Data Processing Agreement.

1. Purpose and Scope

1.1 Purpose

This Data Processing Agreement ("DPA") governs the processing of personal data by DemanualAI on behalf of the Client in connection with the Dataviz by DemanualAI platform ("Service").

1.2 Nature of Processing

DemanualAI provides an AI-powered analytics platform that connects to the Client's databases, translates natural language questions into SQL queries, executes those queries, and returns results to authorized users. In the course of providing this Service, DemanualAI may process personal data contained in query results.

1.3 Scope of Data Processing

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws including GDPR (EU) and DPDP Act 2023 (India).
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, transmission, and deletion.
• "Sub-Processor" means any third party engaged by DemanualAI to process personal data on behalf of the Client.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

3. Obligations of DemanualAI (Data Processor)

3.1 Lawful Processing

DemanualAI shall:

• Process personal data only on documented instructions from the Client
• Not process personal data for any purpose other than providing the Service
• Not sell, share, or use Client data for marketing, advertising, or model training

3.2 Confidentiality

• All DemanualAI personnel with access to personal data are bound by confidentiality obligations
• Access to Client data is restricted to authorized personnel on a need-to-know basis

3.3 Security Measures

DemanualAI implements the following technical and organizational measures:

Encryption:

• Data in transit: TLS 1.2+ for all communications
• Data at rest: AES-256-GCM for credentials (Supabase Vault), AES-256 for database storage
• SSH tunneling available for database connections

Access Control:

• JWT-based authentication with RS256 signature verification
• Role-Based Access Control (RBAC): Viewer, Editor, Admin
• Row-Level Security (RLS) enforced at database level for tenant isolation
• Database credentials accessible only via encrypted Vault with audit trail

Monitoring & Audit:

• Immutable, append-only audit log of all query executions
• Credential access logging (who accessed which credentials, when)
• Real-time rate limiting and usage monitoring
• AWS WAF with managed rulesets for threat detection

Application Security:

• 3-stage SQL validation (syntax, schema, EXPLAIN) before any query execution
• Read-only enforcement at multiple layers (LLM prompt, SQL validator, database connector)
• Prompt injection defense with input/output scanning
• Non-root Docker containers with minimal base images
• CORS whitelisting and security headers (HSTS, X-Frame-Options, etc.)

3.4 Data Minimization

• Zero data retention model: Query results are not permanently stored
• Cached results have configurable TTL and are automatically evicted
• Only metadata necessary for Service operation is retained
• Schema metadata stores table/column structure only; sample values limited to distinct value previews

3.5 Sub-Processors

DemanualAI uses the following sub-processors:

Sub-Processor changes: DemanualAI will notify the Client at least 30 days before adding or replacing a sub-processor. The Client may object in writing within 15 days. If the objection cannot be resolved, either party may terminate the affected Service.

3.6 Data Breach Notification

In the event of a Data Breach:

• DemanualAI will notify the Client within 72 hours of becoming aware of the breach
• Notification will include: nature and scope of the breach; categories and approximate number of affected data subjects; likely consequences; and measures taken or proposed to address the breach
• DemanualAI will cooperate with the Client's breach response and regulatory notification obligations

3.7 Data Subject Rights

DemanualAI will assist the Client in fulfilling data subject requests:

3.8 Data Return and Deletion

Upon termination of the Service:

• DemanualAI will, at the Client's election, return or delete all personal data within 30 days
• Deletion includes: conversations, query history, reports, connection credentials, schema metadata
• Audit logs may be retained for up to 90 days after termination for compliance purposes, after which they are permanently deleted
• DemanualAI will provide written confirmation of deletion upon request

4. Obligations of the Client (Data Controller)

4.1 Lawful Basis

The Client warrants that:

• It has a lawful basis for processing personal data through the Service
• It has provided appropriate notices to data subjects regarding the use of AI-powered analytics tools
• It has obtained necessary consents where required by applicable law

4.2 Database Credentials

The Client shall:

• Provide read-only database credentials for use with the Service
• Not provide superuser or administrative database credentials
• Rotate credentials periodically and update them in the Service
• Notify DemanualAI immediately if credentials are compromised

4.3 Data Classification

The Client is responsible for:

• Understanding what personal data exists in the databases connected to the Service
• Ensuring that users are authorized to access the data they query
• Configuring appropriate access controls (roles and permissions) within the Service

5. International Data Transfers

5.1 Data Location

• Primary processing: AWS ap-south-1 (Mumbai, India)
• AI processing: AWS us-east-1 (N. Virginia, USA) — ephemeral, no data stored
• Database hosting: Supabase (AWS-managed regions)

5.2 Transfer Mechanisms

For transfers outside the Client's jurisdiction:

• AWS and Supabase maintain Standard Contractual Clauses (SCCs) for EU data transfers
• DemanualAI will execute additional transfer agreements as required by applicable law

6. Audit Rights

6.1 Client Audit

The Client may:

• Request information about DemanualAI's security measures and compliance status
• Conduct or commission an audit of DemanualAI's data processing activities, with reasonable notice (minimum 30 days)
• Audits limited to once per year unless a Data Breach has occurred

6.2 Documentation

DemanualAI will maintain and provide upon request:

• Security whitepaper (updated quarterly)
• List of sub-processors
• Summary of technical and organizational measures
• Incident response records (if applicable)

7. Liability and Indemnification

7.1 Limitation of Liability

• DemanualAI's total liability under this DPA shall not exceed the total fees paid by the Client in the 12 months preceding the claim
• DemanualAI is not liable for unauthorized access resulting from the Client providing non-read-only database credentials
• DemanualAI is not liable for personal data exposure resulting from the Client's users querying personal data through the Service

7.2 Indemnification

Each party shall indemnify the other against losses arising from the indemnifying party's breach of this DPA.

8. Term and Termination

8.1 Term

This DPA is effective from the Effective Date and remains in force for the duration of the Service Agreement between the parties.

8.2 Survival

Sections 3.6 (Breach Notification), 3.8 (Data Return and Deletion), 6 (Audit Rights), and 7 (Liability) survive termination.

9. Governing Law

This DPA is governed by the laws of India. For Clients subject to GDPR, the GDPR provisions in this DPA shall be interpreted in accordance with GDPR.

10. Contact

This DPA template is provided for reference. DemanualAI recommends that both parties have this agreement reviewed by legal counsel before execution.