This Data Processing Agreement ("DPA") forms part of the agreement between Skyes Over London LC ("Processor") and the customer entity that has agreed to the kAIxU Terms of Service ("Controller"). This DPA incorporates the EU Standard Contractual Clauses (Module 2: Controller to Processor) by reference. Enterprise customers requiring a countersigned DPA should contact legal@kaixu.app.
Terms used but not defined here have the meanings given in the GDPR (Regulation (EU) 2016/679) and the UK GDPR as applicable.
Processor agrees to process Personal Data on behalf of Controller solely for the purpose of providing the Services, for the duration of the subscription and for 30 days thereafter (during which Controller may export data prior to deletion).
| Category | Examples | Purpose |
|---|---|---|
| Identity data | Email address, hashed password | Account management, authentication |
| Workspace content | Code, text files | Storage and retrieval, AI-assisted editing (with users' consent) |
| Usage and telemetry | AI call counts, session metadata | Quota enforcement, billing, debugging |
| Security events | Login IPs, MFA events | Account security, audit logging |
Data subjects include: Controller's employees, contractors, and end users who access the Services.
Processor shall:
Controller represents and warrants that it has the legal authority to provide Personal Data to Processor, that Personal Data has been collected lawfully, and that it has provided required notices to data subjects regarding the use of the Services.
| Domain | Measure |
|---|---|
| Encryption in transit | TLS 1.2 minimum on all connections; HSTS enforced |
| Encryption at rest | AES-256 at infrastructure level (Neon PostgreSQL) |
| Access control | Role-based access (owner / admin / editor / viewer); principle of least privilege |
| Authentication | bcrypt (cost 12) password hashing; TOTP MFA available |
| Audit logging | All auth events, data access, and admin actions logged with IP and timestamp |
| Vulnerability management | npm audit on every CI run; dependency updates reviewed monthly |
| Incident response | Security Incident response plan with 72-hour notification SLA |
| Personnel security | Principle of least privilege for internal system access; confidentiality agreements required |
Controller grants general written authorisation to engage the Sub-processors listed at /subprocessors. Processor shall notify Controller of any intended changes to Sub-processors with at least 15 days notice. Controller may object in writing within 15 days; if no resolution is reached, Controller may terminate the Services with a pro-rated refund.
Where Personal Data is transferred outside the EEA or UK to Sub-processors in the USA, such transfers are made under the EU Standard Contractual Clauses (Controller to Processor, Module 2) and, where applicable, the UK International Data Transfer Addendum. Copies of applicable SCCs are available upon written request to legal@kaixu.app.
Controller (or its appointed auditor under confidentiality) may audit Processor's compliance with this DPA once per calendar year, with 30 days written notice, during business hours. Processor may satisfy audit requests by providing a current SOC 2 Type II report or equivalent third-party assessment in lieu of on-site audit.
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. This DPA does not expand those limits. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under applicable data protection law.
This DPA is governed by the same law as the Terms of Service, except where the GDPR or UK GDPR mandates otherwise. For EU / UK data transfers, the governing law for the SCCs is the law of the relevant EU member state or England and Wales respectively.
Data Protection enquiries: privacy@kaixu.app
Legal: legal@kaixu.app
By accepting the Terms of Service (including the incorporated DPA), Controller agrees to be bound by this DPA as of the date of acceptance. Enterprise customers requiring a separately countersigned DPA should contact legal@kaixu.app.
Skyes Over London LC