Data Processing Agreement

1. Scope and Roles

You are the controller of Customer Personal Data, and we are your processor. "Customer Personal Data" means personal data that we process on your behalf through the Service, including:

• analytics and session recordings of visitors to websites that Pazi hosts for your business;
• email sent to and received at your business's @me.pazi.ai address; and
• personal data in the content, files, instructions, and connected services that your AI agents work with.

Our own processing of account, billing, security, and product-usage information as a controller is described in our Privacy Policy, not in this DPA.

2. Details of Processing

• Subject matter and duration: providing the Service for as long as you use it, until the data is deleted as described in Section 9.
• Nature and purpose: hosting, storing, transmitting, analyzing, and otherwise processing data to run your websites, business email, AI agents, and connected services.
• Data subjects: visitors to your websites, people who exchange email with your business, and your customers, contacts, team members, and other people whose information you or your agents provide.
• Categories of data: website visitor identifiers, pages viewed, referrers, device and browser information, and session recordings with form inputs masked; email addresses, names, message content, and attachments; and any other personal data in your content. Website visitor IP addresses are removed before analytics data reaches our analytics provider.
• Special categories of data: you should not use the Service to process special categories of personal data unless the law allows it and you have assessed the risk.

3. Processing on Your Instructions

We process Customer Personal Data only on your documented instructions, which are the Terms of Service, this DPA, and your use and configuration of the Service, unless the law requires otherwise. If we believe an instruction infringes data-protection law, we will tell you.

4. Confidentiality

We ensure that the people we authorize to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide and support the Service.

5. Security

We maintain technical and organizational measures appropriate to the risk, including:

• encryption of data in transit and of saved credentials at rest;
• separation of each business's data, and isolated sandboxes for AI agent work;
• access controls, short-lived authorization for agent runs, and redaction of saved secrets;
• masked form inputs and removed IP addresses in website analytics; and
• monitoring, logging, and backups of the systems that run the Service.

6. Sub-processors

You authorize us to use the sub-processors listed below. We require each one to protect Customer Personal Data with obligations no less protective than this DPA, and we remain responsible for them. We will update this list before a new sub-processor starts processing Customer Personal Data. If you object to a change on reasonable data-protection grounds, contact us. If we cannot resolve your objection, you may stop using the affected part of the Service or delete your account.

7. International Transfers

We and most of our sub-processors process Customer Personal Data in the United States. For transfers of personal data from the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, Module Two (controller to processor), which are incorporated into this DPA by reference, with you as the data exporter and Pythagora as the data importer. Our sub-processors receive Customer Personal Data under the Standard Contractual Clauses or another transfer mechanism that the law permits.

8. Personal Data Breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and give you the information we have that you need to meet your own obligations.

9. Deletion

When you delete your account, we delete Customer Personal Data from the Service, including email received at your business address. Deletion of your websites' visitor analytics is requested from our analytics provider at the same time, and the provider completes it. Deleting a business or taking down a website also deletes its data.

Email that no business keeps, such as mail sent to an address that doesn't exist, is deleted as soon as it arrives.

Database backups and load-balancer access logs are kept with no fixed expiry and are not changed when an account is deleted. We use them only for security and to restore the Service after an incident. We may also keep records that the law requires us to retain.

10. Assistance and Audits

Taking into account the nature of the processing, we will help you respond to requests from data subjects, carry out data protection impact assessments, and consult supervisory authorities. You can correct and delete much of your data directly in the Service; for anything else, contact us.

We will make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits, including inspections, by you or an auditor you appoint, with reasonable notice and no more than once a year unless a supervisory authority requires otherwise.

11. Precedence and Contact

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data. Send questions about this DPA to hi@pythagora.ai.