Hoylu Legal Information
Terms of Service
Customer Terms of Service
[PDF]
Effective: June 9, 2026
These Customer Terms of Service (the “Customer Terms”) describe your rights and responsibilities when using our visual planning platform, applications, and services, including our mobile and desktop applications (the “Services”). Please read them carefully. If you are a Customer (defined below), these Customer Terms govern your access and use of our Services. If you are being invited to a Project set up by a Customer, the User Terms of Service (the “User Terms”) govern your access and use of the Services.
Binding Agreement
These “Customer Terms” Form a Part of a Binding “Agreement”
These Customer Terms (or, if applicable, your written agreement with us) and any Order Form(s) (defined below) together form a binding “Agreement” between Customer and us. If any terms in the Customer Specific Supplement apply to Customer (e.g., if Customer is a U.S. government entity), those terms are also incorporated herein by reference and form part of the Agreement.
“We,” “our” and “us” refers to the applicable Hoylu entity in the section entitled “Which Hoylu Entity is Customer entering into and Agreement With?” below.
Your Acknowledgement and Understanding on Behalf of “Customer”
If you purchase a Project Subscription or Construction Volume Subscription, activate a Project, invite users to that Project, or use or allow use of that Project or any of its Workspaces after being notified of a change to these Customer Terms, you acknowledge your understanding of the then-current Agreement and agree to the Agreement on behalf of Customer. Please make sure you have the necessary authority to enter into the Agreement on behalf of Customer before proceeding.
Customer and Instructions
You are the “Customer”
“Customer” is the organization that you represent in agreeing to the Agreement.
Signing Up Using a Corporate Email Domain
If you purchased a Project Subscription or Construction Volume Subscription using your corporate email domain, your organization is Customer, and Customer can modify and re-assign roles on your Projects and their associated Workspaces (including your role) and otherwise exercise its rights under the Agreement. If Customer elects to replace you as the representative with ultimate authority for the Project, we will provide you with notice following such election and you agree to take any actions reasonably requested by us or Customer to facilitate the transfer of authority to a new representative of Customer.
What This Means for Customer – and for Us
Individuals authorized by Customer to access the Services (an “Authorized User”) may submit content or information to the Services, such as text, drawings, and other content or files (“Customer Data”), and Customer may exclusively provide us with instructions on what to do with it. For example, Customer may provision or deprovision access to the Services, enable or disable Third-Party integrations, manage permissions, retention and export settings, transfer or assign Workspaces within a Project, or consolidate Workspaces across Projects. Since these choices and instructions may result in the access, use, disclosure, modification or deletion of certain or all Customer Data, Customer is responsible for ensuring such actions are made in accordance with the Agreement.
Customer will (a) inform Authorized Users of all Customer policies and practices that are relevant to their use of the Services and of any settings that may impact the processing of Customer Data; and (b) ensure the transfer and processing of Customer Data under the Agreement is lawful.
Ordering Subscriptions
Hoylu offers two subscription models. Both models grant access to the Services for an unlimited number of Authorized Users within the scope of the purchased subscription. A subscription may be procured through the Services interface, or in some cases, via an order form entered into between Customer and us (each, an “Order Form”). Each Authorized User must agree to the User Terms before accessing any Workspace. Subscriptions commence when we make them available to Customer and continue for the applicable subscription term as specified in the Order Form or at the time of purchase.
Definitions
For the purposes of this Agreement, the following terms have the meanings set out below:
“Project” means a defined construction project registered by Customer in the Services, as identified in the applicable Order Form or at the time of purchase.
“Workspace” means an individual collaborative workspace created within a Project in the Services. A single Project may contain one or more Workspaces.
“Project Subscription” means a subscription covering one Project and all Workspaces within it, scoped by the Project Construction Volume.
“Construction Volume Subscription” means an enterprise subscription covering all of Customer’s active Projects and their associated Workspaces, up to the Total Construction Volume limit specified in the applicable Order Form.
Project Subscriptions
A Project Subscription grants Customer and its Authorized Users access to the Services for a single Project, which may encompass one or more Workspaces. Subscriptions are scoped to the Project, not to individual users — all Authorized Users associated with the Project may collaborate within any Workspace under that Project at no additional per-user cost. The scope of a Project Subscription is determined by the Project’s construction volume (the total estimated hard construction cost of the Project, excluding design fees, land costs, and soft costs, as declared by Customer at the time of purchase, the “Project Construction Volume”). The Project Subscription tier applicable to Customer is fixed at the tier specified in the Order Form or selected at the time of purchase, and shall remain in effect for the duration of the then-current subscription term. Hoylu may update its published tier thresholds from time to time, but any such changes shall apply to Customer only upon renewal of the applicable Project Subscription. A Project Subscription may be procured through the Services interface or via an Order Form. If the Project Construction Volume increases during the subscription term such that it exceeds the threshold of the purchased tier, Customer shall notify Hoylu and the parties will agree an upgrade to the applicable tier. Unless the Order Form states otherwise, upgrades are charged on a pro-rata basis for the remaining term. During an active subscription term, Customer may purchase additional Project Subscriptions, each covering a separate Project and its associated Workspaces. Unless the Order Form states otherwise, all Project Subscriptions will share a common renewal date and terminate on the same end date.
Construction Volume Subscriptions
A Construction Volume Subscription is designed for enterprise customers managing multiple concurrent Projects. Rather than subscribing Project by Project, Customer purchases access based on its total active construction volume across all Projects (the aggregate estimated hard construction cost of all active Projects at any given time, excluding design fees, land costs, and soft costs, the “Total Construction Volume”). A Construction Volume Subscription grants Customer and all of its Authorized Users access to an unlimited number of Projects and their associated Workspaces within the Services, up to the Total Construction Volume limit specified in the Order Form, at no additional per-user, per-Project, or per-Workspace charge. Construction Volume Subscriptions are available exclusively via an Order Form. The Total Construction Volume limit, subscription term, fees, and any overage terms will be specified in the applicable Order Form. If Customer’s Total Construction Volume exceeds the purchased limit at any point during the term, Customer shall promptly notify Hoylu and the parties will agree on an upgrade or overage fee as set out in the Order Form.
Purchasing Decisions
Our public statements about the Services or future features are an expression of intent
Trial Subscriptions
From time to time, Hoylu may offer Customer access to the Services on a trial or evaluation basis free of charge for a defined period (the “Trial Period”), as specified at the time of registration or in a written trial agreement. Trial access is provided for evaluation purposes only and not for production use.
A Trial Period will expire on the earlier of: (a) the end of the specified Trial Period; (b) the start date of a paid Project Subscription or Construction Volume Subscription purchased by Customer for the same Services; or (c) termination of the trial by Hoylu in its sole discretion. Hoylu reserves the right to limit, suspend, or terminate any Trial Period at its sole discretion if it reasonably believes Customer’s activities are inconsistent with an evaluation purpose or may create legal or technical risks.
To avoid being charged at the end of the Trial Period, Customer must either purchase a Project Subscription or Construction Volume Subscription, or cease use of the Services, before the Trial Period expires. If Customer is inadvertently charged following cancellation before the Trial Period end, Customer should contact Hoylu at support@hoylu.com. Customer acknowledges that any Customer Data entered into the Services during the Trial Period may be permanently deleted upon expiry of the Trial Period unless Customer converts to a paid subscription before expiry. Customer is responsible for exporting any Customer Data it wishes to retain before the Trial Period ends.
Notwithstanding any other provision of this Agreement, Trial Subscriptions are provided “as is” without any warranty, uptime commitment, indemnification obligation, or support entitlement. Hoylu disclaims all liability in connection with any Trial Subscription.
Choosing to be a Beta Tester
Occasionally, we look for beta testers to help us test our new features. These features will be identified as “beta” or “pre-release,” or words or phrases with similar meanings (each, a “Beta Product”). Beta Products may not be ready for prime time so they are made available “as is,” and any warranties or contractual commitments we make for other Services do not apply. Should Customer encounter any faults with our Beta Products, we would love to hear about them; our primary reason for running any beta programs is to iron out issues before making a new feature widely available.
Feedback is Welcome
The more suggestions our customers make, the better the Services become. If Customer sends us any feedback or suggestions regarding the Services, there is a chance we will use it, so Customer grants us (on behalf of itself and all of its Authorized Users and other Customer personnel) an unlimited, irrevocable, perpetual, sublicensable, transferable, royalty-free license to use any such feedback or suggestions for any purpose without any obligation or compensation to Customer, any Authorized User or other Customer personnel. If we choose not to implement the suggestion, please don’t take it personally. We appreciate it nonetheless.
Privacy Policy
Please review our Privacy Policy for more information on how we collect and use data relating to the use and performance of our websites and products.
Customer and Authorized Users
Use of the Services
Customer must comply with the Agreement and ensure that its Authorized Users comply with the Agreement and the User Terms. We may review conduct for compliance purposes, but we have no obligation to do so. We aren’t responsible for the content of any Customer Data or the way Customer or its Authorized Users choose to use the Services to store or process any Customer Data. The Services are not intended for and should not be used by anyone under the age of 16. Customer must ensure that all Authorized Users are over 16 years old. Customer is solely responsible for providing high speed internet service for itself and its Authorized Users to access and use the Services.
Our Removal Rights
If we believe that there is a violation of the Agreement that can simply be remedied by Customer’s removal of certain Customer Data, we will, in most cases, ask Customer to take direct action rather than intervene. However, we may directly step in and take what we determine to be appropriate action, if Customer does not take appropriate action, or if we believe there is a credible risk of harm to us, the Services, Authorized Users, or any third parties.
Acceptable Use
Customer shall, and shall ensure that its Authorized Users do, comply with Hoylu’s Acceptable Use Policy available at hoylu.com/legal (the “AUP”), as updated from time to time in accordance with the “Modifications” section below. The AUP is incorporated into this Agreement by reference.
In addition to the prohibitions in the AUP, Customer shall not, and shall ensure that its Authorized Users do not:
(a) use the Services in violation of any applicable law or regulation, or in a manner that infringes or violates any Third-Party intellectual property, privacy, publicity, or other rights;
(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code or underlying ideas of the Services, except to the extent such restriction is prohibited by applicable law (including Article 6 of Directive 2009/24/EC on the legal protection of computer programs and its national implementations);
(c) access or use the Services in order to build a competitive product or service, or copy any features, functions, or user interface elements of the Services;
(d) sublicense, resell, rent, lease, time-share, or otherwise make the Services available to any third party, except as expressly permitted under this Agreement;
(e) access or use the Services, or cause the Services to be accessed or used, by any automated means — including bots, scripts, robots, spiders, crawlers, scrapers, headless browsers, robotic process automation (RPA) tools, large language models, or other artificial-intelligence agents — except through interfaces expressly authorized by Hoylu in writing for such access and only in accordance with the terms, scope, rate limits, and other conditions set forth in such authorization. Hoylu may grant, condition, suspend, modify, or revoke such authorization in its discretion. Use of Hoylu’s standard end-user web, desktop, and mobile clients by a natural person logged in as an Authorized User does not require separate authorization under this clause;
(f) attempt to gain unauthorized access to the Services or any related systems or networks, or to defeat, avoid, bypass, or circumvent any authentication, access control, rate limit, or monitoring mechanism of the Services; or
(g) interfere with or disrupt the integrity or performance of the Services or the data of other customers contained therein.
Where a violation of this section or the AUP is deliberate, repeated, or presents a credible risk of harm to Hoylu, the Services, other Authorized Users, or third parties, Hoylu may suspend Customer’s access to the affected Projects and their associated Workspaces immediately, and may terminate the Agreement in accordance with the “Termination for Cause” section. For all other violations, Hoylu shall provide Customer with notice and a reasonable opportunity to cure before exercising suspension or termination rights.
Payment Obligations
Payment Terms
For Customers that purchase our Services, fees are specified in the Order Form(s) — and must be paid in advance. Payment obligations are non-cancelable and, except as expressly stated in the Agreement, fees paid are non-refundable. For clarity, in the event Customer elects not to renew a Project Subscription or Construction Volume Subscription, Customer will remain responsible for any unpaid fees accrued up to the expiration of the then-current subscription term, and the Services will be deemed fully performed and delivered upon expiration of that term. If we agree to invoice Customer by email, full payment must be received within thirty (30) days from the invoice date. Fees are stated exclusive of any taxes, levies, duties, or similar governmental assessments of any nature, including, for example, value-added, sales, use or withholding taxes, assessable by any jurisdiction (collectively, “Taxes”). Customer will be responsible for paying all Taxes associated with its purchases, except for those taxes based on our net income. Should any payment for the Services be subject to withholding tax by any government, Customer will reimburse us for such withholding tax.
Late Payment
Any amounts not paid by Customer when due (excluding amounts disputed in good faith) will accrue interest from the invoice due date at the rate of one and a half percent (1.5%) per month, or the highest rate permitted by applicable law, whichever is lower. Hoylu’s right to charge interest does not limit any other rights or remedies available to Hoylu in respect of overdue amounts.
Usage Verification and Subscription Review
Customer acknowledges that Hoylu may, at its own expense and no more than once per calendar year, review Customer’s use of the Services for the purpose of verifying compliance with this Agreement and the accuracy of declared Project Construction Volumes or Total Construction Volume (each, a “Subscription Review”). Customer shall reasonably cooperate with any Subscription Review and, upon Hoylu’s written request, provide records evidencing its construction volumes (such as project contracts, contract award values, or change orders) within fifteen (15) business days of such request. If a Subscription Review reveals that Customer’s actual construction volume exceeds the purchased limit, Hoylu may invoice Customer for the applicable tier difference or overage, calculated from the date the excess commenced, and Customer shall pay such amounts within thirty (30) days of invoice.
Suspension for Non-Payment
If any fees owed to us by Customer (excluding amounts disputed reasonably and in good faith) are thirty (30) days or more overdue, we may, without limiting our other rights and remedies, suspend Customer’s access to all Projects and their associated Workspaces under the applicable Project Subscription(s) or Construction Volume Subscription until those amounts are paid in full, so long as we have given Customer ten (10) or more days’ prior notice that its account is overdue. Notwithstanding the second paragraph of the “Providing the Services” section below, Customer acknowledges and agrees that a suspension will result in a temporary loss of access to Customer Data during the period of suspension.
Our Obligations
Providing the Services
Customer isn’t the only one with responsibilities; we have some, too. We will (a) make the Services available to Customer and its Authorized Users as described in the Agreement; and (b) not use or process Customer Data for any purpose without Customer’s prior written instructions; provided, however, that “prior written instructions” will be deemed to include use of the Services by Authorized Users and any processing related to such use or otherwise necessary for the performance of the Agreement.
Be assured that (a) the Services will perform materially in accordance with the applicable Order Form and this Agreement; and (b) subject to “Suspension for Non-Payment” sections, we will not materially decrease the functionality of a Service during a subscription term. For any breach of a warranty in this section, Customer’s exclusive remedies are those described in the sections titled “Termination for Cause” and “Effect of Termination”.
Availability
For some of our Services, we also offer specific uptime commitments paired with credits, if we fall short. In those cases, the credits will serve as what the lawyers call liquidated damages and will be Customer’s sole remedy for the downtime and related inconvenience. For all Service plans, we will use commercially reasonable efforts to make the Services available 24 hours a day, 7 days a week, excluding planned downtime. We expect planned downtime to be infrequent but will endeavor to provide Customer with advance notice (e.g., through the Services), if we think it may exceed five (5) continuous minutes.
Protecting Customer Data
The protection of Customer Data is a top priority for us so we will maintain a variety of administrative, physical, and technical safeguards. Those safeguards will include measures for preventing unauthorized access, use, modification, deletion and disclosure of Customer Data by our personnel. Before sharing Customer Data with any of our Third-Party service providers, we will ensure that the Third-Party maintains, at a minimum, reasonable data practices for maintaining the confidentiality and security of Customer Data and preventing unauthorized access. Customer (not us) bears sole responsibility for adequate security, protection and backup of Customer Data when in Customer’s or its representatives’ or agents’ possession or control. We are not responsible for what Customer’s Authorized Users do with Customer Data. That is Customer’s responsibility.
The Hoylu Team
We may leverage our employees, those of our corporate affiliates and third-party contractors (the “Hoylu Team”) in exercising our rights and performing our obligations under the Agreement. We will be responsible for the Hoylu Team’s compliance with our obligations under the Agreement.
Ownership and Proprietary Rights
Customer Ownership
As between us on the one hand, and Customer and any Authorized Users on the other, Customer will own all Customer Data. Subject to the terms and conditions of the Agreement, Customer (on behalf of itself and all of its Authorized Users) grants us and the Hoylu Team a worldwide, non-exclusive, limited term license to access, use, process, copy, distribute, perform, export and display Customer Data, only as reasonably necessary (a) to provide, maintain and update the Services; (b) to prevent or address service, security, support or technical issues; (c) as required by law or in accordance to Hoylu’s policies; and (d) as expressly permitted in writing by Customer. Customer represents and warrants that it has secured all rights in and to Customer Data from its Authorized Users as may be necessary to grant this license.
Hoylu Ownership
We own and will continue to own our Services, including all related intellectual property rights. We may make software components available, via app stores or other channels, as part of the Services. We grant to Customer a non-sublicensable, non-transferable, non-exclusive, limited license for Customer and its Authorized Users to use the object code version of these components, but solely as necessary to use the Services and in accordance with the Agreement and the User Terms. All of our rights not expressly granted by this license are hereby retained.
Statistical and Aggregated Data
Hoylu may collect, derive, and use anonymised and aggregated data generated through Customer’s and its Authorized Users’ use of the Services (“Statistical Usage Data”) for Hoylu’s own internal purposes, including analysis, product improvement, and benchmarking. Statistical Usage Data will not identify Customer, any Authorized User, or any specific Customer Data. Hoylu will not disclose Statistical Usage Data in a form that could reasonably be used to identify Customer or any Authorized User.
Data Processing and Privacy
To the extent Hoylu processes personal data on behalf of Customer in connection with the Services, Customer acts as the data controller and Hoylu acts as the data processor in respect of such personal data. Hoylu’s collection and use of personal data in connection with the Services is described in Hoylu’s Privacy Policy, available at https://www.hoylu.com/privacy-policy/. Where Customer’s use of the Services involves the processing of personal data subject to applicable data protection laws (including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or equivalent legislation), such processing shall be governed by Hoylu’s Data Processing Addendum (“DPA”), which is incorporated into this Agreement by reference and available at hoylu.com/legal/dpa. Customer shall only provide to Hoylu the minimum amount of personal data necessary to enable Customer to use the Services in accordance with this Agreement. Customer is responsible for providing any required notices to, and obtaining any required consents from, its Authorized Users and other data subjects in connection with the processing of their personal data through the Services.
Term and Termination
Term
Each Project Subscription and Construction Volume Subscription has a defined term as specified in the applicable Order Form or at the time of purchase. The Agreement remains effective until all subscriptions ordered under the Agreement have expired or been terminated or the Agreement itself terminates. Termination of the Agreement will terminate all subscriptions and all Order Forms, and access to all associated Projects and their Workspaces.
Auto-Renewal
Unless an Order Form says something different, all subscriptions automatically renew for additional periods of one (1) year. Pricing for renewals may change at our discretion.
Termination for Cause
We or Customer may terminate the Agreement on notice to the other party if the other party materially breaches the Agreement and such breach is not cured within thirty (30) days after the non-breaching party provides notice of the breach. Customer is responsible for its Authorized Users, including for any breaches of this Agreement caused by its Authorized Users. We may terminate the Agreement immediately on notice to Customer if we reasonably believe that the Services are being used by Customer or its Authorized Users in violation of applicable law.
Termination Without Cause
Customer may elect not to renew a Project Subscription or Construction Volume Subscription at the end of its then-current term by providing written notice to Hoylu no less than thirty (30) days prior to the renewal date. We may also terminate any subscription without cause by providing Customer with thirty (30) days prior written notice, in which case we will refund Customer any prepaid fees covering the period after the effective date of termination.
Effect of Termination
Upon any termination for cause by Customer, we will refund Customer any prepaid fees covering the remainder of the term of all subscriptions after the effective date of termination. Upon any termination for cause by us, Customer will pay any unpaid fees covering the remainder of the term of those subscriptions after the effective date of termination. In no event will any termination relieve Customer of the obligation to pay any fees payable to us for the period prior to the effective date of termination.
Data Portability and Deletion
We are custodians of Customer Data. During the term of the applicable Project Subscription or Construction Volume Subscription, Customer will be permitted to export or share certain Customer Data from the Services; provided, however, that because we have different products with varying features and Customer has different retention options, Customer acknowledges and agrees that the ability to export or share Customer Data may be limited or unavailable depending on the type of Services plan in effect and the data retention, sharing or invite settings enabled. Following termination or expiration of the applicable Project Subscription or Construction Volume Subscription, including all associated Projects and Workspaces, Hoylu will provide Customer with read-only access to Customer Data for a period of thirty (30) days from the effective date of termination or expiration (the “Export Window”), during which Customer may export its Customer Data from the Services. Following the Export Window, we will have no obligation to maintain or provide any Customer Data and may thereafter, unless legally prohibited, delete all Customer Data in our systems or otherwise in our possession or under our control. Customer is responsible for exporting all Customer Data it wishes to retain before the end of the Export Window.
Representations; Disclaimer of Warranties
Customer represents and warrants that it has validly entered into the Agreement and has the legal power to do so. Customer further represents and warrants that it is responsible for the conduct of its Authorized Users and their compliance with the terms of this Agreement and the User Terms.
EXCEPT AS EXPRESSLY PROVIDED FOR HEREIN, THE SERVICES AND ALL RELATED COMPONENTS AND INFORMATION ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT ANY WARRANTIES OF ANY KIND, AND WE EXPRESSLY DISCLAIM ANY AND ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. CUSTOMER ACKNOWLEDGES THAT WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.
Limitation of Liability
OTHER THAN IN CONNECTION WITH CUSTOMER’S INDEMNIFICATION OBLIGATIONS HEREUNDER, IN NO EVENT WILL EITHER CUSTOMER’S OR THE HOYLU TEAM’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT OR THE USER TERMS (WHETHER IN CONTRACT OR TORT OR UNDER ANY OTHER THEORY OF LIABILITY) EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER IN THE TWELVE (12) MONTHS PRECEDING THE LAST EVENT GIVING RISE TO LIABILITY. THE FOREGOING WILL NOT LIMIT CUSTOMER’S PAYMENT OBLIGATIONS UNDER THE “PAYMENT TERMS” SECTION ABOVE.
IN NO EVENT WILL EITHER CUSTOMER OR ANY MEMBER OF THE HOYLU TEAM HAVE ANY LIABILITY TO THE OTHER PARTY OR TO ANY THIRD-PARTY FOR ANY LOST PROFITS OR REVENUES OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, COVER OR PUNITIVE DAMAGES HOWEVER CAUSED, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, AND WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW.
The limitations under this “Limitation of Liability” section apply with respect to all legal theories, whether in contract, tort or otherwise, and to the extent permitted by law. The provisions of this “Limitation of Liability” section allocate the risks under this Agreement between the parties, and the parties have relied on these limitations in determining whether to enter into this Agreement and the pricing for the Services.
Indemnification
Customer will defend Hoylu and the members of the Hoylu Team (collectively, the “Hoylu Indemnified Parties”) from and against any and all Third-Party claims, actions, suits, proceedings, and demands arising from or related to Customer’s or any of its Authorized Users’ violation of the Agreement or the User Terms (a “Claim Against Us”), and will indemnify the Hoylu Indemnified Parties for all reasonable attorney’s fees incurred and damages and other costs finally awarded against a Hoylu Indemnified Party in connection with or as a result of, and for amounts paid by a Hoylu Indemnified Party under a settlement Customer approves of in connection with, a Claim Against Us. We must provide Customer with prompt written notice of any Claim Against Us and allow Customer the right to assume the exclusive defense and control, and cooperate with any reasonable requests assisting Customer’s defense and settlement of such matter. This section states your sole liability with respect to, and the Hoylu Indemnified Parties’ exclusive remedy against Customer for, any Claim Against Us.
Hoylu’s Indemnification Obligations
Hoylu will defend Customer and its directors, officers, and employees (collectively, the “Customer Indemnified Parties”) against any Third-Party claim alleging that the Services, as provided by Hoylu and used by Customer in accordance with this Agreement, infringe any valid and enforceable patent, copyright, or registered trademark, or misappropriate a trade secret (a “Claim Against Customer”), and will indemnify the Customer Indemnified Parties for damages and reasonable attorney’s fees finally awarded in connection with such Claim Against Customer. If such a claim is brought or reasonably anticipated, Hoylu may, at its option and expense: (a) procure for Customer the right to continue using the affected Services; (b) modify the Services so they are non-infringing; (c) replace the affected Services with non-infringing technology of substantially similar capability; or (d) if none of the foregoing is commercially practicable, terminate the affected Services on thirty (30) days’ notice and refund any prepaid fees for the terminated Services, pro-rated for the unused portion of the subscription term. Hoylu’s obligations under this section do not apply to claims arising from: (i) Customer’s modification of the Services without Hoylu’s consent; (ii) use of the Services in combination with products or services not provided by Hoylu; (iii) Customer Data; or (iv) Customer’s use of the Services in breach of this Agreement. This section states Hoylu’s entire liability, and Customer’s exclusive remedy, for any Claim Against Customer.
Notwithstanding anything to the contrary in this Agreement, Hoylu’s total aggregate liability under this section, together with all other liabilities under this Agreement, shall not exceed the cap set out in the “Limitation of Liability” section.
Indemnification Procedure
The indemnifying party’s obligations under this Indemnification section are conditioned on the indemnified party: (a) providing prompt written notice of the claim; (b) granting the indemnifying party sole control over the defence and any settlement negotiations (provided that no settlement may be agreed that imposes any obligation or liability on the indemnified party without its prior written consent); and (c) providing all reasonable information and assistance requested by the indemnifying party in connection with the defence or settlement of the claim.
Confidentiality
Confidential Information
Each party (“Disclosing Party”) may disclose “Confidential Information” to the other party (“Receiving Party”) in connection with the Agreement, which is anything that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure including all Order Forms, as well as non-public business, product, technology and marketing information. Confidential Information of Customer includes Customer Data. If something is labeled “Confidential,” that’s a clear indicator to the Receiving Party that the material is confidential. Notwithstanding the above, Confidential Information does not include information that (a) is or becomes generally available to the public without breach of any obligation owed to the Disclosing Party; (b) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party; (c) is received from a Third-Party without breach of any obligation owed to the Disclosing Party; or (d) was independently developed by the Receiving Party.
Protection and Use of Confidential Information
The Receiving Party will (a) take at least reasonable measures to prevent the unauthorized disclosure or use of Confidential Information, and limit access to those employees, affiliates and contractors who need to know such information in connection with the Agreement; and (b) not use or disclose any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement. Nothing above will prevent either party from sharing Confidential Information with financial and legal advisors; provided, however, that the advisors are bound to confidentiality obligations at least as restrictive as those in the Agreement.
Compelled Access or Disclosure
The Receiving Party may access or disclose Confidential Information of the Disclosing Party if it is required by law; provided, however, that the Receiving Party gives the Disclosing Party prior notice of the compelled access or disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party’s cost, if the Disclosing Party wishes to contest the access or disclosure. If the Receiving Party is compelled by law to access or disclose the Disclosing Party’s Confidential Information, the Disclosing Party will reimburse the Receiving Party for its reasonable cost of compiling and providing access to such Confidential Information as well as the reasonable cost for any support provided in connection with the Disclosing Party seeking a protective order or confidential treatment for the Confidential Information to be produced.
Survival
The sections titled “Feedback is Welcome,” “Our Removal Rights,” “Trial Subscriptions,” “Acceptable Use,” “Payment Terms,” “Late Payment,” “Usage Verification and Subscription Review,” “The Hoylu Team,” “Customer Ownership,” “Hoylu Ownership,” “Statistical and Aggregated Data,” “Data Processing and Privacy,” “Effect of Termination,” “Data Portability and Deletion,” “Representations; Disclaimer of Warranties,” “Limitation of Liability,” “Indemnification,” “Hoylu’s Indemnification Obligations,” “Indemnification Procedure,” “Confidentiality,” “Affiliates,” “Professional Services” and “Survival,” as well as all of the provisions under the general heading “General Provisions,” will survive any termination or expiration of the Agreement.
General Provisions
Customer Reference and Marketing Rights
Customer grants Hoylu a non-exclusive, royalty-free, worldwide license to use Customer’s company name, logo, trademarks, and trade names (collectively, “Customer Marks”) for marketing and promotional purposes, including but not limited to:
• Website and Digital Presence – Listing Customer as a client on Hoylu’s website, landing pages, and customer showcase pages.
• Social Media – Referencing or tagging Customer in posts, stories, or announcements across platforms including LinkedIn, X (Twitter), Instagram, Facebook, and others.
• Press and Media – Identifying Customer as a client in press releases, media pitches, analyst briefings, and award submissions.
• Sales and Business Development – Including Customer’s name and logo in pitch decks, proposal documents, RFP responses, and investor materials.
• Advertising – Using Customer’s name or logo in paid digital or print advertising campaigns referencing Hoylu’s customer base.
• Case Studies and Testimonials – Developing case studies, success stories, or testimonials based on Customer’s use of Hoylu’s services, subject to Customer’s prior written approval of the specific content.
• Events and Sponsorships – Referencing Customer as a client in event materials, conference presentations, webinars, or trade show collateral.
All use of Customer Marks shall comply with Customer’s standard trademark and brand usage guidelines, as provided to Hoylu from time to time. Hoylu shall not use Customer Marks in any manner that is false, misleading, disparaging, or that implies endorsement beyond the scope of the parties’ commercial relationship.
Opt-Out Right – This license is granted on an opt-out basis. Customer may withdraw consent at any time by sending written notice to info@hoylu.com. Hoylu will cease new uses of Customer Marks within thirty (30) days of receiving such notice, though pre-existing published materials (e.g., printed collateral or archived web pages) may not be immediately retroactively removed.
Affiliates
Customer may permit its Affiliates to access and use the Services under this Agreement, subject to the following conditions: (a) Customer remains fully liable for its Affiliates’ compliance with the terms of this Agreement and the User Terms; (b) all access by Affiliates is within the scope of Customer’s purchased Project Subscription(s) or Construction Volume Subscription; and (c) Customer shall ensure that each Affiliate agrees to the User Terms before accessing the Services. For the purposes of this Agreement, “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with Customer, where “control” means ownership of more than fifty percent (50%) of the voting securities of such entity.
Force Majeure
Neither us nor Customer will be liable by reason of any failure or delay in the performance of its obligations on account of events beyond the reasonable control of a party, which may include denial-of-service attacks, a failure by a Third-Party hosting provider or utility provider, strikes, shortages, riots, fires, acts of God, war, pandemics, terrorism, and governmental action.
Relationship of the Parties; No Third-Party Beneficiaries
The parties are independent contractors. The Agreement does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no Third-Party beneficiaries to the Agreement.
Professional Services
From time to time, Hoylu may offer professional services, including implementation, onboarding, training, or consulting services (“Professional Services”). Any Professional Services will be governed by a separate statement of work or order form agreed between the parties (each, an “SOW”), which will set out the scope, timeline, fees, and delivery standards applicable to those services. In the event of any conflict between an SOW and this Agreement, the SOW shall prevail with respect to the Professional Services only. Professional Services are distinct from the subscription-based Services and their terms do not modify or supplement this Agreement unless expressly stated in the applicable SOW.
Email and Hoylu Messages
Except as otherwise set forth herein, all notices under the Agreement will be by email, although we may instead choose to provide notice to Customer through the Services. Notices to Hoylu will be sent to info@hoylu.com, except for legal notices, such as notices of termination or an indemnifiable claim, which must be sent to legal@hoylu.com. Notices will be deemed to have been duly given (a) the day after it is sent, in the case of notices through email; and (b) the same day, in the case of notices through the Services.
Modifications
As our business evolves, we may change these Customer Terms and the other components of the Agreement (except any Order Forms). If we make a material change to the Agreement, we will provide Customer with reasonable notice prior to the change taking effect, either by emailing the email address associated with Customer’s account or by messaging Customer through the Services. Customer can review the most current version of the Customer Terms at any time by visiting this page and by visiting the most current versions of the other pages that are referenced in the Agreement. The materially revised Agreement will become effective on the date set forth in our notice, and all other changes will become effective upon posting of the change. If Customer (or any Authorized User) accesses or uses the Services after the effective date, that use will constitute Customer’s acceptance of any revised terms and conditions.
Waiver
No failure or delay by either party in exercising any right under the Agreement will constitute a waiver of that right. No waiver under the Agreement will be effective unless made in writing and signed by an authorized representative of the party being deemed to have granted the waiver.
Severability
The Agreement will be enforced to the fullest extent permitted under applicable law. If any provision of the Agreement is held by a court of competent jurisdiction to be contrary to law, the provision will be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of the Agreement will remain in effect.
Assignment
Except with respect to the Hoylu Team, neither party may assign or delegate any of its rights or obligations hereunder, whether by operation of law or otherwise, without the prior written consent of the other party (not to be unreasonably withheld). Notwithstanding the foregoing, either party may assign the Agreement in its entirety (including all Order Forms), without consent of the other party, to a corporate affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Customer will keep its billing and contact information current at all times by notifying Hoylu of any changes. Any purported assignment in violation of this section is void. A party’s sole remedy for any purported assignment by the other party in breach of this section will be, at the non-assigning party’s election, termination of the Agreement upon written notice to the assigning party. In the event of such a termination by Customer, we will refund Customer any prepaid fees covering the remainder of the term of all subscriptions after the effective date of termination. Subject to the foregoing, the Agreement will bind and inure to the benefit of the parties, their respective successors and permitted assigns.
Which Hoylu Entity is Customer Entering into an Agreement With?
All references to ‘Hoylu,’ ‘we,’ or ‘us’ under the Agreement, what law will apply in any dispute or lawsuit arising out of or in connection with the Agreement, and which courts have jurisdiction over any such dispute or lawsuit, depend on where Customer is domiciled.
Domicile | Hoylu Entity | Governing Law | Venue |
United States & Canada | Hoylu, Inc. | State of Washington | King County, Washington |
Rest of World | Hoylu AB | Sweden | Stockholm, Sweden |
The Agreement, and any disputes arising out of or related hereto, will be governed exclusively by the applicable governing law above, without regard to conflicts of laws rules or the United Nations Convention on the International Sale of Goods. The courts located in the applicable venue above will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the Agreement or its formation, interpretation or enforcement. Each party hereby consents and submits to the exclusive jurisdiction of such courts. In any action or proceeding to enforce rights under the Agreement, the prevailing party will be entitled to recover its reasonable costs and attorney’s fees.
Entire Agreement
The Agreement, including these Customer Terms and all referenced pages and Order Forms, if applicable, constitutes the entire agreement between the parties and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. Without limiting the foregoing, the Agreement supersedes the terms of any online agreement electronically accepted by Customer or any Authorized Users. However, to the extent of any conflict or inconsistency between the provisions in these Customer Terms and any other documents or pages referenced in these Customer Terms, the following order of precedence will apply: (1) the terms of any Order Form (if any), (2) the portions of the Customer Specific Supplement that apply to Customer (if any), (3) the Customer Terms and (4) finally any other documents or pages referenced in the Terms. Notwithstanding any language to the contrary therein, no terms or conditions stated in a Customer purchase order, vendor onboarding process or web portal, or any other Customer order documentation (excluding Order Forms) will be incorporated into or form any part of the Agreement, and all such terms or conditions will be null and void.
Last Revised Date: 9th June 2026
User Terms of Service
[PDF]
Effective: June 9, 2026
These User Terms of Service (the “User Terms”) govern your access and use of our online collaboration and workspace tools, platform, applications and services, including the our mobile and desktop applications (the “Services”). Please read them carefully. Even though you are signing onto an existing workspace, these User Terms apply to you as a user of the Services. We are grateful you’re here.
Binding Agreement
These User Terms are Legally Binding
These User Terms are a legally binding contract between you and us. As part of these User Terms, you agree to comply with the most recent version of our Acceptable Use Policy, which is incorporated by reference into these User Terms. If you access or use the Services, or continue accessing or using the Services after being notified of a change to the User Terms or the Acceptable Use Policy, you confirm that you have read, understand and agree to be bound by the User Terms and the Acceptable Use Policy. “We”, “our” and “us” currently refers to the applicable Hoylu entity in the Agreement (defined below).
Customer’s Choices and Instructions
You are an Authorized User on a Workspace Controlled by a “Customer”
An organization or other third party that we refer to in these User Terms as “Customer” has invited you to a workspace (i.e., a unique domain where a group of users may access the Services, as further described in our Support pages). If you are joining one of your employer’s workspaces, for example, Customer is your employer. If you are joining a workspace created by your friend using her personal email address to work on her new startup idea, she is our Customer and she is authorizing you to join her workspace.
What This Means for You—and for Us
Customer has separately agreed to our Customer Terms of Service or entered into a written agreement with us (in either case, the “Agreement”) that permitted Customer to create and configure a workspace so that you and others could join (each invitee granted access to the Services, including you, is an “Authorized User”). The Agreement contains our commitment to deliver the Services to Customer, who may then invite Authorized Users to join its workspace(s). When an Authorized User (including, you) submits content or information to the Services, such as messages or files (“Customer Data”), you acknowledge and agree that the Customer Data is owned by Customer and the Agreement provides Customer with many choices and control over that Customer Data. For example, Customer may provision or deprovision access to the Services, enable or disable third party integrations, manage permissions, retention and export settings, transfer or assign workspaces, share channels, or consolidate your workspace or channels with other workspaces or channels, and these choices and instructions may result in the access, use, disclosure, modification or deletion of certain or all Customer Data. Please check out our Support pages for more detail on our different Service plans and the options available to Customer.
The Relationship Between You, Customer and Us
AS BETWEEN US AND CUSTOMER, YOU AGREE THAT IT IS SOLELY CUSTOMER’S RESPONSIBILITY TO (A) INFORM YOU AND ANY AUTHORIZED USERS OF ANY RELEVANT CUSTOMER POLICIES AND PRACTICES AND ANY SETTINGS THAT MAY IMPACT THE PROCESSING OF CUSTOMER DATA; (B) OBTAIN ANY RIGHTS, PERMISSIONS OR CONSENTS FROM YOU AND ANY AUTHORIZED USERS THAT ARE NECESSARY FOR THE LAWFUL USE OF CUSTOMER DATA AND THE OPERATION OF THE SERVICES; (C) ENSURE THAT THE TRANSFER AND PROCESSING OF CUSTOMER DATA UNDER THE CONTRACT IS LAWFUL; AND (D) RESPOND TO AND RESOLVE ANY DISPUTE WITH YOU AND ANY AUTHORIZED USER RELATING TO OR BASED ON CUSTOMER DATA, THE SERVICES OR CUSTOMER’S FAILURE TO FULFILL THESE OBLIGATIONS. HOYLU MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, TO YOU RELATING TO THE SERVICES, WHICH ARE PROVIDED TO YOU ON AN “AS IS” AND “AS AVAILABLE” BASIS.
Ground Rules
You Must be Over the Legal Age
To the extent prohibited by applicable law, the Services are not intended for and should not be used by anyone under the age of sixteen. You represent that you are over the legal age and are the intended recipient of Customer’s invitation to the Services. You may not access or use the Services for any purpose if either of the representations in the preceding sentence is not true. Without limiting the foregoing, you must be of legal working age.
Follow the Rules
To help ensure a safe and productive work environment, all Authorized Users must comply with our Acceptable Use Policy and any applicable policies established by Customer. If you see inappropriate behavior or content, please report it to your Primary Owner or employer.
Term
These User Terms remain effective until Customer’s subscription for you expires or terminates, or your access to the Services has been terminated by Customer or us. Please contact Customer if you at any time or for any reason wish to terminate your account, including due to a disagreement with any updates to these User Terms or the Acceptable Use Policy.
Limitation of Liability
If we believe that there is a violation of the Agreement, User Terms, the Acceptable Use Policy, or any of our other policies that can simply be remedied by Customer’s removal of certain Customer Data or taking other action, we will, in most cases, ask Customer to take action rather than intervene. We may directly step in and take what we determine to be appropriate action (including disabling your account) if Customer does not take appropriate action or we believe there is a credible risk of harm to us, the Services, Authorized Users, or any third parties.
IN NO EVENT WILL YOU OR WE HAVE ANY LIABILITY TO THE OTHER FOR ANY LOST PROFITS OR REVENUES OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, COVER OR PUNITIVE DAMAGES HOWEVER CAUSED, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, AND WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. UNLESS YOU ARE ALSO A CUSTOMER (AND WITHOUT LIMITATION TO OUR RIGHTS AND REMEDIES UNDER THE CONTRACT), YOU WILL HAVE NO FINANCIAL LIABILITY TO US FOR A BREACH OF THESE USER TERMS. OUR MAXIMUM AGGREGATE LIABILITY TO YOU FOR ANY BREACH OF THE USER TERMS IS ONE HUNDRED DOLLARS ($100) IN THE AGGREGATE. THE FOREGOING DISCLAIMERS WILL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW AND DO NOT LIMIT EITHER PARTY’S RIGHT TO SEEK AND OBTAIN EQUITABLE RELIEF.
Application of Consumer Law
Hoylu is a workplace tool intended for use by businesses and organizations and not for consumer purposes. To the maximum extent permitted by law, you hereby acknowledge and agree that consumer laws do not apply. If however any consumer laws (e.g., in Australia, the Competition and Consumer Act 2010 (Cth)) do apply and cannot otherwise be lawfully excluded, nothing in these User Terms will restrict, exclude or modify any statutory warranties, guarantees, rights or remedies you have, and our liability is limited (at our option) to the replacement, repair or resupply of the Services or the pro-rata refund to Customer of pre-paid fees for your subscription covering the remainder of the term.
Survival
The sections titled “The Relationship Between You, Customer, and Us,” “Limitation of Liability,” and “Survival,” and all of the provisions under the general heading “General Provisions” will survive any termination or expiration of the User Terms.
General Provisions
Email and Hoylu Messages
Except as otherwise set forth herein, all notices under the User Terms will be by email, although we may instead choose to provide notice to Authorized Users through the Services. Notices to Hoylu should be sent to info@hoylu.com, except for legal notices, which must be sent to legal@hoylu.com. A notice will be deemed to have been duly given (a) the day after it is sent, in the case of a notice sent through email; and (b) the same day, in the case of a notice sent through the Services. Notices under the Agreement will be delivered solely to Customer in accordance with the terms of that agreement.
Privacy Policy
Please review our Privacy Policy for more information on how we collect and use data relating to the use and performance of our products.
Modifications
As our business evolves, we may change these User Terms or the Acceptable Use Policy. If we make a material change to the User Terms or the Acceptable Use Policy, we will provide you with reasonable notice prior to the change taking effect either by emailing the email address associated with your account or by messaging you through the Services. You can review the most current version of the User Terms at any time by visiting this page, and by visiting the following for the most current versions of the other pages that are referenced in these User Terms: Acceptable Use Policy and Privacy Policy. Any material revisions to these User Terms will become effective on the date set forth in our notice, and all other changes will become effective on the date we publish the change. If you use the Services after the effective date of any changes, that use will constitute your acceptance of the revised terms and conditions.
Export
You agree to comply with all relevant U.S. and foreign export and import Laws in using the Services. You (a) represent and warrant that you are not listed on any U.S. government list of prohibited or restricted parties or located in (or a national of) a country that is subject to a U.S. government embargo or that has been designated by the U.S. government as a “terrorist supporting” country, (b) agree not to access or use the Services in violation of any U.S. export embargo, prohibition or restriction and (c) will not submit to the Services any information controlled under the U.S. International Traffic in Arms Regulations.
Waiver
No failure or delay by either party in exercising any right under the User Terms, including the Acceptable Use Policy, will constitute a waiver of that right. No waiver under the User Terms will be effective unless made in writing and signed by an authorized representative of the party being deemed to have granted the waiver.
Severability
The User Terms, including the Acceptable Use Policy, will be enforced to the fullest extent permitted under applicable law. If any provision of the User Terms is held by a court of competent jurisdiction to be contrary to law, the provision will be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of the User Terms will remain in effect.
Assignment
You may not assign any of your rights or delegate your obligations under these User Terms, including the Acceptable Use Policy, whether by operation of law or otherwise, without the prior written consent of us (not to be unreasonably withheld). We may assign these User Terms in their entirety (including all terms and conditions incorporated herein by reference), without your consent, to a corporate affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of our assets.
Governing Law; Venue; Fees
The User Terms, including the Acceptable Use Policy, and any disputes arising out of or related hereto, will be governed exclusively by the same applicable governing law of the Agreement, without regard to conflicts of laws rules or the United Nations Convention on the International Sale of Goods. The courts located in the applicable venue of the Agreement will have exclusive jurisdiction to adjudicate any dispute arising out of or relating to the User Terms, including the Acceptable Use Policy, or its formation, interpretation or enforcement.
Each party hereby consents and submits to the exclusive jurisdiction of such courts. In any action or proceeding to enforce rights under the User Terms, the prevailing party will be entitled to recover its reasonable costs and attorney’s fees.
Entire Agreement
The User Terms, including any terms incorporated by reference into the User Terms, constitute the entire agreement between you and us and supersede all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. To the extent of any conflict or inconsistency between the provisions in these User Terms and any pages referenced in these User Terms, the terms of these User Terms will first prevail; provided, however, that if there is a conflict or inconsistency between the Agreement and the User Terms, the terms of the Agreement will first prevail, followed by the provisions in these User Terms, and then followed by the pages referenced in these User Terms (e.g., the Privacy Policy). Customer will be responsible for notifying Authorized Users of those conflicts or inconsistencies and until such time the terms set forth herein will be binding.
Contacting Hoylu
Please also feel free to contact us if you have any questions about Hoylu’s User Terms of Service. You may contact us at info@hoylu.com or at our mailing address below:
For Customers and Authorized Users who use Workspaces established for Customers in the US and Canada:
Hoylu Inc.
11335 NE 122nd Way, Suite 105
Kirkland, WA 98034
USA
For Customers and Authorized Users who use Workspaces established for Customers outside the US and Canada:
Hoylu Norge AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AB
Åbjörnaboda Svenskatorpet 2
341 55 Vittaryd
Sweden
Last Revised Date: 9th June 2026
Customer Specific Supplement
Effective: September 18, 2020
The terms of the Customer Specific Supplement (“Customer Specific Supplement”) below supplement and amend Customer’s Contract (as defined in our Customer Terms of Service) if Customer falls into the corresponding category of Customer.
If there is any conflict between the Customer Specific Supplement and the Contract, the applicable terms in the Customer Specific Supplement will prevail. Nothing in this Customer Specific Supplement makes us a government contractor for any federal, state, local, or foreign government.
I. U.S. Government Customers
If Customer is a U.S. government or U.S. public entity (or use of the Services is for the U.S. Government), the terms of the Customer Specific Supplement in this Section I apply.
- Use By or For the U.S. Government. The Services are a “commercial item,” as defined at 48 C.F.R. §2.101, and constitute “commercial computer software” and “commercial computer software documentation,” as used in 48 C.F.R. §12.212 or 48 C.F.R. §227.7202 to §227.7204. This commercial computer software and related Documentation is provided to end users for use, by and on behalf of the U.S. Government, with only those rights as are granted to all other end users pursuant to the terms and conditions herein.
- Indemnification, Auto-Renewal, Venue, Legal Fees: The sections in the Contract titled “Governing Law,” “Auto-renewal,” “Venue; Waiver of Jury Trial; Fees,” and “Customer’s Indemnification of Us” are hereby waived to the extent they are inconsistent with federal law.
- No Endorsement: We agree that Customer’s seals, trademarks, logos, service marks, trade names, and the fact that Customer has a presence on one of our Sites and uses our Services, will not be used by us in such a manner as to state or imply that our products or services are endorsed, sponsored or recommended by Customer or by any other element of the U.S. Government, or are considered by Customer or the U.S. Government to be superior to any other products or services. Except for pages whose design and content is under the control of the Customer, or for links to or promotion of such pages, we agree not to display any Customer or government seals, trademarks, logos, service marks, and trade names on our homepage or elsewhere on one of our hosted sites unless permission to do so has been granted by Customer or by other relevant federal government authority. We may list Customer’s name in a publicly available customer list on a Site or elsewhere so long as the name is not displayed in a more prominent fashion than that of any other third party name.
II. State or Local Government Customers
This Section II applies to Customer if Customer is a state or local government, but only to the extent the Services are being used in an Authorized User’s official capacity as a state or local government official. The sections in the Contract titled “Governing Law,” “Venue; Waiver of Jury Trial; Fees,” and “Indemnification of Us” will not apply to Customer only to the extent Customer’s jurisdiction’s laws prohibit Customer from accepting the requirements in those sections.
III. Healthcare Customers
Unless Customer has entered into a written agreement with Hoylu to the contrary, Customer acknowledges that Hoylu is not a “Business Associate” as defined in the Health Insurance Portability and Accountability Act and related amendments and regulations as updated or replaced (“HIPAA”), and that the Services are not HIPAA compliant. Customer must not use, disclose, transmit or otherwise process any “Protected Health Information” as defined in HIPAA (“PHI”) through the Services. Customer agrees that we cannot support and have no liability for PHI received from Customer, notwithstanding anything to the contrary herein.
IV. Education Professional Customers
If Customer is a school or educator in the United States and wants its students, who are over the age of 13, to use the Services, Customer is responsible for complying with the U.S. Family Educational Rights and Privacy Act (“FERPA”). This means Customer must notify those students’ parents/guardians of the personally identifiable information that it will collect and share with us and obtain parental/guardian consent before its students sign up or use the Services. When obtaining such consent, Customer should provide parents/guardians with a copy of our Privacy Policy. Customer must keep all consents on file and provide them to us if we request them. If Customer is located outside of the United States, we will rely upon Customer to obtain any required consents or approvals from the parent or guardian of any student covered by similar laws and, as a condition to Customer’s and its students’ use of the Services, Customer will comply with such laws.
V. Patent Assertion Entities
You agree that if Customer is a Patent Assertion Entity or is acting on behalf of, or for the benefit of a Patent Assertion Entity, Customer will not assert, or authorize, assist, encourage, or enable any third party to assert, any claim, or pursue any actions, suits, proceedings, or demands, against Hoylu or its affiliates that allege that the Services infringe, misappropriate, or otherwise violate any intellectual property rights (including patents). A “Patent Assertion Entity,” sometimes referred to as a ‘non-practicing entity’ or a ‘patent troll,’ is (a) any entity that derives or seeks to derive most of its revenue from the offensive assertion of patent rights, or (b) directly or indirectly controls, is controlled by, or is under common control with an entity described in (a). This section will survive any termination or expiration of the Contract.
Contacting Hoylu
Please also feel free to contact us if you have any questions about Hoylu’s Customer Specific Supplement. You may contact us at info@hoylu.com or at our mailing address below:
Hoylu Inc.
11335 NE 122nd Way, Suite 105
Kirkland, WA 98034
USA
Last Revised Date: 26.05.2026
Acceptable Use Policy
Effective: September 18, 2020
This Acceptable Use Policy sets out a list of acceptable and unacceptable conduct for our Services. If we believe a violation of the policy is deliberate, repeated or presents a credible risk of harm to other users, our customers, the Services or any third parties, we may suspend or terminate your access. This policy may change as Hoylu grows and evolves, so please check back regularly for updates and changes.
Capitalized terms used below but not defined in this policy have the meaning set forth in the User Terms of Service.
Do:
- comply with all User Terms of Service, including the terms of this Acceptable Use Policy;
- comply with all applicable laws and governmental regulations, including, but not limited to, all intellectual property, data, privacy, and export control laws, and regulations promulgated by any government agencies, including, but not limited to, the U.S. Securities and Exchange Commission, and any rules of any national and other securities exchanges;
- upload and disseminate only Customer Data to which Customer owns all required rights under law and under contractual and fiduciary relationships (such as proprietary and confidential information learned or disclosed as part of employment relationships or under nondisclosure agreements) and do so only consistent with applicable law;
- use commercially reasonable efforts to prevent unauthorized access to or use of the Services;
- keep passwords and all other login information confidential;
- monitor and control all activity conducted through your account in connection with the Services;
- promptly notify us if you become aware of or reasonably suspect any illegal or unauthorized activity or a security breach involving your accounts or teams, including any loss, theft, or unauthorized disclosure or use of a username, password, or account; and
- comply in all respects with all applicable terms of the third party applications, including any that Customer elects to integrate with the Services that you access or subscribe to in connection with the Services.
Do Not:
- permit any third party that is not an Authorized User to access or use a username or password for the Services;
- share, transfer or otherwise provide access to an account designated for you to another person;
- use the Services to store or transmit any Customer Data that may infringe upon or misappropriate someone else’s trademark, copyright, or other intellectual property, or that may be tortious or unlawful;
- upload to, or transmit from, the Services any data, file, software, or link that contains or redirects to a virus, Trojan horse, worm, or other harmful component or a technology that unlawfully accesses or downloads content or information stored within the Services or on the hardware of Hoylu or any third party;
- attempt to reverse engineer, decompile, hack, disable, interfere with, disassemble, modify, copy, translate, or disrupt the features, functionality, integrity, or performance of the Services (including any mechanism used to restrict or control the functionality of the Services), any third party use of the Services, or any third party data contained therein (except to the extent such restrictions are prohibited by applicable law);
- attempt to gain unauthorized access to the Services or related systems or networks or to defeat, avoid, bypass, remove, deactivate, or otherwise circumvent any software protection or monitoring mechanisms of the Services;
- access the Services in order to build a similar or competitive product or service or copy any ideas, features, functions, or graphics of the Services;
- use the Services in any manner that may harm minors or that interacts with or targets people under the age of thirteen;
- engage in activity that incites or encourages violence or hatred against individuals or groups;
- impersonate any person or entity, including, but not limited to, an employee of ours, an “Administrator”, an “Owner”, or any other Authorized User, or falsely state or otherwise misrepresent your affiliation with a person, organization or entity;
- use the Services to provide material support or resources (or to conceal or disguise the nature, location, source, or ownership of material support or resources) to any organization(s) designated by the United States government as a foreign terrorist organization pursuant to section 219 of the Immigration and Nationality Act or other laws and regulations concerning national security, defense or terrorism;
- access, search, or create accounts for the Services by any means other than our publicly supported interfaces (for example, “scraping” or creating accounts in bulk);
- send unsolicited communications, promotions or advertisements, or spam;
- place any advertisements within a Hoylu client;
- send altered, deceptive or false source-identifying information, including “spoofing” or “phishing”;
- abuse referrals or promotions to get more credits than deserved;
- sublicense, resell, time share or similarly exploit the Services;
- use the Services for consumer purposes, as Hoylu is intended for use by businesses and organizations;
- access or use the Services on behalf of, or for the benefit of, any Patent Assertion Entity (as defined in the Customer-Specific Supplement);
- use contact or other user information obtained from the Services (including email addresses) to contact Authorized Users outside of the Services without their express permission or authority or to create or distribute mailing lists or other collections of contact or user profile information for Authorized Users for use outside of the Services; or
- authorize, permit, enable, induce or encourage any third party to do any of the above.
Contacting Hoylu
Please also feel free to contact us if you have any questions about Hoylu’s Acceptable Use Policy. You may contact us at info@hoylu.com or at our mailing address below:
For Customers and Authorized Users who use Workspaces established for Customers in the US and Canada:
Hoylu Inc.
11335 NE 122nd Way, Suite 105
Kirkland, WA 98034
USA
For Customers and Authorized Users who use Workspaces established for Customers outside the US and Canada:
Hoylu Norge AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AB
Åbjörnaboda Svenskatorpet 2
341 55 Vittaryd
Sweden
Last Revised Date: 26.05.2026
Global Trade Compliance
Hoylu’s products and services are subject to U.S. economic sanctions regulations and may be subject to U.S. export control restrictions. You and/or the user are responsible for complying with any local laws in your jurisdiction that may impact your right to import, export, or use Hoylu’s products, services, software, and technologies.
Below is Hoylu’s Export Control Classification Number (“ECCN”) for Hoylu’s products and services and the license exception per the United States Department of Commerce’s Export Administration Regulations (“EAR”).
Hoylu makes no representation or warranty as to the accuracy or reliability of the classifications listed herein. Any use of such classifications by the user, is without recourse to Hoylu and is at the users’ own risk. Hoylu is in no way responsible for any damages whether direct, consequential, incidental, or otherwise, suffered by the user as a result of using or relying upon such classifications, for any purpose whatsoever.
Product name | ECCN | License Exception |
Hoylu Sketch Windows desktop application | 5D992.c | Mass market |
Hoylu Sketch Mac desktop application | 5D992.c | Mass market |
Hoylu Sketch iOS mobile application | 5D992.c | Mass market |
Hoylu Sketch Android mobile application | 5D992.c | Mass market |
Hoylu Flow Windows desktop application | 5D992.c | Mass market |
Hoylu Flow Mac desktop application | 5D992.c | Mass market |
Hoylu Flow iOS mobile application | 5D992.c | Mass market |
Hoylu Flow Android mobile application | 5D992.c | Mass market |
Hoylu Personal Edition Windows desktop application | 5D992.c | Mass market |
Hoylu Personal Edition Mac desktop application | 5D992.c | Mass market |
Hoylu Personal Edition iOS mobile application | 5D992.c | Mass market |
Hoylu Personal Edition Android mobile application | 5D992.c | Mass market |
Hoylu Device Edition Windows desktop application | 5D992.c | Mass market |
Hoylu Device Edition Mac desktop application | 5D992.c | Mass market |
Hoylu Device Edition iOS mobile application | 5D992.c | Mass market |
Hoylu Device Edition Android mobile application | 5D992.c | Mass market |
Hoylu Wall Edition Windows desktop application | 5D992.c | Retired |
Hoylu Wall Edition Mac desktop application | 5D992.c | Retired |
Hoylu Wall Edition iOS mobile application | 5D992.c | Retired |
Hoylu Wall Edition Android mobile application | 5D992.c | Retired |
Restricted access to Hoylu
If you’ve been prevented from creating a Hoylu account or blocked from using Hoylu’s services, you may be located in a country or region with restricted access. If you have any questions, get in touch with us by using the Contact button in the top right.
Service Level Agreement
Hoylu Service Level Agreement (SLA)
[PDF]
1.0 Agreement Overview
1.1. SLA Introduction
This is a Service Level Agreement, henceforth also known as the “SLA” is between Hoylu Inc. and the client for all services and service levels in connection to the Hoylu platform service, henceforth also known as “Service.”
1.2. Definitions, Conventions, Acronyms, and Abbreviations
Term | Description |
SLA | Service Level Agreement |
Accuracy | Degree of conformance between a result specification and standard value |
Client | A person (or enterprise) who accesses the Hoylu platform through a sign-on, authenticated process. |
Customer | A person (or enterprise) who accesses the Hoylu platform through a sign-on, authenticated process. |
Company | Identifies Hoylu, Inc. |
End-User | A person who accesses the Hoylu platform through a sign-on, authenticated process. |
Service | The Hoylu platform (app.hoylu.com; us.hoylu.com) |
Service Provider | Identifies Hoylu, Inc. |
Support Team | The Hoylu Support team is utilized to troubleshoot any platform-related issues/concerns. |
Timeliness | The characteristic represents the performance of an action that leaves sufficient time remaining to maintain SLA service expectations. |
1.3. Purpose
The purpose of this SLA is to specify the requirements of the SaaS service as defined herein with regards to:
Requirements for services that will be provisioned to the Customer
Agreed service targets
Criteria for target fulfillment evaluation
Roles and responsibilities of Service Provider and Customer
Supporting processes, limitations, exclusions, and deviations
2.0 Service Agreement Overview
2.1. Service Availability Targets
The Service for hosting production instances will be available to Clients on a 24×7 basis, except for maintenance windows or other scheduled or application-specific maintenance outlined in this document.
It is our goal to ensure that services supporting the Service are deemed reliable in terms of availability (Uptime) and performance. Therefore, we will measure the reliability using Mean Time Between Failures (MTBF) and compute the average (by month and year) time between each “failure.” Hoylu will strive to achieve a MTBF of 30 days at the minimum.
The target availability (Uptime) of Service is 99.5%.
If Hoylu falls short of the 99.5% Uptime commitment and the Customer is affected, Hoylu will apply a Service Credit to Customer’s account for future use.
Downtime is the number of continuous minutes Services were unavailable during a calendar month (i.e., June 1 through June 30). Hoylu calculates unavailability using server monitoring software to measure the server-side error rate, ping test results, web server tests, TCP port tests, and website tests.
Downtime excludes the following:
Slowness or other performance issues with individual features (link expansions, search, file uploads, etc.)
Issues that are related to external apps or third parties, including shared channels
Any products or features identified as the pilot, alpha, beta or similar
External network or equipment problems outside of our reasonable control, such as bad routing tables between your internet service provider (ISP) and our server
Scheduled Downtime for maintenance.
Any brief unavailability up to 2 minutes.
Service Credits
If Hoylu falls short of our Uptime commitment, Hoylu will apply a credit to the Customer’s account equal to the monthly amount billed for the Services during the period Hoylu was down (we call these Service Credits).
Service Credits are not refunds, cannot be exchanged into a cash amount, are capped at a maximum of 30 days of paid service, requires Customer to have paid any outstanding invoices, and expire upon termination of Enterprise Agreement. Service Credits are the sole and exclusive remedy for any failure by Hoylu to meet its obligations under this SLA.
Note, Downtime doesn’t affect everyone at the same time or in the same way. For example, some accounts may receive Service Credits during an outage in their region, while other accounts in other regions that have not been similarly affected will not.
2.2. Service Maintenance
Maintenance includes but is not limited to: adding/removing/replacing servers, networks, or Service features, new/updated feature or product releases, or any change that may have an overall impact on the Service’s availability.
Maintenance Windows: Standard. Non-Standard. Emergency
At this time, Hoylu has a Standard Maintenance Window that requires zero downtime; as a result, no specific date or time has been established for Standard Maintenance Windows or Non-Standard Maintenance Windows.
It is understood that in some circumstances, Emergency Maintenance Windows will be required.
2.3. Service Levels, Rankings, Priority, and Handling
Timelines below reflect estimated Support Team Response times based on identified Category as determined by Hoylu, Inc.
Category | Definition | Initial Response Timeline (SLA) |
Informational | Inquiry for information (example: “how-to” scenarios”) | 1 (one) Business Day (Monday-Friday) |
Low | Minimal effect: the company can still provide all critical services to all users but has lost efficiency (for example: a few users experience workspaces not saving; one “organization” cannot log in to the system) | 2 (two) Business Hours (Monday-Friday) |
Medium | The Company has lost the ability to provide critical services to a subset of system users (for example: partial data loss/workspaces not saving with impact to multiple organizations/users) | 1 (one) Business Hour (Monday-Friday) |
High | The Company is no longer able to provide some critical services to any users (for example: complete outage; all clients workspaces not saving; data-security incident) | 10 (ten) Business Minutes (Monday-Friday) |
The timeline below reflects Functional Impact Categories and estimated Engineering response time once reported to the Hoylu Support Team.
Severity Level | Description | Target Response |
1. High | The Company is no longer able to provide some critical services to any users (for example: complete outage, all clients workspaces not saving, data-security incident) | 2 (two) Business Hours (Monday – Friday) |
2. Medium | The Company has lost the ability to provide critical services to a subset of system users (for example: partial data loss/workspaces not saving with impact to multiple organizations/users) | 1 (one) Business Day (Monday – Friday) |
3. Low | Minimal effect: the company can still provide all critical services to all users but has lost efficiency (for example: a few users experience workspaces not saving; one “organization” cannot log in to system) | 1 (one) Week |
Handling
Requests for support will be fulfilled based on priorities determined by urgency and level of impact (as determined by the Hoylu Support team).
Response is defined as a “good faith” effort to communicate with the Client using the contact information provided. The response may be via phone or email.
Response times are measured once a request is submitted via the Hoylu issue tracking system. Other forms of contact may negatively affect the ability of Hoylu to meet the requests in a timely fashion. Examples include direct email/phone/another contact with an individual Hoylu personnel.
Response Times
Responses will be driven by the priority assigned to the Service as defined in this SLA. Note: Complex service and support requests involving coordination with 3rd parties, etc. may require additional effort and time to resolve.
2.4. Exceptions and Limitations
This SLA is subject to the following exceptions and special conditions:
Service Provider must ensure platform availability of 99.5% during standard business hours (Monday-Friday).
Service Provider may not be liable to credit reimbursements for service impacts to data centers due to natural disasters or force majeure.
Response to request of Severity Level 2 or below by Customer can be delayed up to 24 hours during non-business days and/or observed holidays by the Service Provider.
2.5. Responses and Responsibilities
Customer/Client responsibilities:
Customers should contact Hoylu Support Team via:
Email Support: support@hoylu.com; or,
Online Support: https://www.hoylu.com/support/
Contacting a Hoylu representative (employee) directly does not initiate the timelines noted in this document.
The customer should provide all necessary information and assistance related to service performance that allows Hoylu to meet the performance standards as outlined in this document.
The customer shall inform Hoylu regarding changing business requirements that may necessitate a review, modification, or overall scope to the requested issue/concern.
The customer will make sure that all responses to the Hoylu response team are within 24 hours of the initial response or any additional follow-up messages.
Hoylu responsibilities:
Hoylu will act as the primary support provider of the services herein identified except when third-party vendors are employed, who shall assume appropriate service support responsibilities accordingly.
Hoylu will inform Customers regarding scheduled and unscheduled service outages due to maintenance, troubleshooting, disruptions, or otherwise necessary.
Hoylu System Status Page shall serve as the primary notification system and can be found online at: https://www.hoylu.com/status
2.6. Service Management (Support Hours)
Service support coverage by Hoylu, Inc., as outlined in this agreement, follows the schedule specified below:
Email and Online Support: During standard business hours [9:00 A.M. to 5 P.M. (EST), Monday to Friday]. Please note that support availability may vary during holidays.
2.7. Support Contact Options
Clients can contact Hoylu Support Service for support by:
Email Support: support@hoylu.com; or,
Online Support Ticket: https://www.hoylu.com/support/ (Recommended)
2.8. Escalation Requests and Procedures
If service is unsatisfactory, you may also contact the Hoylu Support team to express any concerns at support@hoylu.com
In the event that additional escalation is determined to be necessary, Hoylu will escalate to its Executive Leadership Team for a resolution.
Hoylu may ask for your feedback.
3.0 Updates
As Hoylu’s business evolves, Hoylu may change Hoylu’s Service Level Agreement.
Last Revised Date: 9th June 2026
Privacy Policy
Hoylu Privacy Policy
Summary
Effective: September 18, 2020
At Hoylu, we value your privacy and the protection of your personal data. You may withdraw your consent to use your personal data. If you would like to withdraw your consent, go to https://www.hoylu.com/consent-withdrawal/ for more information.
Hoylu AB operates Hoylu Software and https://www.hoylu.com/consent-withdrawal/. This page informs you of our policies regarding the collection, use and disclosure of Personal Information we receive from users of the Websites and the Services.
This Privacy Policy describes how Hoylu collects, uses and discloses information, and what choices you have with respect to the information.
When we refer to “Hoylu”, we mean the Hoylu entity that acts as the controller or processor of your information, as explained in more detail in the “Identifying the Data Controller and Processor” section below.
Applicability of This Privacy Policy
This Privacy Policy applies to Hoylu’s online collaboration and workspace tools, platform, applications and services, including the our mobile and desktop applications (collectively, the “Services”), Hoylu.com and other Hoylu websites (collectively, the “Websites”) and other interactions (e.g., customer service inquiries, user conferences, etc.) you may have with Hoylu. If you do not agree with the terms, do not access or use the Services, Websites or any other aspect of Hoylu’s business.
This Privacy Policy does not apply to any third-party applications or software that integrate with the Services through the Hoylu platform (“Third Party Services”), or any other third-party products, services or businesses. In addition, a separate agreement governs delivery, access and use of the Services (the “Customer Agreement”), including the processing of any text, files or other content submitted through Services accounts (collectively, “Customer Data”). The organization (e.g., your employer or another entity or person) that entered into the Customer Agreement (“Customer”) controls its instance of the Services (its “Workspace”) and any associated Customer Data. If you have any questions about specific Workspace settings and privacy practices, please contact the Customer whose Workspace you use.
Information We Collect and Receive
Hoylu may collect and receive Customer Data and other information and data (“Other Information”) in a variety of ways:
Customer Data. Customers or individuals granted access to a Workspace by a Customer (“Authorized Users”) routinely submit Customer Data to Hoylu when using the Services.
Other Information. Hoylu also collects, generates and/or receives Other Information:
I. Workspace and Account Information. To create or update a Workspace account, you or your Customer (e.g., your employer) supply Hoylu with your name, address, telephone number, email address, password, domain and/or similar account details. In addition, Customers that purchase a paid version of the Services provide Hoylu (or its payment processors) with billing details such as credit card information, banking information and/or a billing address.
II. Usage Information.
Services Metadata. When an Authorized User interacts with the Services, metadata is generated that provides additional context about the way Authorized Users work. For example, Hoylu logs the Workspaces, channels, people, features, content and links you view or interact with, the types of files shared, and what Third Party Services are used (if any).
Log data. As with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Websites or Services and record it in log files. This log data may include the Internet Protocol (IP) address, the address of the web page visited before using the Website or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences and cookie data.
Device information. Hoylu collects information about devices accessing the Services, including type of device, what operating system is used, device settings, application IDs, unique device identifiers and crash data. Whether we collect some or all of this Other Information often depends on the type of device used and its settings.
Location information. We receive information from you, your Customer and other third-parties that helps us approximate your location. We may, for example, use a business address submitted by your employer, or an IP address received from your browser or device to determine approximate location. Hoylu may also collect location information from devices in accordance with the consent process provided by your device.
III. Cookie Information. Hoylu uses cookies and similar technologies in our Websites and Services to help us collect Other Information. The Websites and Services may also include cookies and similar tracking technologies of third parties, which may collect Other Information about you via the Websites and Services and across other websites and online services.
IV. Contact Information. In accordance with the consent process provided by your device, any contact information that an Authorized User chooses to import (such as an address book from a device) is collected when using the Services.
V. Third-Party Data. Hoylu may receive data about organizations, industries, lists of companies that are customers, Website visitors, marketing campaigns and other matters related to our business from parent corporation(s), affiliates and subsidiaries, our partners, or others that we use to make our own information better or more useful. This data may be combined with Other Information we collect and might include aggregate-level data, such as which IP addresses correspond to zip codes or countries. Or it might be more specific: for example, how well an online marketing or email campaign performed.
VI. Additional Information Provided to Hoylu. We also receive Other Information when submitted to our Websites or in other ways, such as if you participate in a focus group, contest, activity or event, apply for a job, enroll in a certification program or other educational program hosted by Hoylu or a vendor, request support, interact with our social media accounts or otherwise communicate with Hoylu.
Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information (collectively, “Information”). However, certain Information is collected automatically and, if some Information, such as Workspace setup details, is not provided, we may be unable to provide the Services.
How We Use Information
Customer Data will be used by Hoylu in accordance with Customer’s instructions, including any applicable terms in the Customer Agreement and Customer’s use of Services functionality, and as required by applicable law. Hoylu is a processor of Customer Data and Customer is the controller. Customer may, for example, use the Services to grant and remove access to a Workspace, assign roles and configure settings, access, modify, export, share and remove Customer Data and otherwise apply its policies to the Services.
Hoylu uses Other Information in furtherance of our legitimate interests in operating our Services, Websites and business. More specifically, Hoylu uses Other Information:
To provide, update, maintain and protect our Services, Websites and business. This includes use of Other Information to support delivery of the Services under a Customer Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends Please also feel free to contact Hoylu if you have any questions about this Privacy Policy or Hoylu’s practices, or if you are seeking to exercise any of your statutory rights. Hoylu will respond within a reasonable timeframe. You may contact us at privacy@Hoylu.com or at our mailing address below:
For Customers and Authorized Users who use Workspaces established for Customers in the US and Canada:
Hoylu Technologies
720 4th Avenue, Suite 120
Kirkland, WA 98033
USA
For Customers and Authorized Users who use Workspaces established for Customers outside the US and Canada:
Hoylu AB
Tunnbindaregatan 37C
602 21 Norrköping
Sweden
and other activities, or at an Authorized User’s request.
As required by applicable law, legal process or regulation.
To communicate with you by responding to your requests, comments and questions. If you contact us, we may use your Other Information to respond.
To develop and provide search, learning and productivity tools and additional features. Hoylu tries to make the Services as useful as possible for specific Workspaces and Authorized Users. For example, we may improve search functionality by using Other Information to help determine and rank the relevance of content, channels or expertise to an Authorized User, make Services or Third Party Service suggestions based on historical use and predictive models, identify organizational trends and insights, to customize a Services experience, or create new productivity features and products.
To send emails and other communications. We may send you service, technical and other administrative emails, messages, and other types of communications. We may also contact you to inform you about changes in our Services, our Services offerings, and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services and you may not opt out of them. In addition, we sometimes send emails about new product features, promotional communications or other news about Hoylu. These are marketing messages so you can control whether you receive them. If you have additional questions about a message you have received from Hoylu please reach out through the contact mechanisms described below.
For billing, account management and other administrative matters. Hoylu may need to contact you for invoicing, account management, and similar reasons and we use account data to administer accounts and keep track of billing and payments.
To investigate and help prevent security issues and abuse.
If Information is aggregated or de-identified so that it is no longer reasonably associated with an identified or identifiable natural person, Hoylu may use it for any business purpose. To the extent Information is associated with an identified or identifiable natural person and is protected as personal data under applicable data protection law, it is referred to in this Privacy Policy as “Personal Data.”
Data Retention
Hoylu will retain Customer Data in accordance with a Customer’s instructions, including any applicable terms in the Customer Agreement and Customer’s use of Services functionality, and as required by applicable law.
Depending on the Services plan, Customer may be able to customize its retention settings and apply those customized settings at the Workspace level, channel level or other level. Customer may also apply different settings to messages, files or other types of Customer Data. The deletion of Customer Data and other use of the Services by Customer may result in the deletion and/or de-identification of certain associated Other Information. For more detail, please review the Support or contact Customer.
Hoylu may retain Other Information pertaining to you for as long as necessary for the purposes described in this Privacy Policy. This may include keeping your Other Information after you have deactivated your account for the period of time needed for Hoylu to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes, and enforce our agreements.
How We Share and Disclose Information
This section describes how Hoylu may share and disclose Information. Customers determine their own policies and practices for the sharing and disclosure of Information, and Hoylu does not control how they or any other third parties choose to share or disclose Information.
Customer’s Instructions. Hoylu will solely share and disclose Customer Data in accordance with a Customer’s instructions, including any applicable terms in the Customer Agreement and Customer’s use of Services functionality, and in compliance with applicable law and legal process.
Displaying the Services. When an Authorized User submits Other Information, it may be displayed to other Authorized Users in the same or connected Workspaces. For example, an Authorized User’s email address may be displayed with their Workspace profile. Please consult the Support for more information on Services functionality.
Collaborating with Others. The Services provide different ways for Authorized Users working in independent Workspaces to collaborate. Other Information, such as an Authorized User’s profile Information, may be shared, subject to the policies and practices of the other Workspace(s).
Customer Access. Owners, administrators, Authorized Users, and other Customer representatives and personnel may be able to access, modify, or restrict access to Other Information. This may include, for example, your employer using Service features to export logs of Workspace activity or accessing or modifying your profile details.
Third-Party Service Providers and Partners. We may engage third party companies or individuals as service providers or business partners to process Other Information and support our business. These third parties may, for example, provide virtual computing and storage services, or we may share business information to develop strategic partnerships with Third Party Service providers to support our common customers.
Third-Party Services. Customer may enable or permit Authorized Users to enable Third Party Services. We require each Third-Party Service to disclose all permissions for information access in the Services, but we do not guarantee that they do so. When enabled, Hoylu may share Other Information with Third Party Services. Third Party Services are not owned or controlled by Hoylu and third parties that have been granted access to Other Information may have their own policies and practices for its collection, use, and sharing. Please check the permissions, privacy settings, and notices for these Third-Party Services or contact the provider for any questions.
Corporate Affiliates. Hoylu may share Other Information with its corporate affiliates, parents and/or subsidiaries.
During a Change to Hoylu’s Business. If Hoylu engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of Hoylu’s assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities, some or all Other Information may be shared or transferred, subject to standard confidentiality arrangements.
Aggregated or De-identified Data. We may disclose or use aggregated or de-identified Other Information for any purpose. For example, we may share aggregated or de-identified Other Information with prospects or partners for business or research purposes, such as telling a prospective Hoylu customer the average amount of time spent within a typical Workspace.
To Comply with Laws. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation, or legal process.
To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property, or safety of Hoylu or third parties, including enforcing contracts or policies, or in connection with investigating and preventing fraud or security issues.
With Consent. Hoylu may share Other Information with third parties when we have consent to do so.
Security
Hoylu takes security of data very seriously. Hoylu works hard to protect Other Information you provide from loss, misuse, and unauthorized access or disclosure. These steps take into account the sensitivity of the Other Information we collect, process and store, and the current state of technology. Hoylu has received internationally recognized security certifications. Given the nature of communications and information processing technology, Hoylu cannot guarantee that Information during transmission through the Internet or while stored on our systems or otherwise in our care will be absolutely safe from intrusion by others. When you click a link to a third-party site, you will be leaving our site and we don’t control or endorse what is on third-party sites.
Age Limitations
To the extent prohibited by applicable law, Hoylu does not allow use of our Services and Websites by anyone younger than 13 years old. If you learn that anyone younger than 13 has unlawfully provided us with personal data, please contact us and we will take steps to delete such information.
Changes to This Privacy Policy
Hoylu may change this Privacy Policy from time to time. Laws, regulations, and industry standards evolve, which may make those changes necessary, or we may make changes to our services or business. We will post the changes to this page and encourage you to review our Privacy Policy to stay informed. If we make changes that materially alter your privacy rights, Hoylu will provide additional notice, such as via email or through the Services. If you disagree with the changes to this Privacy Policy, you should deactivate your Services account. Contact the Customer if you wish to request the removal of Personal Data under their control.
Privacy Shield
Hoylu complies with the EU-U.S. Privacy Shield Framework, as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, as applicable to the United States. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/. When Hoylu receives personal information subject to the Privacy Shield Principles and subsequently transfers such information to a third-party service provider acting as an agent on Hoylu’s behalf, Hoylu maintains certain liability under the Privacy Shield Principles if both the agent processes the information in a manner inconsistent with the Privacy Shield and (ii) Hoylu is responsible for the event giving rise to the damage.
In compliance with the Privacy Shield Principles, Hoylu commits to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact our Data Protection Officer by sending an email to privacy@Hoylu.com.
Hoylu has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) with regard to unresolved Privacy Shield complaints concerning data transferred from the EU.
European residents may elect to arbitrate unresolved complaints pursuant to the Privacy Shield’s Recourse, Enforcement and Liability Principle and Annex I of the Privacy Shield. Prior to initiating such arbitration, you must: (1) contact us and afford Hoylu the opportunity to resolve the issue; (2) seek assistance from the panel established by the EU DPAs above; and (3) contact the U.S. Department of Commerce (either directly or through a European Data Protection Authority) and afford the Department time to attempt to resolve the issue. Each party shall be responsible for its own attorney’s fees. Pursuant to the Privacy Shield, the arbitrator(s) may only impose individual-specific, non-monetary, equitable relief necessary to remedy any violation of the Privacy Shield Principles with respect to the individual filing the complaint.
Hoylu is also subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Data Protection Officer
To communicate with our Data Protection Officer, please email privacy@Hoylu.com.
Your Rights
Individuals located in certain countries, including the European Economic Area, have certain statutory rights in relation to their personal data. Subject to any exemptions provided by law, you may have the right to request access to your information, as well as to seek to update, delete or correct this information. To the extent that Hoylu’s processing of your personal data is subject to the General Data Protection Regulation (GDPR), Hoylu relies on its legitimate interests, described above, to process your data. Hoylu may also process information that constitutes your personal data for direct marketing purposes, provided that you have a right to object to Hoylu’s use of your personal data for this purpose at any time.
Your California Privacy Rights
This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA.”
For more details about the personal information we have collected over the last 12 months, including the categories of sources, please see the Information We Collect and Receive section above. We collect this information for the business and commercial purposes described in the How We Use Information section above. We share this information with the categories of third parties described in the How We Share and Disclose Information section above. Hoylu does not sell (as such term is defined in the CCPA) the personal information we collect (and will not sell it without providing a right to opt out).
Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.
California consumers may make a request pursuant to their rights under the CCPA by contacting us at info@Hoylu.com. We will verify your request using the information associated with your account, including email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf.
Contacting Hoylu
Please also feel free to contact Hoylu if you have any questions about this Privacy Policy or Hoylu’s practices, or if you are seeking to exercise any of your statutory rights. Hoylu will respond within a reasonable timeframe. You may contact us at privacy@Hoylu.com or at our mailing address below:
For Customers and Authorized Users who use Workspaces established for Customers in the US and Canada:
Hoylu Inc.
11335 NE 122nd Way, Suite 105
Kirkland, WA 98034
USA
For Customers and Authorized Users who use Workspaces established for Customers outside the US and Canada:
Hoylu Norge AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AS
Nedre Slottsgate 13 – 15
0157 Oslo
Norway
Hoylu AB
Åbjörnaboda Svenskatorpet 2
341 55 Vittaryd
Sweden
Last Revised Date: 26th May 2026
Data Processing Addendum
Hoylu Data Processing Addendum (DPA)
[PDF]
This Data Processing Addendum, together with its Schedule and Annexes (the “DPA”), forms part of the Customer Terms of Service and Privacy Policy, both as updated from time to time, or other applicable written agreement between the Contracting Hoylu Entity identified in Section 1.4 below (“Hoylu”) and the customer identified in such agreement (“Customer”) (such agreement, the “Agreement”), for the use of Hoylu’s online services (the “Services”). Capitalized terms not defined herein have the meaning set forth in the Agreement. To the extent of any conflict between this DPA, any previously executed data processing addendum, and the Agreement, this DPA will govern. In the event of any conflict between the body of this DPA on the one hand, and the UK Addendum and/or Standard Contractual Clauses (as applicable) on the other, the UK Addendum and/or Standard Contractual Clauses (as applicable) shall prevail.
Customer enters into this DPA on its own behalf and, to the extent required under applicable Data Protection Laws and Regulations, on behalf of its Authorized Affiliates. For the purposes of this DPA only, “Customer” includes Customer and Authorized Affiliates.
This DPA reflects the parties’ agreement with regard to the Processing of Personal Data. In the course of providing the Services to Customer pursuant to the Agreement, Hoylu may Process Personal Data on behalf of Customer, and the parties agree to comply with the following provisions with respect to any Personal Data.
1. Definitions
1.1 “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
1.2 “Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom; (b) is permitted to use the Services pursuant to the Agreement between Customer and Hoylu but has not signed its own Agreement with Hoylu and is not a “Customer” as defined under the Agreement; and (c) qualifies as a Controller of Personal Data Processed by Hoylu.
1.3 “Controller” means the entity that determines the purposes and means of the Processing of Personal Data, and includes “business” as defined in the CCPA.
1.4 “Contracting Hoylu Entity” means: (a) where Customer is domiciled in the United States or Canada, Hoylu, Inc., a Washington (USA) corporation at 11335 NE 122nd Way, Suite 105, Kirkland, WA 98034, USA; or (b) where Customer is domiciled elsewhere, Hoylu AB, a Swedish company at Åbjörnaboda Svenskatorpet 2, 341 55 Vittaryd, Sweden. The Contracting Hoylu Entity is the entity that has entered into the Agreement with Customer.
1.5 “Customer Data” has the meaning set forth in the Agreement and includes all content, files, drawings, text, metadata, and other data submitted to the Services by or on behalf of Customer or its Authorized Users.
1.6 “Data Protection Laws and Regulations” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, to the extent applicable: (a) the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and any national legislation implementing or supplementing it, including the Norwegian Personal Data Act (personopplysningsloven), the Swedish Data Protection Act (dataskyddslagen), and the Austrian Data Protection Act (Datenschutzgesetz); (b) the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”); (c) the Swiss Federal Act on Data Protection (“FADP”); and (d) the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. and associated regulations and amendments, including the California Privacy Rights Act amendments (“CCPA”), and other U.S. state privacy laws (collectively, “U.S. Privacy Laws”).
1.7 “Data Subject” means the identified or identifiable person to whom Personal Data relates.
1.8 “Hoylu Group” means Hoylu AS (Norway) together with its direct and indirect subsidiaries from time to time, currently including Hoylu AB (Sweden), Hoylu Inc. (USA), Hoylu Norge AS (Norway), and Hoylu GmbH (Austria).
1.9 “Personal Data” means any information that is Customer Data and that relates to an identified or identifiable natural person (or, where treated as personal data under applicable Data Protection Laws and Regulations, an identified or identifiable legal entity).
1.10 “Processing” (including its various forms) means any operation or set of operations performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
1.11 “Processor” means the entity that Processes Personal Data on behalf of the Controller and includes a “service provider” as defined under the CCPA.
1.12 “Security and Privacy Documentation” means Hoylu’s Security Overview, Sub-Processor List, and Privacy Policy (each as updated from time to time and accessible at https://www.hoylu.com/legal), together with Hoylu’s ISO/IEC 27001:2022 certification documents made reasonably available by Hoylu.
1.13 “Standard Contractual Clauses” or “SCCs” means the contractual clauses annexed to the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, located at http://data.europa.eu/eli/dec_impl/2021/914/oj, completed as set forth in Section 11.
1.14 “Sub-processor” means any Processor engaged by the Contracting Hoylu Entity, including other members of the Hoylu Group acting as a Sub-processor.
1.15 “Supervisory Authority” means an independent public authority established by an EU/EEA Member State pursuant to the GDPR, the United Kingdom Information Commissioner’s Office, and/or the Swiss Federal Data Protection and Information Commissioner.
1.16 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, available as of the Effective Date at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf.
2. Processing of Personal Data
2.1 Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is either a Controller or a Processor of Personal Data, and the Contracting Hoylu Entity is a Processor (or, where Customer acts as a Processor, a sub-processor to Customer’s Controller).
2.2 Customer’s Processing of Personal Data. In its use of the Services, Customer shall:
(a) Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations, and ensure that its instructions for the Processing of Personal Data comply with Data Protection Laws and Regulations;
(b) have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquires Personal Data;
(c) have provided adequate notices to, and obtained valid consents or established another lawful basis under, Data Subjects relating to the Processing of Personal Data (including its disclosure to Hoylu) and, where applicable, to cross-border transfers; and
(d) not, by act or omission, cause Hoylu to violate any Data Protection Laws and Regulations, or any notices provided to or consents obtained from Data Subjects.
2.3 Hoylu’s Processing of Personal Data.
2.3.1 The Contracting Hoylu Entity shall treat Personal Data as confidential information and shall only Process Personal Data: (a) to fulfil its obligations to Customer under the Agreement, including this DPA; (b) on behalf of Customer and in accordance with Customer’s documented instructions; and (c) in compliance with Data Protection Laws and Regulations. This DPA and the Agreement constitute Customer’s complete and final documented instructions to Hoylu for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately. For purposes of the SCCs and the UK Addendum (as applicable), the following are deemed instructions by Customer to Process Personal Data: (i) Processing in accordance with the Agreement; (ii) Processing initiated by Customer and/or its Authorized Users in their use of the Services; and (iii) Processing to comply with other reasonable documented instructions provided by Customer (e.g., via email or support ticket) where such instructions are consistent with the terms of the Agreement and this DPA.
2.3.2 The subject matter of Processing by Hoylu is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, and the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1.
2.3.3 Without prejudice to Section 2.3.1, the Contracting Hoylu Entity shall:
(a) not “sell” Personal Data or “share” Personal Data for purposes of “cross-context behavioural advertising” or “targeted advertising” as such terms are defined under U.S. Privacy Laws;
(b) not attempt to (i) re-identify any pseudonymized, anonymized, aggregate, or de-identified Personal Data; or (ii) link or otherwise create a relationship between Customer Data and any other data, in each case without Customer’s express authorization;
(c) not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Hoylu;
(d) comply with any applicable restrictions under U.S. Privacy Laws on combining Personal Data with personal data that Hoylu receives from, or on behalf of, another person, or that Hoylu collects from any interaction between it and a data subject;
(e) not use Personal Data, and shall ensure that no Sub-processor uses Personal Data, for the training or fine-tuning of artificial intelligence or machine-learning models, except as expressly directed by Customer in writing; and
(f) promptly notify Customer if Hoylu determines that (i) it can no longer meet its obligations under this DPA or Data Protection Laws and Regulations; (ii) it has breached this DPA; or (iii) in Hoylu’s reasonable opinion, an instruction from Customer infringes Data Protection Laws and Regulations.
2.3.4 Data Residency. Customer may elect, at sign-up or by Order Form, between the European Union–hosted instance of the Services (app.hoylu.com) and the United States–hosted instance (us.hoylu.com). Hoylu shall not relocate Customer Data from the elected hosting region to another region without prior written notice to Customer and a reasonable opportunity for Customer to object and, where Customer’s objection cannot be accommodated, to terminate the affected Services with a pro-rata refund for the unused portion of the prepaid term.
2.3.5 Government Access Requests. Hoylu shall promptly notify Customer of any government or law-enforcement request for access to or information about Hoylu’s Processing of Personal Data on Customer’s behalf, unless prohibited by Data Protection Laws and Regulations. Hoylu shall provide reasonable cooperation in relation to any such request. If Hoylu is prohibited from disclosing the details of such a request to Customer, Hoylu shall inform Customer that it can no longer comply with Customer’s instructions under this DPA without providing further detail, and await Customer’s further instructions. Hoylu shall use all available legal mechanisms to challenge any demands for data access through national-security process, as well as any non-disclosure provisions attached thereto.
2.3.6 DPIA and Regulator Consultation Assistance. Hoylu shall provide reasonable assistance to and cooperation with Customer for Customer’s performance of a data protection impact assessment of Processing or proposed Processing of Personal Data, and for Customer’s prior consultation with regulatory authorities under applicable Data Protection Laws and Regulations. Such assistance shall be provided at no additional charge to the extent it is proportionate to the nature of Hoylu’s Processing activities; for extensive engagements, the parties shall agree the scope and reasonable charges in advance.
2.3.7 The Contracting Hoylu Entity certifies that it understands its obligations under this DPA (including the restrictions in this Section 2) and that it will comply with them.
3. Data Subject Requests
The Contracting Hoylu Entity shall, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject to exercise the Data Subject’s rights related to Personal Data under Data Protection Laws and Regulations, including the right of access, the right to rectification, the right to restriction of Processing, the right to erasure (“right to be forgotten”), the right to data portability, the right to object to the Processing, and the right not to be subject to a decision based solely on automated processing (each, a “Data Subject Request”). Taking into account the nature of the Processing, Hoylu shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request. To the extent that Customer, in its use of the Services, does not have the ability itself to address a Data Subject Request, Hoylu shall, upon Customer’s request, use commercially reasonable efforts to assist Customer in responding, to the extent legally permitted and required under Data Protection Laws and Regulations. Customer is responsible for any disproportionate costs arising from Hoylu’s assistance.
4. Hoylu Personnel
4.1 Confidentiality. The Contracting Hoylu Entity shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities, and have executed written confidentiality agreements. Such confidentiality obligations shall survive the termination of the personnel engagement.
4.2 Reliability. The Contracting Hoylu Entity shall take commercially reasonable steps to ensure the reliability of any Hoylu personnel engaged in the Processing of Personal Data.
4.3 Limitation of Access. The Contracting Hoylu Entity shall ensure that access to Personal Data is limited to those personnel who require access to perform the Services in accordance with the Agreement.
4.4 Privacy Contact. For questions about this DPA or any other privacy matters, please contact privacy@hoylu.com.
5. Sub-processors
5.1 Appointment of Sub-processors. Customer acknowledges and agrees that the Contracting Hoylu Entity may engage Sub-processors, including other members of the Hoylu Group, in connection with the provision of the Services. Hoylu has entered into a written agreement with each Sub-processor containing data-protection obligations no less protective than those in this DPA with respect to the protection of Personal Data, to the extent applicable to the nature of the services provided by such Sub-processor.
5.2 List of Current Sub-processors and Notification of New Sub-processors. Hoylu maintains its current list of Sub-processors at https://www.hoylu.com/legal/sub-processors. Hoylu shall notify Customer of any intended addition or replacement of Sub-processors by updating that page and, where Customer has subscribed to Hoylu’s sub-processor change notifications, by sending an email at least thirty (30) calendar days before authorizing the new Sub-processor to Process Personal Data in connection with the provision of the Services. Customer is responsible for subscribing to such notifications.
5.3 Objection Right for New Sub-processors. Customer may object to Hoylu’s use of a new Sub-processor by notifying Hoylu in writing within ten (10) business days of Hoylu’s notice. In such event, Hoylu may, at its option, use reasonable efforts to make available to Customer a change in the Services, or recommend a commercially reasonable change to Customer’s configuration or use of the Services, to avoid Processing of Personal Data by the new Sub-processor without unreasonably burdening Customer. If Hoylu is unable to make such change available within thirty (30) days of Customer’s objection, Customer may terminate the affected Services on written notice to Hoylu. Upon such termination, Hoylu shall refund Customer any prepaid fees for such Services covering the remainder of the term, and shall not penalize Customer for such termination.
5.4 Liability for Sub-processors. The Contracting Hoylu Entity remains liable to Customer for the acts and omissions of its Sub-processors to the same extent as for its own acts and omissions under this DPA.
6. Security
6.1 Controls for the Protection of Personal Data. The Contracting Hoylu Entity shall maintain appropriate technical and organizational measures to protect the security (including protection against unauthorized or unlawful Processing; accidental or unlawful destruction, loss, alteration or damage; and unauthorized disclosure of or access to Personal Data), confidentiality, and integrity of Personal Data. Such measures are described in the Security and Privacy Documentation and are aligned with the controls of Hoylu’s ISO/IEC 27001–certified Information Security Management System. Hoylu will not materially decrease the overall security of the Services during a subscription term.
6.2 Third-Party Certifications and Audits. Upon Customer’s reasonable written request and not more than once per twelve (12) month period (except where required following a confirmed Personal Data Incident or by a Supervisory Authority), and subject to the confidentiality obligations in the Agreement, the Contracting Hoylu Entity shall make available to Customer a copy of its then-most-recent third-party audits, certifications, and ISO/IEC 27001 statement of applicability; provided, however, that this Section 6.2 shall not apply where Customer or Customer’s independent third-party auditor is a competitor of Hoylu. Where an on-site audit is reasonably required (e.g., following a confirmed Personal Data Incident materially affecting Customer’s Personal Data), the parties shall agree the scope, timing, and reasonable costs in advance, with the costs of on-site audits to be borne by Customer.
6.3 Unauthorized Processing of Personal Data. Customer retains the right to take reasonable and appropriate steps to stop and remediate unauthorized Processing of Personal Data, including any Processing of Personal Data not authorized in this DPA.
7. Personal Data Incident Management and Notification
The Contracting Hoylu Entity maintains security-incident management policies and procedures as described in the Security and Privacy Documentation and the Agreement. Hoylu shall notify Customer without undue delay, and in any event within seventy-two (72) hours after becoming aware, of any accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed by Hoylu or its Sub-processors (a “Personal Data Incident”). Such notification shall include, to the extent reasonably available at the time: (a) the nature of the incident; (b) the categories and approximate number of Data Subjects and Personal Data records concerned; (c) the likely consequences; (d) the measures taken or proposed to address and mitigate the incident; and (e) the name and contact details of a Hoylu point of contact. Where it is not possible to provide all such information within the seventy-two (72)–hour window, Hoylu shall provide initial notification within that window and supplement it without undue delay as further information becomes available. Hoylu shall make reasonable efforts to identify the cause of such Personal Data Incident and take such steps as it deems necessary and reasonable to remediate the cause to the extent the remediation is within Hoylu’s reasonable control. The obligations in this Section 7 do not apply to incidents caused by Customer or Customer’s Authorized Users.
8. Return and Deletion of Personal Data
Upon termination of the Agreement, the Contracting Hoylu Entity shall, at Customer’s election, return Personal Data to Customer and/or delete Personal Data in accordance with the procedures and timeframes specified in the Security and Privacy Documentation, to the extent permitted by applicable law. Hoylu may retain Personal Data only to the extent required by applicable law and for the duration of, and subject to the protections required by, such legal obligation. Upon Customer’s reasonable written request, Hoylu shall provide a written certification of deletion.
9. Authorized Affiliates
9.1 Contractual Relationship. Each Authorized Affiliate agrees to be bound by the terms of this DPA and, to the extent applicable, the Agreement. All access to and use of the Services by Authorized Affiliates must comply with the terms of the Agreement, and any violation by an Authorized Affiliate is deemed a violation by Customer. For the avoidance of doubt, an Authorized Affiliate is not, and does not become, a party to the Agreement by virtue of Customer entering into this DPA, and is solely a party to this DPA.
9.2 Communication. Customer shall remain responsible for coordinating all communication with Hoylu under this DPA and is entitled to make and receive any communication in relation to this DPA on behalf of its Authorized Affiliates.
9.3 Rights of Authorized Affiliates. Where an Authorized Affiliate becomes a party to this DPA with Hoylu, it shall, to the extent required under applicable Data Protection Laws and Regulations, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:
9.3.1 Except where applicable Data Protection Laws and Regulations require the Authorized Affiliate to exercise a right or seek a remedy under this DPA against Hoylu directly by itself, the parties agree that: (a) only Customer shall exercise any such right or seek any such remedy on behalf of the Authorized Affiliate; and (b) Customer shall exercise any such rights under this DPA in a combined manner for all of its Authorized Affiliates together (as set out, for example, in Section 9.3.2), not separately for each Authorized Affiliate individually.
9.3.2 The parties agree that Customer shall, when carrying out an on-site audit of the procedures relevant to protecting Personal Data, take all reasonable measures to limit any impact on Hoylu and its Sub-processors by combining, to the extent reasonably possible, several audit requests carried out on behalf of different Authorized Affiliates into one single audit.
10. Limitation of Liability
To the extent permitted under applicable Data Protection Laws and Regulations, each party’s and all of its Affiliates’ aggregate liability arising out of or related to this DPA, and all DPAs between Authorized Affiliates and the Contracting Hoylu Entity, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability set forth in the Agreement, and such limitations apply to the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt, the Contracting Hoylu Entity’s and its Affiliates’ total liability for all claims from Customer and all of its Authorized Affiliates arising out of or related to the Agreement and each DPA shall not be understood to apply individually and severally to Customer and/or any Authorized Affiliate that is a contractual party to any such DPA.
11. International Data Transfers
11.1 Application of Transfer Mechanisms. Subject to the additional terms in Schedule 1, the Contracting Hoylu Entity makes available the Standard Contractual Clauses and the UK Addendum, which apply to any transfers of Personal Data under this DPA from the European Economic Area and/or their member states, Switzerland, and the United Kingdom, respectively, to countries that do not ensure an adequate level of data protection within the meaning of the applicable Data Protection Laws and Regulations.
11.2 Deemed Signature of SCCs. To the extent legally required, by signing the Agreement, Customer and the Contracting Hoylu Entity are deemed to have signed the Standard Contractual Clauses, which form part of this DPA and (except as set forth in Sections 11.4 and 11.5) are completed as follows:
(a) Module 2 of the SCCs applies to transfers of Personal Data from Customer (as a controller) to the Contracting Hoylu Entity (as a processor); Module 3 of the SCCs applies to transfers of Personal Data from Customer (as a processor) to the Contracting Hoylu Entity (as a sub-processor);
(b) Clause 7 (Docking clause) is included;
(c) Under Clause 9 (Use of sub-processors), the parties select Option 2 (General written authorization);
(d) Under Clause 11 (Redress), the optional language requiring Data Subjects to be permitted to lodge a complaint with an independent dispute-resolution body is not included;
(e) Under Clause 17 (Governing law), the parties choose Option 1 and select the laws of Sweden;
(f) Under Clause 18 (Choice of forum and jurisdiction), the parties select the courts of Sweden;
(g) Annex I(A) and I(B) (List of parties; description of transfer) are completed as set out in Schedule 1;
(h) Under Annex I(C) (Competent supervisory authority), the parties select the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, “IMY”);
(i) Annex II (Technical and organisational measures) is completed as set out in Schedule 1; and
(j) Annex III (List of sub-processors) is not applicable, as the parties have chosen General Authorization under Clause 9.
11.3 United Kingdom Transfers. With respect to Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law of any EEA jurisdiction or Switzerland) governs the international nature of the transfer, the UK Addendum forms part of this DPA and takes precedence over the rest of this DPA as set out in the UK Addendum. Undefined capitalized terms used in this Section 11.3 have the meanings given in the UK Addendum. For purposes of the UK Addendum: (a) the parties’ details are the parties and their Affiliates to the extent any of them is involved in such transfer; (b) the Key Contacts are the contacts set out in Schedule 1; (c) the Approved Standard Contractual Clauses referenced in Table 2 are the SCCs as completed by the parties; (d) either party may end this DPA as set out in Section 19 of the UK Addendum; and (e) by entering into the Agreement, the parties are deemed to be signing the UK Addendum.
11.4 Swiss Transfers (FADP). For transfers of Personal Data subject to the FADP, the SCCs form part of this DPA, but with the following differences to the extent required by the FADP: (a) references to the GDPR in the SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR; (b) references to personal data in the SCCs also refer to data about identifiable legal entities until the entry into force of revisions to the FADP that eliminate this broader scope; (c) the term “member state” in the SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the SCCs; and (d) the relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the SCCs (where the FADP and GDPR apply, respectively).
11.5 Copies of Sub-processor Agreements. The parties agree that copies of the Sub-processor agreements that must be provided by Hoylu to Customer pursuant to the applicable SCCs or UK Addendum may have all commercial information or clauses unrelated to the applicable transfer mechanism removed by Hoylu beforehand, and that such copies will be provided by Hoylu in a manner to be determined in its discretion, only upon written request by Customer.
11.6 Processor-to-Processor Clauses. For purposes of Module 3 of the SCCs, Customer agrees that it is unlikely that Hoylu will know the identity of Customer’s Controller(s) because Hoylu does not have a direct relationship with such Controller(s). Therefore, Customer will fulfil any and all of Hoylu’s obligations to Customer’s Controller(s) under Module 3.
11.7 Audits and Certifications. The audits described in the UK Addendum and the SCCs shall be carried out in accordance with Section 6.2 of this DPA.
11.8 Certification of Deletion. The certification of deletion of Personal Data described in the UK Addendum and the SCCs shall be provided by Hoylu to Customer upon Customer’s request, in accordance with Section 8.
12. General
12.1 Order of Precedence. In the event of any conflict between (a) the UK Addendum and/or SCCs, (b) this DPA, and (c) the Agreement, the order of precedence is (a) over (b) over (c).
12.2 Term. This DPA is effective on the later of (i) the effective date of the Agreement, and (ii) the date this DPA is executed by both parties, and remains in effect for the term of the Agreement and any further period during which Hoylu Processes Personal Data on behalf of Customer.
12.3 Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
12.4 Notices. Notices to Hoylu under this DPA shall be sent to info@hoylu.com with a copy to privacy@hoylu.com. Notices to Customer shall be sent to the contact details associated with Customer’s account.
Schedule 1 — Annex I
A. List of Parties
Data exporter(s):
Name: The entity identified as Customer in the DPA or such other agreement between Hoylu and Customer.
Address: The address for Customer associated with the Hoylu account.
Contact person’s name, position, and contact details: The contact details associated with the Hoylu account.
Activities relevant to the data transferred under these Clauses: The activities specified in the DPA.
Signature and date: By using Hoylu’s Services to transfer data to third countries, Customer is deemed to have signed this Annex I.
Role (controller / processor): Controller, or in some instances Processor.
Data importer(s):
Name: The Contracting Hoylu Entity, as defined in Section 1.4, namely:
— Where Customer is domiciled in the United States or Canada: Hoylu, Inc., 11335 NE 122nd Way, Suite 105, Kirkland, WA 98034, USA.
— Where Customer is domiciled elsewhere: Hoylu AB, Åbjörnaboda Svenskatorpet 2, 341 55 Vittaryd, Sweden.
Contact person’s name, position, and contact details: Data Protection Officer, privacy@hoylu.com.
Activities relevant to the data transferred under these Clauses: The Contracting Hoylu Entity is a cloud-based software-as-a-service provider of online collaboration and workspace tools, which Processes Personal Data on the instruction of the data exporter in accordance with the terms of the Agreement.
Signature and date: By Processing the data exporter’s Personal Data on the data exporter’s instructions, the Contracting Hoylu Entity is deemed to have signed this Annex I.
Role (controller / processor): Processor.
B. Description of Transfer
Categories of Data Subjects whose Personal Data is transferred:
The data exporter and/or Data Subjects (as directed by the data exporter) may submit Personal Data to the Services concerning the following categories of Data Subjects:
— Employees, agents, advisors, contractors, members, and freelancers of the data exporter;
— Prospects, customers, business partners, vendors, and project counterparties of the data exporter (where natural persons);
— Employees, agents, or contact persons of the data exporter’s prospects, customers, business partners, vendors, and project counterparties; and
— Other categories of Data Subjects as expressly determined by the data exporter.
Categories of Personal Data transferred:
The data exporter and/or Data Subjects may submit Personal Data to the Services, the type, extent, and detail of which is determined and controlled by the data exporter and/or the Data Subject in its sole discretion. Such Personal Data typically includes identification and contact details (name, email, telephone), account credentials, profile information, content submitted to workspaces (drawings, notes, text, files, comments), usage metadata, and IP/log data.
Sensitive data transferred (if any):
The data exporter and/or Data Subjects may submit sensitive data to the Services, the type, extent, and detail of which is determined and controlled by the data exporter and/or Data Subject in its sole discretion. Hoylu’s Services are not designed for the Processing of special categories of personal data within the meaning of Article 9 GDPR, and Customer is responsible for ensuring that any such data is Processed in compliance with applicable law. The restrictions and safeguards applicable to all Personal Data, including any sensitive data, are set out in Hoylu’s Security and Privacy Documentation.
Frequency of the transfer: Continuous, for the duration of the Agreement.
Nature of the Processing: Hoylu Processes Personal Data only as necessary to perform the Services and only performs the type(s) of Processing instructed by the data exporter, pursuant to the Agreement, this DPA, and the SCCs.
Purpose(s) of the data transfer and further Processing: The provisioprivacyn of the Services to the data exporter, as further described in the Agreement.
Retention period: Subject to any other terms allowing or requiring longer retention, and subject to Hoylu’s data-retention policies as described in the Security and Privacy Documentation, Hoylu only Processes Personal Data for the duration of the Agreement, unless the Personal Data is deleted earlier by the data exporter and/or Data Subject. Sub-processors retain Personal Data for periods consistent with the purposes for which Hoylu engages them.
For transfers to (sub-)processors: Hoylu transfers Personal Data to Sub-processors as set out at https://www.hoylu.com/legal/sub-processors. Sub-processors are engaged for purposes including cloud hosting, payment processing, transactional email delivery, customer support, and customer-relationship management, each as described on that page.
C. Competent Supervisory Authority
The competent supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, “IMY”), Box 8114, 104 20 Stockholm, Sweden, in accordance with Clause 13 of the Standard Contractual Clauses and the choice of Swedish law under Clause 17.
Annex II — Technical and Organisational Measures
The technical and organisational measures Hoylu takes to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the Processing, and the risks for the rights and freedoms of natural persons, are described in:
— Hoylu’s Security Overview, available at https://www.hoylu.com/security-overview; and
— Hoylu’s ISO/IEC 27001 certification documentation, available at https://www.hoylu.com/security-overview, and provided to Customer on reasonable request in accordance with Section 6.2.
Hoylu’s Information Security Management System is independently certified to ISO/IEC 27001, and covers the controls applicable to the Processing of Personal Data under this DPA.
Hoylu has entered into written data-processing agreements with each of its Sub-processors that Process Personal Data, requiring those Sub-processors to adhere to standards no less protective than those set out in this DPA. The current Sub-processor list is available at https://www.hoylu.com/legal/sub-processors.
Last Revised Date: 9 June 2026
Sub-Processors
Hoylu Product Sub-Processor List
Last Updated: May 19, 2026
Hoylu uses third-party service providers (“subprocessors”) that may process personal data of Hoylu customers in the course of providing the Hoylu Service. This list identifies all subprocessors that have access to or process customer personal data, in accordance with Article 28 of the General Data Protection Regulation (GDPR).
Customers may select between app.hoylu.com (EU-hosted) and us.hoylu.com (US-hosted) at sign-up or during order process based on their data residency preference.
Transfers of personal data from the EEA to the United States are based on the subprocessor’s certification under the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (Module 3).
| Subprocessor | Processing Location | Purpose of Processing |
| Microsoft Azure | European Union, paired regions (app.hoylu.com) or United States (us.hoylu.com) | Cloud infrastructure for hosting the Hoylu services including all Customer data and backups |
| Anthropic Claude | United States | Internal analysis of user engagement metadata (e.g., project participation, activity levels) to improve the service and support customer success. Data is not used for AI training. |
| HubSpot | United States | Customer relationship management, communication, order and offer tracking |
| Instatus | United States | Service status page hosting |
| Microsoft 365 | European Union (Microsoft EU Data Boundary) | Individual email communication and business document processing |
| Oracle NetSuite | United States | Billing and account management |
| Stripe | United States | Online payment processing for self-service customer subscriptions and purchases |
| Twilio SendGrid | United States | Transactional Email delivery |
| Zendesk | European Union (EU Data Center) | Customer support |
Get notified about changes in our subprocessors by subscribing to events on status.hoylu.com.
Security Overview
ISO Certification
Hoylu is an ISO/IEC 27001:2022 provider whose Information Security Management System (ISMS) has received third-party accreditation from the International Standards Organization.
ISO/IEC 27001:2022 is an information security management system standard published in 2022 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
A-LIGN, an independent, third-party auditor, found Hoylu to have technical controls in place and formalized IT Security policies and procedures. A-LIGN is an ISO / IEC 27001 certification body accredited by the ANSI National Accreditation Board (ANAB) to perform ISMS 27001 certifications. Hoylu has implemented several security measures and countermeasures that protect it from unauthorized access or compromise and IT personnel were found to be conscientious and knowledgeable in best practices.
This certification demonstrates Hoylu’s continued commitment to information security at every level and ensures you that the security of your data and information has been addressed, implemented, and properly controlled in all areas of our organization.
Hoylu achieves ISO/IEC 27001:2022 Certification
ISO 27001:2022 is an information security standard published by the International Organization for Standardization (ISO), the world’s largest developer of voluntary international standards, and the International Electrotechnical Commission (IEC). Hoylu’s certification was issued by A-LIGN, an independent and accredited certification body based in the United States on successful completion of a formal audit process. This certification is evidence that Hoylu has met rigorous international standards in ensuring the confidentiality, and integrity.

CAIQ Questionnaire
The Consensus Assessments Initiative Questionnaire (CAIQ) is a survey provided by the Cloud Security Alliance (CSA) for cloud consumers and auditors to assess the security capabilities of a cloud service provider. The CAIQ was developed to create commonly accepted industry standards to document the security controls in infrastructure-as-a-service, platform-as-a-service and software-as-a service applications. The CAIQ is contains a series of yes or no control-assertion questions that can be customized to fit an individual cloud customer’s needs. In keeping full transparency with our clients, Hoylu has completed this CAIQ v4 document.
Accessibility Statement
Measures to Support Accessibility
Measures to Support Accessibility
Hoylu takes the following measures to ensure accessibility of Hoylu:
- Include accessibility throughout our internal policies.
- Appoint an accessibility officer and/or ombudsperson.
- Provide continual accessibility training for our staff.
- Assign clear accessibility goals and responsibilities.
Conformance Status
Conformance Status
The Web Content Accessibility Guidelines (WCAG) define requirements for designers and developers to improve accessibility for people with disabilities. It defines three levels of conformance: Level A, Level AA, and Level AAA. Hoylu is partially conformant with WCAG 2.1 level AA. Partially conformant means that some parts of the content do not fully conform to the accessibility standard.
Feedback
Feedback
We welcome your feedback on the accessibility of Hoylu. Please let us know if you encounter accessibility barriers on Hoylu:
E-mail: support@hoylu.com
We try to respond to feedback within 5 business days.
Formal Complaints
Formal Complaints
For an overview of audit and compatibility measures, including reporting issues, interpretation of WCAG Guidelines, and remediation plans, view our Accessibility Corrective Action Plan.
Formal Approval of Accessibility Statement
Formal Approval of Accessibility Statement
This Accessibility Statement is approved by:
The Hoylu Product Team