1. Roles
For the purposes of GDPR Article 28: You (the customer) are the controller. random-assistant.com, operated by the legal entity identified on the Imprint page, is the processor.
2. Subject matter and duration
We process your data for the sole purpose of providing the assistant service for the duration of your contract with us. On termination, your data is deleted under §7.
3. Nature and purpose of processing
- Authenticating you to the service.
- Reading your data on connected integrations for the assistant to prepare drafts.
- Storing assistant memories that personalise your briefs.
- Maintaining the audit log of every assistant action.
- Sending transactional email through Resend.
4. Categories of data and data subjects
Data subjects: you, and (incidentally) the people you correspond with through your connected accounts.
Categories: account credentials, OAuth tokens, email and message content, calendar metadata, CRM records, assistant-generated text, audit log entries. See the Privacy page for the full inventory.
5. Sub-processors
We use the sub-processors listed at Sub-Processors. We notify you by email 15 days before adding or replacing a sub-processor. You may object in writing; if we cannot reach agreement, you may terminate the contract pro-rata.
6. Technical and Organisational Measures (TOMs)
- Per-tenant AES-256-GCM encryption at rest, keys derived from a master via HKDF.
- OAuth 2.0 only for third-party integrations. No password storage.
- EU residency. All processing in Frankfurt, EU.
- Audit logging for every assistant action.
- TLS 1.2 or higher for all data in transit.
- Principle of least privilege for operator access. Operator access logged and reviewed.
7. Deletion on termination
On contract termination, all customer data is deleted within 30 days. Only a minimal tombstone audit trail is retained for legal compliance (date of deletion, account ID, no content). Full process described under Right to Erasure.
8. Audit rights
You may request a written audit report once per calendar year, scoped to your tenant. Audits in person are by mutual agreement and at your cost.
9. Liability
Liability is limited as described in our Terms of Service §5.
10. Governing law
Czech law. See Terms §8.
Signed DPA
Email hello@random-assistant.com from your account address to request a signed copy or to start negotiating a Custom DPA.