Data Processing Addendum

1. Roles and scope#

The DPA applies when we process personal data contained in your workspace (Inputs, Outputs, brand memory, and data from accounts you connect) to provide the Services. You’re the controller of that data, and we’re your processor, or service provider under US state laws. We process it only on your documented instructions, which include the Terms and your use of the product settings.

2. What we commit to#

• confidentiality obligations for everyone who processes the data;
• the security measures described in Security, which form the DPA’s technical and organisational measures annex;
• no selling or sharing of your personal data, and no use of it outside the business purpose, including no model training without your written opt-in;
• help with data subject requests, impact assessments and consultations with authorities, where you need it;
• notice of a personal data breach without undue delay, and within 72 hours of confirming it, with the information you need to meet your own obligations;
• return or deletion of the data within 30 days after the Services end, and from backups within a further 35 days, unless the law requires us to keep it.

3. Subprocessors#

You authorise the subprocessors in our current list. We bind each one by written terms at least as protective as the DPA, and we remain responsible for them. We give 30 days’ notice before adding or replacing one. If you object on reasonable data-protection grounds and we can’t resolve it, you can end the affected Services and receive a refund of prepaid fees for them.

4. International transfers#

Workspace content stays in the region you choose. Where personal data is transferred out of the EU, UK or a GCC country, the DPA incorporates the European Commission’s standard contractual clauses, the UK addendum, and the transfer mechanisms required by the relevant GCC authority, as applicable.

5. Audits#

We answer reasonable security questionnaires, and share our security overview and penetration-test summary under NDA. Once our SOC 2 and ISO reports are issued (see Compliance), we’ll share them too. Enterprise customers may audit further, at reasonable notice and no more than once a year, unless a regulator requires otherwise.

6. Getting a signed copy#

The DPA is available on every paid plan and during the pilot on request. Choose “Data processing addendum” in the form below, and we’ll send it ready to sign within two business days.

Version history