Effective Date: [17.08.2026] Version: 1.0
1. Parties, Scope and Structure
1.1 This Data Processing Agreement ("DPA") is entered into between:
- Craft Innovations R&D Inc, 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5 ("Processor," "Company," "we"); and
- the customer entity identified in the Agreement or applicable order form ("Controller," "Customer," "you").
1.2 This DPA forms an integral part of the AICI Terms of Use (the "Agreement") and applies whenever the Company processes Personal Data on behalf of Customer in connection with the AICI platform (the "Services").
1.3 Order of precedence. In the event of conflict, the following order applies with respect to the processing of Personal Data: (a) the Standard Contractual Clauses (where applicable); (b) this DPA; (c) the Agreement; (d) any other documentation.
1.4 Acceptance. This DPA is accepted by Customer's acceptance of the Agreement. A countersigned copy is available on request at privacy@aici.com.ua
1.5 Terms not defined here have the meaning given in the Agreement or in the GDPR.
2. Definitions
"Applicable Data Protection Law" means, as applicable: Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"); the Law of Ukraine "On Personal Data Protection"; and any other data protection or privacy law applicable to the processing.
"Controller," "Processor," "Data Subject," "Personal Data," "Personal Data Breach," "Processing," "Special Categories of Personal Data," "Supervisory Authority" have the meanings given in the GDPR.
"Customer Personal Data" means Personal Data contained in Customer Content and processed by the Company on Customer's behalf under the Agreement.
"Research Participant" means a natural person whose voice, image, statements or behaviour are captured in Customer Content.
"SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.
"Sub-processor" means any processor engaged by the Company to process Customer Personal Data.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
3. Roles of the Parties
3.1 With respect to Customer Personal Data, Customer acts as Controller (or, where Customer processes on behalf of its own client, as Processor and the Company as sub-processor) and the Company acts as Processor.
3.2 Customer determines the purposes and means of the processing, including which research materials are uploaded, which Research Participants are recorded, which analyses are run and how Outputs are used. The Company does not determine those purposes.
3.3 With respect to account registration data, billing data, support communications and Platform telemetry, the Company acts as an independent Controller, as described in its Privacy Policy at [URL].
3.4 Where Customer acts as a processor for its own client, Customer warrants that it has that client's authorisation to engage the Company as a sub-processor and that its instructions to the Company are consistent with its own client's instructions.
4. Details of Processing
The subject matter, duration, nature and purpose of the processing, the categories of Data Subjects and of Personal Data, are set out in Annex A.
5. Customer's Obligations and Warranties
5.1 Lawfulness. Customer warrants that:
(a) it has established and documented a valid legal basis under Art. 6 GDPR (and, where applicable, Art. 9 GDPR) for all processing it instructs;
(b) it has provided all information required under Arts. 13–14 GDPR to Research Participants, including the fact of recording, the purposes of processing, the use of automated and AI-based processing, the categories of recipients (including the Sub-processors in Annex C), and the retention period;
(c) where consent is the legal basis, that consent is freely given, specific, informed, unambiguous, documented and revocable, and that Customer maintains records of it;
(d) it has complied with all laws governing the recording of conversations, including any all-party (two-party) consent requirement applicable in the Research Participant's jurisdiction;
(e) its instructions to the Company do not cause the Company to breach Applicable Data Protection Law.
5.2 Special Categories. The Services are not designed for the processing of Special Categories of Personal Data. Customer shall not upload Customer Content containing Special Categories of Personal Data unless it has a valid basis under Art. 9(2) GDPR and has notified the Company in advance at privacy@aici.com.ua. Customer acknowledges that free-form interview material may incidentally contain such data and undertakes to minimise this, including by instructing Research Participants not to disclose unnecessary sensitive information and by using the Platform's redaction functionality where available.
5.3 Prohibited data. Customer shall not upload Personal Data of children, payment card data, government identification numbers, or Personal Data collected covertly.
5.4 Data minimisation. Customer is responsible for uploading only Personal Data that is adequate, relevant and limited to what is necessary for its research purposes, and for configuring retention within the Platform accordingly.
6. Company's Obligations
The Company shall:
6.1 Documented instructions. Process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required by Union, Member State, Canadian or other applicable law to which the Company is subject; in that case, the Company shall inform Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. The Agreement, this DPA and Customer's use of the Platform's functionality constitute Customer's complete documented instructions.
6.2 Unlawful instructions. Immediately inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. The Company may suspend performance of the affected instruction pending clarification.
6.3 Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations of a contractual or statutory nature, are trained in data protection, and access Customer Personal Data only on a need-to-know basis under least-privilege access controls.
6.4 Security. Implement and maintain the technical and organisational measures set out in Annex B, in accordance with Art. 32 GDPR.
6.5 Sub-processors. Comply with Section 7.
6.6 Data subject rights. Comply with Section 8.
6.7 Assistance. Comply with Sections 9 and 10.
6.8 Deletion and return. Comply with Section 12.
6.9 Audits and information. Make available all information necessary to demonstrate compliance with Art. 28 GDPR and allow for audits in accordance with Section 13.
6.10 No independent use. Not sell Customer Personal Data, not use it for advertising or profiling, and not use it for its own purposes, save for the limited generation of aggregated de-identified telemetry described in Section 11.3.
7. Sub-processors
7.1 General authorisation. Customer grants the Company general written authorisation to engage Sub-processors, subject to this Section.
7.2 Current Sub-processors. The Sub-processors engaged at the Effective Date are listed in Annex C and maintained at URL: aici.com.ua/subprocessors
7.3 Notice of changes. The Company will notify Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, by e-mail to the address registered by Customer and by updating the page in Section 7.2. Customer may subscribe to change notifications at that page.
7.4 Objection. Customer may object on reasonable, documented data-protection grounds within fourteen (14) days of notice. The parties will discuss in good faith. If no resolution is reached, Customer may terminate the affected Services on written notice, with a pro-rata refund of prepaid fees for the unused period. This is Customer's sole remedy.
7.5 Flow-down. The Company shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for the performance of each Sub-processor's obligations.
8. Data Subject Rights
8.1 Taking into account the nature of the processing, the Company shall assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests to exercise Data Subject rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making).
8.2 The Platform provides Customer with self-service functionality to search, export, correct, redact and delete Customer Content, which will in most cases be sufficient to respond to such requests without the Company's involvement.
8.3 If a Data Subject contacts the Company directly regarding Customer Personal Data, the Company will not respond substantively, and will promptly forward the request to Customer, unless legally required to respond.
8.4 Where Customer requires additional assistance that cannot reasonably be provided through Platform functionality, the Company will provide it, and may charge its reasonable costs for assistance that is disproportionate or repetitive.
9. Personal Data Breach
9.1 The Company shall notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
9.2 The notification shall include, to the extent known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and the contact point for further information. Where information is not available at once, it will be provided in phases without undue further delay.
9.3 The Company shall take reasonable steps to contain, investigate and remediate the breach, and shall cooperate with Customer in Customer's fulfilment of its obligations under Arts. 33 and 34 GDPR.
9.4 Notification of a breach is not, and shall not be construed as, an acknowledgment of fault or liability.
9.5 Customer is responsible for notifying the competent Supervisory Authority and, where required, affected Data Subjects.
10. DPIA and Prior Consultation
The Company shall provide reasonable assistance to Customer with data protection impact assessments (Art. 35 GDPR) and prior consultations with Supervisory Authorities (Art. 36 GDPR), taking into account the nature of the processing and the information available to the Company. The Company maintains a standard information package for this purpose (covering the Services architecture, sub-processors, transfers, retention and security measures) available at [URL].
AI-specific note. Customer acknowledges that systematic large-scale processing of interview recordings, or processing involving sensitive research topics or vulnerable Research Participants, may require a DPIA under Art. 35(3) GDPR, and that this assessment is Customer's responsibility as Controller.
11. Artificial Intelligence and Model Training
11.1 No training. The Company shall not use Customer Personal Data to train, fine-tune, adapt, evaluate or otherwise develop any artificial intelligence or machine learning model, whether its own or a third party's.
11.2 Sub-processor commitments. The Company has contracted with each AI Sub-processor listed in Annex C on terms that provide for zero data retention and no use of Customer Content for model training or human review. Customer Content submitted to these Sub-processors is processed transiently to return an output and is not retained thereafter, save for any transient retention strictly necessary for abuse monitoring where the provider's terms so require and as noted in Annex C.
11.3 Telemetry. The Company may generate and use aggregated, de-identified statistics and technical metadata (for example, feature usage counts, file durations, error rates, processing latency) that do not constitute Personal Data and cannot be attributed to Customer, any Authorized User or any Research Participant. The Company shall not attempt to re-identify such data.
11.4 Opt-in. Any use of Customer Personal Data for model improvement beyond Section 11.3 requires Customer's separate, express, revocable written opt-in.
11.5 Sentiment analysis. The sentiment-analysis functionality operates on the textual content of transcripts only and does not process biometric data or infer emotions from voice, facial expression or other biometric characteristics. The Company does not operate an emotion recognition system or a biometric categorisation system within the meaning of Regulation (EU) 2024/1689. Customer's use of this functionality is subject to the restrictions in Section 6.8 of the Agreement.
11.6 No automated decision-making. The Company does not carry out automated decision-making producing legal or similarly significant effects concerning Data Subjects (Art. 22 GDPR). Where Customer uses Outputs in a manner that may produce such effects, Customer is solely responsible for compliance with Art. 22, including provision of human intervention and the right to contest.
12. Retention, Deletion and Return
12.1 The Company shall process Customer Personal Data for the duration of the Agreement and for the retrieval period described below.
12.2 Customer may delete Customer Content at any time through the Platform. Deleted content is removed from active production systems within 30 days and from encrypted backups within 90 days.
12.3 On expiry or termination of the Agreement, Customer has a 30-day retrieval window to export Customer Content. Thereafter the Company shall delete all Customer Personal Data in accordance with the periods in Section 12.2, except to the extent that storage is required by Union, Member State, Canadian or other applicable law, in which case the Company shall inform Customer and shall protect the retained data under the terms of this DPA for as long as it is retained.
12.4 The Company shall certify deletion in writing on Customer's request.
13. Audits
13.1 The Company shall make available to Customer all information reasonably necessary to demonstrate compliance with Art. 28 GDPR.
13.2 Where that information is insufficient, Customer may conduct an audit, subject to: (a) at least thirty (30) days' prior written notice; (b) no more than once per twelve (12) months, except following a Personal Data Breach or where required by a Supervisory Authority; (c) conduct during normal business hours, without unreasonable disruption; (d) execution of a confidentiality undertaking by Customer and any third-party auditor, who shall not be a competitor of the Company; (e) scope limited to systems and documentation relevant to Customer Personal Data; and (f) Customer bearing its own costs and the Company's reasonable costs where the audit exceeds [two] business days.
13.3 The Company shall not be required to disclose information that would compromise the security or confidentiality of other customers' data.
14. International Transfers
14.1 Processing locations. Customer Personal Data is hosted in Frankfurt and may be accessed for support and processed by Sub-processors in EU, Canada, the United States, AU, as detailed in Annex C.
14.2 Transfers to the Company (EEA → Canada). The European Commission has recognised Canada as providing an adequate level of protection for personal data transferred to recipients subject to PIPEDA (Commission Decision 2002/2/EC). The Company is subject to PIPEDA. Transfers of Customer Personal Data from the EEA to the Company are therefore made on the basis of that adequacy decision. Should that decision be repealed, suspended, amended or invalidated, the SCCs shall apply automatically in accordance with Section 14.4, without further action by the parties.
14.3 Onward transfers. Where a Sub-processor is located outside the EEA in a country without an adequacy decision, the Company shall ensure an appropriate transfer mechanism is in place, being the SCCs, the EU–US Data Privacy Framework (where the Sub-processor is certified), or another valid mechanism, together with any supplementary measures identified as necessary by a transfer impact assessment.
14.4 SCCs. Where the SCCs apply, they are incorporated into this DPA by reference and completed as set out in Annex D:
- Module Two (Controller to Processor) where Customer is a controller;
- Module Three (Processor to Processor) where Customer is a processor acting for its own client.
14.5 UK and Switzerland. For transfers subject to UK law, the UK Addendum applies, completed as set out in Annex D. For transfers subject to Swiss law, the SCCs apply with the modifications set out in Annex D.
14.6 Government access. The Company shall, to the extent legally permitted, notify Customer of any legally binding request from a public authority for disclosure of Customer Personal Data, challenge requests that appear unlawful or overbroad, and disclose only the minimum amount of data lawfully required. The Company maintains a record of such requests and reports on them at [URL / on request].
14.7 Ukraine. Where Customer or Research Participants are located in Ukraine, the parties shall comply with the Law of Ukraine "On Personal Data Protection." Customer is responsible for any notification or registration obligations applicable to it as owner of the personal data file.
15. Liability, Term and General
15.1 Liability. Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, save that nothing in the Agreement or this DPA limits any liability that cannot be limited under Applicable Data Protection Law, including liability towards Data Subjects under Art. 82 GDPR. Where the SCCs apply, nothing in this DPA limits the rights of Data Subjects as third-party beneficiaries under the SCCs.
15.2 Term. This DPA takes effect on the Effective Date and continues for as long as the Company processes Customer Personal Data. Sections 12, 13, 14 and 15 survive termination.
15.3 Changes. The Company may update this DPA where necessary to reflect changes in law, guidance from Supervisory Authorities, or changes to the Services, provided the update does not materially reduce the protections afforded to Customer Personal Data. Material changes will be notified at least [30] days in advance.
15.4 Governing law. This DPA is governed by the law stated in the Agreement, save that where the SCCs apply, the SCCs are governed by the law specified in Annex D.
15.5 Contact. Data protection enquiries: privacy@aici.com.ua.
ANNEX A — Details of Processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the AICI research platform: hosting, transcription, translation, search, analysis and structuring of qualitative research material. |
| Duration | The term of the Agreement, plus the retrieval and deletion periods in Section 12. |
| Nature of processing | Collection (via upload), storage, transcription, diarization, translation, indexing, text analysis and thematic coding, sentiment labelling, generation of derived documents, retrieval, export, erasure. |
| Purpose | Enabling Customer to conduct and document qualitative user research, usability testing and related analysis. |
| Categories of Data Subjects | Research Participants (interviewees, usability-test participants); Authorized Users of Customer; third parties incidentally mentioned by Research Participants. |
| Categories of Personal Data | Voice recordings and, where uploaded, video; transcripts of speech; names, pseudonyms and participant identifiers; contact details where included by Customer; professional role, employer, seniority; opinions, preferences, attitudes and behaviours expressed; any other Personal Data Customer chooses to include in uploaded material, notes or metadata; for Authorized Users: name, e-mail, role, IP address, access logs. |
| Special Categories | Not intended. May occur incidentally in free-form speech (e.g. references to health, religion, political opinion, sexual orientation, trade-union membership). Customer's obligations are set out in Section 5.2. |
| Frequency | Continuous, as determined by Customer's use of the Platform. |
| Transfers | As set out in Section 14 and Annex C. |
| Retention | As set out in Section 12 and as configured by Customer. |
ANNEX B — Technical and Organisational Measures (Art. 32 GDPR)
Statement of accuracy. The measures below describe the controls implemented by the Company as at 17 August 2026. Each is evidenced by code, configuration or documented procedure. Measures that are planned but not yet implemented are marked as such and are not represented as being in effect. This Annex is updated when controls change materially.
B.1 Encryption
- Data in transit: TLS 1.2 or higher for all connections to the Platform and to Sub-processors.
- Data at rest: AES-256 encryption of database contents, uploaded media and transcripts at the infrastructure layer.
- Application-layer encryption: OAuth tokens for third-party meeting integrations (Zoom, Google Meet) are additionally encrypted with AES-256-GCM at the application layer.
B.2 Access control
- Role-based access control within each Workspace, with distinct roles (owner, admin, researcher, viewer) maintained in a dedicated authorisation table.
- Tenant isolation enforced at the database layer through row-level security (RLS) policies.
- Least-privilege architecture: the privileged service role is available only to server-side edge functions; client applications operate under an anonymous role constrained by RLS.
- Multi-factor authentication (TOTP) is available to all users and is mandatory for administrative access, enforced at the administrative interface.
- Production access is restricted to the named individuals recorded in the Company's internal access register.
- Access reviews are conducted in accordance with the Company's documented access-review procedure.
B.3 Logging and monitoring
- Immutable security audit log recording: authentication events (login, logout), password changes, enabling and disabling of MFA, role changes, sharing events, project deletion, data subject export and erasure actions, and every access by administrative personnel to customer data.
- Audit log retention: 24 months, enforced by an automated daily purge job.
- Automated anomaly detection running hourly, alerting on indicators including access to a single account from four or more distinct IP addresses and five or more export operations within the monitored window.
B.4 Data minimisation
- Only the data necessary for the requested operation is transmitted to Sub-processors.
- Test and development environments contain no production Customer Content; automated end-to-end tests execute only against dedicated test domains.
- Not implemented: the Platform does not currently provide in-product redaction or automated anonymisation of Research Participant data. Customer remains responsible for minimisation at the point of upload.
B.5 Availability and resilience
- Encrypted backups with point-in-time recovery (PITR) covering a rolling 7-day window.
- A restoration procedure is documented. It has not yet been tested. Recovery targets of RTO ≤ 4 hours and RPO ≤ 1 hour are stated as objectives and are not warranted service levels.
B.6 Organisational and development security
- Documented incident response plan, including a breach notification procedure operating to the timeline in Section 9.1 of this DPA.
- Documented security assessment of each Sub-processor before onboarding, and 30 days' advance notice to Customers of any change to the Sub-processor list.
- Secure development lifecycle: mandatory peer code review; continuous integration enforcing linting, type checking, unit tests, end-to-end tests and build verification on every change; automated dependency vulnerability scanning (Dependabot and dependency audit); automated secret scanning (gitleaks) to prevent credential exposure in source control.
- Not implemented: independent third-party penetration testing.
B.7 Certifications The Company does not hold SOC 2, ISO 27001 or equivalent third-party security certification, and no such certification process is currently underway. The Company provides the controls documentation in this Annex, together with completed security questionnaires on request, in satisfaction of its obligations under Section 13.1.
ANNEX C — Sub-processors
As at 17 August 2026. The current list is maintained at [URL: aici.com.ua/subprocessors], with change notification as set out in Section 7.3.
C.1 Infrastructure
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Lovable AB (Sweden) — Lovable Cloud | Provision and administration of the hosting, database, storage, authentication and edge-function environment | EU (Frankfurt) | Intra-EEA — no transfer mechanism required | Not used for training |
| Supabase Inc. (United States) | Underlying database, storage, authentication and compute platform; parent-entity support and administrative access | Storage in EU (Frankfurt); support access may originate from the United States | SCCs 2021/914 (Module Three) within the Lovable/Supabase DPA chain | Not used for training; retention per AICI configuration |
C.2 AI processing
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Lovable AI Gateway | Routing layer through which all AI model calls are made | EU / US | SCCs (within the Lovable Cloud DPA) | Not used for training; gateway does not store request content |
| ElevenLabs Inc. (Scribe) | Automatic speech recognition and speaker diarization | EU | Storage and processing in the EEA. SCCs 2021/914 apply as a backstop to any support or administrative access originating from the provider's US establishment | Not used for training. ⚠️ Retention period pending written confirmation — see Annex E |
| Google LLC (Gemini family) | Summarization, translation, thematic coding, text-based sentiment labelling, generation of reports, personas and CJMs | United States | SCCs 2021/914 | Not used for training (Gemini API enterprise terms) |
| OpenAI LLC (fallback path) | Summarization, thematic coding, document generation | United States | SCCs 2021/914 + provider DPA | Not used for training. Retained up to 30 days for abuse monitoring under the provider's API terms |
C.3 Media processing
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Shotstack Pty Ltd | Rendering of video clips for the video showcase feature | Australia | SCCs 2021/914 | Not used for training |
C.4 Operations
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Stripe, Inc. | Payment and subscription processing | US / EU | SCCs + provider DPA | N/A — no Customer Content |
| Resend, Inc. | Transactional e-mail and system notifications | United States | SCCs + provider DPA | N/A — no Customer Content |
C.5 Customer-initiated integrations
The following are engaged only where an Authorized User connects the relevant account and are used solely to retrieve recordings on that user's instruction. Where Customer does not connect an integration, no data is transmitted.
| Sub-processor | Purpose | Location of processing | Transfer mechanism | Content used for training / retention |
|---|---|---|---|---|
| Zoom Communications, Inc. | Import of meeting recordings | United States | SCCs + provider DPA | N/A |
| Google LLC (Google Workspace / Meet API) | Import of meeting recordings | United States | SCCs 2021/914 | N/A |
C.6 Services not used
For the avoidance of doubt, as at the date of this Annex the Company does not use:
- any third-party customer-support platform — support is provided through an in-product page and by e-mail;
- any third-party product analytics or error-tracking service (such as Sentry, PostHog or Google Analytics) — application errors are written to an internal database table within the Company's own EU-hosted environment, with notifications sent by e-mail;
- any separate cloud host beyond the infrastructure listed in C.1;
- any advertising, tracking or data-enrichment service.
ANNEX D — Standard Contractual Clauses:
Completion
Module: Two (Controller → Processor) where Customer is a controller; Three (Processor → Processor) where Customer is a processor.
| Clause | Selection |
|---|---|
| Data exporter | Customer, as identified in the Agreement. Contact: the e-mail registered to Customer's account. |
| Data importer | Craft Innovations R&D Inc, 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5. Contact: privacy@aici.com.ua. |
| Clause 7 (docking) | Boes not apply |
| Clause 9 (sub-processors) | Option 2 — general written authorisation. Notice period: 30 days (Section 7.3). |
| Clause 11(a) (redress) | Optional independent dispute resolution language does not apply. |
| Clause 17 (governing law) | The law of Ontario, Canada. |
| Clause 18(b) (forum) | The courts of Ontario, Canada. |
| Annex I.A | Parties as above. |
| Annex I.B | As set out in Annex A of this DPA. |
| Annex I.C (supervisory authority) | The supervisory authority of the Member State of the data exporter's establishment or Art. 27 representative. |
| Annex II (security) | As set out in Annex B of this DPA. |
| Annex III (sub-processors) | As set out in Annex C of this DPA. |
UK Addendum: Tables 1–3 completed by reference to the above; Table 4 — the Importer may end the Addendum as set out in Section 19.
Switzerland: references to the GDPR are read as references to the FADP; "Member State" does not restrict Data Subjects in Switzerland from bringing proceedings in Switzerland; the competent authority is the Federal Data Protection and Information Commissioner.