Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between OurAI ApS (“Processor”, “OurAI”, “we”) and the customer organisation that has subscribed to the OurAI service (“Controller”, “Customer”, “you”).
This DPA applies only to Business Customers: Organisations, including sole traders acting in a professional capacity, that use OurAI in the course of a business or professional activity. If you use OurAI as an Individual Customer for personal purposes, this DPA does not apply to you. Your data is governed solely by the Privacy Policy, and OurAI is the controller for the personal data you submit.
Scope
This DPA reflects the parties’ agreement on the processing of Personal Data by OurAI on Customer’s behalf in the course of providing the OurAI service, in compliance with the EU General Data Protection Regulation (“GDPR”) and the Danish Data Protection Act.
By accepting the Agreement, the Business Customer enters into this DPA on its own behalf and, to the extent required, on behalf of its affiliates that use the service. No separate signature is required.
Definitions
Capitalised terms not defined here have the meaning given in the Agreement or in the GDPR. “Personal Data”, “Processing”, “Data Subject”, “Controller”, “Processor”, “Sub-processor”, and “Personal Data Breach” have the meanings given in the GDPR.
“Customer Personal Data” means Personal Data that Customer or its authorised users submit to the service and that OurAI processes on Customer’s behalf.
Roles
- Customer is the Controller of Customer Personal Data. Customer determines the purposes and means of the processing and is responsible for ensuring that the processing it instructs OurAI to perform is lawful under the GDPR and the Danish Data Protection Act.
- OurAI is the Processor, acting only on Customer’s documented instructions.
- Where OurAI processes Personal Data for its own purposes, for example account billing data and the contact details of Customer’s administrators, OurAI is an independent Controller and the Privacy Policy applies, not this DPA.
Subject matter and duration
OurAI processes Customer Personal Data to provide the OurAI service, a controlled and audited workspace for using AI models. It does so for the duration of the Agreement, plus any period needed to return or delete the data under the Return or deletion section.
Details of the processing
Nature and purpose. Hosting, transmitting and processing prompts, conversations, files, memories and usage metadata on Customer’s instructions, so that Customer’s authorised users can use AI models. Generating audit logs, billing data and aggregated workspace insights.
Categories of Data Subjects. Customer’s authorised users, such as employees and contractors, and any individuals whose personal data is included in the content Customer’s users submit.
Categories of Personal Data. Identifiers such as name, work email and user ID. Authentication and session data. The content of prompts, conversations, uploaded files and memories, which may contain personal data chosen by Customer’s users. Usage metadata such as model, token counts, timestamps and conversation ID. Governance records: Audit log entries, group membership, and requests to reveal an author’s identity or to export or erase a member’s data, with who made and approved them.
Special-category data. Not requested by, and not required for, the service. Customer is responsible for ensuring that its users do not submit special-category data without an appropriate lawful basis.
Frequency of processing. Continuous, for as long as Customer uses the service.
Customer instructions
OurAI will process Customer Personal Data only on Customer’s documented instructions, including for transfers to a third country, unless processing is required by Union or Member State law to which OurAI is subject. In that case, OurAI will inform Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Agreement, this DPA and Customer’s use of the product’s configuration controls, such as model permissions and workspace policies, together constitute Customer’s documented instructions.
OurAI will inform Customer without undue delay if, in OurAI’s opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
Confidentiality
OurAI ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations, by contract or by law, and are trained on data-protection requirements. Only personnel who need access to Customer Personal Data in order to provide the service are authorised, and access is withdrawn without undue delay when the authorisation ends or is revoked. OurAI can demonstrate these confidentiality commitments to Customer on request.
Security
OurAI implements appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. OurAI may update them from time to time, provided the level of security is not reduced. These measures include at least:
- Encryption in transit: TLS 1.3 for all customer-facing endpoints. Calls between the platform’s application services use mutual TLS, and traffic between servers is carried over an encrypted private network.
- Encryption at rest: Customer Personal Data in conversations, uploaded and generated files, memories and audit logs is encrypted by the application with AES-256-GCM, using a separate key for each customer. Other data is protected by access controls on the server.
- Access control: Role-based access and least-privilege defaults. Administrative access to production servers is possible only over a private network with SSH key authentication, or in an emergency through the hosting provider’s console behind multi-factor authentication.
- Audit logging: Administrative actions in the product, such as changes to roles, members, policies and API keys, are logged. So is every administrator view or search of audit log content.
- Network segmentation: Production runs on its own server, separate from development and staging. On the GPU server, production and development models run as separate services with their own ports and memory, and the GPU server stores no Customer Personal Data.
- Backups: Daily backups stored within the EU. Restores are tested at least annually.
- Vulnerability management: Dependency scanning, security updates installed automatically and activated on a documented schedule, and periodic penetration testing.
- Incident response: A documented playbook, a defined on-call rotation and a review after each incident.
- Personnel: Written confidentiality undertakings and data-protection instructions, signed before access is granted. Data-protection and security training at onboarding and yearly. Access reviewed twice a year.
- Vendor management: Written contracts with Sub-processors that impose, in substance, the same data-protection obligations as this DPA, except where the Sub-processor list states otherwise.
- Data minimisation and retention: When enabled by Customer, redaction replaces personal data with placeholders before it is sent to an AI provider. Customer content is kept until Customer’s users delete it, and the audit log is kept for a fixed period determined by Customer’s plan.
Detailed evidence of these measures, for example penetration-test summaries, is available to Customer on reasonable request under the Audit section.
Sub-processors
General authorisation
Customer grants OurAI a general authorisation to engage the Sub-processors listed below.
New Sub-processors
OurAI will give Customer at least 30 days’ prior notice before adding or replacing a Sub-processor, by updating the list below and notifying Customer’s admin contact by email or in the product. Customer may object within that window on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service for convenience and receive a pro-rata refund of pre-paid fees for the unused portion.
Sub-processor obligations
OurAI imposes on each Sub-processor, in substance, the same data-protection obligations as those in this DPA, and remains liable to Customer for any breach by a Sub-processor. On Customer’s request, OurAI will provide a copy of its agreement with a Sub-processor. Commercial terms that do not affect its data-protection content may be redacted.
Search queries sent to Brave Software are the exception: Brave excludes them from its data processing terms, so neither these obligations nor a transfer mechanism covers them. They are sent only while the web-search tool is enabled, which Customer’s admin can switch off.
Current sub-processors
We currently engage the following Sub-processors:
- Hetzner (Hetzner Online GmbH): primary hosting infrastructure for the managed deployment. Datacenter in Helsinki, Finland (EU); company seated in Germany (EU).
- Anthropic: AI model inference, where Customer’s workspace policy permits. Located in the United States. A request can be processed in other countries where the provider’s cloud suppliers operate.
- Google (Gemini): AI model inference, where Customer’s workspace policy permits. Located in the United States. A request can be processed in other countries where the provider’s cloud suppliers operate.
- Mistral AI: AI model inference, where Customer’s workspace policy permits. Located in France (EU).
- OpenAI: AI model inference and image generation, where Customer’s workspace policy permits. Located in the United States. A request can be processed in other countries where the provider’s cloud suppliers operate.
- xAI: AI model inference, where Customer’s workspace policy permits. Located in the United States. A request can be processed in other countries where the provider’s cloud suppliers operate.
- Brave Software: web search: when the web-search tool is enabled, search queries derived from Customer conversations are sent to Brave, which keeps them for up to 90 days. Brave does not treat search queries as personal data, so they are not covered by its data processing terms, standard contractual clauses or the Data Privacy Framework. Located in the United States.
- Postmark (ActiveCampaign): transactional email: email verification, workspace invitations, owner activation, and password reset messages to Customer’s users. Located in the United States.
- Proton: business email and document storage for business communications. Located in Switzerland.
- Sentry (Functional Software): error monitoring for the service’s backend and web applications. Error reports are stored in Frankfurt, Germany (EU); account data is stored in the United States.
- Stripe (Stripe Payments Europe Ltd): billing and payment processing. Contracting entity in Ireland (EU), with transfers to Stripe in the United States. Stripe acts as an independent controller for fraud prevention, anti-money-laundering checks and the development of its own services.
Customer support is handled over email. No separate support-ticketing Sub-processor is engaged.
We will update this list before adding or replacing a Sub-processor, with the prior notice described above.
International transfers
Customer Personal Data is hosted in Helsinki, Finland (EU/EEA). Where Customer’s workspace configuration permits AI models hosted outside the EU/EEA, the prompts and responses are transferred to the relevant provider, which keeps them as described under Return or deletion.
For transfers outside the EU/EEA, OurAI relies on:
- an adequacy decision of the European Commission, which for the United States means the EU-US Data Privacy Framework where the recipient is certified
- otherwise the European Commission’s Standard Contractual Clauses (SCCs), which the Sub-processor has entered into with OurAI or within its own group
- supplementary measures: Encryption in transit, a contractual ban on training and, where Customer enables it, redaction before content is sent
Customer authorises OurAI to enter into the SCCs and any successor mechanism with Sub-processors on Customer’s behalf.
Web-search queries sent to Brave Software are the exception described under Sub-processors.
Assistance to Controller
Taking into account the nature of the processing and the information available, OurAI will provide reasonable assistance to Customer to:
- respond to requests from Data Subjects exercising their rights under the GDPR
- comply with its security, breach notification, data protection impact assessment and prior consultation obligations under the GDPR
OurAI will pass on Data Subject requests it receives directly to Customer and will not answer them itself, unless Customer instructs otherwise. OurAI may tell the person that the request has been passed on.
Personal Data Breach notification
OurAI will notify Customer without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data, whether at OurAI or at a Sub-processor, so that Customer can meet its own 72-hour deadline for reporting to the supervisory authority. The notification will include the information the GDPR requires, to the extent then known, and will be supplemented as more information becomes available.
Return or deletion at the end of processing
- Export. Customer’s owner can download all Customer Personal Data in the workspace, including files, in a structured, machine-readable format from the admin console until the workspace is deleted.
- End of subscription. When Customer’s subscription ends, the workspace is frozen, and 30 days later OurAI deletes it with all Customer Personal Data. OurAI emails Customer’s owner when the subscription ends and 3 days before the deletion. Downloading the data before then is Customer’s responsibility.
- Deletion on request. Customer can ask in writing for deletion at any time.
- Time limit. Deletion is completed within 30 days of the request or of the date the workspace closes, except where Union or Member State law requires longer retention, for example Danish bookkeeping law for financial records.
- Copies at Sub-processors. Copies that Sub-processors keep under their own terms, such as model providers’ abuse-monitoring records, web-search queries and error reports, are deleted on their schedules, at most 90 days after they were made. A model provider can keep content it flags as abuse for longer, as its terms allow.
Customer’s rights to switch provider and retrieve its data under the EU Data Act are set out in the Terms of Service.
Audit
OurAI will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to reasonable confidentiality and operational safeguards.
To minimise disruption, OurAI may satisfy an audit request by providing recent penetration-test summaries or completed security questionnaires, where these reasonably address Customer’s concerns. On-site audits are limited to once per year, conducted during business hours, with at least 30 days’ notice, and at Customer’s expense, except when prompted by a confirmed Personal Data Breach.
Audits of Sub-processors are as a rule performed through OurAI: On Customer’s reasonable request, OurAI will obtain and share documentation of a Sub-processor’s compliance with its data-protection obligations.
OurAI will give supervisory authorities that have a statutory right of access to Customer’s or OurAI’s facilities, or representatives acting on their behalf, access to OurAI’s physical facilities on presentation of appropriate identification.
Liability
The liability provisions of the Agreement apply to this DPA. The total combined liability of the parties under the Agreement and this DPA, taken together, is subject to the limitations in the Agreement.
Order of precedence
If there is a conflict between this DPA and the Agreement on the subject of personal data processing, this DPA controls. If there is a conflict between this DPA and the SCCs referred to under International transfers, the SCCs control.
Contact
Notices and questions under this DPA can be sent to support@ourai.dk. OurAI directs notices to Customer’s admin contact. Each party will keep the other informed of changes to its contact point.
Governing law
This DPA is governed by Danish law, as the Agreement specifies, without prejudice to mandatory provisions of the GDPR and any applicable Member State law.