Data processing agreement

Last updated: · Draft for counsel review

What the DPA is

When your team uses inrelay, the conversations in your workspace are your data — you are the controller, we are the processor. The data processing agreement is the contract that makes that binding: it sets out what we may do with that data, and nothing more. It incorporates into the terms of service for every customer.

What it covers

• Scope and instructions. We process workspace content only to provide the service — storing conversations, routing them to teammates, and sending them to AI providers for triage and drafting on your instruction.
• Confidentiality and security. The technical and organisational measures we maintain.
• Subprocessors. We use the vendors listed at /subprocessors, flow the same obligations down to them, and notify you before adding one.
• International transfers. Safeguards for data leaving the EEA/UK.
• Assistance. Helping you answer data-subject requests from your customers, and notifying you of personal-data breaches.
• Return and deletion. Export of your data on exit and deletion afterwards, on the timeline in the privacy policy.

AI providers under the DPA

Drafting sends conversation content to our AI model providers over their APIs; under those providers’ API terms your data is not used to train their models. They appear in the subprocessor list like any other vendor — no special carve-outs.

Requesting a signed copy

If your compliance process needs a countersigned DPA, request one at and we will return an executed copy. For the summary of your rights under GDPR, see /gdpr.