Processor
AI Publisher — the party processing data on behalf of the Controller.
Controller
The Customer — the party determining why and how personal data is processed.
1. Purpose of This Agreement
This Agreement applies where we process personal data on behalf of customers while providing SaaS and AI-based services. It defines:
- Processing responsibilities
- Security obligations
- Confidentiality duties
- Data transfer safeguards
2. Definitions
Personal Data
Any information relating to an identified or identifiable individual.
Processing
Any operation performed on personal data including collection, storage, analysis, transmission, or deletion.
3. Scope of Processing
We process data only as necessary to provide the Service. Processing may include:
- Account management
- AI prompt handling
- File processing
- Output generation
- Technical support
- Usage logging
4. Categories of Data Processed
Data may include:
5. Categories of Data Subjects
Data subjects may include:
- Customer employees
- End users
- Business contacts
- Client representatives
6. Processing Instructions
We process personal data only:
- Under documented customer instructions
- As required for service delivery
- Where legally required
7. Confidentiality Obligations
All personnel with access to personal data must be bound by confidentiality obligations. Access is restricted to authorized personnel only.
8. Security Measures
We implement commercially reasonable safeguards including:
- Encryption in transit
- Secure storage
- Access controls
- Authentication protection
- Activity monitoring
Infrastructure may use secure providers such as Amazon Web Services and Google Cloud.
9. Use of Subprocessors
We may engage subprocessors necessary for service delivery. Examples may include:
- Hosting providers
- Payment processors
- Analytics providers
- Infrastructure providers
Customers may request a current subprocessor list.
10. Subprocessor Safeguards
All subprocessors must be contractually required to maintain equivalent data protection obligations.
11. International Data Transfers
Where data is transferred outside the EU, lawful safeguards apply including:
- Standard Contractual Clauses (SCCs)
- Approved transfer mechanisms
This is required under GDPR for all cross-border data transfers.
12. Assistance with Data Subject Rights
We assist customers where reasonably necessary to respond to:
- Access requests
- Deletion requests
- Correction requests
- Portability requests
- Restriction requests
13. Security Incident Notification
If a personal data breach affecting customer data occurs, we will notify the customer without undue delay. Notification will include:
Nature of Incident
Likely Impact
Corrective Actions
14. Audit Rights
Where legally required, customers may request reasonable information demonstrating compliance. Formal audits must be:
- Proportionate
- Reasonable
- Subject to confidentiality
15. Data Retention and Deletion
Upon account termination or instruction:
Personal data will be deleted or returned unless retention is legally required.
16. AI Processing Clarification
Where AI features are used:
Submitted prompts and files may be processed solely to deliver requested outputs. No unrelated resale of customer content occurs.
17. Legal Requests
If legally compelled to disclose data, we will notify the customer unless prohibited by law.
18. Liability Relationship
Liability under this DPA follows the main service agreement unless otherwise agreed.
19. Term and Duration
This DPA remains effective while personal data is processed through the Service.
20. Governing Law
This DPA follows the governing law selected in the main Terms of Service.
21. Contact for Data Protection Matters
Email: privacy@aipublisher.com
Enterprise Assurance
Customer data is processed only for service delivery under documented safeguards and contractual confidentiality obligations.