Data Processing Agreement

Version 1.4 · Last updated: 24 October 2026

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between:

• the customer that has accepted the CueLens Terms of Service (the "Customer" or "Controller"), and
• Dream Ideas Tomasz Dąbrowski, Aleja Komisji Edukacji Narodowej 19/5, 02-797 Warszawa, Poland, NIP 5832756805 ("CueLens", "we" or "Processor").

This DPA forms part of the Terms of Service (the "Agreement"). It applies whenever we process personal data on the Customer's behalf while providing the Service. By accepting the Terms, the Customer also accepts this DPA. If you need a copy signed by both parties, write to contact@cuelens.ai.

This DPA doesn't cover personal data we process as a controller in our own right, such as the details of the Customer's account users and the billing details used for its subscription and invoices. Our Privacy Policy covers that data. Stripe, which processes subscription payments, is therefore not a sub-processor under this DPA.

If this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

2. Definitions

"GDPR" means Regulation (EU) 2016/679. "Customer Personal Data" means personal data we process on the Customer's behalf under the Agreement. Terms such as "controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR.

3. Roles and instructions

• The Customer is the controller of Customer Personal Data, and CueLens is its processor.
• We process Customer Personal Data only on the Customer's documented instructions, including for transfers to third countries, unless EU or Polish law requires otherwise. In that case, we'll tell the Customer before processing, unless the law prohibits it.
• The Agreement, this DPA and the Customer's configuration of the Service are the Customer's complete instructions. That configuration includes which workspaces are connected, which lenses are used and where cues are sent. Additional instructions must be agreed in writing.
• We'll tell the Customer promptly if, in our opinion, an instruction infringes the GDPR or other data protection law.
• The Customer is responsible for having a lawful basis for the processing, and for giving its data subjects any information the law requires. This includes its end customers whose conversations the Service analyses.
• Where the Customer tells the Service to send cues to third-party tools it chooses, such as issue trackers, kanban boards (for example Trello) or chat tools, those tools are the Customer's own providers, not our sub-processors. Once content has been delivered there, it is governed by the Customer's agreement with that provider.

4. Details of the processing

Annex I sets out the subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects.

5. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality, either by contract or by law. Access is limited to what's needed to provide, secure and support the Service.

6. Security

We implement the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk, as required by Art. 32 GDPR. We may update these measures as technology develops, as long as the overall level of protection doesn't decrease.

7. Sub-processors

• The Customer gives general authorisation for us to engage sub-processors. The sub-processors in use at the date of this DPA are listed in Annex III.
• We'll notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, the Customer may terminate the affected part of the Service before the change takes effect.
• We impose data protection obligations on each sub-processor that are substantially the same as those in this DPA. We remain fully liable to the Customer for our sub-processors' performance of those obligations.

8. International transfers

We store Customer Personal Data in the European Union: Amazon Web Services, Frankfurt, Germany. Some sub-processors listed in Annex III process data in the United States. Any such transfer relies on the recipient's certification under the EU–US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with any supplementary measures needed.

9. Assistance to the Customer

• Data subject requests: taking into account the nature of the processing, we'll help the Customer respond to requests from data subjects to exercise their GDPR rights. If we receive such a request directly, we'll forward it to the Customer without undue delay and won't respond ourselves, except to redirect the data subject.
• Other obligations: we'll help the Customer meet its obligations under Art. 32–36 GDPR, covering security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us.

10. Personal data breaches

We'll notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include, as far as the information is available:

• the nature of the breach,
• the categories and approximate number of data subjects and records concerned,
• the likely consequences, and
• the measures taken or proposed.

We'll take reasonable steps to contain the breach and limit its effects.

11. Deletion and return

When the Customer disconnects an integration or the Agreement ends, we'll delete Customer Personal Data from active systems within 30 days, including conversations, stored images, cues, clusters and feedback. It will also roll out of backups within that period. Access tokens and settings for disconnected destinations, such as a Trello API token, are deleted at the same time. Content already delivered to a destination, such as Trello cards, stays there under the Customer's control. Before deletion, the Customer may ask for an export of its cues. We may keep data longer only where EU or Polish law requires it, and then only for that purpose.

12. Audits and information

We'll make available all information necessary to demonstrate compliance with Art. 28 GDPR, and we'll allow for and contribute to audits, including inspections, by the Customer or an auditor it mandates. To keep this proportionate:

• the Customer will first rely on the information and documentation we provide, including our sub-processors' certifications and audit reports,
• on-site audits require at least 30 days' written notice and can take place at most once a year, unless a supervisory authority requires them or there has been a personal data breach,
• audits take place during business hours, at the Customer's cost, and are subject to confidentiality.

13. Liability, term and law

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the GDPR or other mandatory law doesn't allow liability to be limited. This DPA stays in force for as long as we process Customer Personal Data. This DPA is governed by Polish law, and disputes are resolved as set out in the Terms of Service.

Annex I: Details of the processing

Annex II: Technical and organisational measures

• Data minimisation: read-only access to connected support tools. We request only the scopes needed to read conversations. For destinations, we use only the access needed to create items and check their status. For Trello, that means read and write scopes without account access, and we recommend a dedicated Trello user that belongs only to the connected board.
• Pseudonymisation: before a conversation is stored or sent to an AI model, contact profile fields are discarded, and names of the people taking part, email addresses, phone numbers, card numbers, IP addresses and street addresses in message text are replaced with placeholders. Postal codes are not replaced and may remain in message text. Images attached to messages are not pseudonymised. To limit their exposure, they're never sent to AI models or destinations, and are kept in private file storage that is not publicly accessible and is reached only through the authenticated app.
• EU hosting: the application, database and file storage for images run on Amazon Web Services in the Frankfurt region (eu-central-1). AWS's infrastructure is certified to ISO 27001 and assessed under SOC 2.
• Encryption in transit: all traffic to and from the Service, and to sub-processors, uses TLS.
• Encryption at rest: the database (Amazon DynamoDB) and file storage (Amazon S3) are encrypted at rest with AES-256.
• Access control: production access is limited to authorised personnel and protected with multi-factor authentication. Service credentials follow least privilege.
• Tenant separation: each Customer's data is logically separated. It's never shown to, or used to train detection for, other Customers.
• AI processing: AI providers are used through their business APIs, under terms that don't allow training on the data submitted.
• Resilience: data is stored in AWS services that replicate it across several availability zones in the Frankfurt region. Any backups are kept for no longer than the deletion period in section 11.
• Logging and monitoring: application and error logging, with logs kept for no longer than 30 days.
• Deletion: documented deletion on disconnection or termination, as set out in section 11.
• Incident response: a documented process to assess, contain and notify personal data breaches, as set out in section 10.

Annex III: Sub-processors

The Customer's own support tool, such as Intercom, and any destination the Customer connects for cues, such as Trello (Atlassian), are the Customer's own providers, not our sub-processors.