Data processing agreement

This covers the personal data we handle on your behalf, as your processor, when your team uses hosted Kythene at kythene.com. For the data we hold in our own right, see the Privacy policy.

Last updated: 31 October 2026

1. Introduction

This Data Processing Agreement ("DPA") forms part of, and is subject to, the Terms & conditions (the "Agreement") between you ("Customer", "you") and Tamperan Ltd, a company registered in England and Wales (company number 17324867), whose registered office is at Piccadilly Business Centre, Aldow Enterprise Park, Manchester M12 6AE, trading as Kythene ("Kythene", "we", "us"). It governs our processing of personal data on your behalf in connection with the hosted Services.

This DPA applies automatically to every hosted workspace, from the date the Agreement does. You don't need to sign anything for it to bind us. If you'd like a signed copy for your records, ask us.

Terms such as "controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the "Data Protection Legislation", meaning the UK GDPR and the Data Protection Act 2018 and, where it applies to the processing, the EU General Data Protection Regulation (EU) 2016/679, in each case as amended or replaced from time to time.

2. Roles of the parties

When your team uses a hosted Kythene workspace, the people in it and their AI agents put work, memories, comments and other content into it. For the personal data in that workspace:

• you are the controller; and
• Kythene is the processor, acting on your documented instructions.

This DPA does not apply to personal data for which Kythene is itself the controller, such as the account details we collect when someone signs in, billing records, product analytics and messages sent to us. That is covered by our Privacy policy. Product analytics is ours, but session recordings can show workspace content on screen, so PostHog is on the sub-processor list for that.

This DPA does not apply to self-hosted Kythene. On a self-hosted instance your data stays on infrastructure you run and we do not process it; the only personal data we hold for a self-host licence is the business contact detail carried in the licence key, which we hold as controller.

You are responsible for having a lawful basis, and giving any notices and getting any consents needed, for the personal data you and your team put into Kythene.

3. Subject matter, duration, nature and purpose

These are set out in Schedule 1. In summary, we store, index, search and serve the content of your workspaces, and send the notifications your team asks for, so as to provide, secure and support the Services, for the duration of the Agreement.

Toolkits and the audit log

If your workspace's owner or an admin connects other services' MCP servers to the workspace (a "toolkit"), your team's and its AI agents' calls to those services go through Kythene, and each call is recorded in the workspace's audit log: who made it, from which AI, to which service and tool, when, how long it took, whether it worked, and the arguments sent and the result returned, in full. A result can contain personal data held in that service, such as a customer's or prospect's details. We process that content as your processor, on your instructions, like the rest of the workspace content.

• Connecting a service is your decision. The services you connect are your own suppliers, not our sub-processors, and what they do with a call is governed by your terms with them.
• The workspace's owners and admins can read every call in the log; everyone else can read only their own. No AI can read it, and each export of it is recorded in the workspace.
• The log is kept for the workspace's retention period, 12 months unless the owner sets another period of between one month and seven years, and records older than that are deleted automatically.
• Put personal data through a toolkit only where you have the lawful basis to do so, and not special category data or protected health information (see section 7).

4. Our obligations as processor

We will:

1. Process only on your instructions - process the personal data only on your documented instructions, including as set out in this DPA and the Agreement and as needed to provide the Services, unless required to do otherwise by law, in which case we will (unless legally prohibited) tell you first. Your configuration and use of the Services, including what your team and its AI agents do in your workspaces, are your documented instructions. We will tell you if, in our opinion, an instruction infringes the Data Protection Legislation.

2. Confidentiality - ensure that anyone we authorise to process the personal data is under an appropriate duty of confidentiality.

3. Security (Article 32) - implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. A summary of our current measures is in Schedule 2.

4. Sub-processors - only engage the sub-processors listed on our sub-processor list, or others notified to you under section 5, and impose on each one data protection obligations no less protective than those in this DPA. We remain responsible to you for each sub-processor's performance of those obligations.

5. Not train AI on it - not use the personal data, or any other content of your workspaces, to train AI models, and not send it to any AI provider ourselves. The embeddings behind semantic recall are computed by us in the United Kingdom. Your own AI agents reading from and writing to your workspace are your instructions, not ours, and the AI services behind them are your suppliers.

6. Assistance with data subject requests - taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights. People can delete their own accounts from their profile, a workspace's content can be exported with the kythe command-line tool, and its owners and admins can export the toolkits audit log separately from the app. If we receive such a request directly, we will, where legally permitted, refer the data subject to you and not respond ourselves except on your instructions.

7. Assistance with compliance - taking into account the nature of processing and the information available to us, assist you in meeting your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.

8. Breach notification - notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the personal data we process on your behalf, and give you the information you reasonably need to meet any obligation to report it to a supervisory authority or to the people affected.

9. Return or deletion - at the end of the Services, give you the means to export your workspace content, then, when you ask us to in writing, delete the personal data we process on your behalf within 30 days, unless the law requires us to keep it. Copies go from our backups within 3 months, and are not restored for any other purpose.

10. Audit and information - make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you mandate, on reasonable notice, under confidentiality obligations, no more than once a year unless a supervisory authority requires it or after a personal data breach, and carried out so as not to disrupt the Services or compromise the security or data of our other customers.

5. Sub-processors and change notice

You give a general authorisation for us to engage the sub-processors on our sub-processor list. If we intend to add or replace one, we will update that list and give you at least 30 days' notice before, by email to the workspace's owners and on that page, the change takes effect, and you may object on reasonable data protection grounds within that period. If you object and we cannot reasonably accommodate the objection, you may terminate the affected Services and we will refund any prepaid fees for the period after termination, as your sole remedy.

6. International transfers

Where processing under this DPA involves a transfer of personal data outside the United Kingdom, or for EU data outside the European Economic Area, we will make sure an appropriate transfer mechanism recognised under the Data Protection Legislation is in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or a relevant adequacy decision or regulation.

In practice, your workspace content is stored and processed by us in the United Kingdom, and the embeddings behind recall are computed there too. Sub-processors that process data elsewhere, as shown on the sub-processor list, do so under such a mechanism set out in their own data processing terms.

7. Special category data and health information

Kythene is not designed for special category data, or for protected health information within the meaning of HIPAA, and we do not sign business associate agreements. Don't put that kind of data into hosted Kythene unless we have agreed otherwise in writing. Self-hosted Kythene keeps all of it on your own infrastructure.

8. Liability and general

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. This DPA forms part of the Agreement; if it conflicts with the rest of the Agreement on the processing of personal data as a processor, this DPA prevails. This DPA is governed by the law of England and Wales and subject to the jurisdiction provisions of the Agreement.

Schedule 1 - Details of the processing

Schedule 2 - Technical and organisational security measures (Article 32)

A summary of the measures we maintain. They may change as the Services evolve, but not so as to reduce the level of protection.

• Encryption of personal data in transit, using TLS between your browser or agent and our edge, and between our edge and our servers.
• Connector credentials encrypted at rest with AES-256-GCM.
• Workspace data is separated per workspace, and every request is checked against the workspace's roles and permissions.
• An activity and audit log of actions in a workspace.
• Nightly encrypted backups, with a monthly restore drill.
• Monitoring and alerting on the Services and on backups.
• Patching and maintenance of the infrastructure the Services run on.
• A process for detecting, investigating and notifying personal data breaches.

Contact

For any question about this DPA, contact us via our contact form or by email at support@kythene.com.