Data Processing Addendum

This Data Processing Addendum (DPA) governs how Dorus processes personal data on your behalf when you use our platform. It forms part of our Terms of Service.

This DPA applies to all Dorus.AI customers who process personal data of EU/EEA data subjects, UK data subjects, or are otherwise subject to GDPR, UK GDPR, or equivalent data protection regulation.

You (the customer) are the Data Controller — you determine the purposes and means of processing personal data of your customers, employees, and contacts.

Dorus is the Data Processor — we process that personal data only on your behalf and in accordance with your documented instructions (as provided through your use of the platform).

In some cases, we may also act as an independent Data Controller for data we collect about you as a customer (such as billing information). This is covered separately in our Privacy Policy.

We process personal data only on your documented instructions, which are established through your configuration and use of the Dorus.AI platform.

If we are required by law to process data for purposes other than your instructions, we will notify you (unless prohibited from doing so by law).

We will not process your data for our own commercial purposes beyond what is necessary to provide the service.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: encryption of data at rest and in transit, access controls and authentication, regular security assessments, and incident response procedures.

We will notify you without undue delay — and no later than 72 hours — after becoming aware of a personal data breach that affects your data.

We use sub-processors to help deliver the service — including cloud infrastructure providers (AWS), AI model providers (OpenAI/Anthropic), and payment processors (Stripe). Each is bound by data processing agreements consistent with this DPA.

We will notify you of any intended changes to sub-processors at least 14 days in advance, giving you the opportunity to object.

A current list of sub-processors is available upon request at privacy@dorus.ai.

Dorus.AI operates primarily in the United States. If you are based in the EU/EEA or UK, data transfers to the US are governed by Standard Contractual Clauses (SCCs) as adopted by the European Commission.

By using Dorus.AI, you authorize the transfer of personal data to the US on this basis.

You remain responsible for responding to data subject rights requests (access, rectification, erasure, portability) from your customers and contacts.

We will assist you in fulfilling those obligations by providing the data access and deletion tools available in your Dorus.AI dashboard, or by responding to requests submitted to privacy@dorus.ai within 5 business days.

We retain personal data for the duration of your subscription and for a maximum of 90 days after cancellation, unless a longer period is required by law.

You may request earlier deletion at any time by contacting privacy@dorus.ai. Upon receiving a valid deletion request, we will erase your data within 30 days.

You have the right to audit our data processing activities to verify compliance with this DPA. You may request audit documentation or, with 30 days' notice, arrange an independent audit at your expense.

We will provide all information reasonably necessary to demonstrate compliance with this DPA.