Data processing agreement

Customer (controller): Company name, Company number, Address.

Born (processor): [Company legal name], [Company number], [Registered address], [Country].

• Subject: Born stores and processes personal data on the customer's behalf to provide the Born service under the main agreement and the terms of service.
• Duration: as long as the main agreement, plus the time needed to return or delete the data (clause 8).
• Nature and purpose: storing, organizing, searching and displaying customer content; drafting and checking with AI models; sending notification emails; sharing with the agencies the customer chooses.
• Data subjects: the customer's staff and the agency staff they invite; people named in the customer's content (for example contacts, customers in research).
• Categories of data: names, work email addresses, roles; content the customer uploads or writes, which may contain personal data. Born is not designed for special categories of data, and the customer agrees not to upload them.

• Process personal data only on the customer's documented instructions - the main agreement, this DPA and the customer's use of Born's features are those instructions - and tell the customer if an instruction seems to break data protection law.
• Make sure everyone with access is bound by confidentiality.
• Keep the security measures in Annex 2 in place, and improve them over time, never weaken them.
• Help the customer respond to requests from data subjects, and with security, breach notification, impact assessments and consultations, as far as Born's role allows.

The customer authorizes the sub-processors in Annex 1. Born tells the customer at least 30 days before adding or replacing one; the customer may object on reasonable data protection grounds, and if it can't be resolved, end the affected service. Born puts the same data protection obligations on each sub-processor and remains responsible for them.

Where a sub-processor processes personal data outside the EEA, Born makes sure the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the EU standard contractual clauses, with supplementary measures where needed.

Born tells the customer without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting the customer's data - with what's known, what's being done, and a contact - and keeps the customer updated.

Born gives the customer the information needed to show compliance with this DPA, and allows reasonable audits on 30 days' notice, at most once a year unless a breach or regulator requires more, carried out so as not to expose other customers' data.

Content sent to AI providers is used only to produce the answer for that request. The providers in Annex 1 do not use it to train their models.

A customer admin can download all the customer's data from Settings at any time. When the main agreement ends, Born deletes the customer's personal data within 30 days, unless the law requires it to be kept.

Liability under this DPA follows the main agreement. If this DPA and the main agreement conflict on personal data, this DPA wins. Governed by [Governing law, e.g. the laws of Lithuania].

• Encryption: all traffic over TLS; data and files encrypted at rest by the hosting providers.
• Separation: every organization's data is separated by row-level security in the database itself, not only by application code. Automated isolation tests sign in as different organizations and check that nothing crosses over; they run on every change to access rules.
• Least access: agencies see only what a brand shares; sensitive brand-only fields are readable by the server alone; admin-only actions are checked on the server.
• Files: uploads are checked against their real file type before they're accepted; files are stored privately and shared only through short-lived links.
• Abuse limits: per-person and per-visitor rate limits on expensive and public actions, and a monthly AI usage cap per organization.
• Monitoring: error monitoring with private data removed before it leaves Born (no request contents, cookies or addresses).
• Records: an append-only audit log of admin actions, and an activity log on every project that can't be edited or deleted.
• Environments: a separate test environment with test data only; changes are tried there before production.
• Accounts: passwords are hashed by the sign-in provider; invitation links are single-use, expire after 14 days and are stored only as a hash.