Data Processing Addendum

• Agreement means our Terms of Service and any order form or other agreement you have with us for the Service, together with this DPA.
• Data Protection Laws means the laws on personal data that apply to the processing under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (“UK GDPR”), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).
• Customer Personal Data means personal data we process on your behalf in providing the Service, as Annex I describes.
• Personal Data Breach means a breach of security that leads to the accidental or unlawful destruction, loss or alteration of Customer Personal Data, or to its unauthorized disclosure or access.
• Subprocessor means a third party we engage that processes Customer Personal Data.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

“Controller,” “processor,” “data subject,” “personal data,” “processing” and “supervisory authority” mean what the GDPR says they mean, and “business,” “service provider,” “sell” and “share” what the CCPA says they mean. “Service” means what the Terms call the Service.

You are the controller of Customer Personal Data, or a processor acting for your own customers. We are your processor, or your subprocessor when you act as a processor. You are responsible for having a lawful basis for the processing and for the instructions you give us.

We also process some data as a controller for our own purposes: your account, billing and usage records, and the security and abuse records our Privacy Policy describes. The Privacy Policy covers that processing, not this DPA.

The subject matter, nature, purpose and duration of the processing, and the kinds of personal data and data subjects, are in Annex I.

We process Customer Personal Data only on your documented instructions. Your instructions are the Agreement, what you do in the Service (such as the computers you start, what you put on them and the calls you make to our API), and any other written instruction we agree to.

If the law requires us to process Customer Personal Data in another way, we will tell you first, unless the law forbids that. If we believe an instruction breaks Data Protection Laws, we will tell you.

We do not sell Customer Personal Data, and we do not use it to train AI models.

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality. We access the content inside your computers only as our Privacy Policy describes: when you ask us to, when it is necessary to operate, secure or protect the Service, or when the law requires it.

We implement the technical and organizational measures in Annex II, taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing, and the risks to people. We may change them over time, but never in a way that lowers the overall protection of Customer Personal Data.

You are responsible for your side: who you give access to your workspaces, keys and computers, and the software you run on your computers.

You authorize us to engage subprocessors. The current list, with what each one does and where, is on our subprocessors page, which is Annex III.

We put each subprocessor under a written contract whose data protection obligations protect Customer Personal Data at least as well as this DPA does, as far as they apply to the service it provides. We remain responsible to you for its work.

We update the subprocessors page when we add or remove one. If you ask at privacy@orgo.ai, we will also email you at least 30 days before a new subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds within that time. We will then work with you in good faith on a change that avoids it, and if we cannot find one, you may end the Agreement for the affected part of the Service by notice to us.

You can meet most requests in the Service itself: you can delete chats, computers and your account, and download files from your computers. Where you cannot meet a request yourself, we will help you by appropriate technical and organizational measures, taking into account the nature of the processing.

If someone asks us directly about Customer Personal Data, we will not answer the request ourselves, except to tell them to contact you, unless the law requires us to. We will tell you about the request when we can tell it concerns you.

We will notify you without undue delay after we become aware of a Personal Data Breach, at the email address on your account. The notice will say what we know at the time: what happened, the kinds and approximate numbers of people and records involved, the likely consequences, and what we have done or plan to do. We will send more as we learn it.

We will take reasonable steps to contain the breach and limit its effects. Notifying you is not an admission of fault.

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, and with consulting a supervisory authority, where Data Protection Laws require them.

We are based in the United States. Our servers are in the United States, and in London, United Kingdom, for computers that run there. Subprocessors process data where the subprocessors page says.

Where Data Protection Laws require it for a transfer of Customer Personal Data out of the European Economic Area, the SCCs are part of this DPA by reference, as follows:

• Module 2 (controller to processor) applies when you are a controller, and Module 3 (processor to processor) when you are a processor.
• Clause 7 (the docking clause) applies.
• In Clause 9, Option 2 (general written authorization) applies, with the notice in section 6.
• The optional wording in Clause 11 does not apply.
• In Clause 13, the competent supervisory authority is the one Annex I names.
• In Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes under them go to the courts of Ireland.
• Annexes I, II and III of the SCCs are filled in by Annexes I, II and III of this DPA.

For a transfer out of the United Kingdom, the UK Addendum is part of this DPA by reference, and the SCCs apply as it amends them. Its Table 1 is filled in by Annex I, its Table 2 by the choices above and its Table 3 by Annexes I to III; in Table 4, either party may end the UK Addendum as its section 19 allows.

If the SCCs or the UK Addendum conflict with this DPA, they prevail.

We make available the information needed to show that we meet this DPA: this DPA, our Privacy Policy, our subprocessors page, and what our Trust Center publishes.

You may also send us reasonable written questions, such as a security questionnaire, and we will answer them. Where that is not enough to show we meet this DPA, or a supervisory authority requires it, we will allow an audit, including an inspection, by you or an independent auditor you choose who is bound by confidentiality: on reasonable notice, during business hours, at your cost, and no more than once in any 12 months unless a Personal Data Breach or a supervisory authority calls for another.

While you use the Service, you can download files from your computers, and delete your computers, chats and account, at any time.

When the Agreement ends, or when you ask us to delete your account, we delete Customer Personal Data. We sign you out everywhere, remove your API keys and stop your plans from renewing right away, then delete or de-identify associated personal data, typically within 30 days. A deleted computer leaves your account at once, and its daily backups are erased within a few days. Some other copies, such as one taken at the moment of deletion, can stay in our storage longer; ask us and we will erase them.

Customer Personal Data the law requires us to keep stays protected by this DPA, and we process it only for that purpose. On request, we will confirm deletion in writing.

For the CCPA, you are a business and we are your service provider. We will:

• not sell or share Customer Personal Data;
• not retain, use or disclose it for any purpose other than providing the Service under the Agreement, or outside our direct business relationship with you, except as the CCPA allows;
• not combine it with personal information we receive from others, except as the CCPA allows;
• meet the CCPA’s obligations that apply to us, and give it the level of privacy protection the CCPA requires; and
• tell you if we decide we can no longer meet these obligations.

You may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data. Other US state privacy laws that apply to the processing are met the same way, under their own names for these roles.

Each party’s liability under this DPA, and under the SCCs and the UK Addendum as far as the law allows, is subject to the limitations and exclusions of liability in section 11 of the Terms, which apply to the Agreement as a whole. Nothing in this DPA limits either party’s liability to data subjects where the SCCs or the law do not allow it.

This DPA lasts for as long as we process Customer Personal Data.

If this DPA conflicts with the rest of the Agreement on the processing of Customer Personal Data, this DPA prevails.

Apart from the SCCs and the UK Addendum, which are governed as section 10 says, this DPA is governed by the same law and courts as the Terms (section 16).

We may update this DPA to follow changes in the law or in the Service, but never to lower its protection of Customer Personal Data. Material changes will be communicated by email or an in-product notice, and the “Last updated” date above will change.

If you need a copy of this DPA signed by both of us, write to privacy@orgo.ai with your company’s legal name and address and the name of the person signing. We will send one back countersigned.

Organic Intelligence, Inc. is a Delaware corporation with its principal place of business in San Francisco, California, United States. Questions about this DPA: privacy@orgo.ai.

Data exporter

You, with the name, address and contact on your account or your signed copy. Controller (Module 2), or processor (Module 3).

Activities: using the Service under the Agreement. Signed by accepting the Terms, or in a signed copy.

Data importer

Organic Intelligence, Inc., San Francisco, California, United States. Contact: privacy@orgo.ai. Processor, or subprocessor.

Activities: providing the Service under the Agreement.

Data subjects

People who use the Service under your account: you, members of your workspaces, and people you share computers or apps with.

People whose personal data you or your agents put on your computers or send through the Service, such as your own customers, contacts and employees.

Personal data

• Account details of people in your workspaces: name, email and sign-in identifiers.
• What is on your computers: files, screenshots and anything your agents create or process, including what an agent remembers.
• Chats with agents.
• The sign-ins and actions of apps you connect to an agent.
• Service records: API calls, computer lifecycle events, timestamps, diagnostic logs and the network addresses requests come from.
• If you turn on a residential IP, the residential IPs a computer had and the names of the sites it reached.

Sensitive data

We do not ask for special categories of personal data. You decide what goes on your computers, and the measures in Annex II apply to all of it.

Frequency

Continuous, while you use the Service.

Nature and purpose

Hosting, storing, running, backing up, transmitting and deleting data as needed to provide the Service, to give you the support you ask for, and to keep the Service secure.

Duration

For the term of the Agreement, then until deleted as section 12 describes.

Subprocessors

The same subject matter, nature and duration, for the purposes each one’s entry on the subprocessors page names.

Supervisory authority

For the SCCs, the supervisory authority Clause 13 points to: that of the EU member state where you are established, or where your EU representative is. For the UK Addendum, the UK Information Commissioner.

Isolation

Each Linux and Windows computer is its own virtual machine with its own disk. Macs and phones are real devices, each used by one customer.

Encryption in transit

Connections to Orgo are encrypted with TLS, and browsers are told to always use HTTPS.

Stored secrets

Secrets you save, API keys and computer screen passwords are encrypted before we store them.

Signing in

Sign-in is by a code we email, or through Google, GitHub, Microsoft or Apple, so we store no passwords. Each person can add an authenticator app as a second factor.

Access you control

Workspace roles decide who can see or operate the computers in a workspace. API keys can be limited to some permissions or to one workspace, and can expire.

Our access

Access to production systems is restricted to authorized staff and requires authentication. We access the content inside your computers only as section 4 describes.

Monitoring

Automated systems act on operational signals, such as resource use and health, and on abuse signals. We do not monitor the contents of your computers in the ordinary course of operating the Service.

Backups

Where a computer has daily backups, they are kept for 7 days while it runs, and its most recent backup is kept while the computer exists. Backups are stored apart from the server the computer runs on, so it can be restored onto another one.

Payments

Card details are handled by Stripe. We never see or store full card numbers.

People

Everyone we allow to process Customer Personal Data is bound by confidentiality.

Deletion

As section 12 describes.

Reporting

Anyone can report a vulnerability to privacy@orgo.ai.

The subprocessors we use, what each one does and where, are listed on our subprocessors page, which we keep current as section 6 describes.