Data Processing Addendum

Effective date: November 6, 2026 · Version: 2026-11-06.1

This Data Processing Addendum ("DPA"), including its schedules and the Subprocessors disclosure, forms part of the Hillclimb Terms of Service between Desiderata LLC ("Desiderata," "we," or "us") and the business, organization, or individual acting in a business capacity that uses Hillclimb through an organization ("Customer").

This DPA takes effect for Customer when a person who is, or later becomes, an owner or admin of Customer's organization has accepted a version of the Terms incorporating it (the acceptance recorded at that person's sign-in counts from the time they hold that role), or when both parties execute a written agreement incorporating it. No separate signature or paid plan is required; Desiderata offers and agrees to this DPA through its incorporation into the Terms. Customer may request a countersigned copy at hello@hillclimb.me. The accepting person must have authority to bind Customer. An account acceptance records that person's action; it does not establish authority on behalf of an unidentified organization or unrelated affiliate. Customer may supplement or correct its legal name, address, privacy contact, and any underlying controller by emailing hello@hillclimb.me, and we will record them with the accepted version. Separate affiliates are covered only when validly represented in that acceptance or separately agreed in writing.

1. Scope and roles

"Customer Personal Data" is information relating to an identified or identifiable person that we process on Customer's behalf to provide Hillclimb to Customer's organizations. It includes personal information in Customer's trees (goals, briefs, outcomes, stories and criteria, evidence and attached files, plans and their revisions, comments, approvals, claims, and activity events); the member, role, team, guest, invitation, and access records used to run Customer's organizations; share links and the records of visits to them; and trigger configuration and the payloads Customer's triggers send or receive. Nonpersonal content remains protected by the Terms' ownership and confidentiality provisions even when data-protection law does not apply.

"Data Protection Law" means US federal and state privacy and personal-data protection law applicable to the particular processing, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and similar state privacy laws. "Business," "controller," "service provider," "contractor," "processor," "consumer," "sell," and "share" have their meanings under applicable Data Protection Law. A "Security Incident" is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. A "Subprocessor" is a provider we engage to process Customer Personal Data on Customer's behalf.

This DPA addresses US data protection law. We don't offer EU, UK or Swiss transfer clauses; if Customer puts personal data of people in those regions into Hillclimb, Customer is responsible for whether that is lawful.

Customer is the business or controller for its instructed processing, or a service provider or processor with authority from its business or controller to appoint us as a further service provider. Desiderata is Customer's service provider, contractor, or processor for that processing. Roles follow the facts and law, not merely these labels. If Customer acts for another business, it must communicate that business's lawful instructions and restrictions, obtain required authorizations, and make relevant information available to it. We will assist Customer with its corresponding obligations.

Share-link visit records (time, approximate location, browser, referrer, and a salted hash of the visitor's IP address and user-agent) are collected so that Customer's owners and admins can see who opened Customer's share links. They are Customer Personal Data processed on Customer's behalf: Customer instructs this collection by creating share links, and is responsible for any notice its share-link recipients require.

We separately determine purposes for account administration and authentication; sessions, OAuth and API-key records; sign-in rate limiting and abuse prevention; security; operational logs; records of acceptance of our terms; service communications; support; and legal compliance, as described in the Privacy Policy. This distinction does not authorize us to reclassify Customer's content as our own data to evade this DPA or reuse it for unrelated purposes. Where Data Protection Law requires a service-provider role for a particular activity, those restrictions apply.

This DPA does not cover a third party's independent processing after Customer or its users direct disclosure to it, including AI agents and MCP clients that users connect, destinations Customer chooses for outbound triggers, and people who receive share links. Those are Customer-directed recipients, not our Subprocessors.

2. Instructions and Customer responsibilities

We will process Customer Personal Data only on documented instructions to provide the purposes in Schedule 1, unless applicable law requires otherwise. The Terms, this DPA, Customer's settings, and actions taken in Hillclimb by Customer's authorized users and the agents acting for them constitute instructions within their lawful scope. Additional instructions may be sent to our contact below. Content stored in trees, evidence, files, trigger payloads, and agent output does not independently change those instructions or our agreement.

Customer is responsible for the lawfulness of its collection, instructions, disclosures, and use; required notices, consents, or other authorizations; accuracy and minimization; and authority for its users, guests, and connected agents. Customer must ensure the recipients it chooses are appropriate, including share-link recipients, trigger destinations, and agents its users connect. These duties do not excuse our own statutory or contractual obligations.

We will promptly tell Customer if, in our opinion, an instruction infringes Data Protection Law. We may suspend that specific processing while seeking clarification or a lawful alternative. If law requires processing outside instructions, we will notify Customer before processing unless legally prohibited. We will assess demands for disclosure, disclose only what is legally required, and seek clarification or challenge a demand where there are reasonable grounds to consider it unlawful.

Do not provide health, biometric, genetic, or similar sensitive data, criminal-offence records, children's personal information, payment-card data, credentials or live secrets, classified material, or export-restricted technical data. A different regulated use requires our express written agreement and appropriate safeguards before submission. Incidental or prohibited submission does not eliminate our duty to protect the information while arranging lawful restriction, return, or deletion; it does not make Hillclimb certified for that use.

3. Use restrictions and confidentiality

We will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to train AI models, or use it to market unrelated services to Customer's contacts. Hillclimb has no built-in AI and does not send Customer Personal Data to AI model providers. We will not retain, use, or disclose Customer Personal Data outside the specified purposes and direct business relationship except as Data Protection Law permits or requires. We will not combine it with personal information from another customer or our own interactions with individuals except to the limited extent law permits for providing the agreed services, security, or other authorized business purposes. We do not acquire ownership of Customer Personal Data.

Access will be limited to authorized people who need it for their assigned responsibilities and are bound by confidentiality obligations or an appropriate statutory duty. We will require appropriate confidentiality and data-protection obligations of Subprocessors. Confidentiality continues after access or the service ends. We will provide relevant handling instructions to anyone we authorize, including contractors.

4. Security and incidents

We will implement and maintain technical and organizational measures appropriate to the processing risks, considering available technology, implementation costs, and the nature, scope, context, and purposes of processing. Schedule 2 states the contractual security measures. We may improve or replace measures without materially reducing the overall protection of Customer Personal Data.

We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. We will not wait for a completed investigation. Notices will go to Customer's designated privacy contact or, if none is designated, to the owners of the affected organization by email. Customer must keep that contact reachable. We will provide information as it becomes available about the incident's nature, affected information and people, approximate scale where known, likely consequences, mitigation, and a contact for follow-up. We will provide updates, take reasonable containment and remediation steps, preserve relevant evidence, and cooperate with Customer's required response.

Customer is responsible for its notifications to individuals and authorities where it has that duty; we remain responsible for ours. We will not notify Customer's individuals on Customer's behalf without its instruction unless law requires it. Unsuccessful attempts that do not compromise personal data are not by themselves Security Incidents; this does not limit notice of attempted violations when required by law. Notification is not an admission of fault. No liability disclaimer, investigation, fee discussion, or need for Customer's approval may delay a legally required notice.

5. Subprocessors

Customer gives general written authorization for the Subprocessors identified in the Subprocessors disclosure for the described functions. We engage each Subprocessor under written terms imposing data-protection obligations appropriate to the processing, including the restrictions Data Protection Law requires of service providers and contractors. We remain responsible to Customer for our Subprocessors' performance of those obligations, subject to lawful contractual limits.

When Customer acts for another business, it confirms that business has authorized the applicable Subprocessors and must pass notices to it promptly. These protections also apply through the subprocessing chain. We will make available on request the identities, functions, relevant processing locations, and available contact information of applicable downstream processors. If an upstream provider's notice does not allow us to honor the applicable period, we must arrange a compliant alternative or suspend the affected processing before the unauthorized change; a provider's shorter notice does not silently shorten Customer's rights.

We will give notice of an intended addition or replacement at least 10 days before the new Subprocessor processes Customer Personal Data, by updating the Subprocessors page, whose version and date change with each update. To receive notices in writing, Customer may ask hello@hillclimb.me to email them to its designated privacy contact, and we will. Notice will identify the provider, its function, and relevant locations. Customer may object during that period on reasonable data-protection grounds by contacting us. We will work in good faith on an alternative, restriction, or other resolution and will not send the objecting Customer's affected data to the proposed provider while the objection is unresolved. If no reasonable resolution is available, either party may end the affected feature or service, with return or deletion under section 8 and a proportionate refund of any prepaid, unused fees. Hillclimb currently charges no fees.

If an emergency requires faster protection, we may suspend affected processing or use an already authorized provider. An emergency does not silently eliminate a required authorization or notice. If law requires a different approval procedure, we will follow it. Customer may request relevant subprocessing terms, with lawful redactions protecting other customers, security, and commercial confidentiality while retaining enough information to demonstrate compliance.

6. Assistance, requests, and assessments

Taking account of the nature of processing, we will assist Customer through appropriate measures with requests to access, know, correct, delete, or obtain a portable copy of personal information, and other individual rights under Data Protection Law. Many requests can be handled by Customer's owners and admins in Hillclimb, including through its API and MCP tools; where they cannot, we will help on request. We will promptly forward requests concerning Customer's instructed processing and will not decide them on Customer's behalf without instructions unless law requires it. We may direct the requester to Customer and verify identity proportionately. For information we control independently, we handle our own duties under the Privacy Policy.

Taking account of the information available to us, we will assist Customer with security obligations, Security Incident notices, and risk assessments that Data Protection Law requires. Customer should provide the relevant request and deadline promptly. Access and deletion requests do not require accepting new commercial terms. Ordinary assistance required by this DPA is included. Any charge for exceptional, additional work must be reasonable, legally permitted, and agreed beforehand; it cannot prevent or delay mandatory assistance or correction of our own breach.

7. Compliance information and audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and Data Protection Law. Customer should first use that documentation where sufficient. Where documentation is not sufficient, Customer, or a qualified independent auditor it appoints under confidentiality obligations, may review our compliance with reasonable advance notice, during business hours, within a defined relevant scope, and with measures protecting our systems and other customers. Routine reviews should ordinarily be no more than once per year, but that scheduling expectation does not restrict reviews required by law, a regulator, a material incident, or reasonable evidence of noncompliance.

Neither party may use confidentiality or security as a blanket reason to prevent a legally required review. We will work on a safe method for necessary access. Customer may not run intrusive security tests without a separately agreed safe scope. Customer normally pays its own auditor; any additional fee for our assistance must meet section 6. We will address identified failures within a timeframe appropriate to their severity and tell Customer if we can no longer meet our obligations. Customer may take reasonable steps to stop and remediate unauthorized processing, including suspension or termination of affected processing.

8. Return, deletion, and duration

This DPA continues while we process Customer Personal Data. Customer's owners and admins can export content through Hillclimb's API and MCP tools and can archive and delete trees. On termination of the relevant service, or a valid instruction during service, Customer may choose return or deletion. We will provide a reasonably accessible export of the relevant data on request and delete remaining active copies, including files attached to evidence, within 30 days after the valid instruction or termination, unless a shorter legal deadline applies or Customer requests a reasonable return period before deletion. If Customer makes no election at termination, deletion is the default. We will confirm completion on request and require the same handling by relevant Subprocessors.

Deleting a tree in Hillclimb removes its records from the active database and the files attached to its evidence from file storage immediately. Deleting an organization in Hillclimb, possible once it owns no trees, also removes its remaining records: files and file records, views, teams, organization-wide triggers (including their URLs and secrets), and usage counts.

An individual user can delete their own Hillclimb account in Settings, which removes their account records, credentials, agent authorizations, and memberships in Customer's organizations. That self-deletion is the individual's choice about their own account; it is not an instruction from Customer and does not delete content the individual authored in Customer's organizations. Content the individual or their agents authored in Customer's organizations, including attached files and history, stays with Customer, still attributed to the individual's name and email address as they were at deletion, shown as “(deleted account)”, so Customer keeps its record of who did what; their claims are released and they are removed from assignments, teams, and approver lists, with Customer's owners taking over approvals they alone held. An individual cannot delete their account while they belong to any organization that has other members: they must leave it, or be removed by Customer's owners or admins, first, and an only owner must make someone else an owner before leaving. Customer's owners and admins cannot delete an individual's account; removing someone from Customer's organization keeps their account and the content they wrote there. An organization whose only member deletes their account is deleted with it, including its trees and files, as that member's instruction for Customer. Customer remains responsible for deciding what happens to its organizations' data, and for responding to an individual's request to erase their information from that data, with our assistance under section 6.

Residual copies in our database provider's point-in-time restore history are isolated from ordinary use and are overwritten on the provider's schedule, currently within 7 days after active deletion. If recovery restores such copies, the deletion instruction must be reapplied before ordinary use. A separate written arrangement may provide a different lawful period; no arrangement overrides a mandatory deadline. Where law requires retention, we will identify the legal requirement and retained categories to Customer unless prohibited, restrict use to that purpose, maintain protection, and delete when retention is no longer required.

Copies independently held by recipients Customer or its users chose, such as connected agents, trigger destinations, and share-link recipients, are subject to those recipients' duties; we will assist with required communications.

9. US state privacy law requirements

Where the CCPA or a similar US state privacy law applies, we act as Customer's service provider, contractor, or processor for Customer Personal Data, which Customer discloses to us only for the limited and specified business purposes described in Schedule 1. In particular, we will:

not sell or share Customer Personal Data, including for cross-context behavioral advertising or targeted advertising;
not retain, use, or disclose it for any purpose, including a commercial purpose, other than the business purposes in Schedule 1, or outside our direct business relationship with Customer, except as Data Protection Law permits;
not combine it with personal information we receive from or on behalf of another person, or collect from our own interactions with individuals, except as Data Protection Law permits;
comply with the obligations Data Protection Law places on us and provide the same level of privacy protection it requires of businesses;
notify Customer if we determine that we can no longer meet our obligations under Data Protection Law; and
impose these obligations in writing on any Subprocessor that processes Customer Personal Data.

Customer may take reasonable and appropriate steps to ensure that we use Customer Personal Data consistently with Customer's obligations, and, on notice, to stop and remediate unauthorized use, as described in section 7. We certify that we understand these restrictions and will comply with them. We will cooperate with assessments Data Protection Law requires. Nothing in this DPA authorizes targeted advertising or a sale or sharing of Customer Personal Data.

10. Where processing happens

Hillclimb is offered to businesses in the United States and operated from the United States. Our providers, listed on the Subprocessors page, host and process Customer Personal Data in the United States, though their distributed delivery and support infrastructure may operate elsewhere. No exclusive processing region is promised without our express written agreement. Customer may ask hello@hillclimb.me for current deployment regions and relevant provider information.

11. Priority, liability, and changes

Mandatory Data Protection Law prevails. This DPA then prevails over conflicting provisions of the Terms concerning Customer Personal Data. The Terms' liability limits and allocation of responsibility apply between the parties only where lawful. They do not bind regulators or limit individuals' nonwaivable rights. Neither party must indemnify the other for the other's wrongful processing.

We may update this DPA using the Terms' notice and acceptance process, without retroactively reducing accrued rights or changing instructions for already collected data inconsistently with applicable law. Subprocessor changes follow section 5. Protection, return and deletion, assistance, and relevant remedies survive as long as the corresponding processing or duty continues. The Terms' governing law (Pennsylvania) and dispute provisions apply to this DPA except where mandatory law requires otherwise.

Schedule 1. Parties and processing details

Customer: the business or person identified through its acceptance and the legal identity and address it supplies under this DPA. Its contact is its designated privacy contact or, if none, the owners of its organization. Its role is business or controller, or service provider or processor acting on another business's instructions. Its relevant activity is planning and verifying work in Hillclimb organizations. Customer may identify any underlying business or controller by email, and we will record it with the accepted version.

Desiderata: Desiderata LLC, operating Hillclimb, 4607 Library Road, Ste 220 PMB 630, Bethel Park, PA 15102, United States. Contact: Privacy Contact, hello@hillclimb.me. Role: service provider, contractor, or processor, or a further service provider where Customer acts for another business. Activity: providing the Hillclimb software, storage, sharing, triggers, agent access through MCP and REST, support, and related security services.

Assent and dates: the DPA starts as stated above. Customer's recorded acceptance of the Terms, or a signed written agreement, supplies its acceptance date and electronic signature. Desiderata's incorporation of this DPA into its offered Terms expresses its assent and serves as its signature.

Subject matter and business purposes: hosting and processing personal data so Customer's users and their agents can build and rank trees of goals and outcomes, record evidence and files, write and review plans, comment, approve changes, manage members, teams, and access, share read-only views, deliver and receive trigger events, meter usage, and protect the instructed processing. Processing does not include selecting recipients for advertising or training AI models.

Operations and frequency: ongoing collection, recording, structuring, storage, retrieval, access-controlled disclosure to Customer's users, guests, agents, and share-link recipients, transmission to Customer-chosen trigger destinations, export, restriction, and deletion as Customer and its authorized users use the service. Processing occurs continuously or on demand according to those actions.

People: Customer's staff, contractors, guests, and invitees; people who open Customer's share links; and other individuals, such as Customer's customers or users, whose information Customer's users include in content. The service is for adults and is not intended to process children's information.

Data: names, email addresses, and account identifiers of users and invitees; roles, team membership, and access grants; authorship, timestamps, and the names of agents acting for users; content of goals, outcomes, evidence, files, plans, and comments, including any personal data users include; activity events, which can include email addresses; trigger payloads, which include the acting user's identifier, name, and email address, and inbound payloads stored as evidence; and share-link visit records (time, city, region and country, user-agent, referrer, and a salted hash of IP address and user-agent; raw IP addresses are not stored). Sensitive categories described in section 2 are excluded from authorized processing. If such information is incidentally discovered, access and further processing will be restricted while lawful handling is arranged.

Duration and retention: for the relevant service and instructed operations, followed by return or deletion and any legally required retention under section 8. Subprocessors process only for their assigned functions and corresponding necessary duration, subject to those requirements. Records we control independently follow the Privacy Policy; the role distinction cannot be used to retain Customer's content for an unrelated purpose.

Schedule 2. Technical and organizational measures

These are our commitments for covered processing, not a claim of independent certification or a warranty that every risk is eliminated.

Access and separation: passwordless authentication by Google, GitHub, or emailed one-time code; organization roles (owner, admin, editor, contributor), per-goal grants, and team access enforced on the server for browser, REST, and MCP requests alike; agents act only with their person's permissions through revocable API keys or OAuth tokens. Approvers can require sign-off before changes take effect, and agents' changes under approvers stay drafts until approved. Administrative access is limited to people with a justified operational need and removed when no longer needed. We will protect administrative accounts with strong authentication and use multifactor authentication where supported.
Credentials: emailed sign-in codes and API keys are stored only as hashes; codes expire after 10 minutes and allow limited attempts; sign-in requests are rate-limited per email address and per IP address. OAuth access tokens expire after one hour.
Files: private object storage for files attached to evidence, accessed only through signed links that expire after 10 minutes for upload and 5 minutes for download, issued after an access check. Share links serve files the same way.
Sharing: share links are read-only, revocable, optionally expiring, stop working when a tree is archived, hide people's names and plans, and ask search engines not to index them. Share-link visits store a salted hash rather than the raw IP address.
Transmission and storage protection: encrypted public connections; encryption at rest for the production database and file storage through our providers' infrastructure controls. Access to keys and secrets is restricted. Data can be decrypted by authorized service processes; this is not end-to-end encryption. Outbound trigger messages are signed so recipients can verify them, and are sent only to public HTTPS addresses.
Minimization: Hillclimb has no analytics or third-party tracking and sends no content to AI model providers. Agent request logs exclude tokens, keys, arguments, and results; we do not intentionally log passwords, access tokens, or file contents.
Integrity and change control: evidence and plan revisions are append-only; an activity log records who changed what, and through which agent; changes are reviewed and tested before deployment; dependencies are maintained. We will evaluate relevant safeguards periodically and following material changes or incidents, and remediate identified weaknesses according to severity.
Availability and recovery: our database provider's point-in-time restore for production records, with recovery checks proportionate to the service. This DPA does not create an uptime percentage, recovery-time guarantee, or permanent archive. Restore history and restored data remain subject to deletion instructions.
People, facilities, and providers: confidentiality obligations, role-appropriate handling guidance, protected administrative devices, and reasonable review of providers' protections. Physical infrastructure access is managed by hosting providers under their applicable safeguards. Customer may request available relevant information; no ISO, SOC, HIPAA, or export-control certification is asserted for Desiderata by this schedule.
Response and lifecycle: a contact for privacy and security matters, incident assessment and response, assistance with rights requests, lawful return and deletion and retention restrictions, and relevant evidence of compliance. We handle these by hand at hello@hillclimb.me.

Contact

Desiderata LLC — Privacy Contact
4607 Library Road, Ste 220 PMB 630
Bethel Park, PA 15102, United States
hello@hillclimb.me

Use this contact for instructions, privacy and security reports, subprocessor objections and notification requests, audit information, deployment-region questions, and requests for a countersigned copy of this DPA. No paid plan is required to contact us.