Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Inkfold Terms of Service between Customer (“Controller”) and Inkfold (“Processor”) whenever Inkfold processes Personal Data on behalf of a business, Team, or Enterprise Customer subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, the Swiss FADP, the Israeli Protection of Privacy Law (5741-1981, Amendment 13), or the California Consumer Privacy Act (CCPA/CPRA). Need a countersigned copy? Email legal@inkfold.app.

1. Roles, Storage Modes & Scope

Customer acts as Data Controller (or Business under CCPA) and Inkfold acts as Data Processor (or Service Provider under CCPA) with respect to Personal Data submitted to Inkfold on Customer’s documented instructions. In Smart mode, content is encrypted at rest (AES-256-GCM under a server-managed key) in Frankfurt (EU); in Private mode, content is encrypted on Customer’s devices using Argon2id + AES-256-GCM before upload so Inkfold holds only ciphertext; in Incognito mode, no content is persisted; and in Bring-Your-Own-Storage / Enterprise Air-Gapped deployments, conversation blobs remain exclusively in Customer-controlled storage.

2. Processor Obligations (GDPR Article 28(3))

• Documented Instructions (Art. 28(3)(a)): Inkfold processes Personal Data solely on Customer’s documented instructions and never uses Customer content to train AI models.
• Confidentiality (Art. 28(3)(b)): All personnel authorized to access infrastructure are bound by written confidentiality obligations and least-privilege, audited access controls.
• Security of Processing (Art. 28(3)(c) & Art. 32): Inkfold maintains the Technical and Organizational Security Measures set out in Annex II below.
• Data Subject Rights Assistance (Art. 28(3)(e)): Inkfold provides self-service UACP exports (Settings → Data → Export), account/workspace deletion, and assistance via privacy@inkfold.app to fulfill GDPR Chapter III requests.
• Personal Data Breach Notification (Arts. 28(3)(f), 33): Inkfold notifies Customer without undue delay (and within 48 hours of confirmation) of any Personal Data Breach affecting Customer data, providing full details required for GDPR Art. 33 and NIS2/DORA reporting.
• Deletion or Return of Data (Art. 28(3)(g)): Upon account deletion or contract termination, all Customer blobs and account metadata are purged from active systems within 30 days (with encrypted Frankfurt backups aging out within 7–30 days).
• Audit & Cryptographic Evidence (Art. 28(3)(h)): Inkfold provides Ed25519-signed UACP and Capture-Manifest audit trails and makes compliance documentation available upon written request.

3. Sub-processors & International Transfers (EU SCCs 2021/914)

Customer authorizes the Sub-processors listed in Privacy Policy §6 (Sub-processors) (Google Cloud Platform Frankfurt europe-west3, Oracle Autonomous Database Frankfurt eu-frankfurt-1, Cloudflare & R2, Lemon Squeezy, Google Workspace, and Customer’s enabled AI vendors). Inkfold provides at least 30 days’ advance email notice before adding any new material Sub-processor.

Primary storage and compute reside in the European Union (Frankfurt, Germany). Administration from Israel is covered by the European Commission’s Adequacy Decision under GDPR Article 45. Where any transfer outside the EEA, UK, or Switzerland is not covered by an adequacy decision or the EU–US Data Privacy Framework, the parties incorporate by reference the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914, Module Two: Controller-to-Processor) (Clause 7 docking enabled; Clause 9(a) Option 2 with 30 days’ notice; Clause 17/18 governed by the laws and courts of Ireland; plus the UK ICO International Data Transfer Addendum).

Annex I & II — Processing Details & Security Measures (TOMs)

• Categories of Data Subjects & Data: Authorized workspace members and end users; account email, workspace roles, encrypted BYOK key blobs, and (in Smart mode) AES-256-GCM encrypted conversations and entity-graph records.
• Encryption & Zero-Knowledge Controls: TLS 1.3 in transit; AES-256-GCM at rest; Argon2id (64 MB, 3 iterations) + AES-256-GCM client-side encryption in Private mode; on-device DLP redaction (none, balanced, strict); and mutual-TLS (mTLS) + IP ACL database isolation in Frankfurt.