Data Processing Addendum

1. Roles

Where a customer submits personal data (for example, client or patient identifiers) into the service, the customer is the data controller and Amnesia AI is the data processor, processing that data only on the customer's documented instructions, as set out here and in the Terms of Service.

2. Nature and purpose of processing

Personal data entered into the desktop app is detected and masked entirely on the customer's device before any request leaves it. The masked request is sent through our gateway to the AI model the customer selects, and the response is restored locally. Our processing is therefore limited, by architecture, to: local detection and masking (on-device, never transmitted to us), metering of masked requests (model, token counts, timestamp), and account/billing administration.

3. Categories of data

Depending on how the customer uses the service, this may include names, tax identifiers, financial account numbers, client or patient identifiers, and similar values entered into the app. We receive these values in unmasked form only if the customer's own device sends them, which the product is specifically built to prevent for anything routed through the masking pipeline.

4. Security measures

Full detail is on our security architecture page. In summary:

• On-device detection using local models; nothing sent to the cloud to be "checked."
• A content-blind gateway that can log metering data but not message content.
• Local data encrypted with SQLCipher and XChaCha20-Poly1305, keyed by Argon2id derivation from a customer-held passphrase we never receive.
• Fail-closed behavior: on any detection error or ambiguity, the send is blocked, not allowed through.
• Hash-chained, tamper-evident audit receipts for every send.

5. Subprocessors

We use the following subprocessors to operate the service:

• Stripe — payment processing.
• Supabase — authentication and account data storage.
• Resend — transactional email.
• Sentry — error monitoring.
• Vercel, Fly.io — application and gateway hosting.
• The AI model provider the customer selects (for example Anthropic, OpenAI, or xAI), which receives masked text under its own terms.

We will notify customers of new subprocessors with material access to personal data with reasonable notice, at legal@amnesia.ai.

6. International transfers

Where personal data is transferred outside the customer's region, we rely on appropriate safeguards, including Standard Contractual Clauses, with our subprocessors.

7. Assistance with data subject rights

We will assist customers, to the extent our architecture allows, in responding to data subject access, correction, or deletion requests concerning account and billing data we hold. For data that only ever existed on the customer's own device, the customer controls it directly, including through free encrypted export.

8. Breach notification

We will notify affected customers without undue delay after becoming aware of a security incident affecting their personal data, with the information available to us at the time.

9. Audit rights

On reasonable request, and no more than once per year absent a security incident, we will make available information reasonably necessary to demonstrate compliance with this addendum.

10. Term and deletion

This addendum applies for as long as we process personal data on the customer's behalf. On termination, we will delete or return the account and billing data we hold within a reasonable period, except where retention is required by law.

Contact

To execute a signed, entity-specific DPA, or with questions about this page: legal@amnesia.ai.