Data processing agreement
Last updated 22 October 2026
This agreement forms part of the terms between the customer (the controller) and Lore (the processor) and applies to personal data that Lore processes on the customer's behalf. It is intended to meet Article 28 of the GDPR.
1. Details of the processing
- Subject matter and purpose: interviewing the customer's departing employees, extracting operating rules, supporting review, and serving approved rules to the customer's AI systems.
- Duration: the term of the agreement, plus up to 30 days for deletion.
- Data subjects: the customer's employees and contractors who are interviewed, and the customer's staff who use the dashboard.
- Categories of data: names, roles, teams, work email addresses, last working day, interview conversations, and rules attributed to the interviewee. No special categories of data are intended.
2. Lore's obligations
- Process personal data only on the customer's documented instructions, including these terms and the customer's use of the product.
- Ensure that people authorised to process the data are bound by confidentiality.
- Apply the security measures in section 6.
- Help the customer respond to data subject requests, including through in-product deletion.
- Help the customer with security, breach notification, impact assessments and prior consultation, as far as is reasonable given the information available to us.
- Notify the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting customer data.
- At the end of the agreement, return approved rules on request and delete customer data within 30 days, unless the law requires us to keep it.
- Make available the information needed to show compliance, and allow reasonable audits, normally by providing documentation and answering a questionnaire once a year.
3. Subprocessors
The customer authorises the following subprocessors. We will give at least 30 days' notice of new subprocessors, and the customer may object on reasonable data protection grounds. We impose data protection obligations on subprocessors that are at least as protective as this agreement and remain responsible for them.
| Provider | Purpose | Location |
|---|---|---|
| Anthropic, PBC | AI processing of interview text, rule extraction and agent answers | United States |
| Neon, Inc. | Database hosting | EU (AWS Frankfurt) |
| Vercel, Inc. | Application hosting and cookieless visitor statistics | EU and United States |
| Clerk, Inc. | Sign-in and company workspaces for customer staff | United States |
| Resend, Inc. | Sending interview invitations by email | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | EU (Germany) |
4. International transfers
Where data is transferred outside the EEA, we rely on the EU Standard Contractual Clauses (module three, processor to processor, with each subprocessor) and, where available, the EU-US Data Privacy Framework.
5. Customer obligations
The customer is responsible for having a lawful basis for the processing, informing data subjects, obtaining any works council approval, and not instructing Lore to process data unlawfully.
6. Security measures
- Encryption in transit (TLS) and at rest.
- Database hosted in the EU (Frankfurt).
- Interview links and API keys stored only as SHA-256 hashes; links can be replaced at any time, which disables the old one.
- Role-based access within each customer workspace; only admins can approve rules, manage interviews and create keys.
- Strict separation of customer workspaces in every database query.
- Rate limiting on interviews and the API, and monthly AI usage caps.
- Error monitoring without sending personal data by default.
- No use of customer data to train AI models.
Contact
Data protection questions: privacy@keeplore.dev