Data processing agreement
How we process personal data in your workspace's content on your behalf, under Article 28 of the GDPR.
1. Parties and scope
This agreement is between the customer that accepted the terms of service (the controller) and [Company name], [registered address] (the processor, "we"). It covers personal data in the content our agents process for the customer: code, analytics, error reports, issues, tickets and messages from the services the customer connects.
2. What we process
| Item | Details |
|---|---|
| Subject matter | Running AI agents on the customer's repositories and connected services |
| Duration | The term of the subscription, plus up to 30 days to delete data |
| Nature and purpose | Reading, analysing and summarising content; proposing and making code changes the customer approves |
| Kinds of personal data | What the customer's content contains: names, e-mail addresses, user ids, IP addresses and messages in code, analytics, error reports, issues and chats |
| Data subjects | The customer's staff, contributors, users and customers whose data is in that content |
3. Our obligations
- We process the data only on the customer's documented instructions: the service as configured in the workspace, and what its members ask the agents to do.
- We never use the data to train AI models, and never sell it.
- Everyone with access to it is bound to confidentiality.
- We keep the security measures on the security page in place, and tell the customer before we weaken any of them.
- We help the customer answer data subjects' requests, and with impact assessments and consultations where the data we process is involved.
- We tell the customer without undue delay, and within 48 hours, after we become aware of a personal data breach affecting their data, with what we know and what we are doing about it.
4. AI providers
Agents call the AI provider the customer chooses (Anthropic, OpenAI, AWS Bedrock, Azure OpenAI or another endpoint), with the customer's own key, under the customer's own agreement with that provider. That provider is the customer's processor, not our sub-processor.
5. Sub-processors
The customer authorises the sub-processors on the sub-processors page. We tell the customer [30] days before adding or replacing one, by e-mail to the workspace's owner. The customer may object on reasonable grounds; if we can't resolve it, they may end the subscription and get a refund of prepaid fees for the remaining term. We bind each sub-processor to the same data protection obligations.
6. Transfers
We store and process the data in the United States (AWS, Virginia). Transfers of personal data outside the EEA, to AWS and to any other sub-processor, rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the recipient is certified) or the EU standard contractual clauses.
7. Audits
On request, once a year, we give the customer the information needed to show we comply with this agreement. Further audits, at the customer's cost and with reasonable notice, are agreed in writing.
8. End of processing
When the subscription ends, we delete the workspace's data within 30 days, or return it first if the customer asks before then, unless the law requires us to keep it. Backups are overwritten within [14] days after that.
Contact for data protection: contact@infrastudio.io.