Data Processing Agreement

1. Who is who

You are the controller. You decide what personal data goes into the products and why.

We are the processor. We process it only to provide the service to you and only on your instructions.

This does not cover personal data we hold about you as our own customer — your account and billing details. For that we are the controller and our Privacy Policy applies.

2. The rule this agreement is built on

The AI agent does not own the data. The customer owns and controls the customer data, and the agent receives only the minimum authorised context necessary to perform its task.

This is not a statement of intent. It is how the platform is built, and the obligations in clauses 5, 6 and 7 are what it means in practice.

3. What we process

4. Your instructions

We process personal data only on your documented instructions, including as to transfers to a third country. Using the products as they are designed is your instruction. We will tell you immediately if, in our opinion, an instruction infringes applicable data protection law.

If a law to which we are subject requires us to process beyond your instructions, we will inform you of that legal requirement before processing, unless that law forbids it on important grounds of public interest.

You are responsible for having a lawful basis to put the data in, for telling the people concerned what you are doing, and for the accuracy of what you submit.

5. What we will not do

We will not:

• use your data for any purpose other than providing the service to you;
• use your data, or let any provider use it, to train an AI model — Anthropic’s commercial terms bar it from training on content submitted through its services, so this is a contractual prohibition rather than a setting either of us could change;
• combine your data with another customer’s;
• sell it, or share it for anyone’s marketing;
• give an AI agent access beyond the task in front of it;
• allow data to cross between customer accounts.

6. AI processing specifically

Because the products are AI systems, this clause says plainly what happens.

• Only what the task needs is sent. The application selects the minimum context for the request. An agent does not hold a connection to your whole account.
• The model is not the security boundary. Permissions, tenant separation and access rules are enforced in our application and database, outside the model, so a prompt cannot talk its way past them.
• Uploaded content is untrusted. Instructions embedded in a document you upload are treated as content, never as commands to the system.
• Output is yours. What the products generate from your data belongs to you.
• No automated decisions with legal effect. The products produce analysis for a human to act on. They do not make decisions about people on their own, and you should not configure them as though they did.
• Memory is scoped. Where a product remembers context between sessions, that memory is confined to your account and is deleted with it.

Clause 7.1 of the Terms of Service limits our responsibility for the behaviour, availability and output of the third-party AI models the products are built on. It does not limit our responsibility under this Agreement for how those providers handle your data — that remains ours under clause 9.

7. Confidentiality and our people

Everyone with access to your data is bound by confidentiality, whether by contract of employment or by a written confidentiality undertaking, and that obligation survives the end of their engagement. Access is limited to those who need it to run or support the service, is authenticated, and is logged. We do not browse customer content.

8. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to individuals, we apply appropriate technical and organisational measures, including:

• encryption in transit and at rest;
• separation of customer accounts enforced at the database layer, not only in the interface;
• authenticated, role-based, logged access to production;
• secrets held in managed stores, never in code;
• automated daily backups, held in the same region as the live data;
• audit logging of access to customer data;
• measures to restore availability and access to personal data in a timely manner after an incident;
• a documented incident response process.

We may change specific measures, but not in a way that materially weakens security.

9. Sub-processors

You give us general authorisation to engage sub-processors. The current list, with each one’s role, location and transfer mechanism, is on our Sub-processors page.

• Every sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this Agreement, including the obligations in clauses 5, 7 and 8.
• Where the engagement involves a transfer of personal data protected by the EU or UK GDPR to a country without an adequacy decision, that contract incorporates the EU Standard Contractual Clauses (Module Three, processor to processor), together with the UK International Data Transfer Addendum where UK data is involved.
• We remain fully liable to you for the performance of each sub-processor’s obligations.
• We will give you 30 days’ notice before adding or replacing one, by email to your account contact.

If you reasonably object on data protection grounds within those 30 days, tell us and we will try to find an alternative. If we cannot, you may terminate the affected subscription and we will refund the unused part of the period you have paid for.

Changes made by a sub-processor, not by us. Our own providers engage sub-processors of their own, and they give us the notice their terms require rather than the notice we give you. Where a provider changes its own sub-processors and gives us less than 30 days, we will tell you as soon as we are told, which may be less than 30 days before the change takes effect. Your right to object and to terminate under this clause is unaffected, but we should be straight with you that in that situation we cannot offer an alternative — we would be changing AI provider, not changing a setting. Anthropic publishes its own sub-processor list, and our Sub-processors page links to it.

10. Deletion and return

While your subscription is active you may export your data in a machine-readable format at any time.

On termination, or on your written request:

1. you have 30 days to export;
2. we then delete the data across every system that holds it — the database, the stored analyses, the chat history, the generated reports and any derived copies;
3. backups expire on their own cycle, no longer than 30 days, after which no copy remains;
4. we keep only what the law requires us to keep, and we keep that no longer than the law requires.

How deletion is carried out

Deletion runs as a scheduled job. It is not a manual clean-up, and it does not depend on someone remembering.

• Cascade from the account record. Your account is the parent record for everything you own. Deleting it cascades through the database to every dependent row — submitted content, analyses, chat history, generated reports, derived and intermediate data — which are removed in a single transaction rather than flagged as hidden or archived.
• Product backends. Any records a product backend holds outside the main database are deleted in the same run, keyed to your account identifier.
• Stored files. Files in object storage are deleted by the same job, by the same key.
• No partial state. If any step fails, the job is retried rather than left half-done, and the account stays closed throughout.
• Backups are not edited. We do not rewrite backups, because doing so would compromise their integrity. They expire on a rolling cycle of no more than 30 days, so a deleted account is absent from all backups within that window.
• Sub-processors. Where a sub-processor holds a copy incidental to its function, we instruct its deletion on the same timetable, except where that provider holds the record as a controller in its own right under a legal retention duty — principally Stripe, which retains transaction and dispute records under its own financial-services and anti-fraud obligations.
• The AI provider is an exception worth stating precisely. It deletes request content automatically within 30 days of receiving it, on a rolling cycle, rather than on an instruction from us about a particular account. In practice content from a deleted account is gone within the same window; the mechanism is elapsed time, not a deletion request, and we cannot accelerate it. Where its systems have flagged content as a possible breach of its usage policy, it may retain that content for up to two years under its own terms. Our Privacy Policy discloses this to your people as well.
• What we retain. A minimal tombstone record that the account existed and when it was deleted, so that a replayed payment or webhook event cannot recreate it; and records we must keep by law. Nothing in the tombstone contains your business content.

On written request we will confirm the date the deletion job completed.

11. Helping you with requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from individuals exercising their rights.

If such a request reaches us directly, we will not respond to it ourselves — we will pass it to you promptly, because it is yours to answer.

We will also give you reasonable assistance with data protection impact assessments and with prior consultation of a supervisory authority, taking into account the nature of the processing and the information available to us.

12. Breach notification

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within 48 hours, and give you what we know: the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed.

We set 48 hours deliberately so that you can meet your own 72-hour notification deadline where the EU or UK GDPR applies to you.

Where a breach originates with one of our own providers, our 48 hours runs from the moment we are told, and our providers are themselves held to 48 hours. In the worst case that chain is longer than your 72 hours. We will not wait out our own window in that situation: where a provider notifies us of a breach affecting your data, we pass it on within 24 hours, with whatever we have at that point, and follow up as we learn more.

We will keep you updated as we learn more. We will not make a public statement naming you without talking to you first, unless the law requires it.

13. Audit

We will make available to you all information necessary to demonstrate compliance with this Agreement.

Once in any twelve months, with 30 days’ notice, you may audit our compliance — or mandate an independent auditor who is not our competitor to do so. An audit must be during business hours, must not disrupt the service, must respect our other customers’ confidentiality, and is at your cost unless it finds a material breach.

We may satisfy an audit request by providing a current third-party report or certification covering the same ground.

14. Liability

The limitation of liability in clauses 15 and 16 of the Terms of Service applies to this Agreement. That is a single cap covering claims under the Terms and under this Agreement together, and nothing in this Agreement creates an additional cap or an additional claim.

Nothing in this clause limits any liability that cannot lawfully be limited, including a data subject’s right to compensation under applicable data protection law.

15. Term and conflict

This Agreement runs for as long as we process personal data on your behalf.

Where it conflicts with the Terms of Service on the processing of personal data, this Agreement wins. Where it conflicts with the Standard Contractual Clauses incorporated under clause 17, those Clauses win.

16. Law and jurisdiction

This Agreement is governed by the laws of Malaysia, and the courts of Malaysia have exclusive jurisdiction, except where the Standard Contractual Clauses incorporated under clause 17 provide otherwise for the matters they govern.

Contact: support@quantmec.com

17. International transfers

Your data is processed outside Malaysia. The locations are set out in our Privacy Policy and on the Sub-processors page, and they are:

For transfers out of Malaysia we rely on section 129(3)(f) of the Personal Data Protection Act 2010: we have taken reasonable steps and exercised due diligence to satisfy ourselves that each recipient will not treat the data in a manner that would breach the Act. The evidence is the written data protection terms we hold with each provider. We maintain a transfer register recording, for each recipient, its name, company registration number, data protection contact, the data transferred, the purpose and the safeguards relied on. It is available to you on request.

Where personal data protected by the EU GDPR is nevertheless transferred to us in Malaysia, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this Agreement by reference and are completed as follows:

• Clause 7 (docking clause): applies.
• Clause 9 (sub-processors): Option 2, general written authorisation, with the 30-day notice period in clause 9 of this Agreement.
• Clause 11 (redress): the optional independent dispute resolution body is not selected.
• Clause 17 (governing law): the law of Ireland.
• Clause 18 (forum): the courts of Ireland.
• Annex I.A (parties): you as data exporter and controller; Quant Mec Technologies as data importer and processor, contact support@quantmec.com.
• Annex I.B (description of transfer): as set out in clause 3 of this Agreement; frequency is continuous for the duration of the subscription; retention as set out in clause 10.
• Annex I.C (competent supervisory authority): the supervisory authority of the EEA member state in which you are established, or, where you are not established in the EEA, the supervisory authority of Ireland.
• Annex II (technical and organisational measures): as set out in clause 8 of this Agreement.
• Annex III (sub-processors): the list published on our Sub-processors page.

For personal data protected by the UK GDPR, the above Clauses apply as modified by the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner, with Tables 1 to 3 completed by reference to the entries above, Table 4 (“ending this Addendum when the Approved Addendum changes”) selecting neither party, and the governing law and forum being the laws of England and Wales.

Onward transfers. Where we transfer personal data to a sub-processor, clause 9 of this Agreement governs the safeguards that apply, and the Sub-processors page names the mechanism relied on for each recipient.

You may request a copy of the Clauses as incorporated, with the Annexes completed, at support@quantmec.com.