Legal

Data processing agreement

Draft

This document is a draft for review by counsel. It isn't in effect yet, and the highlighted [PLACEHOLDERS] are filled in before launch.

Markdown version

Effective November 8, 2026. Last updated: November 8, 2026.

This Data Processing Agreement ("DPA") is part of the Terms of Service between Ask Lou LLC, a Delaware limited liability company at 160 Maplewood Ave, Maplewood, NJ 07040, USA ("Processor", "we"), and the Customer ("Controller", "you"). It applies whenever we process Customer Personal Data for you. It is meant to meet Article 28 of the GDPR and UK GDPR, and the service-provider requirements of the CCPA/CPRA and similar US state laws.

1. Definitions

Terms used in the GDPR (such as personal data, processing, controller, processor, data subject and personal data breach) have the meanings given there. "Customer Personal Data" means personal data in Customer Data that we process for you. "Subprocessor" means a third party we engage to process Customer Personal Data.

2. Roles and instructions

You're the controller (or a processor acting for your controller), and we're your processor. We process Customer Personal Data only on your documented instructions. Those are: these terms; your configuration of the service (connections, features, agents, retention settings); and your other written instructions. We'll tell you if we believe an instruction breaks data-protection law. As a CCPA service provider we won't:

sell or share Customer Personal Data;
retain, use or disclose it outside our direct business relationship with you, or for any purpose other than providing the service;
combine it with other data except as the law allows.

3. Details of the processing (Annex I)


Subject matter and duration	Providing the service, for the term of the agreement and until deletion under section 10
Nature and purpose	Hosting, capturing, organizing, searching, summarizing and acting on Customer Data as you configure: email and calendar capture, CRM records, meeting recording and transcription, AI features and agents, the API, MCP and integrations
Categories of data subjects	Your users; your contacts, prospects, customers and partners; meeting participants; anyone else in Customer Data
Categories of personal data	Names, business contact details, job details, email and message content and metadata, calendar entries, meeting audio, video and transcripts, CRM notes and fields, and whatever else you put in
Special categories	Not intended. You won't submit them unless needed and lawful. The service redacts some sensitive identifiers automatically
Frequency	Continuous
Retention	As configured by you (defaults: recording media 7 days, or 30 with clips; transcripts 2 years), then as in section 10

4. Confidentiality and personnel

Everyone we authorize to process Customer Personal Data is bound by confidentiality. Our staff access Customer Data only as needed to provide support you've asked for, keep the service secure, or comply with law, and that access is logged.

5. Security (Annex II)

We maintain the technical and organizational measures described in our security overview. They include:

separation of each organization's data, enforced by the database;
encryption in transit (TLS) and at rest (the database disk with LUKS2, AES-256; backups with OpenPGP before they leave the server, to a key kept off our servers), with connected-account credentials encrypted by us under versioned keys that can be rotated;
two-step sign-in, which owners need to use owner powers;
least-privilege access, for our own staff too;
an append-only, tamper-evident audit log;
automated detection, alerting, the means to stop sending at once, and incident response;
encrypted backups, with restore drills on a schedule;
dependency controls;
secure development with independent review of every release.

We may update these measures, but never in a way that lowers overall protection.

6. Subprocessors

You give general authorization for the subprocessors listed at Subprocessors.

Notice. We give at least 30 days' notice of a new or replacement subprocessor, by email and on that page.
Objections. You may object on reasonable data-protection grounds within that period. We'll then try to find a solution. If we can't, you may end the affected service and get a pro-rata refund of prepaid fees for it.
Their terms. We impose data-protection terms on each subprocessor at least as protective as this DPA, and we're responsible for their performance.

7. Data subject requests and assistance

The service lets you access, correct, export and delete Customer Personal Data. If a data subject contacts us directly, we'll pass the request to you and won't answer it ourselves unless you tell us to. We'll help you, taking into account the nature of the processing, with:

data subject requests;
security;
breach notification;
data protection impact assessments;
prior consultation with regulators.

8. Personal data breaches

We'll notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any case within 48 hours. The notice will say what we know: the nature of the breach, the categories and approximate numbers involved, the likely consequences, and the measures taken or proposed. We'll follow up as we learn more. Notifying us of a breach isn't an admission of fault.

9. International transfers

We host Customer Data in Germany. Where Customer Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the following apply, with Annexes I and II of this DPA and the subprocessor list as their annexes:

the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller-to-processor) or Module 3 (processor-to-processor);
the UK International Data Transfer Addendum.

The governing law and forum for the Clauses are Ireland. Docking (Clause 7) applies. For Clause 9, the option is general authorization with the notice period above. We'll also rely on the EU-US Data Privacy Framework where a recipient is certified.

10. Deletion and return

You can export Customer Data at any time while the agreement is in force. After it ends, we delete Customer Personal Data within 30 days, and backups expire on their schedule (within 30 more days), unless the law requires us to keep it. In that case we keep it confidential and process it only for that purpose.

11. Audits

We'll make available the information needed to show compliance with this DPA: our security overview, questionnaire answers, and independent audit reports once we have them. If that isn't enough, you may audit us, or have an independent auditor do so. That's limited to once a year (more often after a breach or where a regulator requires it), with 30 days' notice, during business hours, under confidentiality and at your cost.

12. Liability and precedence

Liability under this DPA is subject to the limits in the terms, except where the law forbids limiting it. If this DPA conflicts with the terms, this DPA wins for personal data. If the Clauses conflict with this DPA, the Clauses win.

Representatives: none appointed (the service is offered to businesses in the United States). Contact for this DPA: privacy@closefinch.com.