Data Processing Agreement — Emet

Effective: 2026-09-15 · Technical claims verified against the running system on 2026-08-05 (see Subprocessors for the re-check date).

This agreement forms part of the Terms of Service and applies automatically to every customer — you do not need to sign or request it. Where you have your own DPA that you need us to sign instead, talk to us; this one is written to make that conversation short rather than to avoid it.

1. Who is who

This split is the same one Privacy Policy §1 describes to your users, stated here as a contractual term rather than as a disclosure.

Rates and payable-word counts sit with Customer Content: we hold them on your instructions, we are not anyone's employer or paying agent, and a question about what a translator is owed goes to you (TERMS §6).

2. What we process, and why

• Subject matter: providing the Emet translation platform.
• Duration: for as long as your workspace exists, plus the export and retention windows in Terms of Service §7 and Privacy Policy §5.
• Nature and purpose: storing your documents; segmenting them; producing AI drafts; letting your people translate, review and approve; maintaining translation memory and glossaries; running quality checks; calculating payable words; measuring time on files where you switch that on; exporting the result.
• Categories of data subject: your staff, and the translators, reviewers and language managers you engage — plus any individual who happens to be named inside a document you upload.
• Types of personal data: the table in Privacy Policy §2, plus whatever your own source material contains.

Special-category data is out of scope. The platform is not designed for it and the Acceptable Use Policy §2 asks you not to upload it.

3. Our instructions come from you

We process Customer Content only on your documented instructions. Your use of the platform is the instruction: uploading a file instructs us to store and segment it, running pre-translation instructs us to send its segments to the AI providers in Subprocessors §§2–3, and so on.

We will tell you if we believe an instruction breaches the LGPD, the GDPR or other applicable data-protection law.

We do not use Customer Content for our own purposes. We do not train models on it, we do not use it to improve the product's output for anyone else, and no organisation's translation memory is ever used to draft another's work — which is enforced in software, not merely promised (Subprocessors, final section).

4. Confidentiality

Everyone with access to Customer Content is bound to confidentiality. Today that is a small, named set of people — the platform is operated by Hesed directly, not by a support organisation — and access to production is limited to those who need it to run it.

5. Security

The measures actually in place, and the ones that are not, are listed in Privacy Policy §7. That list is part of this agreement rather than marketing copy, which has one consequence worth stating plainly:

Encryption at rest applies to both deployments. The database, object store and cache are held in a LUKS2 volume (AES-XTS, 512-bit key), in a separate container for app.emet.ing and for app.hesedtranslation.com.

The encryption is narrower than the phrase suggests. Its key is held on the server, so it protects a disk that is decommissioned, removed or seized, and not a host that is compromised while running. We say so rather than let "encrypted at rest" carry more weight than it can bear — noting that the cloud-provider encryption offered by comparable platforms has the identical limit.

Backups are encrypted before they leave the machine, with a key the backup provider does not hold. If your own policy requires encryption at rest for live data, check which deployment you are on and raise it before uploading rather than after.

We will not weaken any measure described there without telling you.

6. Subprocessors

You give general authorisation for the subprocessors listed in Subprocessors, which names each one, its location, and precisely what it receives.

We will give 30 days' notice before adding a subprocessor that would receive Customer Content, during which you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service and export your content under Terms of Service §7. A replacement made urgently for security or continuity reasons may be notified promptly after the fact.

Each subprocessor is engaged under terms requiring confidentiality and security appropriate to what it receives, and we remain responsible to you for their performance.

How that is evidenced, checked on 2026-09-10. GDPR Art. 28(4) requires those terms to exist by contract, so the sentence above is a duty rather than a sentiment. None of the four is signed, and none of them can be — each publishes a data processing addendum that binds automatically rather than on signature, which is stronger evidence than a countersigned copy, not weaker:

Each of the four obliges its provider to impose materially equivalent terms on its own subprocessors and to remain liable for them. What none of the four carries is anything specific to Brazil or the LGPD — they are built around the GDPR and, in two cases, the CCPA. That is why §7 states a basis of its own rather than pointing at them.

7. International transfers

Your primary copy is in São Paulo, Brazil. Four things reach parties outside Brazil, and they are four different kinds of thing — so the basis is stated for each rather than asserted once for all of them.

1. AI drafting — Anthropic (US) and Google (US). What crosses the border is segment text and the rules for translating it. It is not your organisation's name, your users' names, their email addresses, your file names, or your commercial data. That boundary is drawn in code and described payload by payload in Subprocessors §§2–3. Scripture, theological prose and the ordinary run of source material contain no personal data about identifiable living people, and where that holds, no personal data is transferred and Art. 33 of the LGPD is not engaged at all.

Where it does not hold, your instruction governs. If you upload a document that names individuals — a field report, a testimony, a donor letter — those names travel with the segment. You are the controller of that content, and your use of pre-translation is the documented instruction to send it (§3). What we owe you is that the boundary above is real, and that you were told plainly before you uploaded rather than after (Terms of Service §4). What the Acceptable Use Policy §2 asks in return is that you not put personal data into source material where the work does not require it.

2. Backups — Backblaze (US). Encrypted with age before they leave the server, under a key Backblaze has never held (Subprocessors §4). Backblaze receives ciphertext it has no means of reading. Personal data is not made available to the recipient in any intelligible form, which is the substance the transfer rules exist to protect.

3. Error reports — Sentry (EU). Configured not to collect personal data (Privacy Policy §4) — stack traces and request metadata, not people. Since 2026-09-10 these are received in Sentry's European data region, which the ANPD recognised as adequate on 26 January 2026 (Resolution CD/ANPD nº 32/2026), so this transfer rests on Art. 33, I and needs no further mechanism.

4. Payments — Paddle. This one is not our transfer to make. Because Paddle is Merchant of Record, you contract with Paddle directly and give your billing details to Paddle, which processes them as its own controller (Subprocessors §9). The flow that touches us runs the other way — Paddle passes back the name, email and billing address we need to provision your subscription, which is a transfer into Brazil.

No reliance is placed on Resolution CD/ANPD nº 19/2024. Those standard contractual clauses would be the route if personal data were being sent to the United States for these purposes, and it is worth stating why we are not quietly leaning on them: as at the date above the ANPD had recognised no foreign standard contractual clauses as equivalent, so the EU clauses inside each of these providers' own agreements would not satisfy the LGPD, and none of them offers the ANPD's clauses. Rather than cite a mechanism we do not have, we have described what actually leaves the country.

If your own policy needs more than this, there is now a route: the ANPD recognised the European Union as adequate on 26 January 2026 (Resolution CD/ANPD nº 32/2026). Error reporting has already moved there — see Subprocessors §5 — and backups could follow on the same basis. Raise it before you upload and we will tell you what is configurable today.

8. Helping you meet your own obligations

• Data subject requests. Most of this is self-service and needs nothing from us: any user can export their own data from Security → Download my data, and an administrator can export the whole organisation from Organisation settings → Your data (Privacy Policy §6). Where a request does need us, we will help you answer it within the time the law gives you. If a data subject comes to us directly about Customer Content, we will refer them to you rather than act.
• Breach notification. We will tell you without undue delay and in any case within 48 hours of confirming that an incident has affected personal data you control, with what we know and what we are doing. The clock to the ANPD and to the affected people is yours, not ours: as controller you have three business days from confirming that personal data was affected (Resolution CD/ANPD nº 15/2024), and 48 hours is set to leave you time inside it. Where the incident instead affects data we control as controller — account identities, sign-in records — we notify within 72 hours of becoming aware (Privacy Policy §8).
• Impact assessments. We will give you the information you reasonably need for a DPIA or an ANPD/supervisory-authority consultation. Much of what such an assessment asks for is already written down in these documents, which is most of why they are written the way they are.

9. Audit and evidence

We will make available the information needed to demonstrate compliance with this agreement, and respond to a reasonable security questionnaire.

Being honest about scale: Hesed is a small operator running a single VPS. We do not hold SOC 2 or ISO 27001 certification and we are not going to pretend an independent audit report exists. What we offer instead is unusually specific documentation — every technical claim in this document set names the file or setting where it can be checked — plus answers to your reviewer's questions.

What we offer as standard. On request, once in any twelve months, we will give you the documentation you need to demonstrate our compliance and answer a reasonable security questionnaire, within 30 days. Much of what such a questionnaire asks is already answered in these documents, each claim naming where it can be checked.

If that is not enough. Where the standard response does not satisfy a genuine compliance requirement of yours, or following a personal data breach affecting your content, you may audit — yourself or through an independent auditor bound by confidentiality — on 30 days' written notice, at your cost, during business hours, no more than once in any twelve months, and without disrupting the service.

Audits are remote, and that is not about our size. Emet is multi-tenant on shared infrastructure. Physical or unrestricted system access would put an auditor in front of other customers' unpublished manuscripts, so audits are conducted through documentation, evidence we produce, and interviews. We will not grant one customer access that compromises another's confidentiality, and you would not want us to make that trade for you either.

10. Deletion and return

On termination you may export everything for 30 days (Terms of Service §7); the export is self-service and does not depend on us acting. After that the organisation is retired and then deleted.

Deleted content persists in backups for up to 14 days before ageing out. We cannot surgically remove one record from a backup archive without destroying the backup, and we would rather state the 14-day lag than imply an instant deletion we cannot perform.

11. Order of precedence

Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement governs. Paddle's Buyer Terms govern the payment transaction and the personal data Paddle processes as its own controller (Subprocessors §9).

Hesed Assessoria em Software LTDA · CNPJ 15.025.740/0001-50 · Rua Leroy, 119, Jd. Monsenhor Rossi, Limeira-SP, 13484-229, Brazil · data-protection contact privacy@emet.ing (encarregado / DPO: Nielsen Tomazini, reachable at the same address)