توافق‌نامه پردازش داده

1. Roles of the parties

For personal data processed through the service, you (the customer) are the data controller and SAIA is the data processor. We process personal data only on your documented instructions, which include your use of the service’s features.

2. Scope of processing

We process the categories of data and data subjects that you determine when you upload training content and when your assistants handle end-user conversations. Processing lasts for the term of your subscription plus any retention period described below.

3. Subprocessors

You authorize SAIA to engage subprocessors to deliver the service (hosting, LLM inference, payment processing, and email delivery). We maintain a current list and will give notice of new subprocessors so you can object on reasonable grounds.

4. International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on appropriate safeguards — including the EU Standard Contractual Clauses — to ensure an equivalent level of protection.

5. Security measures

We implement technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit and at rest.
• Role-based access controls and least-privilege access.
• Logical isolation of each customer’s content.
• Regular backups and monitoring for unauthorized access.

6. Breach notification

If we become aware of a personal data breach affecting your data, we’ll notify you without undue delay and provide the information you reasonably need to meet your own notification obligations.

7. Return & deletion

On termination, you can export your data for 30 days. After that, we’ll delete or anonymize personal data within a commercially reasonable period, except where retention is required by law.

8. Signing the DPA

This DPA forms part of the agreement between you and SAIA. If your organization requires a signed copy or has specific clauses to review, contact privacy@neuraldesk.io and we’ll work with your team.