Data processing addendum
Draft — not yet reviewed by a lawyer.
This addendum ("DPA") forms part of the terms of service between Plexus Labs ([address]) and the customer, and applies when Plexus Labs processes personal data on the customer's behalf in providing simmail.
1. Roles
For universe data (mail, attachments, app logins, personas, settings and activity that the customer or its apps put into simmail), the customer is the controller and Plexus Labs is the processor. For account and billing data, Plexus Labs is a controller, as described in the privacy policy.
2. Processing
- Subject matter and purpose: running simulated email universes for testing software.
- Duration: while the customer uses the service, and until the data is deleted under section 7.
- Data subjects: whoever the customer chooses to include in test data. simmail is designed for fictional or consenting people.
- Types of data: email addresses, names and message content that the customer puts in universes.
3. Instructions
Plexus Labs processes universe data only on the customer's documented instructions, which are these terms and the customer's use and configuration of the service, unless the law requires otherwise. We will tell the customer if we believe an instruction breaks data protection law.
4. Confidentiality and security
People who process universe data are bound by confidentiality. We maintain technical and organizational measures appropriate to the risk, including those described on our security page: isolation between universes, hashed credentials, short-lived signed sign-in passes, and no outbound mail delivery.
5. Subprocessors
The customer authorizes the subprocessors below. We will give notice of a new subprocessor before it processes universe data, and the customer may object on reasonable data protection grounds. We bind subprocessors to data protection terms no less protective than this DPA.
| Subprocessor | Purpose | Data |
|---|---|---|
| Google (Gemini API) | AI that writes simulated people's replies, personas and inbound mail; link reputation checks (Web Risk) | Parts of mail content and persona details when AI is on; URLs in mail |
| Polar | Merchant of record: payments, invoices, tax | Account and billing data only |
| Cloudflare | Hosting the website and docs; relaying link fetches by simulated people | Website requests; URLs fetched |
| [Hosting provider, to be named] | Servers and databases for the hosted service | Account data and universe data |
6. Assistance
Taking into account the nature of the processing, we will help the customer respond to data subject requests and with security, breach notification and data protection impact assessments. Most requests can be handled directly in the service: mail can be read over IMAP or the API and deleted by deleting the universe.
7. Breaches
We will notify the customer without undue delay after becoming aware of a personal data breach affecting universe data, with the information we have, and keep them updated.
8. Deletion
Universe data is deleted automatically under the retention the customer's plan and settings allow. When the customer deletes a universe or organization, or when the agreement ends, we delete the related universe data, except where the law requires us to keep it.
9. Audits
On reasonable request, we will provide information needed to show compliance with this DPA. We do not currently hold third-party security certifications.
10. International transfers
Universe data may be processed in the United States and other countries where our subprocessors operate. Where the law requires it, the parties agree to the appropriate transfer mechanism, such as the EU Standard Contractual Clauses, which will be attached to the final version of this DPA.
Contact
To request a signed copy or ask questions: [email protected].