This addendum forms part of the Terms of Service between Henway LLC and the customer agreeing to those Terms. It applies where you use the Services to process personal data about your own clients or contacts, most commonly on the Consultant and Agency plans, where you run discovery sessions on someone else's behalf.
Effective September 10, 2026. Section references to the Privacy Policy point to app.henwayai.com/privacy.
For personal data you put into the Services about your own clients, you are the controller and Henway is the processor. You decide what to collect and why; we process it to provide the Services and on your instructions.
For your own account data, meaning name, email, plan and billing status, and how you use the product, Henway is the controller, and our Privacy Policy governs.
We process personal data only to provide the Services, as described in our documentation, and on your documented instructions. If we believe an instruction breaches applicable data protection law, we will tell you.
Access is limited to personnel who need it to operate or support the Services, and they are under a duty of confidentiality.
We maintain technical and organisational measures appropriate to the risk, including:
We do not currently hold SOC 2, ISO 27001 or equivalent certification, and we will not represent otherwise.
You authorise the sub-processors listed in Section 5 of our Privacy Policy, currently Anthropic, Stripe, Railway, Vercel, Resend and PostHog. Each is engaged under terms requiring protections materially equivalent to this DPA, and we remain responsible for their performance. We will give at least 30 days' notice before adding or replacing one. You may object on reasonable data protection grounds, and if we cannot resolve it you may terminate the affected Services without penalty for the unused term.
Taking into account the nature of the processing, we will assist you in responding to requests from data subjects. The Services let you access, export and delete session data directly. Where someone contacts us rather than you, we will refer them to you unless we are legally required to act, and we operate a self-serve erasure route at app.henwayai.com/privacy/delete which anonymises a person across every account they appear in.
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting personal data we process for you, with the information we hold at that time and updates as we learn more.
You can delete sessions and generated apps at any time from your account, and deleting an app disables its link immediately. On termination we will delete or anonymise the personal data we process for you within the retention period in Section 8 of our Privacy Policy, except where law requires us to keep it. De-identified and aggregated data that cannot be linked to an individual may be retained.
On reasonable written request, no more than once a year, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is legally required, the parties will agree scope, timing and cost in advance, and it will be conducted so as not to disrupt the Services.
The Services are operated from the United States and personal data you submit is processed there. Where you transfer personal data of individuals in the EEA or UK, the parties agree that the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) apply and are incorporated by reference, with Henway as data importer.
In case of conflict, this DPA prevails over the Terms of Service on matters of data protection. Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.
For anything in this DPA, contact Henway LLC at support@henwayai.com.
Privacy policy · Terms of service · Delete my data · Support · Contact
© 2026 Henway AI. Patent-pending technology.
Product names on this site are trademarks of their owners. Henway is not affiliated with, endorsed by or sponsored by any of them, and earns nothing when it recommends one.
