Cactus Data Processing Addendum
Review what personal data Cactus processes for your team, each side’s responsibilities, subprocessors, data locations, deletion terms, and liability.
What the DPA covers
The DPA is part of the Terms of Service. It applies whenever Cactus processes personal data for you, and you don’t need to sign it. If the DPA and the Terms disagree about personal data, the DPA controls. It covers the data Cactus processes and why, each side’s responsibilities, subprocessors, data locations and transfers, deletion, and liability. To request a copy signed by both parties, email hello@heycactus.ai.
Personal data
You decide why and how your personal data is processed, and Cactus processes it for you. Under the GDPR, you are the controller and Cactus is your processor; under the CCPA, you are the business and Cactus is your service provider.
| Category | What it covers |
|---|---|
| People | Your teammates; people who read your Help Center, ask in Messenger, or use your public MCP address; people in connected conversations, channels, and messages; and people named in connected code and commits |
| Data | Names and email addresses; messages and conversations, including anything a person writes in them; commit authors’ names; random visitor-browser IDs; the email a visitor leaves when they ask for a person; IP addresses in request logs and sign-in records; and recordings of visits to the app and Help Centers |
| Purpose | Running Cactus for you: reading your sources, writing pages and answers, answering your customers, and keeping Cactus secure |
| Memory | When memory is on, Cactus keeps each person’s earlier conversations with the product, readable only in that person’s conversations. A team owner can erase a person’s memory at any time, and memory can be turned off for the product |
| Processing period | While you use Cactus, and afterward for the periods listed for each data type in the [Privacy Policy](concept://cactus-privacy-policy) |
Cactus handles its own records of who uses Cactus, such as your name and email as a Cactus user, under the Privacy Policy. Cactus isn’t built for health records, payment card numbers, government ID numbers, or other special categories of data; the Acceptable Use Policy asks you not to connect them.
Responsibilities
Cactus
Processes your personal data only on your instructions. If Cactus thinks an instruction breaks data protection law, it tells you.
Binds people at Cactus who can access your personal data to confidentiality.
Protects your data with the measures on the Trust Center and keeps them up to date.
Helps you respond to requests to access, correct, or delete personal data, and, within reason, with impact assessments and regulator questions.
Tells you without undue delay when it knows of a security incident affecting your personal data, and keeps you updated.
Gives you information to check its compliance with the DPA and answers security questionnaires.
Your team
Have a lawful basis for the personal data you provide and tell the people it concerns, for example in your privacy notice.
Give Cactus only instructions allowed by data protection law.
Keep team sign-ins safe and choose carefully who can see what.
Subprocessors
Cactus uses these companies to process your personal data. Each receives only what it needs for its part, under data-protection terms that protect your personal data at least as well as the DPA does.
| Company | What it does and receives | Processing location |
|---|---|---|
| Cloudflare | Runs the website, app, and Help Centers; keeps a log of each request | Worldwide, on Cloudflare’s network |
| Microsoft Azure | Runs the server where Cactus reads your sources and writes pages and answers | United States, East US 2, Virginia |
| Restate | Runs Cactus jobs and keeps a record of each job’s steps, including what each step read, for seven days | United States, AWS us-east-2, Ohio |
| Neon | Stores the database, including the search index of your code | United States, AWS us-east-1, Virginia |
| Convex | Carries live updates, including the words of an answer while it is being written | Still being confirmed with Convex |
| Modal | Copies your repositories, builds the search index of your code, and runs the commands Cactus reads it with | United States for stored copies; sandboxes can run in any region Modal uses |
| Vercel | The Vercel AI Gateway carries every call Cactus makes to a model | Still being confirmed with Vercel |
| OpenAI | Runs the models that read your sources and write pages and answers, and the model that turns text into search vectors | Still being confirmed with OpenAI |
| TypeSafe AI | Runs Jev, the model that makes some small decisions, such as whether your customers would notice a release | Still being confirmed with TypeSafe AI |
| Firecrawl | Reads your product’s public website to find its logo, colours, and links, and fetches a public page for Cactus when a site turns a plain request away | Still being confirmed with Firecrawl |
| Resend | Sends Cactus email, including the email your customers get when they write to your team | United States |
| PostHog | Records usage events, errors, and visit recordings from the app and Help Centers; keeps model-call traces for debugging that only Cactus’s two founders can open | United States, AWS us-east-1, Virginia |
| Google and logo.dev | Supply the small logo beside a product’s name; the browser asks them for it by the product’s web address | Still being confirmed with the companies |
| Google and GitHub | Sign you in when you choose either sign-in option | Still being confirmed with the companies |
Before a new company starts receiving your personal data, Cactus adds it to the DPA and emails your team’s Owners. If you object on data-protection grounds, tell Cactus within 30 days. If Cactus can’t resolve it with you, you may end the Terms for the part of Cactus the change affects.
Data location
The database, the server that reads your sources, and Cactus’s job records are in the United States. When personal data leaves the European Economic Area, the UK, or Switzerland for a country the law does not already recognise as protecting it, the Standard Contractual Clauses apply between you and Cactus, as completed by the DPA.
Deletion
You can handle many requests yourself by deleting a page, conversation, or product, or disconnecting a source. For other requests, write to Cactus. Cactus deletes your personal data when you delete it and when your account closes. Until then, you can ask for a copy. The Privacy Policy lists retention periods for each type of data.
Liability
What you and Cactus owe each other under the DPA is limited as the Terms of Service say.