Last updated: 2026-10-24
This Data Processing Agreement (the "DPA") governs the processing of personal data that a business customer (the "Controller") submits to Probapedia (the "Processor") through the service. It supplements the Terms of Service. If this DPA conflicts with the Terms on a matter of data protection, this DPA prevails.
For individual consumer accounts, Probapedia acts as Controller for the data described in the Privacy Policy. For business accounts that submit end-user data through the service, the business is the Controller and Probapedia is the Processor.
The Controller authorises Probapedia to engage sub-processors that perform the functions listed below. Probapedia notifies the Controller of any material change to this list at least 14 days in advance and gives the Controller the right to object. Each sub-processor is bound by written terms that impose data-protection obligations at least as protective as this DPA.
| Function | Data categories processed | Region |
|---|---|---|
| Cloud hosting and managed database | All data listed in section 3 | EU |
| Authentication | Email address, session identifiers | EU |
| Security edge and abuse prevention | IP address, request metadata | Global edge |
| AI analytical processing | Prompts, completions, uploaded images | Provider regions under contractual safeguards |
| Payment processing | Billing metadata, transaction references | Provider regions under contractual safeguards |
| Transactional email | Email address, one-time sign-in links | US under Standard Contractual Clauses |
The current sub-processor list is available to the Controller on request through the contact address in section 13.
Primary storage is within the European Economic Area. Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision of the European Commission or on Standard Contractual Clauses, together with supplementary technical measures such as encryption in transit, encryption at rest, and per-tenant isolation. The Controller may request the transfer mechanism that applies to any sub-processor by writing to the contact address in section 13.
Probapedia notifies the Controller without undue delay, and in any event within 72 hours of becoming aware of a personal-data breach affecting the Controller's data. The notification includes the nature of the breach, the categories and approximate volume of data affected, the likely consequences, the measures taken or proposed, and a contact point for follow-up.
Once per year, or after a personal-data breach affecting the Controller, the Controller may request a written summary of the security controls in place. On-site audits require 30 days' notice, occur during business hours, are limited to the systems that process the Controller's data, and are subject to confidentiality. The Controller bears the cost of an on-site audit unless the audit reveals a material breach of this DPA.
Liability under this DPA is subject to the limitations in the Terms of Service. Nothing in this DPA limits liability that cannot be limited under applicable law.
On termination of the business account, Probapedia deletes or returns the Controller's data within 30 days, except where retention is required by law. The Controller may export data at any time through the Account page.
Probapedia may update this DPA to reflect changes in law, in sub-processors, or in the service. Material changes are announced to the Controller at least 14 days before they take effect.
[email protected] — DPA questions and requests.
[email protected] — security disclosures.
Educational analytics only. Not financial advice.