Data Processing Addendum
How we process personal data on behalf of business customers, including GDPR terms.
On this page
1. Scope and how this Addendum applies
This Data Processing Addendum (the "DPA") forms part of the agreement between AI AIDE LLC ("AI AIDE", "Processor") and the customer ("Customer", "Controller") for AI AIDE's products and services, which may be the Co-Create Terms of Service, the Consulting Services Agreement or another written agreement (the "Agreement"). It applies to the extent AI AIDE processes Customer Personal Data on Customer's behalf in providing the services (the "Services"). It is incorporated into the Agreement automatically when a business customer accepts the Agreement, and it applies for as long as AI AIDE processes Customer Personal Data. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Clauses control.
This DPA does not apply to personal data that AI AIDE processes as a controller for its own purposes, such as account and billing information about Customer's own users, which is covered by our Privacy Policy.
2. Definitions
"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), the Texas Data Privacy and Security Act and other US state privacy laws. "Customer Personal Data" means personal data that Customer (or its end users) submits to the Services, or that AI AIDE otherwise processes on Customer's behalf under the Agreement. "Subprocessor" means a third party engaged by AI AIDE to process Customer Personal Data. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. Terms such as "controller", "processor", "data subject", "processing", "business", "service provider" and "sell" have the meanings given in Data Protection Laws.
3. Roles and instructions
Customer is the controller (or business) and AI AIDE is the processor (or service provider) of Customer Personal Data. Where Customer is itself a processor for another controller, AI AIDE is Customer's subprocessor, and Customer is responsible for passing on any instructions and notices to that controller.
AI AIDE will process Customer Personal Data only on Customer's documented instructions, which are: to provide, maintain, secure and support the Services as described in the Agreement and the documentation; to carry out processing that Customer or its end users start through the Services (including sending content to AI model providers when a feature is used); and as further agreed in writing. AI AIDE will tell Customer if, in its opinion, an instruction violates Data Protection Laws, and may suspend the affected processing until the instruction is changed. AI AIDE may also process Customer Personal Data where required by law, after telling Customer unless the law forbids it.
Customer is responsible for the lawfulness of its instructions and of the collection of Customer Personal Data, including providing all notices and obtaining all consents and legal bases required, and for not submitting special categories of data, children's data or other regulated data unless the Services are suitable for it and the law allows it.
4. Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the Services under the Agreement |
| Duration | The term of the Agreement plus the period until deletion under Section 10 |
| Nature and purpose | Hosting, storing, transmitting, organizing, analyzing and otherwise processing data to build, run and support Customer's apps, automations and workflows, and to perform consulting work |
| Types of personal data | Whatever Customer and its end users submit, typically names, contact details, account credentials, user-generated content, messages, usage and device data |
| Categories of data subjects | Customer's end users, employees, contractors, customers and other individuals whose data Customer submits |
| Special categories | None intended. Customer must not submit them unless agreed in writing |
5. AI AIDE personnel
AI AIDE will make sure that people authorized to process Customer Personal Data are bound by confidentiality obligations and have access only as needed to perform the Services.
6. Security
AI AIDE will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as described in Annex 2. AI AIDE may update these measures as long as the update does not materially reduce the overall level of protection. Customer is responsible for using the Services securely, including protecting its account credentials, configuring access for its collaborators, securing the apps it builds and the keys it adds, and keeping backups of data it considers important.
7. Subprocessors
Customer gives AI AIDE general authorization to engage Subprocessors. The current list is at aiaide.io/legal/subprocessors. AI AIDE will impose data protection obligations on each Subprocessor that are no less protective in substance than this DPA, and remains responsible for their performance. AI AIDE will update the list before a new Subprocessor begins processing Customer Personal Data and will notify Customers that have asked for notice by email (as the list explains). Customer may object on reasonable data protection grounds within 30 days after notice. The parties will discuss the objection in good faith. If AI AIDE cannot offer a reasonable alternative, Customer may terminate the affected Services as its sole remedy, and receive a pro-rata refund of prepaid fees for the terminated part, if any.
8. Assistance
Taking into account the nature of the processing, AI AIDE will provide reasonable assistance to Customer in: responding to requests from data subjects exercising their rights (many of which Customer can handle itself through the Services); carrying out data protection impact assessments and prior consultations with supervisory authorities; and meeting its security and breach notification obligations. If AI AIDE receives a request from a data subject about Customer Personal Data, it will direct the data subject to Customer where it can identify Customer, and will not respond itself except as the law requires. Assistance beyond what the Services' features provide may be charged at reasonable rates.
9. Security Incidents
AI AIDE will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the incident, the data and data subjects affected, the likely consequences and the measures taken or proposed, and AI AIDE will supplement it as more information becomes available. AI AIDE will take reasonable steps to contain and remedy the incident. Notification is not an acknowledgment of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data (such as blocked login attempts or scans) are not Security Incidents.
10. Return and deletion
During the term, Customer can export or delete Customer Personal Data through the Services (for example, by downloading an app's code or data, or deleting the app or account). After the Agreement ends, AI AIDE will delete Customer Personal Data in its systems within the periods described in the product's retention terms, normally within 90 days, except data it must keep by law, which remains protected by this DPA, and copies in backups, which are deleted as the backups expire.
11. Audits
On written request no more than once a year (or after a Security Incident, or where a supervisory authority requires it), AI AIDE will make available the information reasonably necessary to demonstrate compliance with this DPA, such as written answers to a reasonable security questionnaire and summaries of its security practices. If that information is not sufficient to meet a legal requirement, Customer may conduct an audit, at its own cost, on at least 30 days' notice, during business hours, in a way that does not disrupt AI AIDE's operations or compromise other customers' data, and subject to confidentiality obligations. AI AIDE does not currently hold third-party security certifications; it will tell Customer if it obtains any.
12. International transfers
AI AIDE processes Customer Personal Data in the United States and wherever its Subprocessors operate. To the extent Customer Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to AI AIDE in a country that does not provide adequate protection, the parties agree that the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (the "Clauses") are incorporated by reference, as follows: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor; the optional docking clause (Clause 7) applies; Clause 9 option 2 (general authorization) applies with the notice period in Section 7; the optional language in Clause 11 does not apply; Clause 17 option 1 applies with the law of Ireland; the courts of Ireland are chosen under Clause 18; Annex I is completed by Section 4 and the parties' details in the Agreement; Annex II is Annex 2 of this DPA; and Annex III is the Subprocessor list. For UK transfers, the UK International Data Transfer Addendum to the Clauses (version B1.0) applies, with Table 4 allowing either party to end it as permitted. For Swiss transfers, the Clauses apply with references to the GDPR read as references to Swiss law and the competent authority being the Swiss Federal Data Protection and Information Commissioner. If an alternative lawful transfer mechanism (such as a recognized data privacy framework) becomes available to AI AIDE, AI AIDE may rely on it instead.
13. US state privacy laws
To the extent the CCPA or similar US state laws apply, AI AIDE acts as Customer's service provider or processor and will: process Customer Personal Data only for the business purposes in the Agreement; not sell or share it, or use it for targeted advertising; not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than the business purposes in the Agreement, except as the law allows; not combine it with personal data from other sources except as the law allows; comply with the obligations that apply to it and provide the same level of privacy protection the law requires; tell Customer if it can no longer meet its obligations; and allow Customer to take reasonable and appropriate steps to stop and remedy unauthorized use. AI AIDE certifies that it understands and will comply with these restrictions.
14. AI processing
Customer acknowledges that AI features send the content they need to AI model providers listed as Subprocessors. AI AIDE does not use Customer Personal Data to train its own AI models, and uses providers under terms that do not permit them to train on data sent through their business APIs by default.
15. Liability
Each party's liability under this DPA, including the Clauses to the extent the law allows, is subject to the exclusions and limitations of liability in the Agreement.
Annex 2: Technical and organizational measures
- Encryption in transit: connections to the Services and to apps hosted by them use HTTPS (TLS).
- Secrets: API keys and access tokens Customer adds are stored encrypted (AES-256-GCM) and released only to the processes that need them.
- Isolation: each app built with Co-Create has its own separate database. Builds run in isolated cloud sandboxes.
- Access control: access to Customer Personal Data is limited to authorized personnel who need it, using individual accounts. Database access from browsers is restricted by row-level security policies, and server-side access checks ownership and membership in code.
- Account security: hashed passwords held by our authentication provider, session tracking, new-device alerts, optional two-step sign-in, and revocation of every session when a password is reset.
- Resilience: managed database hosting with daily backups kept for 7 days, and monitoring and alerting on key services, with a public status page.
- Change management: code changes pass automated tests before deployment, and app changes made through Co-Create can be rolled back.
- Subprocessor management: Subprocessors are selected for their security practices and bound by written terms.
- Incident response: automated monitoring and alerts, and a process for investigating, containing and notifying Security Incidents.
- Deletion: account and data deletion tools, with deletion from live systems and expiry from backups.
Contact
Questions about this DPA, or requests for a countersigned copy: cyberdesigner@aiaide.io, subject "DPA".