Our data processing agreement, open to every plan, without a sales call.
This text is a draft and our lawyer has not reviewed it yet, so it cannot be signed today. You can read it now, and ask to sign: we send you the final text for signature as soon as it is ready, and tell you what changed from this draft.
1. Who is who
This agreement is between CommitOps and the company that uses the CommitOps service (the customer). It forms part of the terms of service and applies whenever CommitOps processes personal data on the customer's behalf.
For the content the customer connects (mail, calendars, transcripts, documents, work items and CRM records) the customer is the controller and CommitOps is its processor. For the account details of the people who sign in, and for billing, CommitOps is a controller under its privacy policy.
2. What we process, and only on your instructions
CommitOps processes customer personal data only to provide the service as the terms and this agreement describe, and on the customer's documented instructions. The settings a customer chooses in the app, and the sources it connects, are its instructions. If CommitOps believes an instruction breaks the law, it says so and does not follow it.
CommitOps never sells customer personal data, never uses it for advertising, and never uses it, or lets a model provider use it, to train a model. Annex 1 lists the kinds of data and of people concerned.
3. People with access
Only people who need it to run the service can reach customer personal data, and each of them is bound to keep it confidential. No person at CommitOps reads customer content unless the customer asks for help with a specific item, or it is needed for security or to comply with law.
4. Security
CommitOps keeps the technical and organizational measures described on its security page at commitops.ai/security. That page marks each measure as in the code, decided, or planned, and only the measures marked in the code are promised by this agreement. CommitOps does not lower the level of protection those measures give during the term.
5. Subprocessors
The customer authorizes the subprocessors listed on the security page and in Annex 2. A test in CommitOps's code fails when the code sends data to a service that is not on that list.
CommitOps announces a new or replaced subprocessor at least 30 days before it receives customer personal data, on the feed at commitops.ai/security/subprocessors.xml and by email to anyone on the notice list. The customer may object on reasonable data protection grounds within those 30 days. If the parties cannot resolve the objection, the customer may end the service and receive a refund of any fees paid for the time after it ends.
CommitOps binds each subprocessor to data protection terms no less protective than these, and remains responsible for what each one does.
6. Helping you answer requests
When a person asks the customer to see, correct, export or delete their data, CommitOps helps the customer answer, through the app where it can and by email to privacy@commitops.ai where it cannot. If such a request reaches CommitOps directly, CommitOps passes it to the customer and does not answer it alone.
CommitOps also gives the customer the information it reasonably needs for a data protection impact assessment or a consultation with a regulator about the service.
7. Breach notice
CommitOps tells the customer without undue delay, and within 72 hours, after it becomes aware of a breach affecting customer personal data. The notice says what happened, what data and how many people are concerned as far as known, what CommitOps is doing about it, and who to contact. CommitOps adds what it learns as it learns it.
8. Deletion
Disconnecting a source deletes the quotes and passages that came from it. When the service ends, or when the customer asks, the whole workspace is deleted within 30 days, unless the law requires something to be kept. The customer can export its commitments before then.
9. Audits
CommitOps answers the customer's reasonable written security questions and questionnaires, once a year or after a breach. CommitOps holds no SOC 2 report or certification today; when it does, it gives the customer the report in place of answering questions the report covers. Where the law gives the customer the right to an audit, CommitOps allows one on 30 days' notice, during business hours, at the customer's cost, and under confidentiality.
10. Transfers outside the customer's country
The service runs in the United States, and some subprocessors may process data in other countries. Where the law requires it for a transfer of personal data from the European Economic Area, Switzerland or the United Kingdom, the parties agree to the European Commission's Standard Contractual Clauses (controller to processor) and the UK addendum, which are incorporated into this agreement by reference, with the customer as data exporter and CommitOps as data importer.
11. Term, liability and order of precedence
This agreement lasts as long as the service does, and then for as long as any customer personal data remains with us. Liability under it is subject to the limits in the terms of service. Where this agreement and the terms disagree about personal data, this agreement wins.
- People concerned
- The customer's staff, and the customer's own customers and prospects who appear in the sources it connects.
- Kinds of data
- Names, email addresses, job titles, what people wrote or said in mail, calls, documents and shared channels, calendar events, CRM records, and work item titles and links. The customer decides what to connect, and should not connect sources holding special category data.
- What we do with it
- Find candidate commitments with a language model, keep each kept quote with a short passage and a pointer to its source, link commitments to work and revenue, and show the results in the app and to agents the customer authorizes.
- How long
- As long as the source stays connected and the workspace exists, then deleted as section 8 says.
The list as of today. The current list, and the feed and email list that announce changes, are on the security page.
| Company | What for | What it receives |
|---|---|---|
| Vercel | Hosts the website and the app | Requests to the app, including the pages you view. Pages can show customer content. |
| Neon | The database | Everything we store, as described above. |
| OpenRouter, and the model providers it routes to | Runs the language models that find candidate commitments | Short passages of text, under zero data retention routing with data collection denied. Nothing is kept or used for training. |
| Sentry | Error reports | Error details with every field that can hold customer content removed before sending. |
| PostHog | Product analytics | Named product events with counts and settings. No customer content, no click capture, no session recording. |
| Stripe | Billing | Your billing contact and payment details. No customer content. |
| Sign-in, and the Gmail, Calendar and Drive access you grant | The requests we make to read the mail, calendar and Drive files you connected, and to create drafts if you turn drafting on. | |
| Microsoft | The Outlook mail and Microsoft Calendar access you grant | The requests we make to read the mail and calendar you connected. |
| Resend | Sends the sign-in link for people who sign in by email. Off until the owner adds a Resend key | Your email address and a single-use sign-in link. No customer content. |
| Integrations you connect | GitHub, GitLab, Linear, Jira, HubSpot, Attio, Salesforce, Pipedrive, Notion, Slack, and your transcript provider (Gong, Zoom, Fireflies or Granola) | What you direct us to send: for example a comment on your pull request naming the commitment it satisfies, or a digest in your Slack channel. |
The measures on the security page marked “in the code”, as they stand on the day of signing.