Data Processing Addendum

Roles

You are the data controller for the personal data in your workspace; Universal AI, Inc. is the data processor. We process that data only to provide the service and only on your documented instructions.

Scope of processing

We process the categories of data you choose to store — contacts, deals, tickets, invoices, documents, and related records — for the duration of your subscription, to deliver the platform and the AI actions you request.

Security measures

Workspace isolation, TLS 1.3 in transit, AES-256 server-side encryption on uploaded files, encrypted database volumes, RBAC, and a hash-chained audit log. See the security page for detail. Personal data is never used to train AI models.

Sub-processors

We engage vetted sub-processors for hosting, payments (Stripe), and email delivery, each bound by equivalent data-protection terms. We maintain a current list and provide notice of material changes.

International transfers

Data is currently hosted in a single region; selectable EU/US residency is on the roadmap and not available today. Where transfers occur, they rely on Standard Contractual Clauses or an equivalent lawful mechanism. Tell us your residency requirement before signing and we will confirm in writing whether we can meet it.

Data-subject requests & deletion

Submit access, export, or erasure requests to privacy@universalai.com; each is tracked in-app and processed within the 30-day statutory window. On termination, data is retained for 30 days, then deleted, unless law requires otherwise.

Request a signed DPA

Email privacy@universalai.com and we'll countersign our standard DPA.

This page is a plain-language summary, not the executed addendum.