Reply AutopilotData Processing Agreement (DPA)
Auftragsverarbeitung gemäß Art. 28 DSGVO — between you (the Customer, as controller) and AI Waverider (as processor). Forms part of, and is governed by, our Terms of Service.
1. Parties
Processor: Sakhr Al-Absi, Einzelunternehmer, trading as AI Waverider, Hünensteig 12, 12169 Berlin, Germany — support@aiwaverider.com.
Controller: the Customer that creates an account and connects one or more mailboxes to the service (identified by the account/billing details on file).
2. Subject matter, duration, nature & purpose
The processor processes personal data on behalf of the controller solely to provide the service: connecting the controller's mailbox(es), classifying inbound email, drafting and (where enabled) sending replies, detecting scheduling intent and assisting with bookings, and the related analytics/usage features the controller turns on. Processing lasts for the term of the subscription and the wind-down/deletion period in clause 10.
3. Types of personal data & categories of data subjects
- Data: email content + metadata (sender/recipient addresses, subjects, bodies, timestamps), contact details of correspondents, calendar/booking details, and any personal data the controller's correspondents include in their messages.
- Data subjects: the controller, its team members, and the people who email the connected mailboxes (leads, customers, contacts).
4. Processing only on documented instructions
The processor processes personal data only on the controller's documented instructions (including configuration in the app), unless required otherwise by EU/Member-State law (in which case the processor informs the controller unless the law prohibits it). The processor will tell the controller if, in its opinion, an instruction infringes data-protection law.
5. Confidentiality
The processor ensures persons authorised to process the data are bound by confidentiality.
6. Security of processing (Art. 32) — technical & organisational measures
- Encryption in transit (TLS) and of stored mailbox/API credentials at rest (AES-256-GCM).
- Tenant isolation: every workspace's data is fenced to its own tenant at the data layer (access controls + automatic per-tenant query scoping).
- Access controls + least privilege; audit logging of administrative actions.
- Backups and the ability to restore availability after an incident.
- Regular review of the measures' effectiveness.
7. Sub-processors
The controller gives general authorisation for the processor to engage the sub-processors below. The processor imposes Art. 28-equivalent obligations on each and remains responsible for their performance. We will give advance notice of any intended addition/replacement and a chance to object.
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI | AI classification + reply generation | USA (SCCs / DPF) |
| Anthropic | AI classification + reply generation (selectable) | USA (SCCs / DPF) |
| Hosting / database / infrastructure provider(s) | Application hosting + data storage | EU (confirm region) |
| Email/SMTP provider | Transactional + outbound email delivery | EU/USA (confirm) |
⚠️ Confirm the exact hosting/DB/email vendors and regions, and that a signed DPA is in place with each (incl. OpenAI & Anthropic) before go-live.
8. Assistance with data-subject rights
The processor assists the controller, by appropriate technical and organisational measures and insofar as possible, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).
9. Personal-data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach, with the information the controller needs to meet its Art. 33/34 obligations.
10. Deletion / return on termination
On termination, and at the controller's choice, the processor deletes or returns the personal data and deletes existing copies, unless EU/Member-State law requires storage. Default retention after mailbox disconnect / account closure: 30 days, then deletion.
11. Audits
The processor makes available the information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, conducted by the controller or a mandated auditor, subject to reasonable confidentiality and scheduling.
12. International transfers
Where personal data is transferred outside the EEA (e.g. to US AI sub-processors), the transfer is covered by the EU Standard Contractual Clauses (2021) and/or the EU-US Data Privacy Framework, with supplementary measures as needed.
13. Liability & governing law
Liability follows the Terms of Service and Art. 82 GDPR. This DPA is governed by German law; place of jurisdiction is Berlin, to the extent permitted.