Data Processing Agreement
Last updated 2026-10-21
This agreement forms part of the Terms of Service between you (“Customer”, the controller) and Alexein (“Processor”) and applies where Customer Content includes personal data subject to data protection law, including the GDPR and UK GDPR.
1. Subject matter
- Nature and purpose: storing Customer Content, reading it into records, searching it, and returning it to Customer, as the Service is described in its documentation.
- Data subjects: Customer’s end users, and people named in what they say.
- Personal data: whatever Customer chooses to send: messages, documents, notes, and the facts memory derives from them.
- Duration: the term of the agreement, then until deletion under section 8.
2. Instructions
Processor processes personal data only on Customer’s documented instructions, which are these terms and Customer’s use of the API and console, unless the law requires otherwise; in that case Processor tells Customer first, where the law allows.
3. Confidentiality
Everyone Processor authorises to process personal data is bound by a duty of confidentiality.
4. Security
Processor maintains appropriate technical and organisational measures, including:
- each end user’s memory held in a separate database, with the tenant on every key inside it;
- the account of every request derived from its key and header, never from its body;
- API keys stored as SHA-256 digests;
- encryption in transit (TLS) for every request;
- request logs limited to metadata and kept for 7 days.
The current measures are described on the security page.
5. Subprocessors
Customer authorises the subprocessors below. Processor will give 30 days’ notice of a new one, during which Customer may object; if the objection cannot be resolved, Customer may end the affected Service. Processor remains liable for its subprocessors.
| Subprocessor | Purpose | Location |
|---|---|---|
| OpenRouter | Routes model calls that read items and filter searches | United States |
| Model providers via OpenRouter | Run those model calls | Varies by provider |
| [Hosting provider] | Stores and serves memory | [Region] |
6. Data subject requests
The Service lets Customer find, correct, export and erase an end user’s data itself. Where Customer needs more, Processor will help, taking into account the nature of the processing.
7. Personal data breaches
Processor will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer’s data, with what is known and what is being done, and will update Customer as more is learned.
8. Deletion and return
Erasure through the API removes every copy of the named data and returns a receipt. When the agreement ends, Processor deletes remaining Customer Content within 30 days, unless the law requires it to be kept.
9. Audits
Processor will make available the information needed to show compliance with this agreement and allow for reasonable audits, on 30 days’ notice, no more than once a year unless a breach or a regulator requires it.
10. Transfers
Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, the parties rely on the standard contractual clauses, which are incorporated by reference.