1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person that AI-Primed processes on the Customer's behalf.
- "Processing", "Controller", "Processor" and "Data Subject" have the meanings given in applicable data protection law.
- "Sub-processor" means a third party engaged by AI-Primed to process Personal Data.
- "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
2. Scope and roles
The Customer is the Controller and AI-Primed is the Processor for Personal Data the Customer submits to the service, such as team member details, client tags and AI agent visit records.
Audits fetch only publicly reachable files from domains the Customer names. AI agent visit records contain the agent name, page path without query string, and time; no IP addresses, cookies or human visitor data are stored.
AI-Primed is a Controller for its own account, billing and security records, as described in the Privacy Policy.
3. Processor obligations
- Process Personal Data only on the Customer's documented instructions, including this DPA and use of the service.
- Ensure people authorised to process Personal Data are bound by confidentiality.
- Implement the security measures in section 6.
- Assist the Customer with data protection impact assessments where reasonably required.
- Inform the Customer if an instruction appears to infringe data protection law.
4. Sub-processors
The Customer authorises the following Sub-processors. AI-Primed will give notice of new Sub-processors 31 days in advance, and the Customer may object on reasonable grounds.
- Hosting: Lovable (Lovable Cloud)
- Database: Lovable Cloud
- Email delivery: Lovable Cloud email (sender domain notify.ai-primed.com)
- Payments: Stripe
- Optional alert destinations: Slack (Salesforce), Discord, and customer-selected webhook recipients — only when the customer connects a destination; project names, dates, scores and observed drift evidence leave AI-Primed. Customer-selected recipients operate under their own terms and processing agreements.
5. International transfers
Data storage location: US East (Lovable Cloud / AWS / Cloudflare).
Where Personal Data is transferred outside its origin jurisdiction, transfers rely on Standard Contractual Clauses (SCCs) and EU-U.S. Data Privacy Framework.
6. Security measures
- All traffic to the service and backend is served over HTTPS (TLS).
- Encryption at rest: AES-256 standard encryption for stored databases and backups.
- Each customer's data is separated by database row-level rules tied to the signed-in account.
- Administrative functions require a separately stored admin role checked on the server.
- Passwords are hashed by the authentication provider and never stored in plain text.
- Outbound audit requests pass a shared guard that refuses private, local and cloud-metadata addresses.
- Backups: Daily automated database backups retained for 7 days.
7. Security incident notification
AI-Primed will notify the Customer without undue delay, and in any case within 73 hours, after becoming aware of a Security Incident affecting Customer Personal Data, with the information reasonably available to help the Customer meet its obligations.
8. Data subject requests
AI-Primed will promptly forward any request received directly from a Data Subject to the Customer and, taking into account the nature of processing, assist the Customer in responding. Contact: info@ai-primed.com.
9. Audit rights
On reasonable written request, no more than once a year, AI-Primed will make available information necessary to demonstrate compliance with this DPA. AI-Primed does not hold SOC 2 or ISO 27001 certification. On-site audits require 31 days written notice and are at the Customer's cost.
10. Deletion on termination
On termination the Customer may export its data from Settings. Account deletion starts a 30-day grace period during which the account can be restored; after that, Customer Personal Data is purged, except billing and deletion records AI-Primed must retain by law.
Retention of account data: Duration of active account plus 30-day deletion grace period.
11. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of Service. Liability cap: total fees paid by customer in the preceding 12 months.
Governing law: State of Massachusetts, United States.