app0 Data Processing Addendum

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the Terms. Other terms have the meanings given in Data Protection Laws.

2. Roles of the Parties

For Personal Data in Customer Content, you are the Controller (or, where you act for another controller, a Processor) and we are your Processor. Where you are a Processor, you warrant that your instructions to us are authorised by the relevant controller and that this DPA is consistent with your obligations to that controller.

3. Your obligations

You must comply with Data Protection Laws in providing Personal Data to us, including through Connected Services, imports, Outside Agents, the meeting notetaker and email you send through the Services. You warrant that:

• the Personal Data was collected and is processed lawfully, with any notices given and consents obtained that Data Protection Laws require, including PECR for the outreach you send;
• you have a lawful basis and all rights, permissions and authorisations needed to disclose the Personal Data to us and to have us process it as described in the Agreement and this DPA;
• your instructions comply with Data Protection Laws; and
• you have assessed whether the Services, including their AI Features, Connected Services and international transfers, are appropriate for the Personal Data you process, and you will not use them for data for which they are not appropriate, such as special category data without safeguards.

You must tell us without undue delay if you determine that our processing under the Agreement does not or will not comply with Data Protection Laws, in which case we need not continue that processing.

4. Our processing obligations

The details of the processing are set out in section 14. We will:

• process Personal Data only on your documented instructions, including for transfers outside the United Kingdom or the European Economic Area, unless required to do so by law that applies to us, in which case we will tell you of that requirement before processing unless the law prohibits it on important grounds of public interest. The Agreement, your use and configuration of the Services, and the features, Connected Services, Agents, approval settings and Outside Agents you choose are your documented instructions;
• tell you promptly if we think an instruction infringes Data Protection Laws, or if we can no longer comply with your instructions, Data Protection Laws or this DPA;
• ensure that every person we authorise to process Personal Data is bound by a duty of confidentiality;
• implement the security measures in section 8;
• engage Sub-processors only as section 6 allows;
• assist you as section 7 sets out;
• delete or return Personal Data as section 10 sets out; and
• make available the information and allow the audits that section 9 sets out.

5. Prohibitions

We will not process Personal Data for any purpose other than providing the Services to you under your documented instructions and this DPA, except where the law requires. We will not sell Personal Data. We will not use Personal Data to train, fine-tune or improve large language models or other AI models, and we will not allow Sub-processors to do so. If we receive a legally binding request from a law enforcement or regulatory authority for disclosure of Personal Data, a notice, enquiry or investigation from a Supervisory Authority, or a complaint or request from a Data Subject, in each case relating to Personal Data we process for you, we will notify you to the extent the law allows.

6. Sub-processors

6.1 Authorisation

You give us general written authorisation to engage the Sub-processors listed in section 15, subject to this section 6.

6.2 Changes

We will tell you of any intended addition or replacement of a Sub-processor, including a Third-Party AI Provider, at least 10 Business Days in advance, by updating section 15 and notifying your Workspace owners or admins by email or in the Services. You may object within that period on reasonable, documented grounds relating to the confidentiality or security of Personal Data or the Sub-processor’s compliance with Data Protection Laws. If you do not object within that period, we may proceed. If you object, the Parties will discuss the objection in good faith. If it cannot be resolved, your sole remedy is to stop using the Services, or the affected feature, and section 10 then applies.

6.3 AI routing

We send AI requests through our AI routing provider, Vercel AI Gateway, which passes each request to the Third-Party AI Provider that serves the model selected for the feature. The default model for each feature is set by us, and Workspace admins may select other models from the catalogue the Services offer, in which case the provider of the chosen model is engaged as a Sub-processor on your instruction. We do not identify the specific provider used for each individual request.

6.4 Sub-processor terms and liability

We engage each Sub-processor under a written agreement that imposes data protection obligations that are no less protective of Personal Data than those in this DPA, to the extent applicable to the service the Sub-processor provides. Where a Sub-processor fails to fulfil its data protection obligations, we remain liable to you for the performance of those obligations in accordance with Data Protection Laws.

7. Assistance

Taking into account the nature of the processing and the information available to us, we will assist you, at your cost where the assistance is more than minimal, by:

• telling you without undue delay of any request from a Data Subject to exercise rights under Data Protection Laws that we receive in relation to Personal Data, and helping you respond, including through the search, edit, export and delete features in the Services;
• helping you meet your obligations under Articles 32 to 36 of the UK GDPR and, where applicable, the EU GDPR, including security, data protection impact assessments and prior consultation with a Supervisory Authority; and
• telling you without undue delay after becoming aware of a Personal Data Breach, and in any event within 48 hours, giving you the information reasonably available to us about its nature, the categories and approximate number of Data Subjects and records concerned, its likely consequences and the measures taken or proposed, and providing further information as it becomes available.

8. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, and the risks to individuals, we will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures in section 16. We will provide data protection and security training to the people we authorise to access Personal Data. You are responsible for the security of your own accounts, devices, Connected Services, Outside Agents, approval settings and the instructions you give Agents.

9. Audits

We will make available to you the information necessary to demonstrate our compliance with Article 28 of the UK GDPR and, where applicable, the EU GDPR, and will allow for and contribute to audits, including inspections, by you or an auditor you mandate, to the extent Data Protection Laws require. We may meet this obligation in the first instance by providing documentation, reports and written answers. You may request an audit no more than once every 12 months, on at least 30 days’ written notice, during Business Days, subject to the Parties agreeing its scope, timing and duration in advance, each acting reasonably, and provided that any auditor is bound by confidentiality. We need not give access to information, facilities or systems where that would breach our obligations to other customers or the law, or compromise security. You bear the cost of audits unless they reveal a material breach of this DPA.

10. Return and deletion

Customer Content is kept for 90 days after the Agreement ends (the “Retention Period”), during which you can export what the Services offer an export for, as section 12.1 of the Terms describes, and we will, on written request, give you a copy of the Personal Data we hold in a commonly used format where reasonably practicable. Within 30 days after the Retention Period we will delete the Personal Data, and instruct Sub-processors to do the same, unless the law requires us to keep it, in which case we will tell you and delete it when that requirement ends. You may ask us to delete sooner. Copies in backups are deleted in the ordinary course of backup rotation and remain subject to this DPA until deleted.

11. International transfers

11.1 Authorisation

You authorise us to transfer Personal Data outside the United Kingdom and the European Economic Area as needed to provide the Services, including to the Sub-processors listed in section 15, provided that we ensure each transfer complies with Data Protection Laws.

11.2 Transfers by us

Where we make a Restricted Transfer to a Sub-processor, we rely on UK adequacy regulations or EU adequacy decisions where they apply, including the UK Extension to the EU-US Data Privacy Framework and the EU-US Data Privacy Framework for certified recipients, and otherwise on the UK IDTA or UK Addendum, or the EU SCCs, with a transfer risk assessment and supplementary measures where needed.

11.3 Transfers by you to us

Where your disclosure of Personal Data to us is a Restricted Transfer, the Parties agree as follows. Where the UK GDPR applies, the UK Addendum is incorporated into this DPA with the EU SCCs, completed as set out in section 17. Where the EU GDPR applies, the EU SCCs are incorporated into this DPA, completed as set out in section 17. If a transfer mechanism relied on under this section is invalidated or replaced, the Parties will cooperate in good faith to put a valid replacement in place promptly.

11.4 Conflicts

If the UK Addendum, UK IDTA or EU SCCs apply and conflict with this DPA, they prevail to the extent of the conflict.

12. Liability

Each Party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms, to the extent the law allows. Nothing in this section limits a Party’s liability to Data Subjects or Supervisory Authorities under Data Protection Laws.

13. General

We may update this DPA, including section 15, as section 6 and the Terms allow, and to reflect changes in Data Protection Laws, by publishing an updated version and giving notice as the Terms require. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the UK Addendum, UK IDTA or EU SCCs provide otherwise. This DPA ends when the Agreement ends, but its obligations continue for as long as we hold Personal Data.

14. Annex 1: Details of processing

15. Annex 2: Sub-processors

Some of the providers below also process personal data for which we are the controller, such as billing and support. That processing is described in the Privacy Policy and is outside this DPA.

Our meeting notetaker runs on a Vexa service that we host on our own server in the United Kingdom. It is not a third-party Sub-processor, but its hosting provider is covered by our hosting arrangements.

Third-Party AI Providers that serve the models used by the Services through Vercel AI Gateway:

Workspace admins may select other models from the catalogue the Services offer. The provider of a selected model is engaged as a Sub-processor on your instruction and is identified in the Services when you select it.

16. Annex 3: Security measures

We maintain the following technical and organisational measures, in addition to those of the Sub-processors above.

• Encryption. All traffic to and from the Services uses HTTPS (TLS). Stored data is encrypted at rest by our database, file storage and email providers. Secrets saved in settings, such as connection keys, are sealed with AES-256-GCM and tied to their workspace.
• Workspace isolation. Every database query runs inside one workspace. Row-level security is enabled on workspace tables, and the application connects with separate database roles for customer work, cross-workspace scheduling and sign-in, each refused rights it does not need. An automated isolation suite checks that nothing crosses between workspaces.
• Access control. Authorised Users sign in with email codes, passwords, Microsoft, Google or OpenID Connect single sign-on, with session cookies that expire after seven days. A workspace can require single sign-on for its domain, and Outside Agents are held to the same rule. Access to data follows workspace membership and role. Our staff reach the admin console only with an email-code session, and admin actions are audit logged.
• Agents and approvals. Agents run inside the permissions of the person they work for. Changes, sends, deletions, outside-service calls and paid actions wait for a person’s approval unless the person turns asking off, and deletes always ask unless explicitly allowed. Email-origin chats cannot change records, browse the web or use connectors. Assistants never hold a mail sending permission.
• Sandboxes. Shell commands run on cloud machines or sandboxes that hold none of our secrets or database credentials. Where Boat is not used, the sandbox has no internet access. Customer-built apps run their UI in a sealed frame with no network and no cookies, and their back end in a sandbox with no network or file access.
• Outside Agents. OAuth with PKCE, opaque tokens stored hashed, consent per workspace and per app, one-hour access tokens, rotated refresh tokens, and disconnect that works on the next call.
• Email. Incoming assistant email is checked for spam, viruses and sender authentication before it reaches an assistant. Sequence links are signed, and unsubscribe acts only on a form submission. Webhook signatures from payment and email providers are verified.
• Application security. Rate limiting on sign-in, discount codes and the MCP server; outbound fetches restricted to prevent access to internal systems; content security policy on the app frame; validation of uploads and imports; protection of cron and internal routes with secrets.
• Data minimisation in operations. Usage records store model, token and cost metadata rather than prompts or Output. Sub-processor call records store the domain or host looked up, never a search query or full email address. Short-lived operational records are deleted on a schedule.
• Backups and resilience. Our database provider maintains managed backups with point-in-time recovery. Deployments can fence writes during a release window so that a failed migration does not corrupt data.
• Personnel and suppliers. Staff with access to Personal Data are bound by confidentiality obligations and receive security training. We carry out due diligence on Sub-processors and engage them under written agreements.
• Incident response. We investigate suspected security incidents, keep records of them and notify you of Personal Data Breaches as section 7 sets out.

17. Annex 4: Transfer terms

This section applies only where section 11.3 applies.

UK Addendum. Where the UK GDPR applies, the UK Addendum is completed as follows. Table 1: the Parties are Customer, as exporter, and Yori AI, as importer, with the details and contact points in the Agreement. Table 2: the EU SCCs as completed below, with the Approved EU SCCs being Module Two (controller to processor) or, where Customer is a Processor, Module Three (processor to processor). Table 3: Annex 1A and 1B are section 14 of this DPA, Annex II is section 16 and Annex III is section 15. Table 4: neither Party may end the UK Addendum under its section 19.

EU SCCs. Where the EU GDPR applies, the EU SCCs are completed as follows. Module Two applies where Customer is a Controller and Module Three where Customer is a Processor. Clause 7, the docking clause, is included. Under Clause 9, Option 2 (general written authorisation) applies with the notice period in section 6.2. Under Clause 11, the optional language is not included. Under Clause 13, the Supervisory Authority is the one identified by Clause 13(a) by reference to Customer’s establishment or representative. Under Clause 17, the EU SCCs are governed by the law of Ireland. Under Clause 18, disputes are resolved by the courts of Ireland. Annex I.A and I.B are section 14 of this DPA, Annex II is section 16 and Annex III is section 15.

UK IDTA. Where the Parties agree in writing to use the UK IDTA instead of the UK Addendum, it is completed with the information in sections 14, 15 and 16 and the choices above, adapted as necessary.