Documented instructions for customer data.
This DPA forms part of the Master Terms when AletheionAGI processes personal data as processor for GQueries, IntentParse or Widport.
1. Parties and duration
The customer is controller and AletheionAGI processor, except where actual processing determines a different role. Processing lasts as needed to provide the Service and through contracted retention or transition.
2. Subject matter, data and subjects
Subject matter: intent parsing, memory, retrieval, grounding, widget, crawling, policy, telemetry and handoff. Data: identifiers, messages, intents, memories, sources, evidence, answers, logs and configurations. Subjects may include customer users, visitors, employees, support agents and business contacts.
3. Instructions and duties
AletheionAGI will process data only under the Terms, order, configurations and lawful documented instructions; notify if an instruction appears unlawful; ensure confidentiality; implement appropriate measures; and assist, considering processing nature, with rights, assessments and regulatory duties. The customer ensures legal basis, transparency, minimization and correct instructions.
4. Subprocessors
The customer authorizes subprocessors on the canonical list. AletheionAGI imposes compatible protection duties and remains responsible for its own obligations. Material changes will be notified by publication or registered contact, allowing a reasoned objection before use where commercially practical.
5. Security and incident
Measures include least privilege, logical segregation, TLS, credential protection, audit trails, backups and incident response as applicable. After confirming an incident involving customer data, we will notify without undue delay with available information for assessment, containment and notification.
6. International transfer
For international transfers, the parties will use a valid LGPD and ANPD Resolution 19/2024 mechanism. Where applicable, ANPD standard contractual clauses are incorporated in full by reference and control conflicts; the parties will complete required variable transfer information.
7. Return, deletion and audit
At termination and on instruction, we will return or delete data subject to functionality, retention, backup and law. We will provide reasonable compliance documentation; additional audits must preserve security and confidentiality, avoid disruption and may depend on agreed scope and costs.
8. Precedence
This DPA controls data-protection conflicts with the Terms; mandatory ANPD clauses control both within their transfer scope.