Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between SHEM INTEGRITY, Inc. ("Integrity", "Processor") and the customer ("Customer", "Controller") and applies where Integrity processes Personal Data on the Customer's behalf — typically on the Team plan.
1. Roles & scope
The Customer is the Controller and Integrity is the Processor of "Customer Personal Data" — Personal Data contained in the content and accounts the Customer and its users submit to the service. Integrity processes Customer Personal Data only to provide the service and on the Customer's documented instructions (including as set out in the Terms and this DPA).
2. Details of processing
- Subject matter: provision of the Integrity workspace (documents, canvases, databases, AI chat, collaboration).
- Duration: for the term of the subscription, plus the deletion windows in §8.
- Nature & purpose: storage, sync, display, backup, AI processing of submitted content, and support.
- Categories of data subjects: the Customer's authorized users and any individuals referenced in their content.
- Categories of data: account identifiers (name, email), workspace content, usage/technical metadata. The Customer must not submit special-category data; Integrity does not intend to process it.
3. Subprocessors
The Customer authorizes Integrity to engage the subprocessors listed on our Subprocessors page (hosting, storage, email, payments, monitoring, analytics, and AI providers). Integrity imposes data-protection obligations on each subprocessor no less protective than this DPA, and remains responsible for their performance. We will notify Customers of new or replaced subprocessors with reasonable advance notice and a chance to object on reasonable data-protection grounds.
4. Security
Integrity maintains appropriate technical and organizational measures, including encryption in transit, access controls and least-privilege, network isolation, logging and monitoring, and regular backups. Measures may evolve but will not materially decrease the overall level of security.
5. AI processing
Where the Customer's users invoke AI features, submitted content is sent to the selected AI subprocessor (see §4 of the Privacy Policy and the Subprocessors page) solely to generate a response. Integrity does not permit AI subprocessors to train on Customer Personal Data. Some AI providers operate outside the EU/US; the Customer can request provider restrictions.
6. Data subject requests & assistance
Taking into account the nature of the processing, Integrity will assist the Customer (by appropriate technical and organizational measures, insofar as possible) to respond to data-subject requests and to meet its obligations regarding security, breach notification, and data protection impact assessments.
7. Personal data breach
Integrity will notify the Customer without undue delay (and within 72 hours of becoming aware) of a Personal Data breach affecting Customer Personal Data, with the information reasonably available to assist the Customer's own obligations.
8. Return & deletion
On termination, the Customer may export its data from the app. Integrity deletes Customer Personal Data from active systems within 30 days; residual copies in backups are deleted within 90 days, except where retention is required by law.
9. International transfers
Where processing involves transfers from the EEA/UK/Switzerland to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (and UK/Swiss addenda as applicable), incorporated by reference and to be attached as Annex to the executed version of this DPA.
10. Audits
Integrity will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality and security limits.
11. General
This DPA is governed by the law stated in the Terms. In case of conflict between this DPA and the Terms regarding processing of Personal Data, this DPA prevails. To request a signed copy, contact [email protected].