Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between NotasAI Inc. (“we”) and you when you use Esment cloud memory for an organisation. It covers the personal data in the workspaces you own (“Customer Personal Data”), which we process on your behalf. If you have signed a separate agreement with us that includes data processing terms, those control instead.

Account, billing, and website data that we handle for our own purposes isn’t covered here; our Privacy Policy covers it.

1. Roles

You are the controller of Customer Personal Data (or a processor acting for your own controller), and we are your processor (or sub-processor). Annex 1 describes the processing.

2. Your instructions

We process Customer Personal Data only on your documented instructions: the Terms, this DPA, and how you use and configure the service — what you and your members save, who you invite, and which assistants and integrations you connect. If the law requires other processing, we tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we tell you.

3. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality. Our staff access workspace content only in the cases set out in section 3 of the Privacy Policy.

4. Security

We maintain the technical and organisational measures in Annex 2. We may update them, but never in a way that lowers the overall protection of Customer Personal Data.

5. Sub-processors

• You authorise the sub-processors in Annex 3. We bind each of them to data protection obligations at least as protective as this DPA, and we remain responsible for them.
• Before adding or replacing one, we update Annex 3 and email the owners of affected workspaces at least 30 days in advance.
• You may object on reasonable data protection grounds within that period. If we can’t address the objection, you may stop using the affected service and we’ll refund any prepaid fees for the unused period.

Assistants and integrations that you connect — for example Claude, ChatGPT, Slack, Notion, or an AI provider you use with your own key — aren’t our sub-processors. You choose them, and their own terms apply.

6. Assistance

• Data subject requests. The service lets you find, export, edit, and delete memories. We help with requests you can’t fulfil that way, and we forward to you any request we receive about your workspace.
• Impact assessments. We give you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities.

7. Personal data breaches

We notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. We tell you what we know about its nature, the data and people affected, its likely consequences, and what we’re doing about it, and we keep you updated as we learn more.

8. Deletion

• You can export your workspaces at any time from the dashboard.
• When you delete a workspace, access ends at once and its content is erased 30 days later.
• When you delete your account, or the Terms end, we erase the workspaces you own within 30 days.
• Backups of the cloud database roll over within a further 7 days.
• On request, we confirm the erasure in writing.

9. Audits

We make available the information you need to verify our compliance with this DPA, including answers to a reasonable security questionnaire once a year. If that isn’t enough, or a supervisory authority requires it, you may audit our compliance once a year on 30 days’ notice, during business hours, at your cost, and under confidentiality. An audit never includes access to other customers’ data.

10. International transfers

We process Customer Personal Data in the United States. For transfers from the EEA, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 where you are a controller, Module 3 where you are a processor. Under them, Clause 7 (docking) applies, Clause 9 follows option 2 with the notice period in section 5, the optional language of Clause 11 doesn’t apply, and Clauses 17 and 18 select the law and courts of Ireland. Annexes 1 to 3 of this DPA complete the Clauses’ appendix.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to those Clauses applies; for transfers from Switzerland, the Clauses apply with references read as references to the Swiss Federal Act on Data Protection and the Swiss supervisory authority.

11. General

Each party’s liability under this DPA is subject to the limits in the Terms, except where the law doesn’t allow it. If this DPA conflicts with the Terms about personal data, this DPA prevails; the Standard Contractual Clauses prevail over both. This DPA lasts as long as we process Customer Personal Data.

Annex 1 — Details of processing

• Subject matter and purpose: providing Esment cloud memory — storing, searching, organising, and syncing memories, and serving them to the assistants and integrations you connect.
• Nature: hosting, storage, indexing (embeddings, entity and link extraction), retrieval and ranking, transmission to connected assistants and integrations, backup, and erasure.
• Duration: while you use the service, plus the deletion periods in section 8. Processing is continuous.
• Data subjects: your workspace members, and anyone mentioned in the content you or your members save — for example colleagues, clients, and contacts.
• Personal data: member emails, roles, and which member wrote each memory; any personal data in memories, Memory Blocks, pages, voice notes (recordings and transcripts), and content captured by integrations; usage metadata such as tool calls and connected assistants.
• Special categories: none are needed for the service. If you choose to save them, you are responsible for having a lawful basis. Records governed by sector-specific rules, such as HIPAA health records or payment card data, need a separate agreement.

Annex 2 — Security measures

Encryption

• TLS for all traffic to and from our servers.
• Storage encrypted at rest by our hosting and storage providers.
• Integration tokens and AI keys you give us are sealed with XChaCha20-Poly1305, under a key kept outside the database.

Access and isolation

• Every query is scoped to a single workspace.
• Roles (Admin, Member, Viewer) are enforced on every request.
• API keys are stored only as hashes, and keys issued to the web dashboard expire after 30 days and never reach the browser.
• Assistants sign in with OAuth 2.1 and PKCE, and their access can be revoked.
• Sensitive actions such as key rotation and OAuth consent are rate-limited.
• Staff access follows least privilege and is limited to the few people who operate the service.

Integrity, availability, and erasure

• Every change to memory is recorded in a change history that the workspace can inspect.
• The cloud database is replicated continuously to separate storage and can be restored to a point in time; those backups roll over within days.
• Deleted workspaces and accounts are erased as set out in section 8, including their voice recordings; a sweep removes any stored recording that no longer belongs to a note.
• Integrations read only the channels and resources you choose, and by default keep the facts extracted from messages rather than the messages.

Annex 3 — Sub-processors

• Render — hosting of the cloud memory service — United States.
• Vercel — hosting of the web dashboard; dashboard requests pass through it — United States.
• Cloudflare — backups of the cloud database, and voice note recordings — United States and Cloudflare’s network.
• OpenAI — embeddings for search — United States.
• Voyage AI — relevance ranking for search — United States.
• Resend — workspace invitation emails — United States.

Questions, or need a countersigned copy? Email privacy@notas.ai. NotasAI Inc. · 131 Continental Dr, Suite 305, Newark, DE 19713, USA.