This Data Processing Addendum (the DPA) forms part of the Terms of Service, or any other written agreement for the Services, between Definable AI Private Limited (Definable, the Processor) and the customer that accepted it (the Customer) (the Agreement). It applies from the day the Agreement does, for as long as Definable processes Customer Personal Data. No separate signature is needed; to receive a countersigned copy, write to [email protected].
1. Definitions
Words defined in the Agreement have the same meaning here. In addition:
- Data Protection Laws: every law on personal data that applies to the processing under this DPA, including India's Digital Personal Data Protection Act, 2023 and its rules (the DPDP Act), the EU General Data Protection Regulation 2016/679 (the GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (the CCPA).
- Customer Personal Data: personal data in Customer Data that Definable processes for the Customer under the Agreement.
- Controller, Processor, Data Subject, Personal Data Breach and Processing have the meanings the GDPR gives them. Under the DPDP Act, Controller means Data Fiduciary, Processor means Data Processor and Data Subject means Data Principal. Under US state laws, Controller means business and Processor means service provider or processor.
- Subprocessor: a third party Definable engages to process Customer Personal Data.
- Standard Contractual Clauses or SCCs: the clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
- UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
- Restricted Transfer: a transfer of Customer Personal Data that Data Protection Laws allow only with an approved safeguard, such as a transfer from the European Economic Area to a country without an adequacy decision.
2. Roles and scope
2.1 Roles. The Customer is the Controller of Customer Personal Data, or a Processor acting for its own Controller, and Definable is its Processor (or Subprocessor). Where the Customer acts for another Controller, it confirms that the Controller has authorised its instructions and Definable's engagement.
2.2 Definable's own data. Definable is an independent Controller for the personal data it needs to run its business with the Customer: account and sign-in details of Authorized Users, billing and payment records, support conversations, security logs and the usage data described in the Terms. Our Privacy Policy covers that data, not this DPA.
2.3 Details. Annex 1 describes the processing: its subject, nature, purpose and duration, the types of personal data and the categories of Data Subjects.
3. Processing on instructions
3.1 Instructions. Definable processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case Definable will tell the Customer first unless the law forbids it. The Agreement, this DPA, and the Customer's configuration and use of the Services, including what its Agents are told to do and which Connected Services and Model Providers they use, are the Customer's complete instructions.
3.2 Unlawful instructions. Definable will tell the Customer if it believes an instruction breaks Data Protection Laws, and may stop the processing concerned until the instruction is changed or confirmed.
3.3 New instructions. Instructions outside the scope of the Agreement need a written agreement between the parties, including any fees.
4. Confidentiality
Definable makes sure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, gets access only as their role needs it, and is trained on handling personal data.
5. Security
5.1 Measures. Definable maintains the technical and organisational measures in Annex 3, appropriate to the risk of the processing. Definable may update them over time, provided the update does not lower the overall protection of Customer Personal Data.
5.2 Certifications. Definable maintains ISO/IEC 27001 and ISO/IEC 42001 certifications for the Services, and keeps them current for as long as this DPA applies. Definable is preparing for a SOC 2 audit.
5.3 The Customer's part. The Customer is responsible for the security choices it makes in the Services: who it invites, the access it grants Agents, which actions need approval, the Connected Services it links, the keys it adds and the data it chooses to put in.
6. Personal Data Breaches
6.1 Notice. Definable will notify the Customer without undue delay, and within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, so the Customer can meet its own deadlines, such as the 72 hours the DPDP Act and the GDPR allow for notifying the authorities.
6.2 What we tell you. The notice will describe, as far as then known, what happened, the categories and rough number of Data Subjects and records concerned, the likely consequences, and the steps taken or proposed to contain it. Definable will update the Customer as it learns more.
6.3 Help. Definable will take reasonable steps to contain and remedy the breach and will help the Customer notify the Data Protection Board of India, supervisory authorities and Data Subjects where the Customer must.
6.4 No admission. A notice under this section is not an admission of fault or liability.
7. Subprocessors
7.1 Authorisation. The Customer authorises Definable to engage the Subprocessors listed in Annex 4, and new Subprocessors as described below.
7.2 Obligations. Definable binds each Subprocessor by written contract to data protection obligations no less protective than this DPA, as far as they relate to the service it provides, and remains responsible for its Subprocessors' performance.
7.3 New Subprocessors. Definable will give the Customer at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating Annex 4 and emailing the Customer's Workspace owners. The Customer may object on reasonable data protection grounds within that period. The parties will then try in good faith to find a solution; if they cannot, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.
7.4 Services the Customer chooses. Model Providers the Customer selects for its Agents through its own provider keys or subscriptions, Connected Services the Customer links, and the channels it puts its Agents on, such as Slack, Telegram and WhatsApp, receive data because the Customer directs it. They act under their own terms with the Customer and are not Definable's Subprocessors. Model Providers that run on Definable's own keys, such as those behind Builder, the Definable agent and Agents billed in Credits, are Definable's Subprocessors and are listed in Annex 4.
8. Data Subject requests
Definable will tell the Customer about any request it receives from a Data Subject about Customer Personal Data, without answering it except to redirect the person to the Customer. Taking into account the nature of the processing, Definable will help the Customer answer requests to access, correct, erase, port or restrict personal data, to nominate another person, or to have a grievance addressed, mainly through the features of the Services and otherwise by reasonable assistance.
9. Impact assessments and consultation
Definable will give the Customer reasonable information and help, taking into account the nature of the processing and the information available to it, for data protection impact assessments, periodic audits, and prior consultations with authorities that Data Protection Laws require of the Customer, including obligations as a Significant Data Fiduciary under the DPDP Act.
10. AI processing
10.1 No training. Definable does not use Customer Personal Data to train or fine-tune any AI model, its own or anyone else's, unless the Customer instructs it to in writing.
10.2 Model Providers. Definable sends Customer Personal Data to a Model Provider only to produce an Agent's response or to run a feature the Customer uses. For Model Providers that are Definable's Subprocessors, Definable uses commercial API terms under which the provider does not train on the data it receives.
10.3 Automated decisions. The Customer decides whether its Agents make decisions that produce legal or similarly significant effects for people, and is responsible for the human review, notices and rights that Data Protection Laws require for them. Definable will provide information it reasonably holds about how the Services work to help the Customer meet those requirements.
11. International transfers
11.1 Where data goes. Definable stores Customer Personal Data in Germany and the United States, and its Subprocessors process it in the locations listed in Annex 4. The Customer authorises these transfers.
11.2 India. Definable will not transfer Customer Personal Data to a country or territory that the Government of India restricts under the DPDP Act.
11.3 Restricted Transfers. For a Restricted Transfer from the European Economic Area, the United Kingdom or Switzerland to Definable, the parties agree to the SCCs, the UK Addendum and the Swiss variations as set out in Annex 2, which are incorporated into this DPA by reference. If a regulator or court invalidates a transfer mechanism, the parties will work together to adopt a valid alternative.
11.4 Onward transfers. Definable makes onward Restricted Transfers to Subprocessors only under an approved safeguard, such as the SCCs or an adequacy decision, including the EU–US Data Privacy Framework where the Subprocessor is certified.
12. Audits
12.1 Reports first. On written request, no more than once a year, Definable will provide its current ISO certificates and, once issued, its most recent SOC 2 report, under confidentiality, and answer a reasonable security questionnaire. The Customer agrees that these generally show Definable's compliance with this DPA.
12.2 Audits. If the reports don't answer a specific question, or a regulator requires it, the Customer may audit Definable's compliance with this DPA, no more than once a year, with at least 30 days' notice, during business hours, under confidentiality, in a way that does not disrupt the Services or reveal other customers' data. The Customer bears its own costs. The audit may be carried out by an independent auditor who is not a competitor of Definable.
13. Return and deletion
13.1 During the term. The Customer can remove Customer Personal Data in the Services at any time, for example by deleting threads, knowledge files, Agents or End Users. Deleting an End User erases that person's conversations, runs and files at once. For other deletions, and for any Customer Personal Data the Customer asks Definable to erase at [email protected], Definable erases the data from its systems within 30 days of the request.
13.2 At the end. When the Agreement ends, Definable stops processing Customer Personal Data except as needed to delete it. For 30 days after the end the Customer may ask at [email protected] for a copy of its Customer Data. After that period Definable deletes Customer Personal Data from its systems, and from backups as they rotate out, unless the law requires it to keep some. Definable keeps any data it must retain confidential and processes it only for the purpose that requires it.
14. The Customer's responsibilities
The Customer will: (a) have a lawful basis, and where the DPDP Act requires it, valid consent and a notice, for all Customer Personal Data it puts into the Services and for the processing it instructs; (b) give its End Users the notices that Data Protection Laws require, including that they are dealing with an AI; (c) not put the sensitive data listed in Section 4.6 of the Terms into the Services unless agreed in writing; and (d) honour withdrawals of consent and other requests from its Data Subjects.
15. US state privacy laws
Where US state privacy laws apply, Definable acts as the Customer's service provider or processor and will: (a) not sell or share Customer Personal Data, as those terms are defined by those laws; (b) not keep, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship with the Customer; (c) not combine it with personal data from other sources except as those laws allow; (d) comply with those laws and provide the same level of protection they require; (e) tell the Customer if it can no longer meet its obligations under them; and (f) allow the Customer to take reasonable steps to stop and remedy unauthorised use. Definable certifies that it understands these restrictions.
16. Liability and precedence
16.1 Liability. Each party's liability arising out of or relating to this DPA is subject to the limits and exclusions in the Agreement, except where Data Protection Laws or the SCCs do not allow them.
16.2 Precedence. If this DPA conflicts with the Agreement, this DPA wins on data protection matters. If the SCCs conflict with this DPA or the Agreement, the SCCs win.
16.3 Changes. Definable may update this DPA to reflect changes in Data Protection Laws or the Services, provided the update does not lower the protection of Customer Personal Data. Definable will tell Customers about material updates at least 30 days in advance.
Annex 1: Details of processing
| Controller | The Customer, as identified in its Workspace or order form. Contact: the Workspace owner. |
| Processor | Definable AI Private Limited, Building 145, Sector 44, Gurugram, Haryana 122009, India. Contact: Anandesh Sharma, Grievance Officer, [email protected]. |
| Data Subjects | The Customer's Authorized Users; its End Users, such as people who chat with its Agents on a channel, in its client app or through the Chrome extension; and people whose data appears in Customer Data, such as contacts, customers and employees named in messages, files or Connected Services. |
| Personal data | Whatever the Customer puts into the Services or has its Agents read, which may include: names, email addresses, phone numbers and channel identifiers; message and conversation content; files and knowledge base documents; content read from Connected Services and web pages; run records and traces of what Agents did; and approval decisions and ratings. |
| Sensitive data | None intended. The Customer must not put the data listed in Section 4.6 of the Terms into the Services unless agreed in writing. |
| Frequency | Continuous, for as long as the Customer uses the Services. |
| Nature and purpose | Hosting, storing, indexing, searching, transmitting, and processing data with AI models, to build and run the Customer's Agents and provide the Services as the Agreement describes. |
| Duration and retention | The term of the Agreement plus the deletion period in Section 13. During the term, Customer Data is kept until the Customer deletes it. Definable's operational logs, which can contain parts of requests, are kept for 7 days. A conversation's code sandbox is deleted 30 days after its last use. |
| Subprocessors | As listed in Annex 4, for the subject matter, nature and duration stated above. |
Annex 2: Restricted Transfers
EU. Where the Customer is a Controller, Module Two (controller to processor) applies; where it is a Processor, Module Three (processor to processor) applies. For both:
- Clause 7 (docking clause) applies.
- Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in Section 7.3 of this DPA.
- Clause 11(a): the optional language does not apply.
- Clause 13: the competent supervisory authority is that of the EU member state where the Customer is established or, if it isn't established in the EU, where its representative is.
- Clause 17: the SCCs are governed by the laws of Ireland.
- Clause 18(b): disputes are resolved by the courts of Ireland.
- Annex I: the parties, processing details and contacts are those in Annex 1 of this DPA; the data exporter is the Customer and the data importer is Definable.
- Annex II: the technical and organisational measures are those in Annex 3 of this DPA.
- Annex III: the Subprocessors are those in Annex 4 of this DPA.
UK. The UK Addendum applies to transfers from the United Kingdom. Its Table 1 is completed with the parties' details in Annex 1, Tables 2 and 3 with the choices above, and in Table 4 either party may end the UK Addendum as its Section 19 allows.
Switzerland. For transfers from Switzerland, the SCCs apply as above with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority; references to EU member states include Switzerland, so Data Subjects there can bring claims where they live; and references to the GDPR include the Swiss Federal Act on Data Protection.
Annex 3: Security measures
- Governance. A written information security programme, certified under ISO/IEC 27001 and ISO/IEC 42001, with a named owner and yearly review.
- Risk management. Regular risk assessments of the Services and of Subprocessors before they are engaged and while in use.
- Encryption. Data encrypted in transit with TLS. Provider keys, channel credentials, MCP credentials and other secrets are encrypted with AES-256-GCM before they are stored, sealed to the Workspace they belong to. Files are stored in Amazon S3, which encrypts them at rest.
- Separation. Each customer's data is kept apart: every request is bound to one Workspace when it signs in, and every database read and write is filtered by that Workspace, so one Workspace can't read another's.
- Access control. Least-privilege access to production systems, granted by role and reviewed regularly, with multi-factor authentication. Access to Customer Data by staff is limited to what support and operations need.
- Credentials. API keys and the sessions Definable issues are stored only as hashes. Sign-in codes are hashed, expire after 10 minutes and are rate limited. Dashboard sign-in is handled by Stytch.
- Isolated code execution. Code that Agents run executes in a sandbox of its own for each conversation, separate from Definable's application and from other conversations.
- Human approval. Customers can require a person's approval before an Agent takes a chosen action, and every step an Agent takes is recorded in a trace the Customer can review.
- Logging and monitoring. Requests and errors are logged and monitored. Secret values are masked in application output, and password, token, authorization, cookie and API key fields are redacted from telemetry.
- Secure development. Code review for every change, automated tests and separate development and production environments.
- Vulnerability management. Timely patching of systems and dependencies.
- Incident response. A documented incident response process, tested regularly, that includes the notices in Section 6.
- Business continuity. Regular backups, tested restores and redundancy for critical systems.
- Physical security. Hosting only in data centres of providers with recognised certifications such as ISO/IEC 27001 and SOC 2.
- People. Confidentiality agreements, background checks where the law allows, and security and privacy training for staff.
Annex 4: Subprocessors
The same list is published in our Trust Center.
| Subprocessor | What it does for us |
|---|---|
| Hetzner Online GmbH Germany | Servers, databases and code sandboxes that run the Services |
| Amazon Web Services, Inc. United States | File storage, email and text message delivery |
| Stytch, Inc. United States | Sign-in and account authentication |
| Composio, Inc. United States | Connections to third-party apps and the actions Agents take in them |
| TinyFish United States | Web search and web page fetching for Agents |
| Anthropic, PBC United States | AI models for Builder, the Definable agent and Agents that run on Definable's keys |
| OpenAI, L.L.C. United States | AI models for Agents that run on Definable's keys |
| TypeSafe AI United States | Routing each message to an Agent's fast or main model |
| Stripe, Inc. United States | Payment processing |
| Razorpay Software Private Limited India | Payment processing |