Data Processing Addendum

For the content your Organization puts into DoThat — your Datasets, your files, the Goblins you build, the conversations people have with them and everything those Goblins generate — you are the controller and we are your processor: we act on your documented instructions and process that content only to provide, secure and support the Service, and for nothing else, including not to train, fine-tune or otherwise improve any artificial intelligence or machine learning model, other than your own Goblins inside your own account and then only where you switch that on. For your own account, authentication, billing, support and website data we are a separate controller, and our Privacy Policy is the notice for it; we are never a joint controller of your content. Where you are yourself a processor acting for your own customers, we act as your sub-processor, and you confirm that the instructions you give us reflect what that controller has instructed you. You are responsible for having the lawful basis, the notices and the consents you need to put personal data into the Service, and for your instructions to us being lawful. If we think an instruction would breach data protection law we will tell you and may pause the affected functionality until we agree a lawful one.

We process the personal data contained in whatever you and your people submit through the Service, whatever anyone using one of your Goblins submits — a visitor to a public or link-shared deployment, an invited external participant, someone writing in by email or a messaging channel — and whatever a Goblin generates from it: prompts, messages, documents, files, Datasets, configurations, conversations and outputs, for as long as your agreement runs and until that content has been returned or deleted. Providing the Service means hosting your Goblins, sending content to third-party AI models for inference, screening prompts and outputs for safety, receiving and parsing inbound email and messaging-channel content addressed to a Goblin, generating outputs, and supporting you. Typical categories are names, contact details including email addresses and, where you connect a messaging channel, telephone numbers and messaging identifiers, account and authentication data, the content of messages, conversations and documents, and anything else your people or the people using your Goblins choose to type. Because the content is written by your side, it may include special category data within the meaning of Article 9 of the UK GDPR and data about criminal convictions and offences; we neither screen for it nor remove it, and you are responsible for the Article 9 condition that goes with it. The people whose data this concerns are your members and staff, your contractors, your customers and prospective customers, the end users of your Goblins — visitors to a public or link-shared deployment, invited external participants and email or messaging correspondents — and anyone else whose details appear in the content.

Two kinds of processing happen only if you turn them on, and turning them on is your documented instruction to us to carry them out. First, we analyse the conversations your Goblins hold and the outputs they produce, to give you insight, analytics and quality information about them. Second, we use your content to build, ground, improve or train your own Goblins, inside your own account and for you alone — never any other model, and never for anyone else. Because both go beyond simply running the Service for you, you are solely responsible for establishing a lawful basis for them, for giving your people and the end users of your Goblins the transparency information Articles 13 and 14 of the UK GDPR require, and for carrying out any data protection impact assessment Article 35 calls for.

We implement and maintain technical and organisational measures appropriate to the risk, of the kind Article 32 of the UK GDPR requires. In practice: access is governed by role-based membership across an Organization and its Workspaces, with a separate access model for who may chat with a Goblin; platform-administrator access additionally requires a verified membership in our own system organisation and a separately scoped session; data is encrypted in transit and at rest, and stored third-party credentials are encrypted under a dedicated, automatically rotated key; each Organization is logically isolated from every other; prompts and outputs pass automated safety screening; and access to customer content by our staff is separately granted, redacted by default, re-authenticated at the point of access and recorded in an audit log. Everyone we authorise to process your content is under a written confidentiality obligation. The full control set is available under NDA. Security is shared: you are responsible in turn for appropriate measures on your own systems, for the people you give access, and for how you configure the Service.

We use these sub-processors to run the Service: Google Cloud (Google LLC) for hosting, storage, logging, secret management and DNS, and for AI model inference via Vertex AI — Gemini models and partner-served Claude models — plus Model Armor safety screening, in the United States; Anthropic (Anthropic PBC) for direct Claude model inference through the Anthropic API where a Goblin is configured with a directly-served Claude model, in the United States, and under Anthropic commercial API terms that content is not used for model training; WorkOS Inc. for authentication — password, magic link, SSO and AuthKit, MFA — and SCIM directory sync, in the United States; Stripe (Stripe Payments UK Ltd) for payments and billing administration, in the UK — Stripe is its own controller for payment processing and for the KYC and fraud data that goes with it, under its own terms and privacy policy, and is our processor only for the limited billing administration data we send it, which is customer email addresses and invoice records; Postmark (ActiveCampaign LLC) for outbound transactional email and inbound email receipt and parsing, in the United States; Slack (Salesforce, Inc.) only where you connect the Slack channel, in the United States; WhatsApp (Meta) only where you connect the WhatsApp channel, in the United States and Ireland; and Google Analytics (Google LLC and Google Ireland Ltd) for consent-gated website analytics, which never sees prompt, Dataset or conversation content, in Ireland and the United States. Every one of them is covered by the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum, and for Google and Anthropic by a UK–US Data Bridge or EU–US Data Privacy Framework certification where one is held. We give at least 30 days written notice before appointing or replacing a sub-processor. You can object on reasonable data-protection grounds within those 30 days and before the change takes effect; if we cannot offer a way to avoid the objected-to sub-processor you may terminate the affected part of the Service.

The Service is hosted in the United States, so personal data in your content is transferred out of the UK for every customer. Where we transfer to a country without a UK adequacy regulation we put appropriate safeguards in place — the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum, or a provider certification where one is held. UK or EU-resident hosting is not available today and we do not promise it; if that changes we will say so rather than imply it.

If there is a personal data breach affecting your content we will tell you without undue delay and in any event within 72 hours of becoming aware of it, with what we know at the time — what happened, its likely consequences, what we are doing about it, and who to ask for more. We will not notify a regulator or an individual about your data without your instruction unless the law requires us to. We will help you answer requests from people exercising their rights and your own regulator, using the export and deletion tools in the product, and we will not answer a request about your content ourselves except on your instructions. We will give you the information you need to demonstrate our compliance, and support one audit in any twelve-month period on reasonable notice — more if there has been a breach.

Deleting a Workspace withdraws everything under it — Goblins, deployments, Datasets, files and their derived indexes — and holds it recoverably for 30 days in your organisation bin before it is permanently erased; an owner or admin can restore it within that window. You can erase an individual item or empty the bin immediately, and permanent erasure removes the derived copies, such as search indexes and extracted chunks, as well as the original. When your agreement ends you have 30 days to export the personal data in your content using the tools in the product, or to ask us in writing to return it (at your cost where returning it takes work the export tools do not do), and we securely delete it within a further 30 days after that window closes — so export anything you need inside those first 30 days. If the law requires us to keep something we go on protecting it under this Addendum and delete it as soon as that requirement ends. We may keep data that has been irreversibly anonymised, and the account and billing records for which we are our own controller.

This Addendum forms part of your agreement with us and prevails over it on anything to do with our processing of personal data on your behalf. Each of us is liable for its own breach of data protection law and of this Addendum, and not for the other side. We remain fully liable to you for our sub-processors as if their acts were our own, and each of them is bound by written terms materially the same as these. Our liability under this Addendum is subject to the cap in your agreement, and nothing in it limits the indemnities you give us under that agreement. It is governed by the law of England and Wales.