For organizations
The agreement an organization signs when its people use Horizon Runway. It sets out what we process, on whose instructions, who else can see it, how long we keep it, and what happens when the relationship ends.
Before you read
This is an unsigned template, published so you can review our terms before you ask for them. It has not yet been through outside counsel and is not legal advice. We will countersign a final version — ours or yours — as part of an agreement.
Prefer your own paper? Send it. We would rather sign your DPA than argue about ours, and this template exists so you can see we have nothing to hide in the exchange.
This Data Processing Agreement ("DPA") is entered into between Horizon Runway ("Processor", "we", "us") and the organization identified in the order or agreement it is attached to ("Customer", "you").
It forms part of, and is governed by, the agreement between the parties for the use of Horizon Runway (the “Agreement”).
For personal data processed on Customer's behalf, Customer is the controller (or business) and Processor is the processor (or service provider). Processor processes that data only on Customer's documented instructions, which the Agreement and this DPA constitute in full.
Where an individual uses Horizon Runway on their own account rather than under Customer's instruction, Processor acts as controller for that individual's data under its published privacy policy, and this DPA does not apply to it.
If this DPA conflicts with the Agreement on the handling of personal data, this DPA governs. If a signed data protection addendum on Customer's own form is executed by both parties, that form governs over this one.
Horizon Runway is a Financial Forecasting calculator. It does not hold, move, or transmit funds, it is not a bank, broker, lender, or financial adviser, and it does not connect to financial institutions. Processor gives no investment, tax, or legal advice, and forecasts are estimates produced from figures the user enters.
Processor holds no certification or audit attestation (including SOC 2, ISO 27001, PCI-DSS, HIPAA, or GDPR certification) and makes no representation that it does. Nothing in this DPA should be read as such a claim.
Annex A sets out the full detail. This section states the boundary, because the boundary is the substance of this agreement.
Subject matter: providing the Horizon Runway forecasting service to Customer's users. Duration: the term of the Agreement, plus the deletion window in clause 8.
By default, a user's forecast data — balances, bills, income, scenarios — is stored in that user's own browser on their own device and is never transmitted to Processor. Cloud storage occurs only where an individual user switches on cloud backup for their own account.
The practical consequence is that for most users Processor holds no forecast data at all. This is a design choice, and Processor will not change it without updating its public trust page and giving Customer notice under clause 5.3.
The categories Processor may process are:
Processor does not collect, request, or provide any field for the following. Customer must not submit them, and Processor's systems are not designed to receive them:
Individuals who use Horizon Runway under the Agreement — Customer's employees, members, students, or clients as applicable — and Customer personnel who correspond with Processor for support.
Processor does not intentionally process special category data, government identifiers, health data, or biometric data, and the service is not directed to children under 13. Customer must not use the service to submit such data.
Processor processes Customer personal data only to provide and support the service, and only on Customer's instructions, unless a law it is subject to requires otherwise — in which case Processor will tell Customer before processing, unless that law forbids it.
Processor does not sell or share personal data, does not use it for cross-context behavioural advertising, does not retain, use, or disclose it for any purpose other than providing the service, and does not combine it with data from other sources except as permitted for a service provider under applicable law. Processor certifies that it understands and will comply with these restrictions. Processor runs no advertising trackers and no third-party analytics SDKs.
Access to Customer personal data is limited to personnel who need it to provide or support the service. Those personnel are bound by confidentiality obligations that survive the end of their engagement. Processor is a small team, and administrative access is limited accordingly — there is no shared login.
Taking into account the nature of the processing and the information available to it, Processor will provide reasonable assistance with Customer's obligations for data subject requests, data protection impact assessments, prior consultations, and security of processing. Because most data is device-local, in many cases the honest answer will be that Processor holds nothing responsive, and Processor will say so in writing.
Where Processor receives a request from one of Customer's data subjects, it will not respond directly except to confirm receipt and to direct them to Customer, unless legally required or authorised by Customer. Processor will forward the request without undue delay. Requests may be sent to support@horizonrunway.com.
Processor acknowledges deletion and access requests within three business days and completes them within 30 days.
Customer is responsible for having a lawful basis for the processing it instructs, for giving its data subjects any required notice, and for the accuracy of instructions it issues.
Customer's users decide whether to enable cloud backup at all, are responsible for protecting their own sign-in and device, and own the figures they enter and any financial decision they take from a forecast. Processor is responsible for producing an accurate projection from the figures given to it.
Horizon Runway is an individual tool. There is no administrator dashboard and no per-person reporting, and Customer will not receive its users' financial data through the service. Where a usage report is agreed, it contains anonymous aggregate counts only.
Customer gives general authorisation for Processor to engage the subprocessors listed in Annex B. Processor remains fully liable to Customer for their performance.
Processor imposes data protection obligations on each subprocessor that are no less protective than those in this DPA, by written contract, before that subprocessor processes Customer personal data.
We keep this list current. If we add a subprocessor that can see customer data, we update this page, and organizational customers on a signed agreement get notice before the change takes effect.
Processor gives Customer at least 30 days' written notice before a new subprocessor with access to Customer personal data begins processing. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected part of the Agreement without penalty and receive a pro-rata refund of prepaid fees.
Processor maintains appropriate technical and organisational measures for the risk presented, described in Annex C. Processor may update those measures, provided it does not materially reduce the overall level of protection.
All traffic is served over HTTPS, and data stored in the managed database is encrypted at rest by the platform. Processor does not claim end-to-end encryption and will not represent otherwise.
Processor holds no third-party audit report today. In place of one, Processor will complete Customer's security questionnaire (including HECVAT Lite for higher education), provide its published subprocessor list, retention schedule, and continuity summary, and answer follow-up questions in writing.
Where Customer's own regulator or policy requires an on-site or documentary audit, the parties will agree scope and timing in advance, and Customer bears its own costs. Where a certificate of insurance or a third-party penetration test attestation becomes a condition of the Agreement, the parties will record that as a dated commitment rather than imply either exists today.
Processor notifies Customer without undue delay, and in any case within 72 hours, after confirming a personal data breach affecting Customer personal data it holds. Notice goes to Customer's stated contact, and Processor will not delay it to finish a communications plan.
The notice states what happened, what data was involved, what Processor has done and is doing, and what Customer and affected people should do. Where the full picture is not yet known, Processor sends what it has and follows up as it learns more.
Processor cooperates reasonably with Customer's own regulatory notification obligations. Notification under this clause is not an admission of fault by either party.
Security issues may be reported to support@horizonrunway.com with “Security report” in the subject line. Processor acknowledges within three business days and does not pursue good-faith researchers.
Processor applies the following retention rules:
At Customer's choice, Processor deletes or returns Customer personal data it holds within 30 days of the end of the Agreement, and deletes existing copies unless a law requires it to keep them — in which case Processor tells Customer what it must keep and why. Platform backups age out within 30 days.
Every user can export their complete data as plain JSON at any time, without contacting Processor. There is no export fee and no lock-in period.
Processor and its subprocessors are established in the United States, and processing takes place there.
Where Customer is established in the EEA, Switzerland, or the United Kingdom and a transfer mechanism is required, the parties will execute the European Commission's Standard Contractual Clauses (Module Two, controller to processor) together with the UK International Data Transfer Addendum where applicable. Those clauses, once executed, are incorporated into this DPA, and Annexes A to C serve as their annexes.
For the CCPA/CPRA and comparable state laws, Processor is a service provider or processor. It receives personal information only to perform the service, and clause 3.2 states the restrictions it accepts. Customer may take reasonable and appropriate steps to confirm Processor's use of personal information is consistent with its obligations.
Under the current design, Processor does not receive non-public personal information from a financial institution Customer: individuals enter their own figures, and Processor does not access Customer's systems. If a future integration changes that, the parties will address GLBA and Safeguards Rule obligations, including a written safeguards commitment, before that integration is enabled.
Processor receives no roster, enrollment data, or student records, and is not designated a school official with a legitimate educational interest unless the parties separately agree it in writing.
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.
Horizon Runway is a United States company whose formation is being completed. Until we name the home state here, these terms are governed by United States law and the law of the state where the company is registered, without regard to conflict-of-law rules.
This template is versioned. The current version is 2026-08-02, and the version in force between the parties is the one executed, not whatever is published later.
Signed for and on behalf of each party by an authorised representative. Name, title, and date to be completed on execution.
Nature and purpose: providing a Financial Forecasting calculator to individual users. Frequency: continuous for the term. Categories of data processed:
Forecast data is processed on the user's own device by default. Processor holds a copy only where a user enables cloud backup for their own account.
The list below is the same one published at horizonrunway.com/trust.
We keep this list current. If we add a subprocessor that can see customer data, we update this page, and organizational customers on a signed agreement get notice before the change takes effect.
Processor operates the following measures today:
Measures not yet in place, stated plainly: no third-party penetration test attestation, no SOC 2 or ISO 27001 report, no cyber liability certificate of insurance, and no SAML SSO. Each is available to discuss as a dated commitment.
Next step
Write to support@horizonrunway.com and we will complete your questionnaire and send a version ready for signature. The facts behind every clause here are published on the trust page.