Data Processing Agreement

Last updated: September 27, 2026

Note: This is a standard-form DPA intended for Business and Enterprise customers who need one for their own regulatory compliance (GDPR, CCPA, etc.). It is incorporated into and governed by our Terms of Service. If your organization needs a countersigned/negotiated version, email [email protected].

1. Definitions

"Controller" means the customer organization, which determines the purposes and means of processing personal data using the Service.
"Processor" means LogicGridz LLC, operating the Talk to Data Service, which processes personal data on the Controller's behalf and instructions.
"Personal Data" means any data relating to an identified or identifiable natural person that the Controller uploads to, or connects via, the Service.
"Sub-processor" means a third party engaged by the Processor to assist in providing the Service, as listed in Section 5.

2. Roles of the Parties

As between the parties, the Controller is the data controller (or "business," under CCPA terminology) for any personal data it uploads, connects, or processes through the Service. The Processor acts solely as a data processor (or "service provider," under CCPA terminology) and processes personal data only:

To provide, maintain, and support the Service as described in the Terms of Service;
On the Controller's documented instructions, which the parties agree are given via the Controller's configuration and use of the Service (e.g., which databases to connect, which files to upload, which AI provider to use); and
As required by applicable law, in which case the Processor will inform the Controller of that legal requirement unless the law prohibits doing so.

3. Nature and Purpose of Processing

The Service processes personal data for the purpose of enabling natural-language querying, analysis, and visualization of the Controller's data. The categories of personal data processed depend entirely on what the Controller uploads or connects — the Processor does not require personal data to operate the Service and the Controller should avoid uploading personal data unless necessary for its use case. Processing lasts for the duration of the subscription and any post-termination retention period described in Section 7.

4. Processor Obligations

Process personal data only as instructed by the Controller and as necessary to provide the Service.
Ensure personnel with access to personal data are subject to confidentiality obligations.
Implement the technical and organizational security measures described in Section 6.
Assist the Controller, to the extent reasonably possible given the nature of the Service, in responding to data subject requests (access, correction, deletion, portability) and in meeting its own obligations under applicable data protection law.
Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provide information reasonably available to assist the Controller's own breach-notification obligations. (See note in Section 8 — a formal breach-notification SLA with a specific time commitment is not yet contractually defined; today this is a best-efforts commitment, not a numbered-hours guarantee.)
Delete or return personal data upon termination of the Service, as described in Section 7, except where retention is required by law.

5. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors to provide the Service. This list reflects services the Processor's own infrastructure relies on; it does not include third-party databases or AI providers the Controller independently chooses to connect using its own credentials (see Section 6 regarding BYOAK).

Sub-processor	Purpose	Location (as of this writing)
Neon	Application database hosting (PostgreSQL)	US (region per deployment config)
Render	Application server hosting	US (region per deployment config)
Stripe	Payment processing	US (global infrastructure)
Resend	Transactional email delivery	US
Sentry	Error monitoring (stack traces, URL, HTTP method, user ID — not request content)	US
Plausible	Privacy-friendly, cookieless website analytics — aggregate traffic only (page views, referrers, country-level location); no cookies, no personal identifiers, no customer data	EU

The Processor will provide advance notice of any new or replaced sub-processor via email or in-app notice where reasonably practicable, and the Controller may object on reasonable data-protection grounds within 14 days of notice.

6. AI Providers (Bring Your Own API Key)

The Service is designed around a "Bring Your Own API Key" (BYOAK) model: the Controller supplies its own API key for its chosen AI provider (Anthropic, OpenAI, Google, or DeepSeek). Because the Controller selects and contracts with the AI provider directly, the AI provider processes data as the Controller's own sub-processor or independent controller under the Controller's direct agreement with that provider, not as a sub-processor of LogicGridz LLC. The Processor's role is limited to transmitting the request (schema, representative data values, and the Controller's question — see the Privacy Policy for specifics) to the AI provider the Controller configured, using the Controller's own credentials. The Controller is responsible for reviewing the relevant AI provider's own data processing terms.

7. Data Deletion on Termination

Upon termination or expiry of the Controller's subscription, the Processor will delete the Controller's personal data (datasets, chat history, uploaded files, connector configurations) within 30 days of a verified deletion request, except for data the Processor is required to retain by law (e.g., billing records) or data contained in aggregated backups, which age out of the standard backup retention cycle. Deletion is currently a manual process initiated by emailing [email protected]; a fully self-service deletion flow is on the roadmap but not yet available.

8. Security Measures

The Processor implements the following technical and organizational measures, consistent with the Privacy Policy:

Encryption in transit (TLS 1.2+) for all traffic.
Encryption at rest (AES-256-GCM) for database connector credentials and AI provider API keys, including Databricks access tokens.
Application-level multi-tenant isolation by organization ID, verified by an automated regression test suite on every release.
Password hashing (bcrypt), short-lived JWT access tokens (15 minutes) with 7-day refresh tokens.
Optional multi-factor authentication (MFA) via time-based one-time passcodes (TOTP), compatible with standard authenticator apps (Google Authenticator, Authy, 1Password, etc.), with single-use recovery codes for account recovery.
Rate limiting and abuse prevention at IP, user, and organization levels.
An immutable audit log for administrative actions.
Point-in-time database backup and restore, tested and documented.

Honest gap disclosure: the Processor does not currently hold a SOC 2 report and has not yet completed a third-party penetration test. These are on the roadmap, timed to actual enterprise demand rather than built speculatively. If either is a hard requirement for your organization, tell us before signing — we would rather be upfront now than have it surface in a security review later.

9. International Data Transfers

The Processor's infrastructure is hosted in the United States (see Section 5). If the Controller is located outside the US and subject to a data protection law restricting international transfers (e.g., GDPR), the parties agree to execute the EU Standard Contractual Clauses (or an equivalent transfer mechanism) as an addendum to this DPA upon request, prior to any such transfer.

10. Liability

Liability under this DPA is subject to the limitation of liability provisions in the Terms of Service.

11. Term

This DPA remains in effect for as long as the Processor processes personal data on the Controller's behalf under the Terms of Service, and survives termination of the underlying subscription solely with respect to obligations relating to data already processed.

12. Contact

To request a signed/negotiated version of this DPA, or with questions: [email protected]