Data Processing Addendum
Last updated 2026-08-03
Data Processing Addendum
Effective date: 2026-08-03
If you are a business customer subject to the GDPR, the UK GDPR, the Swiss FADP, or a US state privacy law, this page explains our data-processing position and how to get a signed Data Processing Addendum ("DPA") in place with Kalmantic Inc.
Where the roles sit
Two different relationships are at work, and it matters which one you are asking about.
Kalmantic as controller. For your account, your subscription, your support conversations, and site analytics, Kalmantic decides why and how the data is processed. The Privacy Policy governs that, and no DPA is needed.
Kalmantic as processor. Where we process personal data contained in your content on your instruction — for example, prompt context sent through a Kalmantic-operated coding agent, or data inside a hosted feature you enabled — you are the controller and we are your processor. That is what a DPA covers.
The local-first reduction. Because openFactory runs on your own machine and your repositories, source code, and agent traffic to third-party vendors do not pass through our servers, the volume of personal data we process on your behalf is materially smaller than for a hosted SaaS tool. For many customers the processor relationship covers only the narrow cases above. Confirm your own architecture before relying on this — if you configure a Kalmantic-operated agent and your code contains personal data, that data is processed by us and by the inference provider serving the request.
What our DPA covers
Our standard DPA includes:
- Subject matter, duration, nature, and purpose of the processing, and the categories of data subjects and personal data (Art. 28(3) GDPR).
- Processing only on documented instructions from you.
- Confidentiality commitments binding on our personnel.
- Security measures under Art. 32 — encryption in transit and at rest, least-privilege access with mandatory MFA, audit logging, and access review.
- Subprocessor terms — our list below, a commitment to flow down equivalent obligations, and 30 days' notice of any new subprocessor with a right to object.
- Assistance with data-subject requests, DPIAs, and prior consultation.
- Breach notification without undue delay after we become aware.
- Deletion or return of personal data at the end of the service, subject to legal retention.
- Audit rights — our documentation and answers to a reasonable annual questionnaire; on-site audit where the law requires it.
- International transfers — the EU Standard Contractual Clauses (module 2 and module 3 as applicable) and the UK Addendum, with a transfer impact assessment available on request.
Subprocessors
Each of the following is engaged under a written contract with data-protection terms at least as protective as ours.
Platform
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Paddle.com Market Ltd | Merchant of record — payment processing, subscription management, invoicing, and global VAT/GST/sales-tax calculation and remittance | Billing name and address, email, card details (collected by Paddle, not by us), transaction records | UK headquarters; EU and US processing regions; serves buyers globally |
| Google LLC (Firebase, Google Cloud) | Authentication, application data storage, website and API hosting | Account identifiers, email, session tokens, application data | US and EU regions |
Model inference — only for agents operated by Kalmantic
These providers are in scope only when you use a coding agent that Kalmantic operates. When you connect a third-party vendor agent under your own credentials, that vendor is your processor, not our subprocessor, and your agreement with them governs.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic PBC | Model inference for Kalmantic-operated agents | Prompt context and completions for the request being served | US |
| OpenAI, L.L.C. | Model inference for Kalmantic-operated agents | Prompt context and completions for the request being served | US |
We contract with inference providers on zero-retention or short-retention terms and on terms that prohibit training on customer content. Confirm the current terms for a specific provider with us before relying on them for regulated data.
Changes to this list
We give 30 days' notice before adding a subprocessor that processes customer personal data. Ask to be added to the notification list at privacy@kalmantic.com. Customers with a signed DPA may object to a new subprocessor on reasonable data-protection grounds; if we cannot resolve the objection, you may terminate the affected service and receive a refund of the unused prepaid portion.
How to request a signed DPA
Email privacy@kalmantic.com from an address on your account with:
- Your full legal entity name and registered address.
- The signatory's name, title, and email.
- Whether you need the EU SCCs, the UK Addendum, the Swiss annex, or a US state-law addendum.
- Any regulated-data context we should know about (health, financial, children's data, or public-sector).
We return a countersigned DPA within 10 business days. We can execute our standard DPA as-is; negotiated redlines are available on annual plans.
Data subject requests
If a data subject contacts us directly about data we process on your behalf, we will not respond substantively — we will refer them to you and notify you promptly, unless the law requires otherwise. Requests about data we control go to privacy@kalmantic.com and are handled under §7 of the Privacy Policy.
Contact
Data protection, DPAs, subprocessor notices: privacy@kalmantic.com. Security and incident reports: security@kalmantic.com.
Kalmantic Inc. operates OpenFactoryAI and openFactory. This addendum was last updated on 2026-08-03.