1. Scope, roles and precedence
This Data Processing Addendum (“DPA”) is part of the Databrush Terms & Conditions (“Terms”) between DATABRUSH LLC (“Databrush”) and the Customer. Capitalized terms not defined here have the meanings in the Terms.
“Customer Personal Data” means personal information in Customer Data that Databrush processes on Customer’s behalf. “Data Protection Laws” means the privacy and data-protection laws that apply to that processing, including the California Consumer Privacy Act and other U.S. state privacy laws.
Customer is the business or controller, or a processor acting for its own controller. Databrush is Customer’s service provider or processor. Information Databrush handles for its own business, such as account, billing, security and support information, is outside this DPA and described in the Privacy Policy.
This DPA prevails over the Terms only for the processing of Customer Personal Data. Each party’s liability under or related to this DPA is subject to the exclusions and limits in Section 14 of the Terms.
2. Details of the processing
| Item | Details |
|---|---|
| Purpose and subject matter | Providing the Service under the Terms: connecting to Customer’s sources; reading them on a schedule, including nightly; proposing and applying definitions; calculating metrics, warnings, Retention Signals and suggestions; keeping each customer’s history; sending emails to Customer’s users; delivering information to Agents that Customer’s users connect; AI features; support; and security |
| Nature of processing | Collection, storage, retrieval, analysis, transmission, display, disclosure to Customer’s authorized users and Agents, and deletion |
| Data subjects | Customer’s customers and end users, Customer’s personnel and users, and other individuals whose information is in Customer’s connected sources |
| Categories of data | Identifiers (such as database and user IDs), names and email addresses, plan, status, subscription and billing information, product activity, sign-up and sign-in times, and any other data in sources Customer connects |
| Sensitive data | None intended. The restricted-data rules in the Acceptable Use Policy apply |
| Frequency and duration | Continuous and scheduled, for the term of the Terms and until deletion under Section 7 |
3. Instructions and Customer responsibilities
Databrush will process Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA, Customer’s configuration of the Service (its sources, schemas, definitions and settings, including turning on customer names and emails for Agents) and requests made through the Service or support are Customer’s complete instructions. Other instructions require a written agreement and may involve fees.
Databrush will tell Customer if it believes an instruction violates Data Protection Laws, and may decline to follow it. Databrush has no duty to review the legality of Customer’s instructions or data. Databrush may also process Customer Personal Data where the law requires it, telling Customer first unless the law forbids it.
Customer represents that it has, and will keep, every lawful basis, notice, consent and permission needed for Databrush and its subprocessors to process Customer Personal Data as this DPA describes, and for its users to direct that information to Agents. Customer is responsible for the accuracy and lawfulness of Customer Personal Data and for choosing what to connect.
Delivering information to an Agent is a disclosure Customer instructs. Agents and their providers are Customer’s own vendors, not Databrush’s subprocessors, and so is Customer’s own database provider, such as Supabase. Databrush is not responsible for information after delivering it to them.
4. Confidentiality and security
Databrush will ensure that people it authorizes to process Customer Personal Data are bound by confidentiality obligations and have access only as needed.
Databrush will maintain reasonable technical and organizational measures appropriate to the risk, including encryption in transit, encrypted storage of credentials and authorization tokens, read-only access to connected databases, authentication and access controls, separation of each customer’s data, limits on what logs record, backups and vulnerability management. Databrush may change these measures as long as it does not materially reduce overall security. This DPA does not represent that Databrush holds any security certification.
5. Subprocessors
Customer generally authorizes Databrush to use subprocessors. The current subprocessors are:
| Subprocessor | Purpose |
|---|---|
| OpenAI | AI features |
| Supabase | Application database, file storage and scheduled jobs |
| Amazon Web Services | Encrypted storage of credentials and authorization tokens |
| Vercel | Hosting and running the Service |
| Clerk | Sign-in and account management |
| Upstash | Temporary encrypted setup data and coordination |
| Sentry | Error monitoring and problem reports |
| Resend | Email delivery |
| Stripe | Payments and subscriptions |
| Google Workspace | Support correspondence |
Databrush will bind each subprocessor to written data-protection obligations appropriate to its processing and remains responsible for its subprocessors as Data Protection Laws require.
Databrush will give notice of a new subprocessor, by email or by updating this DPA, at least 10 days before it begins processing Customer Personal Data, except where an urgent change is needed for security or continuity. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer’s sole remedy is to end the affected Service and receive a refund of prepaid fees for the unused period.
6. Assistance, requests and incidents
Requests from individuals. If Databrush receives a request from an individual about Customer Personal Data and can identify Customer, it will pass the request to Customer and will not respond except to direct the person to Customer, unless the law requires otherwise. Databrush will provide reasonable help with such requests through the Service’s features and, where needed, through support, such as deleting the records it holds about a particular person.
Assessments. Databrush will provide information reasonably available to it to help Customer with required risk assessments and consultations with regulators, taking into account the nature of the processing. Help beyond the Service’s standard features may be charged at reasonable rates.
Security incidents. A “Security Incident” is a breach of Databrush’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data in Databrush’s systems. Unsuccessful attempts and events that do not compromise Customer Personal Data are not Security Incidents. Databrush will notify Customer without undue delay after confirming a Security Incident, give information reasonably available to help Customer meet its obligations, and take reasonable steps to contain it. Customer is responsible for notices to individuals and regulators that Data Protection Laws require of Customer. A notice is not an admission of fault or liability.
7. Deletion and return
During the term, Customer can delete Customer Personal Data with the Service’s features. For example, disconnecting a source deletes the history Databrush stored for it, and deleting a workspace or account deletes its data. Customer can export what the Service’s features allow before the Terms end; Databrush has no duty to provide other exports.
After the Terms end, Databrush will delete Customer Personal Data within a commercially reasonable period. This does not apply to copies in backups, which are overwritten on their normal cycle, or to data the law requires Databrush to keep; those copies stay protected by this DPA. Databrush will instruct its subprocessors to delete Customer Personal Data to the extent its agreements with them allow. Copies kept by a provider under its own retention terms, such as an AI provider’s abuse-monitoring logs, are deleted on that provider’s schedule. On written request, Databrush will confirm deletion.
8. Demonstrating compliance
On written request, no more than once in any 12 months, Databrush will provide information reasonably needed to show that it complies with this DPA, such as written answers to a reasonable security questionnaire and summaries of its practices.
Where Data Protection Laws require more, Customer may have an independent auditor, bound by confidentiality, conduct an audit on at least 30 days’ notice, during business hours, at Customer’s expense and without access to other customers’ data or to Databrush’s providers’ facilities. Databrush may instead provide a report from a qualified independent assessor. Customer will reimburse Databrush’s reasonable costs of an audit.
9. U.S. state privacy law terms
Where the California Consumer Privacy Act or a similar law applies, Databrush will not sell or share Customer Personal Data, and will not retain, use or disclose it for any purpose other than the purposes in Section 2, or outside the direct business relationship with Customer, except as that law permits. It will not combine Customer Personal Data with personal information from other sources except as that law permits. Databrush will comply with the obligations that law places on it, provide the level of privacy protection it requires, and tell Customer if it can no longer meet those obligations. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized processing by notifying Databrush. Databrush will not attempt to re-identify de-identified data. Databrush understands these restrictions and will comply with them.
10. Data outside the United States
The Service is offered to customers in the United States. Where the GDPR, UK GDPR or Swiss data-protection law applies to Customer Personal Data, this DPA is intended to meet the processor requirements of those laws. This DPA does not include Standard Contractual Clauses or other transfer terms. If Customer’s use of the Service would require them, Customer must tell Databrush before connecting that data, and the parties will put appropriate terms in place before it is processed.
11. Term
This DPA applies for as long as Databrush processes Customer Personal Data and ends when that processing ends.