Data processing agreement

This agreement covers the personal data Context Engine processes for you, inside your engines, on your instructions. It is part of the terms of service, and you accept it when you accept those — there is nothing to sign and nothing to request.

It exists because Article 28 of the UK and EU General Data Protection Regulation requires a written contract wherever one company processes personal data on another's behalf. If you are using Context Engine for a company, that company is the controller and this is the contract.

The privacy policy covers the other half — the data we hold as controller, about you as an account holder. This agreement does not apply to that, and nothing here reduces what that policy promises.

Which data this covers

In scope: your engine's content. Notes, records, files and their extracted text, journal entries, tasks, conversations with the assistant, transcribed audio, anything that arrives through a connected service, and the identifiers of people who speak to your engine on a chat channel. You decide what goes in and why. You are the controller; we are the processor.

Not in scope: your account. Your email address, sign-in records, usage metering, billing and support correspondence. We decide to collect those, for our own purposes, so we are the controller for them and the privacy policy governs them.

What we do with it, and what we will not

We process your engine's content only to provide the service, and only on your instructions. Using the product is the instruction: creating a record, asking a question, connecting a service, running a flow. These terms and the manual are the documented instructions Article 28 asks for.

We will not process it for any other purpose. In particular we do not use it to train models, we do not sell it, and we do not use it for advertising.

If we ever believe an instruction from you would break data protection law, we will tell you and may decline to act on it.

The details Article 28(3) asks to be written down

Security

We keep the measures set out below, and will not weaken them during this agreement. They are the ones that actually run, not aspirations.

• Every engine is isolated. Its own database, its own search index, its own credentials, its own Worker. The tenant predicate is mandatory in every query and is enforced in the router rather than in code a tenant could be running an old copy of.
• Prompts and answers are not stored by the model gateway. Calls carry a header that drops the request and response bodies; what remains is the model, token counts, duration and cost.
• Our logs never contain content. No note, message, search query, prompt or model output. A user appears as an opaque identifier, never an email address.
• Encryption in transit everywhere, and at rest by the underlying platform.
• Access to production is held by the small number of people who operate the service, and no more. We do not yet run a formal periodic access review, and we would rather tell you that than imply one.
• Every write in an engine is recorded with its actor in that engine's own event log, which you can read at any time. Reads are not logged — so the log tells you what was changed and by whom, and does not tell you what was looked at. We would rather you knew that than assumed otherwise.
• Two-step sign-in is available on every account, and API keys can be rotated at any time from the console.

We will not pretend these are more than they are: the service is young, the two limits above are real, and the privacy policy says plainly which placement guarantees we can and cannot keep. Every measure on this list either runs today or is named as not running.

Sub-processors

You give us general authorisation to use the sub-processors listed in the "Who else handles it" table in the privacy policy. That table is the list, and it is maintained rather than illustrative.

Each of them is bound by written terms no less protective than these, and we stay responsible to you for what they do.

Before we add one, we will tell every engine owner by email, with at least thirty days' notice. If you object on reasonable data protection grounds within that period, write to us and we will work with you to find a way forward; if there is none, you may stop using the service and we will refund the unused part of any prepaid fee.

Sending data outside your country

We are a company in the United States, so providing the service moves personal data there.

Where the data comes from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses and their UK addendum, which are incorporated into this agreement by reference. Module Two applies where you are a controller and we are your processor. Where we pass data to a sub-processor outside those areas, the same clauses or an equivalent mechanism apply between us and them.

An owner who chooses European Union placement when creating an engine keeps that engine's database and stored files in the EU. The privacy policy explains exactly what that does and does not cover, and we will not claim more for it here than we claim there.

When something goes wrong

If personal data we hold for you is lost, exposed or accessed without authorisation, we will tell you without undue delay after becoming aware of it, so that you can meet your own obligation to your supervisory authority — which normally runs to seventy-two hours from the moment you become aware.

We tell you with the information we have at that point rather than waiting to have all of it, and we give you the rest in stages as we establish it. We are not promising to have finished investigating within any fixed period, because that is not a thing anybody can promise; we are promising to reach you quickly and keep you current.

We will tell you what happened, which engines are affected, what data was involved as far as we know, what we have done, and what we suggest you do. We will not wait until we have a complete picture to make the first contact.

Helping you meet your own obligations

• Requests from data subjects. The product answers most of these directly: you can search an engine, correct a record, delete one, and export the whole thing as Markdown and JSON. Where that is not enough, ask us and we will help.
• Assessments and consultations. We will give you the information you reasonably need for a data protection impact assessment or a prior consultation. Much of it is already public in the privacy policy and the manual.
• Demonstrating compliance. We will make available the information needed to show that this agreement is being met.

Audit

You may ask, once in a twelve-month period, for the information reasonably needed to verify our compliance with this agreement, and we will answer in writing. Where that genuinely does not resolve a specific concern, we will agree an inspection with you: at your cost, on reasonable notice, at a time that does not disrupt the service, by someone who is not a competitor of ours and who is under a duty of confidence. If we hold a current third-party audit report or certification covering the point, providing it satisfies this.

Deletion and return

You can take a complete copy of an engine at any time — a ZIP of Markdown and JSON, from the console — so the return of your data is something you exercise rather than something you request.

Deleting an engine is yours to do, and it takes effect after a day, during which you can change your mind. When it runs it removes the engine's database, its search index, its stored files, its rows in every nightly backup, its account records and any authorisations naming it. Nothing of the engine survives except a log line saying it was deleted.

If this agreement ends and you have not deleted your engines, we will delete them on your request. Backups age out on the schedule the privacy policy states.

Your side of this

You are the controller, which means some things are yours rather than ours:

• Having a lawful basis for the personal data you put into an engine, and for what you tell the assistant to do with it.
• Telling the people whose data it is, where the law requires it — including people in a chat you connect your engine to.
• Not putting in special category data, or data about children, unless you have told us and we have agreed in writing how it will be handled.
• Keeping your members' access rights current, and your credentials private.

How this fits together

Where this agreement and the terms of service disagree about the processing of personal data, this agreement wins. Where it and the Standard Contractual Clauses disagree, the Clauses win. Everything else in the terms — including the limits on liability, the governing law and the forum — applies to this agreement too.

Changes

We may update this agreement as the service or the law changes. For a change that reduces what we promise here, we will email every engine owner at least thirty days before it takes effect. The date at the top of this page is when it was last changed.

Contact

Write to us from the console at /help/write, or email hello@contextengine.com. The postal address is in the privacy policy.