log is sealed into a hash chain per organisation and checked daily. The database is backed up every hour, with a copy in Amazon S3 in Frankfurt and a daily copy of the whole server at Hetzner, and a failed or missing backup raises an alert. A backup was restored as a test in September 2026, and a full restore onto a new server follows after launch. Every change to the application is deployed only after its automated tests pass, among them the tests that check that each organisation sees only its own data.

We keep these measures up to date and do not lower their level while this agreement runs.

The application stores your data in the EU. Two sub-processors may handle some of it outside the EU: Google, which runs the support mailbox, and Cloudflare, whose network carries every request to the panel and the API. We run Hetscale from Türkiye, so the founder's access to your data is a transfer to a country outside the EU. Where the GDPR applies to you, the EU's standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module Two, controller to processor, are part of this agreement: you are the data exporter and we are the data importer.

In those clauses, clause 7 applies; under clause 9 option 2 applies, with the 14 days' notice above; the option in clause 11 does not apply; the supervisory authority under clause 13 is the one competent for you; under clause 17 option 1 applies and the clauses are governed by German law; under clause 18 disputes go to the courts of Germany. Their annexes are this page: the parties and the data in the first sections, the measures under Security and the list of sub-processors. The data exporter is your business, as named in your organisation and, once you buy a plan, in its billing details, and its contact is your organisation's owner; we are the data importer, reached at support@hetscale.com. You and we accept the clauses and their annexes when you accept the terms, and that acceptance counts as both parties' signature on that date. Where the clauses and this agreement differ, the clauses win.

Where the UK GDPR applies to you, the clauses apply as amended by the International Data Transfer Addendum to them, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as it is revised under its section 18. This page fills in its tables, and either of us may end it as its section 19 allows. Where Switzerland's Federal Act on Data Protection applies to a transfer, the Federal Data Protection and Information Commissioner is the supervisory authority for it, a reference to the GDPR means that act, and people in Switzerland can also bring a claim in the courts where they live.

Türkiye has no adequacy decision from the European Commission. On request we give you the information we have for your assessment of this transfer, as clause 14 asks: the Turkish laws under which a public authority can request data from us, whether we have received such requests and how we answer them. If a public authority asks us for your data, we tell you promptly or, where the law forbids that, try to have the ban lifted. We challenge a request we consider unlawful and give only the minimum it requires, as clause 15 asks.

A sub-processor outside the EU, or with a parent company outside it, receives your data under the EU–US Data Privacy Framework or the standard contractual clauses in its own data processing agreement.

If we become aware of a breach of the security of your data, we tell your organisation's owner by email without undue delay, and within 48 hours at the latest: what happened, which data and roughly how many people and records it concerns, its likely consequences, what we did and propose to limit them, and whom to contact for more. We add what we learn later as soon as we know it, and we help you notify the supervisory authority and, where needed, the people concerned.

Your members can see much of this data in the panel, and change or remove a good part of it themselves. If a person asks us about their data in your organisation, we pass the request to you and help you answer it. A member can still have their own account deleted, as theprivacy policy says. They then leave your organisation, their API tokens there are revoked, and our record of the mail sent to them and the invitations addressed to them are deleted; what they did stays named in your organisation's audit log until those entries are a year old.

We also help you, with the information we have, with a data protection impact assessment or a consultation with a supervisory authority.

On request we give you the information you need to show that this agreement is kept, and we answer security questionnaires. You can audit us once a year, and also after a breach, when a supervisory authority requires it or when there are signs that this agreement is not kept. You can do it yourself or through an independent auditor bound to confidentiality, at your own cost. You give us 30 days' notice, or less in those other cases. An audit starts with the documents we provide and may include an inspection.

When the agreement ends, you choose whether we return your data before we delete it, or only delete it. You can take part of it yourself through the panel and the API, such as a group's settings as JSON and, on Team, the audit log; on request we send you the rest of your organisation's data as a file, the audit log included, within 30 days.

To have it deleted, cancel the subscription and have your organisation's owner write tosupport@hetscale.com from the owner's address. Within 30 days we delete your organisation with all its data, and the support mail and problem reports about it in our mailbox, and confirm the deletion in writing. The copies in our backups, the snapshots of our servers included, are gone within 30 days after that. We keep your request and our answer as the record of the deletion, and the payment records without the billing name and email, as the privacy policy says. Your members' own accounts stay until each member asks. The servers, snapshots and placement groups Hetscale created in your Hetzner projects stay there, since they are yours, and our answer says how to delete them.

We tell you by email at least 30 days before a change to this agreement applies to you, as the terms do for every change; a new sub-processor follows the 14 days above. Outside the standard contractual clauses, the law and the courts of the terms apply.

Last updated 2026-10-12