1. Scope and instructions
This Data Processing Addendum (DPA) forms part of the Databrush Terms between DATABRUSH LLC and the Customer identified by its accepted account or order. It applies to personal information in connected records, credentials, prompts, results, and workspace content that Databrush processes on the Customer’s behalf (Customer Personal Data). The Customer acts as controller or, where authorized by its controller, processor; Databrush acts as processor, subprocessor, or service provider as applicable. Personal use does not by itself make a Customer a regulated business. Our independently determined account, payment, security, and business-administration processing is described in the Privacy Policy.
Databrush will process Customer Personal Data only on documented instructions to provide the Service: the Terms and this DPA, authorized source permissions and configuration, user requests, and documented support instructions. The processing includes receiving and inspecting source metadata and bounded source records; generating and executing read-only analytical queries; transmitting relevant context and results to authorized AI and infrastructure providers; and storing, retrieving, displaying, correcting, returning, and deleting the resulting work. It continues for the Service term and the permitted return, deletion, and retention period below.
Data subjects may include the Customer’s personnel, users, customers, prospects, vendors, and other individuals in its authorized business records. Data types may include ordinary contact and profile details, identifiers, purchases and subscriptions, product activity, schema and query content, and the related prompts, results, and technical records. Frequency depends on authorized setup, requests, refreshes, and operation. The restricted-data rules in the Terms apply; this DPA does not authorize HIPAA records, children’s records, or other restricted information.
The Customer is responsible for lawful instructions, necessary notices and permissions, and restricting source access to appropriate data. Databrush will inform the Customer if it considers an instruction unlawful and may suspend that instruction while it is resolved. Processing required by law is permitted only to the extent the law allows; Databrush will inform the Customer before it occurs unless legally prohibited. Both parties will comply with the data-protection laws applicable to their respective processing.
2. Purpose and use limits
Databrush will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it for targeted advertising, or use it to train general-purpose AI models. Databrush will not opt Customer Personal Data into its providers’ model training.
Databrush will not retain, use, or disclose Customer Personal Data outside the direct business relationship or for purposes other than the specific Service functions described in Section 1, except as applicable law permits. It will not combine that data with personal information from other customers or its independent interactions except as permitted by applicable law for those functions. These restrictions also apply to providers acting on Databrush’s instructions.
Where California’s CCPA applies to this service-provider processing, Databrush will provide the same level of privacy protection required of a business under that law. Databrush certifies that it understands and will comply with the applicable restrictions in this DPA, will notify the Customer if it can no longer meet its obligations, and will permit reasonable and appropriate steps to verify, stop, and remediate unauthorized processing.
3. Security and confidentiality
Databrush will maintain safeguards appropriate to the information and risks: authenticated access and workspace authorization; restricted privileged access and confidentiality duties; encrypted transport and controlled credential storage; bounded read-only source queries; private application storage; filtered operational logging; secure development and vulnerability response; and incident, recovery, and privacy-request procedures. Databrush will periodically assess these measures and will not materially reduce their overall protection during the agreement.
People authorized to process Customer Personal Data must be bound by confidentiality duties and have access only as necessary for their role. No independent security certification, zero provider retention, or exclusive US data residency is represented by this DPA. The Customer remains responsible for its own source environment and authorized users.
5. Requests and incidents
Databrush will provide reasonable assistance, taking account of the processing and information available, with access, correction, deletion, portability, and other individual rights, and with legally required security assessments, impact assessments, and regulatory consultation. A request concerning an organizational customer’s records will be referred to that Customer promptly unless prohibited by law; Databrush will not respond on its behalf without authorization except as legally required. Individuals using Databrush personally may contact us directly.
Databrush will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and within any shorter legal deadline. A breach includes unauthorized disclosure or access and accidental or unlawful destruction, loss, or alteration. Databrush will provide available information about the incident, affected information, likely consequences, mitigation, and a contact; provide material updates; and assist the Customer’s legally required response. Notice will not await complete forensic certainty. Databrush will investigate, contain, and remediate the incident and preserve appropriate evidence.
Send privacy and security requests to support@databrush.ai. Notices to the Customer go to its designated contact or account administrator. Each party must keep those contacts current. Reasonable charges for unusually extensive assistance may be agreed in advance where lawful, but will not delay required assistance or shift costs caused by Databrush’s breach to the Customer.
6. Return and deletion
On termination or a valid earlier instruction, Databrush will, at the Customer’s choice, return Customer Personal Data in a reasonably usable available format and delete the remaining copies, or delete it without return, unless law requires retention. The Customer may give this instruction through support@databrush.ai; no particular export or deletion interface is required. At planned account closure Databrush will seek the Customer’s choice; absent another lawful instruction, deletion is the default.
Databrush will complete the requested action without undue delay and within applicable legal deadlines, direct its subprocessors to act, and provide confirmation on request. The process covers related records, histories, derived results, credentials, and provider copies. Removing content from the interface, disconnecting a source, or deleting one member’s login is not proof that all copies have been erased. A member’s request must be scoped to avoid deleting other people’s authorized shared content.
Where law permits delayed deletion from backups or security archives, those copies will remain protected, be isolated from ordinary processing, and expire under the applicable retention schedule. Deletion instructions will be reapplied before restored data returns to ordinary use. Databrush will identify material retained categories, the reason, and applicable schedule when responding to a request; it will not treat technical dependencies or absence of automation as permission for indefinite retention. Legally required retained information will be limited to the justified purpose and deleted when that requirement ends. Customers should revoke or rotate source credentials separately when access should end.
7. Demonstrating compliance
Databrush will make information reasonably necessary to demonstrate compliance available and allow and contribute to audits or inspections by the Customer or its independent auditor. The parties will use available documentation and remote assessment where appropriate, with confidentiality and protection for other customers’ information. Routine audits may be coordinated on reasonable notice during business hours, ordinarily once annually. Those arrangements do not restrict legally required audits, regulatory access, or investigations of an unresolved material compliance concern or relevant breach.
This DPA controls a conflict with the Terms about Customer Personal Data. It does not limit nonwaivable individual rights or a regulator’s powers. Databrush will cooperate with competent authorities as required by law.
8. Additional transfer requirements
US customer eligibility does not establish that every record is governed only by US law. Before connecting data whose processing requires additional international-transfer instruments or safeguards, the Customer must contact Databrush so the parties can establish them. This DPA does not itself execute EU Standard Contractual Clauses, a UK transfer instrument, or customer-specific transfer annexes, and is not a representation that those arrangements have already been completed.
Databrush will use a lawful basis for transfers and onward transfers within its responsibility. Where a required mechanism or safeguard is not in place, the affected processing must not begin or must be suspended until it is established. The restricted-data provisions in the Terms continue to apply. Contact support@databrush.ai for those arrangements before submitting affected data.