Last updated Oct 24, 2026
Effective date: October 24, 2026
This Data Processing Agreement ("DPA") is between Dandelion Development Inc., doing business as easyAIQ ("easyAIQ", "we", "us"), and the customer that has agreed to the easyAIQ Terms of Service at easyaiq.com/terms ("Customer", "you"). It forms part of those Terms (the "Agreement") and applies automatically when you accept them.
This DPA applies whenever we process Customer Personal Data while providing the Service.
Roles. For Customer Personal Data, you are the business or controller and we are your service provider or processor. If you act as a processor for someone else, you confirm that your instructions to us are authorized by that party, and we act as your subprocessor.
Order of precedence. If this DPA conflicts with the Agreement on the processing of personal data, this DPA controls. Otherwise the Agreement controls, including its limitation of liability.
Capitalized terms not defined here have the meaning given in the Agreement.
Instructions. We process Customer Personal Data only on your documented instructions. The Agreement, this DPA, and your use and configuration of the Service are your complete instructions. We will tell you if we believe an instruction breaks Data Protection Laws, and we may decline to follow it.
Details. Annex 1 describes the subject matter, nature, purpose and duration of the processing and the types of data and individuals involved.
Your responsibilities. You are responsible for the lawfulness of the Customer Personal Data you upload, for giving any notices and obtaining any consents required, and for your instructions complying with Data Protection Laws.
No training. We will not use Customer Personal Data to train or fine-tune any AI model, and we will not permit our Subprocessors to do so.
Confidentiality. Everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality.
Security. We will maintain the technical and organizational measures in Annex 2. We may update them, but not in a way that materially reduces the overall protection of Customer Personal Data.
General authorization. You authorize us to engage the Subprocessors listed at easyaiq.com/subprocessors, which names each one, what it does, and where it processes data.
Our obligations. Before a Subprocessor processes Customer Personal Data, we will put in place a written contract that imposes data protection obligations at least as protective as this DPA, including the prohibition on model training. We remain responsible for each Subprocessor's performance.
New Subprocessors. We will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the list and emailing your account administrators. Anyone else can subscribe to these notices by writing to legal@easyaiq.com.
Objection. You may object on reasonable data protection grounds within 30 days of the notice. We will work with you in good faith to find a solution. If we cannot, you may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
Requests from individuals. If we receive a request from an individual to exercise privacy rights over Customer Personal Data, we will not respond to it except to refer them to you, unless the law requires otherwise. Taking into account the nature of the processing, we will help you respond to such requests, largely through the Service's features, which let you view and delete content.
Other assistance. We will provide reasonable information you need to complete data protection assessments or respond to regulators about the Service.
Security Incidents. We will notify you without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting your Customer Personal Data. Our notice will describe, as far as we know, what happened, the data affected, the likely consequences, and the steps we are taking. We will update you as we learn more, take reasonable steps to contain the incident, and cooperate with your own notification obligations.
Notifying you is not an admission of fault. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked login attempts or network scans, are not Security Incidents.
Legal requests. If a government or court asks us for Customer Personal Data, we will try to redirect them to you. Where legally allowed, we will notify you promptly so you can seek protection, and we will disclose only what we are legally required to.
Where the CCPA or a similar US state law applies, we act as your service provider or processor. The business purpose of the processing is providing the Service, as described in Annex 1. We will:
You may take reasonable steps to make sure we use Customer Personal Data in line with these obligations, through the information and audits described in Section 7.
We certify that we understand and will comply with these restrictions.
On written request, no more than once a year, we will answer a reasonable security questionnaire and provide information needed to show compliance with this DPA. If that information is not enough to show compliance, or a regulator requires it, you may conduct an audit on at least 30 days' notice, during business hours, at your expense, under confidentiality terms, and in a way that does not disrupt the Service or expose other customers' data. An independent auditor you appoint must not be our competitor.
You may delete Customer Content, including Customer Personal Data, at any time using the Service. After the Agreement ends we will delete remaining Customer Personal Data within 30 days, and from backups within a further 35 days, unless the law requires us to keep it. Any data we must keep remains protected by this DPA. The Service does not include an export feature, as described in the Agreement.
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. This DPA lasts as long as we process Customer Personal Data and ends automatically after that. We may update this DPA as described for the Terms in the Agreement, but changes will not reduce your protections during a paid subscription term unless the law requires it.
| Item | Details |
|---|---|
| Subject matter | Providing the easyAIQ Service under the Agreement |
| Nature of processing | Storing, parsing and indexing documents; creating searchable representations (embeddings); retrieving relevant passages; sending passages and questions to AI model providers to generate answers; displaying answers and history; deleting data |
| Purpose | Letting Authorized Users upload documents and ask questions about them using AI |
| Duration | The term of the Agreement, plus the deletion periods in Section 8 |
| Individuals concerned | Determined by you. Typically your Authorized Users, and people named in documents you upload, such as employees, clients, customers, vendors and contacts |
| Types of personal data | Determined by you. Typically names, contact details, job information, and any other personal data contained in uploaded documents, questions and Outputs |
| Sensitive data | None intended. You must not upload regulated data, such as health information subject to HIPAA or payment card data, unless an Order Form allows it |
| Location | United States |
| Subprocessors | As listed at easyaiq.com/subprocessors |