Start free

Data Processing Addendum

Last updated: September 20, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service, or any other agreement for the Service, between Oakview IT LLC, doing business as OpenWake AI ("Openwake") and the customer that agreed to them ("Customer"). It applies whenever Openwake processes personal data on Customer's behalf. It takes effect when Customer accepts the Terms; no signature is needed. If Customer needs a countersigned copy, write to privacy@openwake.ai. If this DPA and the Terms conflict about the processing of personal data, this DPA prevails.

1. Definitions

"Data Protection Law" means the laws that apply to the processing of Customer Personal Data, including where applicable the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States state privacy laws such as the California Consumer Privacy Act. "Customer Personal Data" means personal data in Customer Data that Openwake processes on Customer's behalf. "Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914. Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in Data Protection Law. Other capitalized terms have the meanings given in the Terms.

2. Roles

Customer is the controller of Customer Personal Data, or a processor acting for its own customers, and Openwake is Customer's processor. Where a United States state privacy law applies, Openwake is Customer's service provider or processor. Openwake is an independent controller of account, billing and website data, as described in its Privacy Policy, and of the public Provider Registry.

3. Customer's instructions and responsibilities

Openwake will process Customer Personal Data only on Customer's documented instructions, which are: to provide, secure and support the Service as described in the Terms and the documentation; to act on the settings Customer chooses in the Service, including the Telemetry, Evidence and Enforcement controls; and to follow other reasonable written instructions that are consistent with the Terms. Openwake will tell Customer if it believes an instruction breaks Data Protection Law, and may pause that processing until the question is settled.

Customer is responsible for the lawfulness of the processing it instructs. In particular Customer confirms that it has a lawful basis for deploying the Service, that it has given the people who use enrolled devices and browsers the notices the law requires and obtained any consent or consultation the law requires, and that it will configure the Service in a way that is proportionate to its purposes.

4. Openwake's obligations

Openwake will:

Openwake will tell Customer first where the law allows;

artificial intelligence models, not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than the business purposes in the Terms, and not combine it with personal data from other sources except as Data Protection Law permits a service provider to do;

fall;

subject writes to Openwake about Customer Personal Data, Openwake will pass the request to Customer and will not answer it except to say so;

extent they concern Openwake's processing and the information is available to Openwake;

5. Personal data breaches

Openwake will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. The notice will describe what is known about the nature of the breach, the data and people likely to be affected, and the steps taken, and Openwake will update it as more is learned. Notice goes to the account owners by email. A notice is not an admission of fault.

6. Subprocessors

Customer gives Openwake general authorization to use subprocessors. The current list is at openwake.ai/legal/subprocessors. Openwake has a written agreement with each subprocessor that imposes data protection duties no less protective than this DPA, and remains responsible for their performance.

Openwake will give at least 30 days' notice of a new subprocessor by updating that page and notifying account owners by email. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may end the affected Service and receive a refund of fees paid in advance for the period after termination.

7. International transfers

Openwake hosts the Service in the United States. Where Customer Personal Data that is subject to the GDPR, the UK GDPR or Swiss law is transferred to Openwake in a country without an adequacy decision, the parties agree that:

controller, and Module Three (processor to processor) applies where Customer is a processor;

with the notice period in section 6; in Clause 11 the optional language does not apply; in Clause 17 option 1 applies and the governing law is that of Ireland; in Clause 18(b) the courts are those of Ireland;

Openwake as data importer, and Annex II with Annex 2 of this DPA. The competent supervisory authority is the one that is competent for Customer under Clause 13;

Commissioner applies, completed with the same information, and either party may end it under its Table 4 option;

Protection, and the Federal Data Protection and Information Commissioner is the competent authority.

If a transfer mechanism is invalidated, the parties will work in good faith to put another in place.

8. Deletion and return

Customer can export its data from the Service at any time while its account is open. During the term, data is deleted according to the retention periods of Customer's plan and settings. After the account is closed, Openwake will delete Customer Personal Data within 30 days, and remaining copies in backups will age out on their normal schedule, within a further 90 days. Openwake may keep data where the law requires it, and will protect it and process it only for that purpose. Records in the signed audit ledger keep hashes and timestamps and no personal data.

9. Audits

Openwake will make available the information reasonably needed to show that it meets its obligations under this DPA, including its security documentation and, when they exist, reports from independent auditors. If Customer reasonably needs more to meet its own legal duties, Customer may ask to audit the processing of Customer Personal Data, no more than once a year and on at least 30 days' written notice, during business hours, under confidentiality, without access to other customers' data, and at Customer's own cost. An audit required by a regulator, or following a personal data breach, is not subject to the once a year limit.

10. Liability

Each party's liability under this DPA is subject to the limits in the Terms. Nothing in this DPA limits a party's liability to data subjects under the SCCs or to the extent Data Protection Law does not allow it to be limited.

Annex 1. Details of the processing

ItemDetail
Subject matter and purposeProviding the Service: showing Customer which AI tools are used on devices and in browsers it manages, raising detections, applying Customer's policies, and retaining evidence where Customer turns that on
DurationThe term of the agreement, plus the deletion period in section 8
Nature of the processingCollection from the Sensors, storage, analysis by automated rules, display to Customer's authorized users, alerting, export and deletion
Data subjectsCustomer's employees, contractors and other people who use devices or browsers on which Customer installs the Sensors; Customer's users of the portal
Categories of personal dataIdentifiers (name, user name, work email address, device name and identifiers, IP address); device, software and security configuration; AI tools, coding agents and tool servers present on a device; internet services and website domains reached; metadata about prompts and tool calls (time, service, kind of account, category of data detected, size); policy results and enforcement outcomes; records of actions in the portal. Where Customer turns on the Evidence Vault: excerpts or full copies of submissions to AI services, which can contain any personal data the person included
Special categoriesNot sought by the Service. Retained evidence may contain special category data if a person includes it in a submission and Customer has turned on retention. Customer controls whether evidence is retained
FrequencyContinuous while the Sensors are running
RetentionAccording to Customer's plan and settings, as described in the documentation and in section 8
SubprocessorsAs listed at openwake.ai/legal/subprocessors, for hosting, email delivery and payment

Annex 2. Security measures

Openwake maintains the following measures, as of the date above:

application and its database are encrypted with TLS over a private network.

addition, the most sensitive fields are encrypted at the application level with AES-256-GCM before they reach the database, including retained evidence, email addresses, alert destinations, authenticator secrets and identity provider secrets. API keys and device tokens are stored as hashes or in encrypted form, never in plain text.

reveal of retained evidence requires a stated reason and is recorded. Sign-in uses one-time codes, optional authenticator apps and step-up verification for sensitive changes. Administrative access to production is limited to the personnel who operate the Service.

organizations is covered by automated tests.

ledger. Reveals and exports of retained evidence are recorded in an audit trail.

verifies a signed manifest and checksums before it updates.

operator-controlled storage in the United States.

content. Customer chooses whether evidence is retained.

Contact

privacy@openwake.ai