Cuiar
Sign inDownload

Legal

Data Processing Agreement

Last updated: October 29, 2026

This Data Processing Agreement ("DPA") is part of the terms between Internet Technology Services LLC ("Cuiar", "we") and a customer that uses Cuiar with a team ("Customer"). It applies when Cuiar processes Customer Personal Data for the Customer under the GDPR, the UK GDPR or the CCPA. It takes effect when the Customer makes a team, and it ends when the team is deleted and the duties in section 9 are done.

1. Words in this DPA

  • Customer Personal Data: personal data that Cuiar processes for the Customer: the team's administration data (members' e-mail addresses and roles, verified domains, the sign-in connection and the team policy) and the content that members of the team put into the services for the Customer (tasks, routines, approvals, files, channels, and sealed vault and sync data).
  • Data Protection Law: the GDPR (Regulation (EU) 2016/679), the UK GDPR with the Data Protection Act 2018, and the California Consumer Privacy Act as the CPRA changed it, where each applies.
  • Sub-processor: a company that Cuiar uses to process Customer Personal Data.
  • "Controller", "processor", "data subject", "personal data breach", "service provider" and "processing" have their meanings in Data Protection Law.

2. Roles

For Customer Personal Data, the Customer is the controller and Cuiar is the processor (a service provider under the CCPA). Cuiar is a controller for account, billing, security and legal data, as the privacy policy tells. The Customer makes sure that it has a legal basis for the processing and that it gives its members the necessary information.

3. Instructions

  • Cuiar processes Customer Personal Data only on the Customer's documented instructions. The terms, this DPA, the settings of the team and the use of the services by the team's members are the instructions.
  • This includes transfers to a third country, which occur only as section 8 tells.
  • When a law makes Cuiar process the data in another way, Cuiar tells the Customer first, unless that law does not allow it.
  • Cuiar tells the Customer at once when, in its opinion, an instruction breaks Data Protection Law.

Annex I gives the subject, duration, nature and purpose of the processing, and the types of data and data subjects.

4. Confidentiality

Cuiar gives access to Customer Personal Data only to persons who need it to give the services, and each of them has a duty of confidentiality.

5. Security

Cuiar keeps the technical and organisational measures in Annex II, which meet GDPR Article 32. Cuiar can change the measures when the change does not lower the protection.

6. Sub-processors

  • The Customer gives Cuiar a general authorisation to use sub-processors. The current list is at cuiar.com/subprocessors (Annex III).
  • Cuiar tells the Customer about a new or replaced sub-processor at least 30 days before it starts: on that page, and by e-mail to the team's owner.
  • The Customer can object in those 30 days, on reasonable data protection grounds, by writing to contact@cuiar.com. If Cuiar cannot solve the objection, the Customer can end the Team plan, and Cuiar refunds the prepaid fees for the period after the end.
  • Cuiar puts the same data protection duties as in this DPA on each sub-processor by a written contract, and is responsible to the Customer for each sub-processor's work.

7. Help to the Customer

  • Data subject requests: members can export, correct and delete their own data with the self-serve tools on cuiar.com/account and in the CLI. Cuiar sends the Customer each request that it gets about Customer Personal Data, and helps the Customer to answer it.
  • Other duties: Cuiar helps the Customer with GDPR Articles 32 to 36 (security, breach notices, impact assessments and prior consultation), as far as the nature of the processing and the information available to Cuiar allow.
  • Personal data breach: Cuiar tells the Customer without undue delay, and in 48 hours at most, after it becomes aware of a breach of Customer Personal Data. The notice gives what GDPR Article 33(3) asks for, as far as Cuiar knows it, and Cuiar sends more when it learns more.

8. Transfers

  • Cuiar is in the United States. Its API and database run in Germany, backups stay in the EU, and task files are stored in Western Europe. Some sub-processors are in the United States, as the sub-processor list tells.
  • For Customer Personal Data that goes from the EEA to Cuiar, the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 apply, Module 2 (controller to processor), with the Customer as data exporter and Cuiar as data importer. Clause 7 applies. In Clause 9(a), option 2 applies, with 30 days. The optional wording in Clause 11(a) does not apply. In Clause 13, the supervisory authority is the one that is competent for the Customer. The annexes of the Clauses are the annexes of this DPA.
  • For Customer Personal Data from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) applies, with its tables filled from this DPA. Either party can end it as its section 19 allows.
  • When the Clauses and this DPA do not agree, the Clauses apply.
  • Cuiar uses Standard Contractual Clauses with each sub-processor outside the EEA and the UK, in that sub-processor's data processing terms.

9. End of the processing

The Customer can export the data with the self-serve tools, and delete the team at any time. When the team is deleted, its administration data is deleted at once. On the Customer's written request, Cuiar deletes or returns the other Customer Personal Data in 30 days, unless a law tells Cuiar to keep it. Backups keep deleted data until they are 30 days old.

10. Audits

  • Cuiar gives the Customer the information that is necessary to show that it obeys this DPA.
  • The Customer, or an independent auditor that the Customer chooses and that has a duty of confidentiality, can audit Cuiar once in 12 months, with 30 days of notice, at the Customer's cost. More audits are possible after a personal data breach or when a supervisory authority asks for one.

11. CCPA service provider terms

For Customer Personal Data under the CCPA, Cuiar:

  • does not sell or share it, and does not keep, use or disclose it for a purpose other than the business purposes in the terms, or outside the direct business relationship with the Customer;
  • does not combine it with personal information from another source, except as the CCPA allows a service provider;
  • obeys the CCPA and gives the same level of privacy protection that the CCPA asks of the Customer, and tells the Customer if it can no longer do so;
  • lets the Customer take reasonable steps to stop and fix use of the data that is not allowed.

12. Order of documents

When this DPA and the terms do not agree about Customer Personal Data, this DPA applies. The limits of liability in the terms apply to this DPA, except where Data Protection Law or the Clauses do not allow them.

Annex I: Description of the processing

  • Data exporter: the Customer, as the controller. Contact: the team's owner.
  • Data importer: Internet Technology Services LLC, as the processor. Contact: contact@cuiar.com.
  • Data subjects: members of the Customer's team, and persons whose data members put into tasks, routines, files and messages.
  • Types of data: e-mail addresses, roles, sign-in connection data, device names; the content of tasks, steps, results, routines, approvals, files and channel messages; vault and sync data, which the server keeps only sealed.
  • Special categories: none are intended. Members can put any content in a task; the Customer decides on such use.
  • Frequency: continuous, while the team uses the services.
  • Nature and purpose: storage, transmission and processing to give the services: run agent tasks and routines, sync, sign-in through the team's identity provider, the team policy, and the model gateway.
  • Duration and retention: for the life of the team, with the periods in the privacy policy, and section 9.
  • Transfers to sub-processors: as in Annex III, for the same purposes and duration.

Annex II: Technical and organisational measures

  • All traffic between the apps, the site and the API uses HTTPS. The API is behind Cloudflare and answers only requests that come through Cloudflare.
  • The vault and synced browser data are encrypted on the member's device (key from Argon2id, items sealed with AES-256-GCM). The server keeps only the sealed data and cannot read it.
  • Sessions, API keys, license tokens and codes are kept only as SHA-256 hashes. Sign-in uses one-time e-mail codes that expire in 10 minutes, with limits on attempts per IP address and per e-mail address, or the team's OpenID Connect provider.
  • API keys have scopes. Account management, billing, keys and the vault need a signed-in session. AI clients connect with OAuth 2.1 and PKCE, after the member approves each one.
  • Task files are in a private bucket. Download links expire in 10 minutes, or in 24 hours in a data export.
  • Model requests go only to providers with zero data retention. Cuiar keeps no text of model requests, only token counts.
  • Server logs hold no IP addresses, e-mail addresses or task text, and are deleted after 14 days. A job deletes each kind of data when its period ends.
  • Daily database backups are kept in the EU for 30 days.
  • Each record belongs to one account, and every request is checked against the account of its credential.
  • Access to production systems is limited to the persons who need it, under a duty of confidentiality.

Annex III: Sub-processors

The list at cuiar.com/subprocessors, as section 6 tells.