Data processing agreement

What we do with your data, as a binding term.

Last updated 12 November 2026. This page forms part of the terms of service. Where you decide what happens to data and we act on your instructions, you are the controller and we are the processor, and these are the terms of that work. One set of terms applies everywhere; where two regimes differ we follow the stricter one.

Draft for review. The version that binds us is the one signed with you or named in your contract.

The subject matter

What is being processed, and why.

Subject matter

Running the agents and the consulting work you bought, and the operations around them.

Duration

For as long as your engagement runs, plus the thirty days in the retention schedule below.

Nature and purpose

Reading what you give us access to, working out what it means, writing back where you allowed it, remembering what we learned about your business, and keeping the record that proves what happened.

Type of personal data

Whatever is in the systems you connect and the evidence you give us. Typically names, business contact details, account and transaction records, and the content of messages with your customers. You decide what reaches us.

Categories of people

Your staff, your customers, your suppliers and your prospects — again, as determined by what you connect.

Our obligations

The nine things we are bound to.

We act only on your instructions

We process your data only as you have told us to, including where a transfer to another country is involved. If a law forces us to do something else we will tell you before we do it, unless that law forbids us from telling you.

Our people are bound to confidentiality

Everyone with access is under a confidentiality obligation, and only a named Better Outcomes person can sign off work.

We keep it secure

The measures are set out in the information security policy, which forms part of this agreement and says plainly what we have tested and what we have not.

We tell you about subprocessors

You give us general authorisation to use the companies in the list below. If we add or replace one we will tell you before it starts, and you may object; if you object and we cannot offer an alternative, you may end the affected service without penalty.

We help you answer people's requests

If someone asks you for their data, or to correct or delete it, we help you answer. Deleting a person from an agent's memory works today and we test it, including every lesson learned only from them. Producing everything held about one named person is still partly a manual job on our side; we will do it, and we are building the route that makes it quick.

We help you with security, breaches and assessments

We give you what you need for your own impact assessments and we take part in your security reviews, with what we actually know.

We delete or return it at the end

At your choice, we delete your data or give it back, and delete our copies, unless a law requires us to keep something. The dates are in the retention schedule below, and we confirm them to you in writing.

We let you check

We give you the information you need to see that we are keeping to this agreement, and we allow and help with an audit. Our Agent Standard scorecard, including the checks we fail, is part of what we hand over — we would rather you read that than a certificate.

We tell you if an instruction looks unlawful

If we think something you have asked us to do breaks data protection law, we say so immediately rather than doing it quietly. The same applies inside the work: an agent refuses a purpose that is unlawful, and client agreement does not cure it.

For buyers in the United States

The four prohibitions, spelled out.

Where California law applies, we act as your service provider and we are prohibited from each of the following. We state them because the law requires them to be in the contract, and because they are good descriptions of what we do anyway.

We do not sell or share your personal information.
We do not retain, use or disclose it for any purpose other than the business purposes in our contract with you.
We do not retain, use or disclose it outside our direct business relationship with you.
We do not combine your personal information with personal information from any other client or from our own dealings with anyone. This is the one that matters most for how our agents learn, so here is exactly how it is kept: what pools across clients is the business function, the right answer and a reason code, and nothing else — no name, no words, no evidence, no numbers.

If a subprocessor of ours engages anyone else, we tell you, and they are bound by a contract carrying all the same terms.

You may check that we are keeping to this, by assessment, audit or technical testing, once in any twelve months.

Subprocessor list

Everyone who helps us run the service.

This is the whole list. It is derived from the code, not from memory: each row names what the service does and where in the system it is called.

Who	What they do	What reaches them	Where
Our own server	Runs the app and the database	Everything described in the privacy policy	United Arab Emirates
Stripe	Takes payment	Your billing details and card data, which goes to them and never to us	Confirm
OpenRouter	Routes our requests to the AI models	The text of a question and the evidence it is answered from	Confirm
Anthropic	The model that answers, by default	The same text, with instructions to keep nothing and train on nothing	Confirm
Alibaba Cloud (Qwen)	First fallback model, used when the default is busy or refuses	The same text, same instruction	Confirm
DeepSeek	Second fallback model	The same text, same instruction	Confirm
Our mail host	Sends sign-in codes	Your email address and a six-digit code	United Arab Emirates

Every model host above is sent an instruction with each call not to keep the text and not to train on it. That instruction is the default in our code, not a setting someone remembered to switch on.

Retention schedule

How long each thing lives.

Your own records — what we hold to do the work

Deleted at the end of the engagement plus thirty days. The thirty days exist so you can ask for an export after you have stopped paying.

engagement + 30 days

The agent's memory pages

Kept while the account is open. Closing the account removes the journey and the client's whole brain.

life of the account

Audit log

Who did what and when.

12 months

Run records

Read over a rolling thirty-day window, and never containing the text of a run.

30 days

Pooled method lessons

Kept indefinitely, because they are the method and contain nothing about you — function, answer, reason code.

indefinite

Invoices and tax records

As long as the law where we are established requires.

as required by law

A request pauses the clock

If someone asks for their data, we stop anything that would delete it until the request is answered. A deletion job running in the middle of a request is the normal way this goes wrong.

on request

If something goes wrong

Breaches, and who tells whom.

If personal data we hold for you is exposed, lost or reached by someone who should not have it, we tell you without undue delay — we do not assess whether it is serious first and we do not wait for a weekly report. You then decide what has to be told to a regulator or to the people affected, because that decision is the controller's, and we give you what you need to make it.

What we send you: what happened, when, which of your data is involved as far as we know it, what we have done to stop it, and what we think you should consider. In phases if we do not know everything at once, rather than a delay while we find out.

The full process, including the clocks that apply in each place, is on your rights and our breach process.

Said plainly, because you should not have to find it out: we have a route for an agent exceeding its limits — it stops itself, writes a record and tells your named person — and we are building the separate process for a personal-data breach. The commitment above is real and is kept by people today.

The rest

Three short things.

Transfers

Where your data goes to another country it goes under a written contract binding the recipient to these terms, or because you instructed it, or because we must to perform our contract with you. The countries are in the subprocessor list.

Our own records

We keep a record of the categories of processing we carry out for each client, and give it to a regulator on request.

Liability and precedence

Reserved — a lawyer is writing this clause.