This Data Processing Addendum ("DPA") forms part of the Terms of Service between PoweAI legal entity name ("PoweAI") and Customer. It applies when PoweAI processes personal information on Customer's behalf.
Roles and instructions
Customer is the business (controller) and PoweAI is the service provider (processor) for personal information contained in Customer Data. PoweAI processes it only on Customer's documented instructions, which are the Terms, the order form and Customer's configuration of the Service, including the permissions and autonomy settings Customer chooses. PoweAI will tell Customer if it believes an instruction violates applicable law.
Service provider commitments
PoweAI will not:
- sell or share the personal information;
- retain, use or disclose it for any purpose other than providing the Service to Customer, or outside the direct business relationship with Customer;
- combine it with personal information from other sources, except as permitted by law.
PoweAI will comply with applicable state privacy laws, provide the same level of protection they require, notify Customer if it can no longer meet its obligations, and allow Customer to take reasonable steps to stop and remediate unauthorized use.
Details of processing
| Subject matter | Provision of the PoweAI Service |
| Duration | The subscription term, plus the deletion period below |
| Nature and purpose | Hosting, analyzing, organizing and generating content from Customer Data to provide the Business Brain, briefs, drafts and authorized actions |
| Types of data | Contact details, communications content and metadata, calendar data, business records, account data |
| Data subjects | Customer's owners, staff, customers, prospects, vendors and other contacts |
Personnel and confidentiality
PoweAI ensures that people authorized to process personal information are bound by confidentiality obligations and access it only as needed to provide the Service.
Security
PoweAI implements technical and organizational measures appropriate to the risk, as described on our Security page, including encryption in transit and at rest, access controls, isolation of each customer's data and audit logging.
Subprocessors
These are the companies that help us run PoweAI. We give 30 days' notice before adding a new one.
Customer authorizes PoweAI to use the subprocessors below. PoweAI binds each subprocessor to data protection terms at least as protective as this DPA and remains responsible for them. PoweAI will give at least 30 days' notice of any new subprocessor. Customer may object on reasonable data protection grounds, and the parties will work in good faith to resolve the objection.
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Anthropic, PBC | AI model processing (Claude) | Customer Data included in requests | United States |
| Supabase, Inc. | Database, storage and authentication | Customer Data, account data | United States confirm region |
| Vercel Inc. | Application hosting and delivery | Account and usage data, data in transit | United States |
| Trigger.dev | Background job processing | Job data, which may include Customer Data | United States confirm |
| Twilio Inc. | SMS and WhatsApp message delivery | Phone numbers, message content | United States |
| Meta Platforms, Inc. | WhatsApp Business Platform | Phone numbers, message content | United States and other regions |
| Payment processor | Billing and payments | Billing contact and payment details | United States |
Preliminary list based on the planned PoweAI stack. Confirm every provider, purpose and region before publishing.
Assistance
Taking into account the nature of the processing, PoweAI will help Customer respond to requests from individuals exercising their privacy rights, and provide reasonable information Customer needs for risk assessments required by law.
Security incidents
PoweAI will notify Customer without undue delay, and in any case within 72 hours, after confirming a security incident affecting Customer's personal information. The notice will describe the incident, the data involved, the steps taken and a point of contact, and PoweAI will provide updates as information becomes available.
Return and deletion
For 30 days after the subscription ends, Customer may request an export of Customer Data. PoweAI then deletes Customer Data within 30 days, with backup copies removed on their regular cycle within 90 days, unless the law requires retention.
Audits
On written request, no more than once a year, PoweAI will answer reasonable security questionnaires and provide available third-party assessment reports, such as Google's security assessment letter where applicable.
Data location and liability
PoweAI processes and stores Customer Data in the United States. Each party's liability under this DPA is subject to the limitations in the Terms.