Data Processing Addendum

"GDPR", "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings in Regulation (EU) 2016/679.

• "Workspace Content" means the personal data Dripl processes for the Customer's workspace in providing the Service. It includes the data AI Studio collects from the chats the workspace tracks, the data it produces from them, and the content the workspace sends, forwards or syncs through the Service. Annex I describes it.
• "Service" means Dripl as described in the Terms, including AI Studio.
• "Sub-processor" means a processor Dripl engages to process Workspace Content.
• "Dripl admins" means Dripl's own administrator accounts. No role in a customer workspace is a Dripl admin.

2.1 For Workspace Content, the Customer is the controller, or a processor acting for its own client, and Dripl is the Customer's processor.

2.2 Dripl is an independent controller for:

• the account, billing, security and support data of the Customer and its team;
• the records of how the Customer's team uses the Service and Dripl's site (activity records): the pages they open, the buttons and links they click and the actions they take, with the IP address, its approximate location and network, and the device and browser, kept for security, abuse prevention, support and improving the Service; activity records are deleted 90 days after the last activity they record, the daily totals made from them hold no IP address and no link to a person, and each member's sign-up source (the page and campaign that brought them, with no IP address) is kept with their account;
• the record of actions Dripl staff take;
• the statistics of public channels that Dripl keeps shared between workspaces, which identify no person;
• the content checks and moderation Dripl runs to keep the Service free of spam and abuse;
• testing changes to its AI instructions with one of a workspace's reports, when a Dripl admin records a reason for it and only while the workspace's AI Studio consent stands. The test's output is kept by Dripl outside the workspace; Dripl's admin tools stop showing it 7 days after the test, and it is deleted the first time that version of the instructions is tested after those 7 days;
• its server logs: the web server's access log, which records every request to Dripl's site, short links included, with the IP address, the browser details and the referring page; the web server's error log, which records each request that caused an error, with the IP address, the request and the referring page; and the app server's request log, which records requests without the visitor's IP address. Dripl keeps the web server's logs for security and troubleshooting, with no scheduled deletion; the app server's request log is overwritten as it fills.

Dripl's Privacy Policy covers that processing.

2.3 The Customer is responsible for the lawfulness of the Workspace Content it brings into the Service. In particular, it must:

• have a lawful basis to read and analyse the chats it adds;
• inform data subjects where Art. 13 or 14 GDPR requires it;
• add only chats it may lawfully read, in line with Telegram's terms.

3.1 Dripl processes Workspace Content only on the Customer's documented instructions, unless Union or Member State law requires otherwise. If it does, Dripl informs the Customer before processing, unless that law forbids it.

3.2 The Customer's instructions are:

• (a) the Terms and this addendum;
• (b) the Customer's configuration and use of the Service, such as the chats it tracks, the reports, Ask AI questions and campaigns it creates, and its AI Studio settings, including auto-send;
• (c) the in-app AI Studio terms the workspace owner or an admin accepts;
• (d) any further written instruction the parties agree.

3.3 Dripl informs the Customer at once if, in its opinion, an instruction infringes the GDPR.

Dripl ensures that the people it authorises to process Workspace Content are bound by confidentiality.

Dripl admins open Workspace Content only:

• to provide support;
• to keep the Service running;
• to investigate suspected abuse;
• where the law requires it;
• to test changes to Dripl's AI instructions, by running one of the workspace's reports through the AI again; the test needs a recorded reason, its output is no longer shown after 7 days, and it is deleted the first time that version of the instructions is tested after those 7 days.

Dripl's admin tools require a reason for every view of AI Studio content and log the view and its reason in Dripl's record of staff actions, which is kept for 6 years. A view that cannot be logged is not shown. Dripl does not notify the Customer of each view.

Dripl implements the technical and organisational measures in Annex II. It may update them, provided that the overall level of protection does not decrease.

6.1 The Customer gives Dripl general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex III and on Dripl's sub-processor page.

6.2 Dripl informs the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance by email to the workspace owner and on our sub-processor page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected part of the Service or end the Terms. Fees already paid are not refunded.

6.3 Dripl imposes data protection obligations on each Sub-processor that are no less protective than this addendum, and remains liable to the Customer for its Sub-processors.

7.1 Taking into account the nature of the processing, Dripl helps the Customer respond to data subject requests. The Service provides these functions:

• deleting reports, campaigns and short links;
• stopping tracking of a chat;
• withdrawing the AI Studio consent, which stops collection;
• withdrawing with the option to delete the collected data;
• deleting the workspace on request (Dripl does this; there is no self-service deletion), which deletes its Workspace Content.

7.2 Members of tracked chats. A member of a tracked chat cannot know which Dripl customer tracks them. The Customer therefore authorises Dripl to act on a verified access, erasure or objection request from such a member directly, across every workspace that holds data about them, as described in Dripl's data subject request process. For an erasure or objection request, Dripl's erase tool then:

• deletes the messages the member's Telegram account wrote, with their text, statistics and AI tags, and the pseudonymous codes that stand for it, from the Customer's workspace;
• removes, in that workspace: the excerpts of those messages in reports; the written analysis of any report that drew on them, which is replaced by a notice while the report's figures stay; Ask AI answers that cited one of those messages or opened it; and the AI explanations of alerts for the chat and day the messages were posted;
• keeps them from being stored again;
• runs a follow-up pass about 10 minutes after the first one ends, which removes any such message stored while the first pass ran.

Three limits remain. An Ask AI answer built from lists or searches of messages, which neither cited nor opened one of those messages, cannot be linked to them, so it stays until its own retention period ends. AI-drafted campaign posts and campaign plans that drew on those messages are not changed; they stay until the Customer deletes them, and a moderation excerpt of such a post stays until the workspace's text period ends. And the erase does not reach the output of a test of Dripl's AI instructions run on one of the workspace's reports (2.2): Dripl's admin tools stop showing it 7 days after the test, and it is deleted the first time that version of the instructions is tested after those 7 days.

For an access request, Dripl sends the member, for each workspace that holds their data, how many of their messages it holds and their dates, the AI tags on them, any counts from the chat's Telegram statistics and the text of their own messages still stored, without naming the Customer.

Apart from the notices that replace removed text, Dripl does not inform the Customer of such an erasure.

7.3 Dripl forwards to the Customer, without undue delay, any other request it receives from a data subject about Workspace Content that it can attribute to the Customer. It does not answer such a request itself unless the Customer instructs it to.

Dripl helps the Customer, at the Customer's reasonable request and taking into account the information available to Dripl, with:

• data protection impact assessments;
• prior consultations with a supervisory authority;
• the security of processing.

Dripl's own assessment of AI Studio is available on request.

Dripl notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting Workspace Content. The notice gives:

• the information Art. 33(3) GDPR requires, as far as Dripl has it;
• updates as more becomes known.

10.1 When the Terms end, or when the Customer deletes its workspace, Dripl deletes the Workspace Content:

• every AI Studio table of the workspace is deleted with it;
• AI batches still running at Anthropic are cancelled and deleted.

Kept after deletion:

• the shared posts and statistics of public channels and the member counts of public chats, which identify no person, without any link to the workspace;
• AI usage cost records (no content), without any link to the workspace;
• daily totals of the use of the Service and Dripl's site, which hold no IP address and no link to a person, for 25 months (2.2);
• the activity records of team members who keep their own Dripl account, which are deleted 90 days after the last activity they record (2.2);
• invoices, for the legal retention period of 10 years;
• the record of Dripl staff actions, for 6 years;
• Dripl's server logs (2.2): the web server's access and error logs, with no scheduled deletion, and the app server's request log, until it is overwritten;
• the output of any test of Dripl's AI instructions that a Dripl admin ran on one of the workspace's reports (2.2), until that version of the instructions is first tested again more than 7 days after the test; Dripl's admin tools stop showing it 7 days after the test.

Dripl deletes an account on request; there is no self-service deletion. Backup copies (database dumps, and archives of session files and media, made before each release) are kept on the same server, readable only by its administrator account, and deleted within 30 days.

10.2 Before deletion, the Customer can download its AI Studio reports as PDF, CSV or XLSX files. On request before the workspace is deleted, Dripl also sends a CSV export of the workspace's collected message statistics and of the message text it still stores, within 30 days of the request.

10.3 During the Terms, Workspace Content is kept for the retention periods in Annex I, unless the Customer deletes it earlier.

Dripl makes available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR. It allows for and contributes to audits, including inspections, by the Customer or an auditor the Customer mandates, under these conditions:

• reasonable notice of at least 30 days;
• at most once a year, unless a supervisory authority requires more, or after a personal data breach;
• at the Customer's cost;
• under confidentiality;
• without access to other customers' data.

12.1 Dripl stores Workspace Content with its hosting provider, Hostinger (Hostinger International Ltd), on servers in Frankfurt am Main, Germany, in the European Union.

12.2 AI Studio sends Workspace Content to Anthropic, PBC in the United States (Annex III). Under Anthropic's commercial terms, Anthropic does not use the data to train its models. Dripl's DPIA assesses the risks of this transfer.

12.3 Dripl's email provider, Microsoft (Microsoft 365, Exchange Online), stores email in the United States. Dripl's notification emails carry some Workspace Content: AI Studio's report and campaign emails (a report's title, its period and its written summary, never an excerpt) and failure digests (the recipient of each failed message). That transfer is covered by the Microsoft Products and Services Data Protection Addendum, which includes the Commission's Standard Contractual Clauses, and by Microsoft's certification under the EU-US Data Privacy Framework. When it is switched on, Dripl's error monitoring uses Sentry's EU data region.

12.4 Because Dripl is established in the European Union and hosts Workspace Content there (12.1), the Customer's use of the Service is not itself a transfer outside the EEA, and the parties need no Standard Contractual Clauses between them (Module 2) for it. Dripl's onward transfers to its US sub-processors are described in 12.2 and 12.3. The governing law and courts are the ones named in the Dripl Terms.

Each party's liability under this addendum is subject to the limits in the Terms, as far as the law allows. Nothing in this addendum limits either party's liability to data subjects under Art. 82 GDPR.

This addendum lasts as long as Dripl processes Workspace Content for the Customer. The law and courts named in the Dripl Terms govern this addendum and any dispute under it.

As listed on Dripl's sub-processor page:

• Anthropic, PBC (AI Studio analysis; United States);
• Hostinger (Hostinger International Ltd; hosting; servers in Frankfurt am Main, Germany, EU);
• Microsoft (Microsoft 365, Exchange Online; email; United States; the Microsoft Products and Services Data Protection Addendum with the EU Standard Contractual Clauses, and the EU-US Data Privacy Framework);
• Sentry (Functional Software, Inc.; error monitoring, only when switched on; EU data region).

Not Sub-processors: the browser push services (Apple, Google, Mozilla, Microsoft, depending on the browser) only carry notifications that are encrypted end to end for the person's device, and hold no key to read them.