Data Processing Addendum (Beta)
Version dpa-v2. Last updated 30 October 2026.
This Data Processing Addendum (“DPA”) is the operative addendum between the customer (“Customer”) and TraceAnalysis-AI (“Processor” / “we”) for personal data processed when Customer uses TraceAnalysis. It applies together with the Privacy Notice and Terms of Use. Contact: [email protected].
1. Roles
- When Customer is a business using TraceAnalysis to analyze device diagnostics for its users, TraceAnalysis-AI acts as a processor of that Customer Personal Data.
- TraceAnalysis-AI is a controller of account credentials (including TOTP secrets), operator logs, PII-incident / miss records used to operate privacy controls, and its own admin telemetry.
- This beta instance is offered only in the United States. It is not designed as an EEA/UK transfer product.
2. Subject matter and duration
Processing of masked diagnostic findings, report text, chat, and related session metadata for the beta retention period (default 30 days for sessions) or until deletion / beta end, whichever is sooner. Account records last until deletion or beta end.
3. Nature and purpose
Operate diagnose, retrieval, model inference, report storage, chat, compare (opt-in), export, and security controls as described in the Privacy Notice.
4. Types of personal data
May include identifiers that survive imperfect masking (names or usernames in free text, residual emails/IPs/GUIDs, device or org labels, app IDs when not fully stand-in-renamed, and similar troubleshooting context). Customer should not submit special-category data or data subject to HIPAA without a separate written agreement (this beta is not a BAA).
5. Data subjects
Customer's workforce or device users whose diagnostics are analyzed; Customer's invited operators/admins on the instance.
6. Processor obligations
We will:
- Process Customer Personal Data only on documented instructions (these Terms, this DPA, and product configuration Customer controls).
- Require confidentiality from persons authorized to process the data.
- Implement technical and organizational measures appropriate to the beta (HTTPS, session cookies, TOTP MFA, CSRF origin checks, rate limits, client + server masking, optional OpenMed second pass, retention jobs).
- Not engage a sub-processor except as listed on /subprocessors or with prior notice and an opportunity to object for material additions.
- Assist Customer with data-subject requests, DPIAs, and breach notices to the extent reasonably possible given the beta's design (masked findings; ZIP never uploaded).
- Delete or return Customer Personal Data at the end of the service, subject to backup windows and legal holds described in the Privacy Notice (host backups, when configured, retain encrypted Postgres/Qdrant dumps for 7 days on operator-owned storage). Customer may export reports as JSON or Markdown from the product.
- Make available information reasonably necessary to demonstrate compliance with this DPA (beta-appropriate; not a full enterprise audit right unless separately agreed).
7. Sub-processors and OpenAI
Current sub-processors are listed at /subprocessors. OpenAI processes masked findings / chat prompts via API in the United States. Application requests set `store=false`; OpenAI's API default is that API data is not used for training unless the customer opts in (this beta does not opt in). OpenAI may retain inputs/outputs up to 30 days for abuse monitoring.
OpenAI Data Processing Addendum status for this operator account: pending confirmation that the OpenAI DPA (and any required schedules) are accepted/attached. Until confirmed, treat OpenAI processing as described in OpenAI's publicly documented API data-usage terms and update this section when the account paperwork is complete.
Operator-hosted models (local chat/embed fallbacks and the OpenMed privacy-filter second pass) are operated by TraceAnalysis-AI and are not separate sub-processors.
8. International transfers
This beta is offered only in the United States. Customer Personal Data is processed in the United States (application host and OpenAI API). We do not market this instance for EEA/UK/Switzerland users and do not rely on SCCs or the EU-US Data Privacy Framework for those regions on this page. If Customer later needs EU/UK processing, that requires a separate written arrangement and updated notices.
9. Security incidents
We will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, with information reasonably available at the time.
10. Liability and order of precedence
Liability caps and disclaimers in the Terms apply to this DPA unless mandatory law says otherwise. If this DPA conflicts with the Privacy Notice on processor topics for Customer Personal Data, this DPA controls. If it conflicts with the Terms on the same topic, this DPA controls for processing of Customer Personal Data.
11. Governing law
This DPA is governed by the laws of the State of Nevada, United States, without regard to conflict-of-law rules. Exclusive venue for disputes arising under this DPA is the state or federal courts located in Nevada, except where mandatory law requires otherwise.