# DPA · Onto
> Data Processing Addendum for customers processing personal data through Onto. Current subprocessor list included.

**Source:** /legal/dpa
**Extracted:** 2026-09-24T18:14:20.483Z

---
Legal

## Data Processing Addendum

The DPA for customers processing personal data through Onto's APIs and SDKs — Onto as Processor, you as Controller.

In preparation

A DPA is only worth as much as its subprocessor annex is accurate. That list is below and is maintained from the running stack; the surrounding clauses follow once the Privacy Policy fixes its retention periods.

Effective

When it's published here

Contact

[founder@buildonto.dev](mailto:founder@buildonto.dev)

Contents

### What the document will cover.

The agreed scope, in the order it will be written. None of it is in force yet; it's here so you can tell now whether the finished document will answer your question.

1.  01
    
    Roles and responsibilities: Onto as Processor, customer as Controller
    
    _Not written_
2.  02
    
    Categories of personal data processed and the documented purpose for each
    
    _Not written_
3.  03
    
    Subprocessor annex, with notification rights and objection window for changes
    
    _Not written_
4.  04
    
    International transfer mechanisms: Standard Contractual Clauses and the UK addendum
    
    _Not written_
5.  05
    
    Audit rights, security-incident notification timelines, and data return on termination
    
    _Not written_
6.  06
    
    Annex of technical and organisational measures aligned with GDPR Art. 32
    
    _Not written_

Live today

### Who else touches your data.

This part isn't waiting on drafting: it's the list as it stands, read off the services the code actually calls. Checked 24 Sep 2026.

1.  [**Vercel**Their privacy policy](https://vercel.com/legal/privacy-policy) Hosting, and Vercel KV (run by Upstash) for short-lived dataEvery request in transit; page payloads cached for an hour; monthly quota counters; MCP sign-in grants; the keyless reader's per-IP counts; cookieless page analytics on buildonto.dev`next, @vercel/kv, @vercel/analytics`
2.  [**Supabase**Their privacy policy](https://supabase.com/privacy) The database, and dashboard sign-inAccount (email, name and company if you gave them), sign-in identity, API key digests, usage records per call, Serve visit records, pages your SDK uploads, reports you save`@supabase/supabase-js`
3.  [**Polar**Their privacy policy](https://polar.sh/legal/privacy) Billing and subscriptionsYour email, plan and purchases. Card details stay with Polar`@polar-sh/sdk`
4.  [**Resend**Their privacy policy](https://resend.com/legal/privacy-policy) EmailYour email and first name for the welcome email; your message, email and plan when you contact support`resend`
5.  [**Notion**Their privacy policy](https://www.notion.so/notion/Privacy-Policy) The old waitlistEmail addresses left on the waitlist before signup opened on 5 June 2026`@notionhq/client`
6.  [**Google Fonts**Their privacy policy](https://policies.google.com/privacy) Fonts on the reader pagesYour IP address and browser details when you open a page at md.buildonto.dev`fonts.googleapis.com`

Meanwhile

### What you can read right now.

[**Privacy**What we collect, what we keep, and how to have it deleted. In force._Read it_](/legal/privacy) [**Security**How keys are stored, what's encrypted, and what we don't claim. Each line cites its code._Read it_](/legal/security)

**Need it sooner?**If your procurement needs this document, or one clause of it, email [founder@buildonto.dev](mailto:founder@buildonto.dev) with the clause. A person replies, and the answer says plainly yes, no or not yet.

---
## Structured Data (JSON-LD)
```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://buildonto.dev/#org",
      "name": "Onto",
      "url": "https://buildonto.dev",
      "logo": "https://buildonto.dev/icon.png",
      "sameAs": [
        "https://x.com/buildonto",
        "https://github.com/ravixalgorithm/ontosdk"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://buildonto.dev/#site",
      "url": "https://buildonto.dev",
      "name": "Onto",
      "publisher": {
        "@id": "https://buildonto.dev/#org"
      }
    },
    {
      "@type": "SoftwareApplication",
      "name": "Onto",
      "applicationCategory": "DeveloperApplication",
      "operatingSystem": "Web",
      "url": "https://buildonto.dev",
      "description": "Onto serves AI agents clean Markdown from your own site, at the same URL, and shows you which agents came. Plus the AIO score, a Read API and an MCP server.",
      "publisher": {
        "@id": "https://buildonto.dev/#org"
      },
      "offers": {
        "@type": "Offer",
        "price": "0",
        "priceCurrency": "USD",
        "description": "Free tier: 1,000 credits / month"
      }
    }
  ]
}
```