Data Processing Agreement

1. Parties and how this agreement applies

This DPA is between the organization that uses Chiron under our Terms of Service or an Enterprise order form ("Customer", the controller) and Mad Science Software B.V., Joop Geesinkweg 601, 1114 AB Amsterdam-Duivendrecht, the Netherlands ("we", the processor). It forms part of those terms and applies automatically; no signature is needed. If you need a countersigned copy for your records, write to inquiries@madsciencesoftware.dev.

Where this DPA and the Terms differ on personal data, this DPA wins. Words such as "personal data", "processing", "controller" and "processor" mean what they mean in the GDPR.

2. What we process

The processing under this DPA is:

Subject matter

Storing, syncing and displaying the memories Customer's members choose to sync to the team server, and running Customer's accounts.

Duration

For as long as Customer uses Chiron, then as set out under "Deletion and return".

Nature and purpose

Receiving memories from members' computers, storing them, sending them to the members allowed to see them, and showing them in the dashboard; nothing else.

Kinds of personal data

Whatever Customer's members put in memories, typically names, contact details and the content of emails, documents, notes and conversations; plus members' account details (email address, name, role, devices).

Whose data

Customer's members, and people who appear in what they save, such as Customer's clients, suppliers and colleagues.

Special categories

Chiron is not designed for special categories of data (such as health data). If Customer's members save them anyway, Customer is responsible for having a lawful basis.

Much of Chiron runs only on members' own computers and never reaches us: the app's local database, embedding and recall. That processing is Customer's own, on Customer's equipment, and is outside this DPA. Recall for a web-based assistant a member connects runs on our servers, and is processing under this DPA.

3. Our commitments

We will:

• process Customer's personal data only on Customer's documented instructions, which are the Terms, this DPA and the settings and actions of Customer's members, unless the law requires otherwise (and then tell Customer first where the law allows);
• tell Customer if we believe an instruction breaks data protection law;
• make sure everyone who can access the data is bound to confidentiality;
• not sell the data, use it for our own purposes, or use it to train artificial intelligence (AI) models;
• help Customer, as far as reasonable, to answer requests from people exercising their rights, and with data protection impact assessments and consultations with authorities about Chiron;
• make available the information needed to show we meet this DPA, and allow audits as set out below.

4. Customer's commitments

Customer is responsible for having a lawful basis to put personal data into Chiron, for its notices to the people concerned, for deciding what members may share (Customer's owner can publish a sharing policy for this), and for the AI assistants its members connect, which process recalled memories under their own providers' terms.

5. Security

We take appropriate technical and organizational measures, including:

• encryption of all connections to the team server and website (Hypertext Transfer Protocol Secure, HTTPS);
• separation of each customer's data in the database itself (row-level security), so requests for one team can't reach another's;
• private memories readable only by the member who saved them, enforced by the server, whatever a teammate's role;
• device and invitation secrets stored only in hashed form; devices that owners or admins can revoke at any time;
• our staff tools show a team's plan and storage use, not its memories;
• The team server's database and its backups are encrypted at rest;
• The database runs on a private network with no public access, with deletion protection and automatic backups kept for 7 days; database credentials are kept in a secrets store, never in code; connections between our services and the database are encrypted; server activity is logged in Amazon CloudWatch; and access to production systems is limited to named staff.

6. Sub-processors

Customer authorizes these sub-processors:

Amazon Web Services, Inc. (AWS)

Hosting of the team server, its database and the website. United States (us-east-1 region).

Google LLC (Firebase Authentication)

Members' sign-in and email verification: email address, name, sign-in identifiers. Processed in the United States.

Stripe, Inc. / Stripe Payments Europe, Ltd.

Subscription billing and tax calculation: team name, owner's email address, billing details. Contracting entity: Stripe Technology Europe, Limited (Ireland).

We impose data protection terms on each sub-processor at least as protective as this DPA, and remain responsible for them. We will tell Customer of a new or replaced sub-processor at least 30 days beforehand by email to the owner and on this page; Customer may object on reasonable data protection grounds and, if we can't resolve it, end the affected service.

7. International transfers

The team server is hosted in the United States. Transfers of personal data from the European Economic Area (EEA), Switzerland or the United Kingdom (UK) rely on the European Union–United States Data Privacy Framework (DPF) where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses (SCCs), which are incorporated into this DPA by reference where needed.

8. Personal data breaches

We will tell Customer of a personal data breach affecting its data without undue delay, and in any case within 48 hours of becoming aware of it, with what we know about its nature, likely consequences and the measures taken, and keep Customer updated.

9. Deletion and return

During the subscription, Customer's members can delete their own memories at any time: the team server erases the memory and its search data when the member's computer next syncs, and every connected computer then erases its copy. A deletion record remains (which memory, when and by whom), without the content. Deleted data leaves database backups within 7 days.

Members' computers keep their own copies of synced memories. Removing a member or revoking a device stops it syncing but does not erase what it already holds; Customer should ask departing members to delete the Chiron data on their computers.

When the subscription ends, Customer's data stays on the team server for 30 days, during which the owner can resubscribe and each member can download their own memories from the dashboard; we then delete it, and it leaves database backups within 7 days. The owner can also delete the team at any time, which deletes its data at once. On Customer's written request we delete its data within 30 days.

10. Audits

On request, we will answer reasonable written questions about our compliance with this DPA. If that is not enough, Customer may, at its own cost, once a year and with at least 30 days' notice, have an independent auditor bound by confidentiality review our compliance.

11. Liability, law and contact

The liability limits in the Terms of Service apply to this DPA as far as the law allows. This DPA is governed by the laws of the Netherlands, and disputes go to the competent court in Amsterdam, the Netherlands. Questions about this DPA: inquiries@madsciencesoftware.dev.