Data processing agreement
The terms that apply when Piolet processes personal data on your behalf, for example contacts in a connected CRM.
Last updated 21 October 2026
Roles
For personal data inside your connected tools and agent runs, you are the controller and ALPN Digital Ltd is the processor. For your own account and billing data, ALPN Digital Ltd is the controller as described in the privacy policy.
Instructions and scope
We process personal data only to run the agents you enable, with the settings you choose, against the tools you connect. Enabling an agent, connecting a tool and approving an output are your documented instructions. We do not use customer data to train models.
Sub-processors
- Hosting and database: Supabase and Vercel (EU and US regions, to be confirmed).
- Model providers: Anthropic and others as listed on the agent page, under no-training terms.
- Tool connections: Composio for hosted OAuth, where used.
- Billing: Stripe. Email delivery: Resend.
Security
Data is encrypted in transit and at rest. Connection tokens are encrypted with per-workspace keys. Access is tenant-scoped at the database level with row-level security. Staff access to customer data is logged and limited to support requests you raise.
Breach notification, audits and deletion
We notify you without undue delay, and within 72 hours, of a personal data breach affecting your workspace. We provide the information reasonably needed to demonstrate compliance. On termination we delete or return personal data within 30 days, except where retention is required by law.
International transfers
Where personal data leaves the UK or EEA, transfers rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses with the relevant sub-processor.