This Data Processing Agreement ("DPA") forms part of the Terms of Service between The Really Useful App Company Ltd ("Processor", "we"; company no. 17088198, registered in England and Wales) and the customer ("Controller", "you") and applies where we process personal data on your behalf through the Alto plugins and hosted API (the "Service").
You are the Controller and we are the Processor in respect of personal data contained in the content you submit to the Service. We process such data only to provide the Service and only on your documented instructions (your configuration and use of the Service constituting those instructions), and as required by law.
Nature/purpose: generating AI output (e.g. image alt text, SEO metadata, summaries, FAQ content) from the content you submit. Duration: for the term of your use of the Service. Processing operations: transmission, transient processing to generate output, usage counting, and return of output.
Types: we do not require personal data. Personal data is only processed if it incidentally appears in the content you submit (e.g. a name in a post, a person in an image). A non-identifying hashed site ID is used for usage counting. Data subjects: any individuals whose personal data you have placed in your site content. We do not request or require special-category data; you should not submit it.
We will: (a) process personal data only on your instructions; (b) ensure persons authorised to process it are bound by confidentiality; (c) implement appropriate technical and organisational security measures (Annex B); (d) assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Articles 32–36 UK GDPR; (e) make available information reasonably necessary to demonstrate compliance; and (f) not use the data to train AI models.
You authorise the sub-processors in Annex A. We impose data-protection terms on each that are no less protective than this DPA, and remain liable for their performance. We will give reasonable notice of any intended change (addition/replacement) so you may object on reasonable data-protection grounds.
Where a sub-processor processes personal data outside the UK, we rely on an appropriate transfer mechanism (UK International Data Transfer Agreement, or the UK Addendum to the EU SCCs) together with any required safeguards.
We will promptly notify you on becoming aware of a personal-data breach affecting your data and provide information reasonably required for you to meet your notification duties. We will forward to you, without undue delay, any data-subject request we receive relating to your data, and assist you in responding.
On termination, or on your request, we will delete personal data processed on your behalf, save for transient processing logs which are deleted on their normal retention cycle, and except where law requires retention.
We will make available information necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice and subject to confidentiality.
Liability under this DPA is subject to the limitations and exclusions in the Terms of Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI model that generates the output | US (transfer safeguards per §6) |
| Render | Hosting of the Alto API | US/EU (transfer safeguards per §6) |
| Freemius | Merchant of record for paid plans (billing data) | US (transfer safeguards per §6) |
Transport encryption (HTTPS/TLS); access controls on the API and its data store; a non-identifying hashed site ID instead of identifying the site directly; least-data transmission (only what's needed per request); no use of customer content for model training; backups with restricted access; operational logs kept for a limited period then deleted.
Questions about this DPA, or a request for a counter-signed copy, can be sent to support@thereallyusefulappcompany.com.