Data Processing Addendum

For the content you create or upload in the cloud apps (documents, matters, chats, reports), you are the controller and we are your processor. For your account and billing data we act as an independent controller, as described in the Privacy Policy.

Requests you run with your own AI key (BYOX) are sent to the AI provider you chose, under your own agreement with that provider; that provider is not our sub-processor.

We process personal data only to provide the Services you use, following your documented instructions — your use and configuration of the Services is that instruction. We do not use your content to train AI models, and we do not sell it.

Categories of data are whatever you choose to put into the apps; data subjects are the people that content relates to.

Saved work is encrypted at rest with AES-256-GCM using a key derived per member; payment and platform secrets are encrypted separately and never shown again after entry. All traffic uses TLS with HSTS.

Access to production systems is limited to authorised administrators, and account, payment, licence and administrative actions are recorded in an audit log.

Privacy Vault detects and redacts personal data inside your browser, so the original text is never uploaded.

Anyone we authorise to process your data is bound by confidentiality obligations.

We use the sub-processors listed on the Sub-processors page (/subprocessors) and remain responsible for them. We will update that page before adding or replacing a sub-processor; you may object on reasonable data-protection grounds by contacting us.

Our infrastructure provider operates a global network. Where personal data is transferred out of the EEA, the UK or another jurisdiction with transfer rules, we rely on the transfer mechanisms in our providers' data processing terms, such as the EU Standard Contractual Clauses.

You can access, export, correct and delete your saved work yourself at any time in My files and in each app. We will reasonably assist you with data-subject requests and data-protection impact assessments that relate to the Services.

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you reasonably need to meet your own obligations.

You may export your data at any time. When your account is deleted we delete your saved work, except records we must keep by law (for example invoices).

On reasonable written request we will provide the information necessary to demonstrate compliance with this DPA. For a countersigned copy of this DPA, contact us.