Data Processing Agreement (DPA)

1. Purpose and applicability

This Data Processing Agreement ("DPA") applies where an enterprise customer ("Customer") subscribes to the Platform and the platform operator ("we") processes entrusted data as a processor. This DPA forms an integral part of the main service agreement (the SaaS Service Contract or online plan terms) and prevails over the main agreement in case of conflict.

2. Roles and processing scope

The Customer determines the purposes and means of processing; we process as processor. Categories of entrusted data: brand and product information, monitored question terms, content assets, knowledge-base documents, lead and form data and derived analytics. Categories of data subjects: Customer's staff (account users) and the Customer's end users (lead/form submitters). Purposes: only delivering the subscribed service (monitoring, generation, distribution, analytics). Duration: the service term. We use entrusted data for no purpose beyond the service.

3. Instructions and assistance

We process entrusted data only on the Customer's documented instructions (including in-platform configuration); if an instruction violates law we will inform the Customer and may refuse. We assist the Customer with its legal obligations, including: responding to data subject requests (export tools and technical support, response within 30 days), personal information protection impact assessments (PIA/DPIA) assistance, and cooperation with regulators.

4. Security measures (TOMs)

We apply measures no less protective than industry standards: TLS transport encryption and AES-256 encryption at rest; dual tenant and project isolation; role-based access control on least privilege; multi-factor authentication and anomalous-login detection; operation audit logs; backup and disaster recovery; employee confidentiality and security training; vulnerability management and incident response; and MLPS Level 3-benchmarked baseline self-assessment (a self-assessment, not a certification). A security statement detailing the measures is available on request.

5. Data breach notification

On a security incident involving entrusted data, we notify the Customer within 72 hours of confirmation (with an initial notification of known facts within 24 hours of internal discovery), covering: nature of the incident, categories and approximate scale of data involved, measures taken, and recommendations. We provide ongoing updates during handling and assist the Customer with its own notification duties to regulators and data subjects (where law requires the Customer to notify, we supply the necessary information).

6. Sub-processors

The Customer agrees that we engage sub-processors to deliver the service (AI engine/model providers, cloud infrastructure, SMS/email, payment, etc.; categories listed in the published Sub-processors page). We sign data protection terms with sub-processors and supervise their processing. We give 30 days' notice of sub-processor changes (subscription or in-app notice); a Customer with reasonable objections may raise them within the notice period and the parties will discuss; failing agreement, the Customer may terminate the affected part of the service with a pro-rata settlement.

7. Cross-border transfers

Data is stored in mainland China by default. Enabling overseas AI engines or overseas distribution involves transfers: (1) for transfers of personal information from China we adopt one of the PIPL Article 38 routes — standard contract (filed with the provincial CAC), security assessment, or protection certification; (2) for GDPR scenarios we use the EU Standard Contractual Clauses (SCC modules two/three) supported by a transfer impact assessment (TIA); (3) we disclose recipient categories and transfer scope, and the Customer can switch off overseas transfers in platform settings.

8. Customer audit rights

The Customer may audit our processing compliance: (1) routine audits — no more than once per year, on 30 days' written notice and under NDA, may include site visits and document review; (2) incident-triggered audits — immediately upon a security incident or reasonable suspicion of non-compliant processing; (3) audits may be performed by an independent third party (not our direct competitor), at the Customer's cost, unless our material non-compliance is found, in which case we bear it. We may also provide recent audit reports or security assessments in place of part of an on-site audit.

9. Data return and deletion

Within 30 days after service termination the Customer may export all entrusted data at any time (Export Center, CSV/Excel with full methodology notes); after the export window we delete entrusted data within 30 days (residual copies in backups are purged within the backup rotation cycle, typically no more than 90 days), and issue a written deletion certificate on request. Records required by law (e.g. logs, financial vouchers), and monitoring raw records kept for verifiability (sampling records and evidence snapshots; the industry group standard recommends keeping them for at least 3 years after project closure), are excepted; such data is processed only for those retention purposes.

10. Liability

We are liable under law for entrusted-data breaches, destruction or non-compliant processing caused by us, within the liability cap of the main agreement (which does not apply to our wilful misconduct or gross negligence). Liability arising from unlawful Customer instructions or the Customer's own conduct rests with the Customer.

11. Term and survival

This DPA takes effect with the main agreement and continues until all entrusted processing ends. Termination of the main agreement does not terminate DPA provisions that by nature survive (data return and deletion, confidentiality, audit rights, liability).