RateLoop Data Processing Addendum

Version: September 2026

This Data Processing Addendum ("DPA") forms part of the agreement between the business customer ("Customer") and Hawig Ventures UG (haftungsbeschränkt), Herzogin-Juliana-Straße 7, 55469 Simmern, Germany ("RateLoop") when RateLoop processes Customer Personal Data on Customer's behalf. It is intended to satisfy Article 28 GDPR. If a signed order form contains different data-protection terms, that signed document controls.

1. Roles and scope

Customer is the controller and RateLoop is the processor for Customer Personal Data submitted to a private workspace, project, evaluation, reviewer group, or customer-directed integration and processed solely to provide the service on Customer's instructions. Each party remains responsible for determining its actual role. RateLoop acts as an independent controller for account security, billing, fraud prevention, legal compliance, and documented service operations.

2. Processing details

• Subject matter and purpose: hosting and securing private evaluation material; administering workspace and reviewer access; obtaining blinded human responses and, when separately enabled, advisory AI ratings; generating text through Chat or the owner-authorized API and delivering reviewed messages when requested; producing customer-requested evidence and exports; and providing support, deletion, resilience, and incident handling.
• Duration: for the service term and afterward only for Customer's configured retention period, deletion reconciliation, backups, active legal holds, or a documented legal duty.
• Data subjects: Customer personnel, agents and contractors; Customer-invited reviewers; and individuals whose data Customer lawfully includes in submitted material.
• Data types: account and work contact identifiers, workspace roles, submitted text and media, rubrics and instructions, reviewer responses and rationales, optional AI ratings and learning examples, Chat and API prompts, messages and system instructions, generated drafts and delivery details, assignment and access records, audit/security metadata, and support or deletion instructions.
• Sensitive data: the service is not intended for secrets, credentials, regulated special category data, criminal-offence data, or children's data unless the parties first agree written instructions and safeguards appropriate to that use.

3. Documented instructions

RateLoop will process Customer Personal Data only on Customer's documented instructions, including the agreement, configured workspace controls, authorized API calls, support requests, and lawful deletion or export requests. RateLoop will inform Customer before processing required by Union or Member State law unless the law prohibits notice. RateLoop will promptly tell Customer if, in its opinion, an instruction infringes applicable data-protection law and may pause that instruction while the parties resolve it.

4. Confidentiality and security

RateLoop limits access to personnel and contractors who need it to provide or secure the service and who are bound by confidentiality. RateLoop maintains measures appropriate to risk, including tenant- and project-scoped authorization, short-lived reviewer leases, blinded assignments, encryption in transit, purpose-separated authenticated encryption for designated private fields and objects, server-only key material, hashed session credentials, access and integrity logging, dependency and source controls, documented backup and deletion procedures, and incident response. Annex 1 states which of these are evidenced today and which are not. RateLoop may update measures without materially reducing overall protection.

RateLoop does not train on Customer Personal Data or customer output text by default. Optional Rating AI sends authorized evaluation material from workspace storage to a RateLoop-operated evaluator, hosted on Railway in Amsterdam or run on a connected device, only after Customer grants inference permission. Training requires separate learning permission and eligible, consented examples; inference permission alone does not authorize training. The Rating AI workflow does not send that material to an external model provider.

When authorized workspace users choose hosted Chat, or an agent uses the owner-authorized generation API, RateLoop sends the submitted prompts, messages and system instructions to Vercel AI Gateway and its routed model provider to generate text with the configured OpenAI model. Chat includes selected conversation history. This external generation path is separate from Rating AI. Provider roles, locations, retention, training restrictions and transfer safeguards depend on the actual routing configuration and agreements; the web hosting region does not establish them. Alpha use remains limited to public, synthetic or safely redacted material.

Optional online source checks send the selected answer and its review context through Vercel AI Gateway to the configured OpenAI model and its web search, only after explicit permission. This feature is unavailable with local drafting or local ratings. Reports are stored with Chat and included in its access and deletion controls. The Alpha restriction to public, synthetic or safely redacted material still applies.

5. Subprocessors

Customer gives general written authorization for the subprocessors on the RateLoop subprocessor list. RateLoop will impose data-protection obligations that are no less protective for the relevant processing and remains responsible for its subprocessors' performance as required by Article 28(4) GDPR. RateLoop will give at least 30 days' advance notice of an intended addition or replacement. Customer may object within 14 days on reasonable data-protection grounds. The parties will work in good faith on a reasonable alternative; if none is available, either party may terminate the affected service without requiring Customer to accept the new subprocessor.

6. Assistance and data-subject requests

Taking account of the nature of processing, RateLoop will reasonably assist Customer with appropriate technical and organizational measures for access, correction, deletion, restriction, portability, and objection requests. If RateLoop receives a request concerning Customer Personal Data, it will direct the requester to Customer unless law permits or requires RateLoop to respond. Customer is responsible for deciding the request and providing lawful instructions. RateLoop will also reasonably assist with security obligations, breach notifications, data-protection impact assessments, and prior consultation under Articles 32–36 GDPR.

7. Personal data breaches

RateLoop will notify Customer without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. RateLoop will provide information then available about the nature of the breach, affected categories and approximate scale, likely consequences, mitigation, and a contact point, and will supplement it as the investigation develops. Notice is not an admission of fault. Customer remains responsible for notifications for which it is controller.

8. Return, deletion, and retention

At Customer's choice and subject to product capabilities, RateLoop will return an available export and delete or anonymize Customer Personal Data after service termination. Deletion may remain in progress while private objects, processor copies, and backups are reconciled. RateLoop may retain records that Union or Member State law requires, data under a valid legal hold, and review evidence under an applicable retention duty; access to retained data is restricted to the retention purpose.

9. Information and audits

RateLoop will make available information reasonably necessary to demonstrate compliance with this DPA and allow an audit by Customer or an independent auditor bound by confidentiality. RateLoop does not currently hold a SOC 2 or ISO certification report. The current security and procurement package is the standard security-questionnaire response and includes reproducible evidence-verification instructions. RateLoop answers customer-specific follow-up questions against the deployed configuration rather than substituting a broad trust claim. Audits must normally use that response and remote evidence first; on-site access requires reasonable advance notice, must not expose other customers or weaken security, and is limited to once per year unless a confirmed breach or supervisory authority requires more. Each party bears its own costs, except that Customer covers unusual assistance beyond RateLoop's standard evidence package.

10. International transfers

RateLoop will not transfer Customer Personal Data outside the EEA except on documented instructions and with a lawful transfer mechanism. Where no adequacy decision applies, the parties incorporate the applicable European Commission standard contractual clauses and relevant supplementary measures.

11. Customer responsibilities and precedence

Customer must have a lawful basis and provide required notices, configure suitable retention and reviewer access, minimize submitted data, and avoid prohibited material. Customer will not instruct RateLoop to collect raw identity documents where a narrower predicate is sufficient. If this DPA conflicts with the service terms on protection of Customer Personal Data, this DPA controls; the applicable signed order otherwise controls commercial terms.

12. Contact

Data-protection instructions, security notices, audit requests, and subprocessor objections must be sent to hello@rateloop.ai and identify the Customer workspace and an authorized contact.

Annex 1 — Technical and organizational measures

These are the measures in place today. Where one is implemented but nothing records that it has been exercised, this annex says so rather than leave the stronger reading available. The technical and organizational measures page states, entry by entry, what RateLoop can show a reader and where the honest answer is currently nothing.

• Access control: opaque principals, hashed HttpOnly sessions, scoped API credentials, least-privilege workspace and project authorization, and reviewer access that expires on its own. Removing a member ends their access to the workspace. RateLoop does not measure how long a removal takes to reach every system that holds it, and therefore states no deprovisioning deadline here.
• Encryption: TLS in transit and authenticated envelope encryption at rest for designated private fields and objects, using tenant- and purpose-separated wrapping keys and server-only key material. That encryption covers the designated fields and objects, not every column of the database.
• Integrity and accountability: hash-chained audit records, signed evidence packets, access logging, dependency controls, code review, and operator, owner, admin and member authority separated in code and covered by tests. Each audit digest covers the record before it, so a deleted or altered record is detectable without trusting RateLoop. Two limits belong beside that: no schedule examines those records, and no recorded attestation states who holds production access. The chain shows the record is intact, not that anyone has read it.
• Availability and recovery: provider-managed backups, which the documented processing-region boundary excludes, bounded retry and dead-letter handling, deletion reconciliation, and a written restore procedure. That procedure has not yet been executed against the hosted deployment: it is documented, and this annex claims nothing beyond that. The measures page above publishes the checks a restore drill must pass and the record of executions, which is empty.
• Incident and vulnerability management: structured failure events emitted by the application, security triage, automated dependency scanning, coordinated remediation, and the 48-hour contractual breach-notification ceiling above. Nothing consumes those events today — there is no log drain and no alert rule — so RateLoop states no continuous monitoring and no detection time. The 48-hour ceiling runs from the moment RateLoop becomes aware of a breach, and this annex does not represent that awareness as automatic.