Data Processing Agreement

1. Overview

This Data Processing Agreement (“DPA”) applies when you use here.now to host files that contain personal data and you are subject to data protection laws such as the UK GDPR or EU GDPR. In that context, you act as the data controller and here.now acts as the data processor on your behalf.

By using the here.now API with an API key to publish files containing personal data, you agree to the terms of this DPA. No separate signature is required.

When you use here.now through a workspace, the organization the workspace belongs to is the data controller, and workspace admins act on its behalf. This DPA applies to the workspace’s use of here.now the same way it applies to an individual account.

2. What here.now processes

here.now processes personal data only to the extent necessary to provide the hosting service:

• Storage — files you upload to Sites and Drives are stored in Cloudflare R2 object storage. Drive contents are private to your account and accounts you explicitly share the Drive with.
• Serving — Site files are served over HTTPS according to the Site’s access settings: publicly, behind a password, restricted to an email allowlist, or restricted to workspace members.
• Metadata — file paths, sizes, content types, and hashes are stored in a routing index to enable serving.
• AI-generated Site metadata — when enabled, bounded excerpts from published files are sent to a third-party AI model (via OpenRouter, routing to Google; see section 7) solely to generate Site display names, display descriptions, search metadata, and related Site metadata. Excerpts are not used to train models. Workspace admins can disable AI metadata generation for all of their workspace’s Sites in workspace settings; manually set metadata never involves an AI model.
• Workspace membership data — for workspace use, member email addresses, roles, and join records are processed to operate membership-based access control and are visible to other members of the same workspace.
• Request metadata — request paths, referrer domains, coarse geography, and privacy-preserving daily visitor hashes are processed to provide owner-facing analytics and for abuse prevention and reliability. Raw IP addresses are not exposed to site owners.
• Thumbnails — if a screenshot of your published site is captured for preview purposes, the page is rendered once by Cloudflare’s Browser Rendering service and a thumbnail image is stored. here.now may also store lightweight thumbnail metadata, such as a representative accent color, to display previews consistently. Thumbnail metadata is not used for ranking, indexing, or content analysis.

Beyond the thumbnail and AI-generated Site metadata described above, here.now does not read, index, analyse, or use the contents of your uploaded files for any purpose other than storing and serving them. We do not use your content to train AI models.

3. Data retention

• Sites published with an API key are retained indefinitely until you delete them.
• Anonymous sites (no API key) are automatically deleted after 24 hours.
• When you delete a site, all associated files are permanently removed from storage.
• Deleting a workspace permanently deletes all of its Sites and files. Removing a workspace member revokes their access promptly but does not delete content they published for the workspace.
• If you close your account, all your sites and files are deleted.

4. Your responsibilities as controller

As the data controller, you are responsible for:

• Ensuring you have a lawful basis to process the personal data you upload.
• Providing any required notices to the data subjects whose data appears in your files.
• Not uploading special category data (health, financial, biometric, etc.) unless you have assessed and accepted the associated risk.
• Deleting sites when the personal data they contain is no longer needed.

5. here.now’s obligations

here.now commits to:

• Processing personal data only as described in this DPA and in accordance with your documented instructions (publishing and serving your files).
• Not selling or sharing personal data in your files with third parties for their own purposes.
• Maintaining reasonable technical and organisational security measures (see section 6).
• Ensuring that people authorised to process personal data are subject to confidentiality obligations.
• Notifying you without undue delay, and in any event within 72 hours, if we become aware of a personal data breach affecting your files, to the extent we can identify it as such.
• Deleting your data upon account closure or upon your request.
• Providing reasonable assistance if you need to respond to a data subject rights request, to the extent the information is within our control.

6. Security measures

here.now implements the following measures to protect stored data:

• Files are stored in Cloudflare R2, which encrypts data at rest.
• All data in transit is encrypted using TLS (HTTPS).
• Access to production infrastructure is restricted to authorised personnel.
• Account variables (API secrets) are encrypted at rest with a separate encryption key.
• Site passwords are stored as hashes and cannot be read back by anyone, including here.now.
• API keys are required for persistent publishing and are individually revocable; anonymous publishing is rate-limited by IP.

Access control depends on the Site’s settings. For public personal sites, the primary control is the confidentiality of the URL itself: URLs are randomly generated and non-guessable. Workspace Sites default to members-only access, enforced at our serving edge: viewers must verify a signed-in workspace membership before content is served, and removing a member revokes their access across all of the workspace’s Sites promptly (typically within a minute). Password protection and email-allowlist restriction are available as additional access controls.

7. Sub-processors

here.now uses the following sub-processors to deliver the service. Each is bound by its own data processing terms with here.now:

We will give at least 30 days’ prior notice of intended material changes to this sub-processor list by emailing the address associated with your account, where available, and by updating this page. You may object to a new sub-processor on reasonable data protection grounds by emailing hello@here.now during the notice period. If we cannot reasonably address the objection, you may stop using the affected service and delete the affected data before the change takes effect. If a sub-processor change is needed urgently for security, availability, or legal reasons, we may make the change with shorter notice and will notify you as soon as practicable.

8. International transfers

here.now’s infrastructure is primarily US-based with Cloudflare’s global network. If you are in the UK or EEA, personal data in your files may be transferred to and stored in the United States. Our sub-processors listed in section 7 participate in applicable transfer mechanisms (including EU Standard Contractual Clauses) under their own DPAs.

For transfers of personal data from the EEA, Switzerland, or the UK to here.now in a country without an adequacy decision, you and here.now incorporate the EU Standard Contractual Clauses, Module Two (controller to processor), and, where applicable, the UK International Data Transfer Addendum. The details in this DPA, including the processing description, sub-processors, and security measures, form the relevant annexes to those terms.

9. Audits and compliance

If you have questions about our data processing practices or need information to complete a compliance assessment, contact us at hello@here.now. We will respond within a reasonable timeframe and provide available information about our security and processing practices.

Upon reasonable written request, we will provide information needed to demonstrate compliance with this DPA, including responses to reasonable security questionnaires and summaries of applicable security practices. Any audit assistance must be subject to reasonable notice, confidentiality, and limits designed to protect the security and availability of here.now and the confidentiality of other customers’ data.

10. Governing law

This DPA is governed by the same law as the here.now Terms of Service. For the purposes of UK and EU GDPR compliance, this DPA is intended to satisfy the requirement for a written contract between controller and processor under Article 28 of the GDPR.

11. Changes

We may update this DPA from time to time. Changes will be reflected by updating the date at the top of this page. If we make a material change to this DPA, we will provide notice by emailing the address associated with your account, where available, or by another reasonably prominent notice before the change takes effect.

12. Contact

Questions about this DPA or data protection at here.now? Email hello@here.now.