Data processing agreement

This Data Processing Agreement (“DPA”) is between ANDGINJA DIGITAL SERVICES, LDA, Av. Avelino Teixeira da Mota, Lote 308, 5º Esq., 1950-034 Lisboa, Portugal, VAT/NIPC PT517700263 (“Saudad”, processor), and any customer who uses Saudad for their work and stores, in their memory, personal data about other people on behalf of their business or their clients (the “Customer”, controller).

It forms part of the Saudad terms of service (the “Agreement”) and applies automatically, without a signature, to that personal data. A Customer who needs a copy signed by both parties can ask for one at andre@andginja.com. If this DPA and the Agreement conflict on data protection, this DPA wins.

“GDPR” means Regulation (EU) 2016/679. “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the GDPR’s meanings. “Customer Data” means the personal data in memories, notes and spaces that the Customer, its users and their connected agents save to Saudad.

2.1 The Customer is the controller of Customer Data and Saudad is its processor.

2.2 Saudad processes Customer Data only on the Customer’s documented instructions. The Agreement, the Customer’s use of the Saudad dashboard and of the agents it connects, and this DPA are those instructions. Saudad will tell the Customer if it believes an instruction breaks data protection law.

2.3 Saudad acts as an independent controller for its own account, sign-in, security and billing data about the Customer’s users, as described in its privacy policy.

Saudad will:

• (a) process Customer Data only to provide Saudad, as described in Annex I, and not sell it, use it for advertising or use it to train AI models;
• (b) ensure that anyone authorised to process Customer Data is bound by confidentiality;
• (c) apply the technical and organisational measures in Annex II;
• (d) use sub-processors only under section 5;
• (e) help the Customer, taking into account the nature of the processing, to answer data subject requests. Most requests can be handled directly in the dashboard (see, edit, forget, export, delete);
• (f) help the Customer with security, breach notification, data protection impact assessments and prior consultations (Articles 32 to 36 GDPR), as far as the information available to Saudad allows;
• (g) at the end of the service, delete Customer Data under section 8;
• (h) make available the information needed to show compliance with Article 28 GDPR, and allow audits under section 9.

Saudad will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Saudad will update it as more becomes known.

5.1 The Customer gives Saudad general authorisation to use the sub-processors listed on Saudad’s sub-processor page (Annex III).

5.2 Saudad will tell the Customer at least 30 days before adding or replacing a sub-processor, by updating that page and emailing account holders. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.

5.3 Saudad will impose on each sub-processor data protection obligations that are no less protective than this DPA, and remains responsible to the Customer for each sub-processor’s performance.

Saudad will not transfer Customer Data outside the European Economic Area except under Chapter V GDPR: to a country with an adequacy decision (including the EU–US Data Privacy Framework for certified recipients), or under the European Commission’s standard contractual clauses with any supplementary measures needed.

The Customer is responsible for having a lawful basis for the Customer Data its users and agents save, for the instructions it gives, and for the agents and third-party apps it chooses to connect. Those apps are not Saudad’s sub-processors; the Customer’s own agreements with their providers govern them.

During the service the Customer can export all Customer Data at any time from the dashboard (a zip file with JSON and text files). When the Customer deletes its account or the Agreement ends, Saudad deletes Customer Data from its live systems immediately, and encrypted backup copies age out within 30 days, unless EU or Member State law requires Saudad to keep it.

Saudad will answer the Customer’s reasonable written questions about its compliance, and provide this DPA’s annexes and any relevant reports it holds. Saudad holds no third-party security certification today. If that is not enough, the Customer may, at its own cost, with 30 days’ notice, at most once a year (or after a breach or a supervisory authority’s request), carry out an audit through an independent auditor bound by confidentiality, without access to other customers’ data.

10.1 Each party’s liability under this DPA is subject to the limits in the Agreement, except where the GDPR does not allow them.

10.2 This DPA lasts as long as Saudad processes Customer Data.

10.3 This DPA is governed by Portuguese law, and the courts of Lisbon have jurisdiction, without prejudice to the GDPR’s rules on data subjects’ rights and supervisory authorities.

• Separation: each owner’s memory lives in its own database with its own credentials; no connection can reach another owner’s memory. Automated isolation tests check this wall.
• Access control: people sign in with a one-time code sent by email (6 digits, valid 10 minutes, stored encrypted, with per-address and per-IP limits). Agents connect with OAuth 2.1 and the person’s explicit consent, which chooses read-and-save or read-only; read-only is enforced twice. API keys are stored only as a SHA-256 hash.
• Encryption in transit: HTTPS for every request to saudad.ai.
• Encryption of stored copies: nightly backups are encrypted with age, each memory to its own key; the platform database backup to an offline master key. Exports are encrypted while stored and expire after 48 hours. Stored connection secrets are encrypted (XChaCha20-Poly1305) with a key held outside the database.
• Deletion: forgotten items are purged after 7 days; deleting a memory destroys its backup key; backups are pruned after 28 days; storage versioning and replication are off so deleted objects don’t survive.
• Backups and recovery: nightly backups, a weekly automatic test restore, and a documented disaster recovery procedure.
• Logging: application logs carry ids and error names, not memory content, email addresses or IP addresses.
• Hosting: Saudad runs on a server rented from Hetzner Online GmbH in Nuremberg, Germany. The server is shared with other services the same operator runs, each in its own containers. The databases publish no port to the internet and sit on a private network.
• Operations: the operator console shows account metadata only and has no screen for memory content. The people who run Saudad can technically reach the databases on the server, but don’t look at memory content, except to help a person at their request, to keep the service secure, or when the law requires it.
• No third-party AI processing of memory beyond embeddings: no chat model processes memory content on Saudad’s side.

The sub-processors on Saudad’s sub-processor page, as it stands on the date the Customer’s processing takes place.