Data processing addendum

Roles

You are the controller of the personal data in the inboxes, calendars, meetings and files your workspace connects. We process that data only on your behalf, to provide the service.

What we process

• Subject matter and duration: providing Dailyhand for as long as your workspace has an account, and the deletion period after it ends.
• Nature and purpose: sorting email, writing drafts, scheduling, taking meeting notes, answering questions, running Flows and keeping Spaces.
• People concerned: members of your workspace and the people they email, meet and book meetings with.
• Types of data: names, email addresses, email subjects and short summaries, calendar event details, meeting recordings, transcripts and notes, uploaded files and the text of questions and answers. We do not ask for special categories of data, though they can appear in email or meetings you connect.

Your instructions

We process data on your documented instructions: these terms, the settings your workspace chooses and the requests your members make in the product. We tell you if we believe an instruction breaks data protection law.

Confidentiality

Everyone at [Legal entity name] who can access customer data is bound by confidentiality, and access is limited to the people who run and support the service.

Security measures

• Encryption in transit for every connection, and encryption at rest for the access keys to connected accounts.
• Full email bodies, attachments and sent mail are never stored; they are read from the mailbox when a task needs them.
• Every request is checked against the workspace and the person that own the data.
• Uploads are size- and type-checked, and model input is marked as material to analyse, never as instructions.
• Errors and access are logged without email content, and an hourly check alerts us to new errors and stuck work.

Subprocessors

You authorise the subprocessors listed on the subprocessors page. Each works under written terms that protect the data as this addendum does. We update the list before a new subprocessor starts processing customer data, and you may object to a change by writing to support@dailyhand.com. If we cannot address the objection, you may end the affected service.

Helping you

Export and deletion are self-serve in Settings. If someone contacts us about their data in your workspace, we pass the request to you rather than answer it ourselves, and we help you respond. We also help with data protection impact assessments and consultations where they concern the service.

Incidents

We tell you without undue delay after we become aware of a breach that affects your data, with what we know, what we are doing and what you may need to do.

International transfers

Where personal data leaves the country it was collected in and the law requires safeguards, the transfer is covered by standard contractual clauses or another mechanism the law recognises.

Deletion and return

Disconnecting an inbox deletes the records we hold for it. When your workspace ends, you can export your data first; we then delete what we hold, apart from billing records we are required to keep. Backup copies are overwritten on our hosting provider's backup schedule.

Audits

We make available the information you need to show compliance with this addendum. For audit questions or a signed copy, write to support@dailyhand.com.

Law

This addendum is governed by the same law as the terms of service: [Governing law and courts].