We store your basic account details, organization membership, content you create, and limited security logs. Your information is visible according to the service’s sharing settings, and authorized OpenTeams staff may access it to operate and support the service. To ask a question or request deletion, contact OpenTeams at [email protected].
1.1
Parties and incorporation. This Data Processing Addendum (“DPA”) is entered into between OpenTeams, Inc. (“OpenTeams”) and the organization that provisions a Hubspace under the Terms of Service (“ToS”) or another written agreement with OpenTeams (“Customer”). It forms part of that agreement (the “Agreement”).
1.2
Roles. For Customer Personal Data, Customer is the controller (or a processor acting for its own controllers) and OpenTeams is a processor (or subprocessor). Annex I describes the processing.
1.3
Where OpenTeams is an independent controller. OpenTeams processes some personal data for its own purposes, as described in its Privacy Policy and limited to: account authentication and security; detecting and preventing abuse and fraud; billing; product usage analytics as described in Privacy Policy §3.3; and compliance with law. That processing is outside this DPA. OpenTeams will not use Customer Personal Data for any other purpose of its
1.4
What this DPA does not cover. Data that stays on a user’s device is not processed by OpenTeams. This includes conversation history, Workspace files, installed Skills, provisioned environments, and local logs. It also excludes data a user sends to an Inference Source that the user or Customer configures with its own credentials (§5.3).
Capitalized terms not defined here have the meaning given in the Agreement.
means personal data that OpenTeams processes on Customer’s behalf in providing the Services to Customer’s Hubspace.
means using data to create, train, fine-tune, or otherwise improve a machine learning or artificial intelligence model, other than transient processing to generate an Output for the user who submitted the Input.
Customer instructions and responsibilities
3.1
Instructions. OpenTeams will process Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and the configuration Customer and its users choose in the Services are those instructions. Configuration includes enabled Connectors, available Inference Sources, group permissions, and sharing settings. Further instructions must be in writing and consistent with the Agreement.
3.2
Customer responsibilities. Customer is responsible for:
01
giving any required notices, for the personal data its users bring into the Services, including through Connectors;
02
deciding which Connectors and Inference Sources its users may enable, and for the terms of any Inference Source configured with Customer’s or a user’s own credentials;
03
any impact assessment, risk assessment, or human-review process that Data Protection Laws or AI laws require of Customer as controller or deployer, including where Cogs support decisions about individuals (Acceptable Use Policy §A.2); and
04
configuring Cogs, Execution Modes, and approval settings appropriately for the data involved (ToS §§7–8).
OpenTeams processing obligations and personnel
4.1
Purpose limitation. OpenTeams will process Customer Personal Data only to provide, secure, and support the Services for Customer, and as required by law.
4.2
4.3
Least-privilege access. Personnel access to Customer Personal Data is limited to those who need it to operate, secure, or support the Services. Access is logged and reviewed quarterly.
5.1
No Training. OpenTeams will not use Customer Personal Data, Inputs, Outputs, Frames, or Connector Content for Training. It will not permit its Subprocessors to do so. This applies whether or not individual users have opted in under the Privacy Policy, unless Customer gives separate written consent.
5.2
Hosted Inference Providers. Where a user selects an Inference Source OpenTeams hosts, OpenTeams will engage the Hosted Inference Provider as a Subprocessor under §6. OpenTeams will contractually require, and configure, that the provider:
01
does not retain Inputs or Outputs beyond what is needed to return the response;
02
03
5.3
Inference Sources configured by Customer or users. An Inference Source configured with Customer’s or a user’s own credentials is engaged by Customer or that user, not by OpenTeams, and is not a Subprocessor. OpenTeams transmits Inputs to it only on that instruction.
5.4
Connector Content. OpenTeams retrieves Connector Content only in response to a request originating from a user’s session. It returns the content to the user’s device without storing it, and uses it only to provide the feature the user invoked. Connector credentials are held in the Hub and never delivered to the desktop application, a Cog, or a Sandbox. Where a Third-Party Service’s developer policy imposes stricter limits (including Google’s Limited Use requirements), OpenTeams will comply with them.
5.5
Human review. OpenTeams personnel will not review Inputs, Outputs, or Connector Content except: (a) at Customer’s or the user’s request, such as for support; (b) where necessary to investigate a Security Incident or abuse; or (c) where required by law.
5.6
Model and provider changes. OpenTeams will give Customer at least [30] days’ notice before a new Hosted Inference Provider processes Customer Personal Data (§6). Where practicable, it will also give notice in the Services before retiring or substituting a hosted model.
6.1
General authorization. Customer authorizes OpenTeams to engage the Subprocessors listed in Annex III and at [SUBPROCESSOR URL].
6.2
Subprocessor obligations. OpenTeams will enter into a written contract with each Subprocessor imposing data protection obligations that are in substance the same as those in this DPA, to the extent applicable to the services the Subprocessor provides. For Hosted Inference Providers, those obligations include the commitments in §5.1 and §5.2. OpenTeams remains fully liable to Customer for each Subprocessor’s performance of its data protection obligations, subject to §13.1.
6.3
Notice of changes. OpenTeams will notify Customer at least [30] days before a new Subprocessor processes Customer Personal Data. Notice will be given by email. In an emergency affecting the security or availability of the Services, OpenTeams may give shorter notice and will explain why.
6.4
Objection. Customer may object on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If OpenTeams cannot offer a reasonable alternative, Customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term.
Security
7.1
Measures. OpenTeams will implement and maintain the technical and organizational measures in Annex II. Those measures will be appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing.
7.2
Updates. OpenTeams may update Annex II, but will not materially reduce the overall level of protection during the term.
7.3
Shared responsibility. Some protections depend on Customer and its users. These include device security, the container runtime used for Sandboxes, the choice of Execution Mode, and approval settings for Cogs. OpenTeams is not responsible for security controls that are configured by, or operate on systems controlled by, Customer or its users (ToS §§8.3–8.4).
Personal data breaches and AI incidents
8.1
Notice. OpenTeams will notify Customer without undue delay, and in any event within [48] hours, after becoming aware of a Security Incident. It need not complete its investigation before giving notice, and may provide information in phases under §8.2.
8.2
Content of notice. The notice will describe, to the extent known:
8.3
Response. OpenTeams will take reasonable steps to contain, investigate, and remediate the incident. It will cooperate with Customer’s own investigation and with any notifications Customer must make. OpenTeams will not notify Customer’s data subjects or regulators about a Security Incident affecting Customer Personal Data without Customer’s approval, unless the law requires it.
8.4
No admission. Notice under this section is not an acknowledgment of fault or liability
8.5
Incidents outside OpenTeams’ control. An event on a user’s device, in a Sandbox, or at an Inference Source configured by Customer or a user is not a Security Incident under this DPA. If OpenTeams becomes aware of one that affects Customer Personal Data, it will tell Customer promptly.
Assistance
9.1
Data subject requests. OpenTeams will provide Customer with in-product tools, or reasonable assistance where tools are insufficient, to respond to requests from data subjects to exercise their rights. If OpenTeams receives a request directly from Customer’s user, it will refer the request to Customer and will not respond on the merits unless Customer authorizes it.
9.2
Local data. Customer acknowledges that OpenTeams cannot access, export, correct, or delete data stored only on users’ devices (§1.4). Requests concerning that data must be fulfilled on the device.
9.3
Impact assessments. OpenTeams will provide reasonable information and assistance for AI impact or risk assessments required by law.
9.4
Cost. Assistance beyond the in-product tools and standard documentation is chargeable at OpenTeams’ then-current rates, except where the request results from OpenTeams’ breach of this DPA.
10.1
Information. On written request, OpenTeams will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes completed security questionnaires and the documentation referred to in §5.7..
10.2
Audits. If the materials above are insufficient, or a Customer may audit OpenTeams’ compliance with this DPA. The audit may be conducted by Customer or by an independent auditor bound by confidentiality and not a competitor of OpenTeams. Audits must be:
on at least 30 days’ notice, except after a Security Incident or at a regulator’s direction;
no more than once in any 12 months; and
during business hours, without unreasonable disruption, and limited to systems that process Customer Personal Data.
10.3
11.1
Location. OpenTeams processes Customer Personal Data in the United States. It will not transfer Customer Personal Data to another country except under this section.
12.1
During the term. Customer and its Hubspace Administrators can export and delete Frames and other Hub-stored content using the Services at any time.
12.2
On termination. For [30] days after the Agreement ends, Customer may export its Hub-stored Customer Personal Data. After that period, OpenTeams will delete it from active systems within [30] days, unless law requires retention. OpenTeams will confirm deletion in writing on request.
12.3
Backups. Customer Personal Data in backups will be deleted on the normal backup cycle, currently 30 days for identity-database backups. Until then it remains protected under this DPA and is not used for any other purpose.
12.4
Connector credentials. On termination, OpenTeams will revoke and delete the Connector credentials it holds for the Hubspace.
12.5
Local data.Termination does not remove data stored on users’ devices. Customer is responsible for removing it, for example through its device-management tools (ToS §14.3).
Liability, term, and general
13.1
13.2
Term. This DPA remains in effect for as long as OpenTeams processes Customer Personal Data, including during the export and deletion periods in §12.
13.3
Changes in law. If a change in Data Protection Laws requires changes to this DPA, the parties will negotiate in good faith. OpenTeams may update this DPA to comply with new law, provided the update does not materially reduce the protection given to Customer Personal Data.
13.3
Governing law. This DPA is governed by the law that governs the Agreement.
13.4
Effective date. This DPA takes effect on [DATE] or, if later, the date Customer accepts it.
Annex I
Item
Description
Data subjects
Customer’s authorized users; individuals whose personal data appears in content users create, share, or retrieve through Connectors (for example, correspondents in email, people named in documents, calendar attendees).
Account data (name, email, credentials, group and Hubspace membership); Frames, version history, and permissions; Inputs and Outputs transmitted for hosted inference; Connector Content in transit; Connector credentials; Hub request logs.
Hosting, storage, transmission, retrieval at user request, routing to Inference Sources, generation of Outputs, access control, and deletion.
Purpose
Providing, securing, and supporting the Services for Customer under the Agreement.
Retention
Hub-stored data: for the term, then per §12. Connector Content: not stored by OpenTeams. Hosted inference Inputs and Outputs: not retained by Hosted Inference Providers. Hub request logs: [PERIOD]. Identity backups: 30 days.
Annex II
Item
Description
Status
Credential isolation
Connector credentials held only in the Hub; never delivered to the desktop application, Cogs, Skills, or Sandboxes
Verified
Verified
Verified
Verified
No third-party trackers
Verified
Hosted Inference Providers configured for zero data retention and no Training
Identity database backups held separately under their own access controls, 30-day retention; [RECOVERY OBJECTIVES]
To confirm
To confirm
[ISO/IEC 27001 / ISO/IEC 42001 MANAGEMENT SYSTEM, OR NAMED SECURITY AND AI GOVERNANCE OWNER]
To confirm
Annex III
[CLOUD PROVIDER]
[UNITED STATES]
Correspondence; diagnostics bundles users send
Not Subprocessors: Third-Party Services a user connects (Google, Slack, GitHub), and Inference Sources configured with Customer’s or a user’s own credentials. Customer or its users engage these directly (§5.3).
Annex IV
US state privacy laws. Where the CCPA/CPRA or a comparable US state law applies, OpenTeams acts as a “service provider” or “processor” and will not:
sell or share Customer Personal Data, as those terms are defined in the CCPA;
use it for Training (§5.1).
OpenTeams will comply with applicable obligations and provide the same level of privacy protection the law requires. It will notify Customer if it can no longer meet them. Customer may take reasonable steps to stop and remediate unauthorized use. OpenTeams certifies that it understands these restrictions
Switzerland. References to the GDPR include the FADP where it applies, and §11.4 governs transfers.
