Data Processing Agreement

1. Subject matter and duration

The Processor processes Personal Data on behalf of the Controller as part of delivering the Service described in the Terms. This DPA enters into force when the Controller accepts the Terms and remains in force for the duration of the subscription and until the exit periods in Section 17 of the Terms and the deletion periods in Section 11 have ended.

2. Nature and purpose of processing

The Processor processes Personal Data to operate the Service: ingesting email, calendar, meeting transcript, and CRM data from the Controller's connected accounts; generating prep packets, briefs, follow-ups, draft replies, and other AI-assisted output; storing structured artifacts for the Controller's review; learning from the connected sources to personalise the Service for the Controller's users: memories, a learned profile, preferences, writing style and working patterns, used for briefs, meeting preparation, drafts and chat; and providing the dashboard and APIs for the Controller to manage the output. The fact types learned from each source are listed in Annex I; nothing outside that list is learned.

3. Categories of data subjects

• The Controller and the Controller's authorized users.
• The Controller's contacts, customers, prospects, employees, partners, and other counterparts whose personal data appears in the connected accounts.

4. Categories of Personal Data

• Identifiers (name, business email, phone, job title).
• Communications content (email bodies, meeting transcripts, calendar entries, chat messages, voice dictation audio and transcripts).
• Contact metadata (last interaction time, deal stage, follow-up state).
• Authentication artifacts (OAuth tokens, refresh tokens, scopes).
• Operational metadata (timezone, tier, audit-log entries, IP hash).
• Inferred data: preferences, working patterns, writing style, and facts about contacts, deals and projects, derived from the connected accounts as listed in Annex I.

Special-category data (GDPR Art 9): the Controller will not direct the Service at special-category data unless covered by a separate written agreement. Special-category data that appears incidentally in connected mailboxes, calendars or transcripts is processed under this DPA and the measures in Annex II. The Service applies an automatic check that refuses to store special-category data (Art 9) or data on criminal convictions (Art 10) as a memory or learned fact, about the user or anyone else, including where it is inferred; the residual risk of a missed wording is assessed in the Processor's DPIA.

5. Roles and instructions (Art 28(3)(a))

The Controller is the controller of the Personal Data. The Processor processes Personal Data only on the Controller's documented instructions, including transfers, unless required by EU or Member State law. Configuration of the Service through the dashboard (connecting integrations, setting retention preferences, enabling features) constitutes documented instructions. In particular, the per-source learning switch is a documented instruction: learning is on by default for each connected source, as described in Annex I, and while the switch for a source is off, nothing new is learned from it. Forgetting a memory or a learned fact is an instruction to delete it. If the Processor is required to process for any other purpose, it will inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

6. Confidentiality of personnel (Art 28(3)(b))

The Processor ensures that persons authorized to process the Personal Data are subject to a written duty of confidentiality. Access is granted on a least-privilege basis and is revoked on role change or departure.

7. Security measures (Art 28(3)(c), Art 32)

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures are set out in Annex II.

8. Sub-processors (Art 28(2), Art 28(3)(d))

The Controller gives general written authorisation under Art 28(2) for the sub-processors in Annex III at the date of acceptance: the list at /legal/processors and the AI model providers reached through OpenRouter listed in Annex III.

The Processor will notify the Controller in writing (email to the account owner and the privacy contact on file) at least 30 days before any intended addition or replacement, stating the sub-processor's identity, location, function, data categories, transfer mechanism and the safeguards verified; the register at /legal/processors is updated when the change takes effect. The Controller may object within 30 days on reasonable data-protection grounds. If the parties do not resolve the objection within 15 days, the Controller may terminate the affected service or the agreement on notice, without penalty, and receive a pro-rata refund of prepaid fees.

The Processor engages sub-processors only under a written contract imposing data-protection obligations equivalent to this DPA, verifies their guarantees before engagement, and remains fully liable to the Controller for their performance. No sub-processor in Annex III is engaged without a signed or incorporated data processing agreement. The AI model providers behind OpenRouter are engaged by OpenRouter under its own terms (Art 28(4)).

9. International data transfers (Chapter V)

The Processor stores the Controller's data in the EU (Hetzner, Germany and Finland); sub-processors process it only in the locations stated in Annex III. The Controller authorises onward transfers only to the sub-processors and locations in Annex III. Where a sub-processor processes Personal Data outside the EEA, the Processor, as data exporter, relies on:

• an adequacy decision under Art 45 GDPR (including the United Kingdom, and recipients certified under the EU-US Data Privacy Framework, whose certification the Processor checks on the official list before engagement and at least once a year); or, failing that,
• the Standard Contractual Clauses (Decision (EU) 2021/914), Module Three (processor to processor), concluded between the Processor and the sub-processor, with the supplementary measures below.

Supplementary measures: encryption at rest with per-tenant keys held by the Processor in the EU, encryption in transit, and minimisation of the content sent to each AI sub-processor. The provider, region and retention of each AI route are stated in Annex III. Copies of the safeguards are provided to the Controller on request. The Processor will not use a transfer path without a valid mechanism, with one exception: web search (Staan, France) may fall back to a search provider in the United States only where the Controller's Web research setting is on, as disclosed in Annex III. The Processor will inform the Controller without undue delay if a mechanism ceases to be valid, proposing an alternative or suspending the affected path.

10. Assistance to the Controller (Art 28(3)(e) and (f))

• Data subject requests: the Processor provides dashboard self-service for access, export, and deletion (Articles 15, 17, 20). For requests that cannot be self-served, the Controller may contact privacy@random-assistant.com and the Processor will assist within reasonable time and at no additional cost where the request volume is consistent with the Service's intended use. The Processor will forward to the Controller within 5 business days any request received directly from a data subject and will not answer it except to refer the data subject to the Controller.
• Controller's information duties: the Controller confirms that it has a lawful basis for connecting each account and for the processing of data of its employees, contacts and other data subjects, and that it gives them the information required by Articles 13 and 14 GDPR. The Processor publishes a template notice for the Controller's contacts and staff, in English and German, at /legal/contacts-notice; the Controller adapts it and gives it to them.
• Article 32 security obligations: see Section 7 and Annex II.
• Articles 33 and 34 breach notification: see Section 12 below.
• Article 35 Data Protection Impact Assessments: on request, the Processor provides its own assessment of the Service, including the learning from connected sources, with a model legitimate-interest assessment, and the information reasonably necessary for the Controller's DPIA.
• Requests about one person: the Controller's users can forget the memories and learned facts about a named contact, and on request the Processor helps find them, so the Controller can answer that person's objection or erasure request.
• Article 36 prior consultation: the Processor will support the Controller's prior consultation with a supervisory authority.

10a. Staff, works councils and no employer view

The Controller is responsible for informing its staff about the Service and for any involvement of a works council or other employee representatives that its law requires before the Service is used, for example under §316 of the Czech Labour Code (Act No. 262/2006 Coll.) or §87(1) no. 6 of the German Works Constitution Act (BetrVG).

The learning described in Annex I serves the user it is learned for. The Processor does not give the Controller's management access to individual users' learned data: no owner, administrator or manager view shows another user's learned profile, working hours, writing style or memories. This does not limit the Controller's rights to export or delete the workspace data as a whole under Sections 10 and 11.

11. Return and deletion of Personal Data (Art 28(3)(g))

At the choice of the Controller, the Processor will return all Personal Data in a structured, commonly used, machine-readable format and/or delete it after the end of the provision of services, and delete existing copies unless EU or Member State law requires further storage. The Processor confirms deletion in writing on request.

• On an erasure request (Article 17): after the Controller confirms the request, deletion of all workspace data, including meeting transcripts and recaps, email triage results, drafts and edits, meeting prep packets, briefs, follow-ups, memories, queued notifications and consent records, and revocation of OAuth tokens, within 3 working days, after review; an active subscription is cancelled first. Deletion, including the account record, completes when we approve the request, within 3 working days of the confirmed request; nothing is deleted before then, and an approved deletion cannot be reversed. The audit log entry of the request is kept as described in the Privacy Policy.
• On termination: data remains available for export during the exit periods in Section 17 of the Terms, after which the same deletion process runs.
• Retention exceptions: financial and tax records (e.g. invoices) are retained for the period required by applicable law.

12. Personal-data breach notification (Art 33)

The Processor will notify the Controller of any personal-data breach affecting the Controller's Personal Data without undue delay and in any event within 48 hours of becoming aware (24 hours for confirmed exfiltration), by email to the account owner and the privacy contact on file. The notification will, to the extent then known, include the following, supplemented in phases without undue delay:

• the nature of the breach, including the categories and approximate number of data subjects and records affected;
• the contact point for further information;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

The Processor documents every breach, assists the Controller with its notifications under Articles 33 and 34, and maintains an internal incident-response procedure governing detection, containment, and notification.

12a. No training and no own-purpose use

The Processor will not use Customer Data, prompts, model inputs or outputs to train, fine-tune, evaluate or improve any machine-learning model, or for any purpose other than providing the Service to the Controller. Tenant-scoped learning that serves only the Controller is part of the Service and is not training a model: what is learned for one Controller is stored in its workspace, used only for its users, and never used for another customer or to change a model. Product analytics use only pseudonymous usage events without content. Any processing for the Processor's own purposes requires the Controller's prior written instruction.

The AI model providers the Processor engages (the routes in Annex III) are engaged under terms that exclude training on Customer Data; the retention terms of each route, where confirmed, are stated in Annex III.

13. Audits and inspections (Art 28(3)(h))

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

• The Processor will respond to reasonable written security questionnaires within 30 days.
• On-site audits require 30 days' written notice, are limited to once per 12 months (more frequent only following a confirmed breach), occur during business hours, are subject to confidentiality, and must not disrupt the Service or expose other tenants' data. The Controller bears its own costs; the Processor may charge reasonable cost recovery for on-site time.
• The Processor may satisfy an audit request in the first instance by providing any third-party audit reports or certifications it holds at the time, its security documentation, and written responses to the Controller's security questionnaire, before an on-site audit is required.

14. Instruction infringement (Art 28(3) second subpara)

The Processor will immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the GDPR or other Union or Member State data-protection provisions.

15. CCPA Service Provider terms

This Section applies where the Controller is a “business” under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq., “CCPA”) and discloses Personal Information of California residents to the Processor. With respect to that Personal Information the Processor is a “service provider” and not a “third party”. The Controller discloses Personal Information to the Processor only for the limited and specified business purposes in Section 2 and Annex I.

The Processor will not: (a) sell or share Personal Information; (b) retain, use or disclose Personal Information for any purpose, including any commercial purpose, other than the business purposes specified in this DPA or as otherwise permitted by the CCPA; (c) retain, use or disclose Personal Information outside the direct business relationship between the parties; or (d) combine Personal Information received from the Controller with Personal Information received from or on behalf of another person, or collected from its own interaction with the consumer, except as permitted by the CCPA.

The Processor will comply with the obligations the CCPA places on service providers and provide the same level of privacy protection as the CCPA requires of businesses; will notify the Controller if it determines that it can no longer meet those obligations; grants the Controller the right to take reasonable and appropriate steps, through the information and audit rights in Section 13, to ensure that the Processor uses Personal Information consistently with the Controller's obligations under the CCPA and, upon notice, to stop and remediate any unauthorised use; will assist the Controller in responding to consumer requests under the CCPA as provided in Section 10; and will engage sub-processors only under written contracts that impose the obligations of this Section, with notice under Section 8. The Processor certifies that it understands the restrictions in this Section and will comply with them.

16. Liability and indemnity

Liability under this DPA is subject to the limitations of liability in the Terms of Service. Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR or to a supervisory authority under Article 83 GDPR.

17. Order of precedence

If there is a conflict between this DPA and the Terms of Service, this DPA prevails for matters of personal-data processing. If there is a conflict between this DPA and the Standard Contractual Clauses, the SCCs prevail.

18. Governing law & jurisdiction

This DPA is governed by the laws of the Czech Republic, the same law that governs the Terms of Service, without prejudice to the Standard Contractual Clauses, which are governed by the law specified within them. Disputes arising out of or relating to this DPA are subject to the jurisdiction set out in the Terms of Service.

Annex I: Description of processing

See Sections 2 to 4 above for the nature, purpose, data subjects, and data categories. Frequency: continuous for the duration of the subscription. Duration: until termination plus the windows in Section 11.

What the Service learns, per source. Learning is on by default for each source the Controller's user connects. Each source has its own learning switch under Settings > Connectors; while it is off, the source still works for what it was connected for and nothing new is learned from it; what was already learned stays until the user forgets it. The user can forget each learned fact and each memory at any time.

Retention of learned data. Memories are archived after 90 days unused, and deleted 12 months after archiving unless the user pins it; a pinned memory stays until the user forgets it. On Enterprise plans unused memories are not archived automatically and stay until the user forgets them; a memory archived another way (for example when the user asks the assistant to archive it, or before the workspace moved to Enterprise) is deleted 12 months after archiving unless the user pins it. Learned-profile facts are kept while confirmed; a proposed fact is not used until the user confirms it; a forgotten fact is deleted, and only a fingerprint stays so it is not learned again. For the names the user is addressed by: only where switched on for the customer's workspace, a name is used as soon as at least two separate emails show it as the user's name (up to five names), without a confirm step, to tell whether a message is meant for the user and in drafts written for the user; kept while the account is active; the user can remove a name, and a removed name is not learned again; names taken from the user's own sent mail (From name and sign-offs) are deleted when the user stops learning from sent mail. A forgotten memory is hidden at once and deleted 7 days after the user forgets it, the window in which it can be restored, and backups are deleted within about 30 days. Writing style is derived from the user's sent mail and edits to drafts and is kept while the account is active. Everything learned is deleted with the workspace under Section 11.

Annex II: Technical and organisational measures

The measures the Processor applies under Article 32 GDPR (Section 7).

Confidentiality

• Access control: access to production systems is limited to authorised administrators, who reach the servers with SSH keys only. Sign-in uses HttpOnly, Secure session cookies; a session lasts 24 hours by default. Every request that changes data is protected against cross-site request forgery. Values used to connect an account are single-use and expire.
• Encryption: OAuth tokens and Class A content (email bodies, transcripts, prep packets, briefs) are encrypted at rest with AES-256-GCM, using per-workspace keys derived via HKDF-SHA256 from a master key held outside the database. TLS 1.2 or higher protects every endpoint in transit.
• Workspace separation: each workspace's data is kept separate in every database query; the application connects to the database as a restricted role, and row-level security policies keyed to the workspace are enabled in the database.
• Secret management: credentials and keys are held outside source code, on the server, with access limited to authorised administrators. Code changes are checked automatically for accidentally included secrets before they are merged.

Integrity

• Signed cookies, parameterised database queries and a content security policy where applicable.
• Audit logging: privileged actions (sign-ins, connecting or disconnecting an account, deletion requests, admin actions) are recorded and kept for 12 months.

Availability and resilience

• Nightly database backups, deleted on a rolling basis within about 30 days. Content encrypted in the database stays encrypted in the backups.
• Sign-in, deletion and other abuse-prone endpoints are rate-limited per IP address and per account.

Regular testing and evaluation

• Automated tests and an independent code review, including security, before each release.

Annex III: Sub-processors

The current list of approved sub-processors is published at /legal/processors and is incorporated into this DPA by reference. The AI model providers OpenRouter routes to are listed below, so that every processor in the chain is identified (EDPB Opinion 22/2024). Both are updated in line with Section 8.

Every request through OpenRouter is limited to EU data regions and to providers that do not collect Customer Data or train on it. The direct Mistral AI live-dictation endpoint keeps audio and text for up to 30 days for abuse monitoring and does not train on them. Contact for every provider above: through the Processor, privacy@random-assistant.com.

Contact

For DPA-related questions or audit requests: privacy@random-assistant.com. This page is the only version of the DPA; it is concluded when the Terms are accepted, and we do not sign separate or negotiated copies.