Data processing agreement, in short

Part of your agreement, no separate signature. It covers the content you put in, not the account and billing data we hold in our own right. On your content it wins over the privacy notice, and on data protection it wins over the rest of the terms. Nothing in it reduces a duty the law puts on either of us.

Written out rather than described in the abstract: what the processing is for, how long it lasts, the people it is about, and the kinds of data involved. Special category and criminal offence data are allowed only where the feature supports them and you hold the basis the law requires, and a document you upload may contain them even where you did not intend it, so the agreement says what happens then. Your own obligations and rights as controller are set out too.

We process on your documented instructions and nothing else. Configuring the product is instructing us: turning a workflow on, setting a spend limit, connecting a mailbox. If we think an instruction breaks the law we tell you and may pause it.

The measures are named rather than promised in general terms: encryption in transit and at rest, every read scoped to your team at the point the data is fetched, passwords held only as a one-way hash, and a test suite that proves one customer cannot read another's rows before a change is released. The working copy the product keeps in your browser is named too. You are entitled to disagree with them.

You authorise the ones on the published list. A new one is published and told to you at least 30 days before it starts, you may object in writing on data protection grounds, and if we cannot meet the objection you may end the affected part of the service, or the service, by written notice before it starts, and take a refund for the period after. We stay liable for everything they do. A provider that one of them engages is covered by that liability rather than by the 30 days.

We tell you about a breach without undue delay and within 48 hours at the latest, with what we know and what we are doing, and a sub-processor telling us counts as us knowing. Whether it goes to a regulator or to the people affected is your decision, because you are the controller.

Your content sits on the infrastructure the privacy policy describes and is not copied into a second database at our seat, but we reach it from outside the European Economic Area, which is a transfer. The European Commission's standard contractual clauses apply to it, governed by Irish law and Irish courts whatever the rest of the agreement says. A demand from a public authority is told to you unless we are forbidden, challenged where it looks unlawful, and answered with the minimum.

You choose return or deletion at the end, and deletion is what happens if you do not choose. Return means the export: the whole portfolio as one machine-readable file, and you take it before you close the account, because closing it erases the portfolio at once. Indexes and embeddings go with the material they came from. A copy may sit in a backup until it is overwritten.

Ask first and we answer in writing, and we pass on what our own providers publish. If that does not satisfy you, you may audit and you choose the auditor. We bear our own cost for one audit in 12 months and may charge reasonable time beyond that, never at a price that makes the right theoretical. An audit after a breach or at a regulator's requirement is not counted against the one.

The models run on the same platform as the rest of the service, and no content goes to another model provider. Your content is not used to train a general purpose or shared model for anybody else. What the product does with an answer, and what waits for you, is in the terms rather than here.