jitprompt

Data Processing Addendum

Version 2026-09-30 · Effective 2026-09-30

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between jitprompt (Mirko Pace, an individual doing business as jitprompt, [MAILING ADDRESS]; “Processor”) and the organization using the Service (“Customer”). It applies when jitprompt processes personal data contained in Customer Content on Customer’s behalf and that processing is subject to the GDPR, the UK GDPR, Swiss data protection law or US state privacy laws (“Data Protection Law”). It takes effect when Customer accepts the Terms; no signature is needed.

1. Roles and instructions

Customer is the controller (or a processor for its own clients) and jitprompt is the processor (or subprocessor). jitprompt processes personal data only on Customer’s documented instructions, which are the Terms, this DPA and Customer’s use of the Service, unless the law requires otherwise, in which case jitprompt will tell Customer first where the law allows.

2. Details of processing (Annex I)

  • Subject matter and duration: providing the Service, for the term of the Terms plus the deletion periods in section 8.
  • Nature and purpose: storing uploaded documents, structuring them into sections with AI models, creating embeddings, and serving sections to Customer’s agents on request.
  • Data subjects: whoever is mentioned in documents Customer uploads, and Customer’s users.
  • Categories of data: whatever Customer chooses to upload (typically business contact details and work-related information) and the plan text Customer’s agents send. Customer will not upload special categories of data (Art. 9 GDPR) or criminal-offence data.
  • Frequency: continuous.

3. Processor obligations

jitprompt will: (a) ensure everyone who processes the data is bound by confidentiality; (b) apply the security measures in Annex II; (c) assist Customer, taking into account the nature of processing, with data-subject requests, security, breach notifications, impact assessments and prior consultations; (d) make available the information needed to demonstrate compliance and allow audits as set out in section 7.

4. Subprocessors

Customer authorizes the subprocessors listed at jitprompt.com/subprocessors. jitprompt imposes data-protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for them. jitprompt gives at least 30 days’ notice of a new subprocessor; Customer may object on reasonable data-protection grounds within that period, and if no solution is found, may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

5. International transfers

Personal data is processed in the United States. For transfers from the EEA, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated by reference with: clause 7 (docking) included; clause 9 option 2 (general authorization, 30 days’ notice); clause 11 optional language omitted; clauses 17 and 18 — the law and courts of Ireland; Annex I as in section 2 and Annex II as below. For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated; for Switzerland, the SCCs apply with the FDPIC as competent authority and references adapted to Swiss law.

6. Personal data breaches

jitprompt will notify Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer’s personal data, with the information Customer needs to meet its own obligations, and will take reasonable steps to contain it.

7. Audits

jitprompt will answer Customer’s reasonable written security questionnaires once a year, and more often after a breach or where a supervisory authority requires it. On-site audits, if required by Data Protection Law, take place on 30 days’ notice, during business hours, at Customer’s cost, and under confidentiality.

8. Deletion and return

On termination, or on Customer’s request, jitprompt deletes Customer Content within 30 days, except: stored files remain in versioned storage for up to 90 days and in database backups for up to 7 days, after which they are overwritten. On request within 30 days of termination, jitprompt provides an export of Customer’s documents.

9. US state privacy laws

Where jitprompt is a “service provider” or “processor” under the CCPA or similar laws, it will not sell or share the personal data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with other data except as those laws permit.

10. Precedence

If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex II — Technical and organizational measures

  • Encryption: TLS for all traffic; AES-256 encryption at rest for the database, backups and file storage (AWS-managed keys).
  • Isolation: every record is scoped to its organization in the application; tests cover cross-organization access on every route.
  • Access control: production access only for the operator, through AWS IAM; the AWS account’s root user is protected with MFA; database in private subnets with no public endpoint.
  • Credentials: passwords hashed with scrypt; session tokens and API keys stored only as SHA-256 hashes; API keys scoped to one namespace and revocable; secrets in AWS Secrets Manager.
  • Abuse protection: rate limits per IP, account and API key; account lockout after repeated failed sign-ins.
  • Logging and monitoring: audit log of administrative changes; application logs and alarms in Amazon CloudWatch (30-day retention).
  • Resilience: automated database backups with point-in-time recovery (7 days); versioned file storage.
  • Data minimization: call logs deleted after 30 days; rate-limit records after 1 day; no Customer Content used to train models.