Data Processing Addendum
Last updated 17 September 2026
Draft. This document is pending review by our legal counsel and may change before launch.
This addendum applies when you use Fulta to build or host an application that processes personal data of other people. In that case you are the controller and Fulta Technologies Kft. is your processor. It forms part of the Terms of Service.
1. Scope of processing
Subject matter. Hosting, building and running the application you create with Fulta.
Duration. For as long as your project exists on the platform, plus the short retention window after deletion.
Nature and purpose. Storing project data, running builds, serving your published application to its visitors, and keeping backups.
Types of personal data. Whatever your application collects — typically names, email addresses, messages, booking or order details, and the account data of your application's own users.
Categories of data subjects. Visitors and users of your published application.
2. Our obligations
We will:
- process personal data only on your documented instructions, including those given through the product, unless law requires otherwise;
- ensure people authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational security measures, including encryption of secrets at rest, isolated build sandboxes with resource limits, restricted network access, and domain separation between the platform, previews and published apps;
- assist you, as far as reasonable, with data subject requests, impact assessments and consultations with supervisory authorities;
- notify you without undue delay after becoming aware of a personal data breach affecting your data;
- delete project data on termination, subject to the retention window and to legal record-keeping duties.
3. Sub-processors
You authorise us to engage sub-processors. The current list is published in the Privacy Policy and includes Cloudflare (compute, hosting, storage), Stripe (payments), OpenAI and Anthropic (AI model providers), our platform hosting provider, our email delivery provider and our analytics provider. We will give notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.
4. International transfers
Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses, together with supplementary measures where needed.
5. Your obligations
You are responsible for the lawfulness of the data your application collects, for the notices and consents shown to its visitors, and for responding to data subject requests addressed to you. You must not use Fulta to process special categories of personal data unless you have told us and we have agreed in writing.
6. Audits
On reasonable written request, and no more than once a year unless a supervisory authority requires otherwise, we will make available the information necessary to demonstrate compliance with this addendum.