Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", the data controller of the personal data described below) and [Disclarion's legal entity name and registered address to be inserted] ("Disclarion", the data processor), governing Disclarion's processing of personal data on Customer's behalf through the disclarion SDK, api.disclarion.com, and app.disclarion.com. Terms used but not defined here have the meaning given to them in Regulation (EU) 2016/679 ("GDPR").

1. Subject matter and duration

Disclarion processes personal data on Customer's behalf for as long as Customer uses the Service, and for the retention period described in Section 8 after termination.

2. Nature and purpose of processing

Disclarion receives a record of each AI interaction that Customer's product sends via the SDK — provider, model name, session identifier, whether disclosure/labeling occurred, and optional metadata Customer chooses to include — and stores it so Customer can review, filter, and export it as evidence of compliance with AI-transparency obligations.

3. Categories of data subjects

The end users of Customer's own chatbot or AI agent product, to the extent their messages or session identifiers are included in the interaction data Customer sends to the Service.

4. Categories of personal data

Session identifiers, and any personal data an end user includes in the free-text content of their conversation (for example, if they type their own name or contact details). Disclarion does not require Customer to send message content and recommends sending the minimum necessary; Customer controls what is included via the SDK integration.

5. Disclarion's obligations

Disclarion will:

• process personal data only on Customer's documented instructions (including via the Service's normal operation), unless required otherwise by law;
• ensure that personnel authorized to process the data are bound by confidentiality;
• implement the technical and organizational measures described in Section 7;
• assist Customer, insofar as reasonably possible, in responding to data subject requests and in Customer's own data-protection impact assessments;
• notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data;
• make available the information reasonably necessary to demonstrate compliance with this DPA.

6. Sub-processors

Customer authorizes Disclarion to engage the following sub-processors, each engaged under a written agreement imposing data-protection obligations equivalent to this DPA:

• Supabase (database hosting and authentication, EU/Ireland)
• Stripe (payment processing, for paid-plan Customers)
• Zoho (transactional email delivery and customer support tooling)
• Railway and Vercel (application hosting)

The current sub-processor list, with the region each one runs in, is published at disclarion.com/subprocessors. Disclarion will give Customer reasonable notice before adding or replacing a sub-processor, and Customer may object on reasonable data-protection grounds.

7. Security measures

These measures are enforced today, not aspirational:

• Database-level tenant isolation: Row-Level Security enforces that one Customer's data cannot be read by another's, at the database layer rather than only in application code.
• Insert-only audit logs: no code path — including Disclarion's own dashboard — can edit or delete a recorded interaction log entry.
• Hashed API keys: API keys are stored only as a one-way hash; the plaintext key is shown once and never stored.
• EU data residency: the database and its backups run in an EU region (Ireland).
• Encryption in transit: all API and dashboard traffic is served over HTTPS/TLS.

8. Data retention and deletion

On termination of the Service, Disclarion will, at Customer's choice, delete or return Customer's data within 30 days, except to the extent Disclarion is required by law to retain copies.

9. International transfers

Personal data is hosted in the EU. Where a sub-processor transfers data outside the EEA/UK, Disclarion ensures an appropriate transfer mechanism (such as Standard Contractual Clauses) is in place.

10. Audit

Disclarion will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable notice, will allow Customer (or an independent auditor Customer appoints) to conduct an audit no more than once per year, subject to confidentiality and reasonable scheduling.

11. Governing law

This DPA is governed by the same law as the Terms of Service. [To be confirmed with counsel.]

12. Contact

Questions about this DPA can be sent to hello@disclarion.com.