Data Processing Addendum

1. Roles

For personal data contained in your connected databases and queries, you are the controller and Datagent AI is the processor. For your account and billing data, we are the controller as described in the Privacy Policy.

2. Scope and instructions

We process personal data only to provide the Service per your documented instructions — executing the queries you run, generating the AI responses you request, and maintaining the audit log. We never use customer data to train models or for any independent purpose.

3. Subprocessors

We will notify workspace owners of subprocessor changes at least 14 days in advance, giving you the opportunity to object.

• Neon (database hosting, EU/US regions).
• Razorpay (payment processing).
• The platform-configured AI provider: Anthropic, OpenAI, or Google (AI inference only).
• Transactional email delivery provider.

4. Security measures

Technical and organizational measures include AES-256-GCM encryption of credentials at rest, TLS in transit, role-based access control, read-only execution defaults, statement timeouts, full query audit logging, and least-privilege internal access. See the Security page for detail.

5. International transfers

Where personal data is transferred outside the EEA/UK, we rely on the EU Standard Contractual Clauses (2021) and the UK Addendum with each subprocessor.

6. Assistance, audits, and breach notice

We assist you with data-subject requests and impact assessments to the extent the data is in our systems. We notify affected controllers of a personal-data breach without undue delay and no later than 72 hours after becoming aware. Enterprise customers may audit compliance annually upon reasonable notice.

7. Deletion and return

On termination, we delete or return personal data within 30 days, except for backups (purged on rotation within 35 days) and records we must retain by law.

8. Executing this DPA

This DPA is incorporated into the Terms of Service for all customers. Enterprise customers who need a countersigned copy or custom terms can email legal@datagent.ai.