Data Processing Agreement (DPA)

Last Updated: September 2026

This Data Processing Agreement governs the processing of personal data by Massejli AI (as Data Processor) on behalf of the Customer (as Data Controller) under the GDPR.

1. Scope and Applicability

This Data Processing Agreement ("DPA") supplements the Terms of Service and applies to the processing of Personal Data in connection with the Massejli AI Services provided to the Customer.

2. Roles of the Parties

  • Customer as Data Controller: The Customer determines the purposes and means of processing Customer Data and Personal Data uploaded to or processed through the AI agents.
  • Massejli AI as Data Processor: Massejli AI processes Personal Data solely on behalf of and under the documented instructions of the Customer.

3. Zero-Training Policy & Data Confidentiality

Massejli AI explicitly agrees and covenants that Customer Data and Personal Data will NEVER be used to train, retrain, improve, or fine-tune public or third-party foundational AI models. All inferences are processed within isolated session contexts.

4. Security Measures (TOMs)

Massejli AI implements and maintains technical and organizational measures (TOMs) designed to ensure a level of security appropriate to the risk, including:

  • Encryption of Customer Personal Data in transit using TLS 1.2 / TLS 1.3 and at rest using AES-256.
  • Strict logical multi-tenant database and vector store isolation.
  • Role-based access controls (RBAC) and least-privilege principles.
  • Regular automated vulnerability scanning and third-party penetration testing.

5. Subprocessors

The Customer grants general written authorization to Massejli AI to engage third-party Subprocessors. Massejli AI maintains an up-to-date Subprocessors Directory and will notify Customers of any intended changes with at least 30 days prior notice.

6. Data Subject Rights & Deletion

Massejli AI provides tools within the platform for Customers to fulfill Data Subject requests (access, rectification, erasure, restriction, and portability). Upon termination of the Services, Massejli AI will delete all Customer Personal Data within 30 days, unless applicable statutory retention laws require longer retention.

7. Contact & Legal Inquiries

For data protection inquiries or to execute a signed copy of this DPA, please contact our Data Protection Officer at [email protected].