Data Processing Agreement

This DPA applies to personal data contained in files you upload to Corgage. You determine the purposes and means of processing; we process that data only on your documented instructions, which are given through your use of the service's features.

Processing covers storage, parsing, analysis, AI-assisted question answering, and generation of reports and presentations from your uploaded datasets. It continues for the duration of your account or until you delete the relevant data.

The categories of personal data and data subjects depend entirely on what you upload. You are responsible for ensuring you have a lawful basis to upload and process that data, and for honoring data-subject requests relating to it.

We process personal data only per your instructions, keep it confidential, and ensure personnel with access are bound by confidentiality obligations.

We implement technical and organizational measures including encryption in transit, authenticated access, and account-level data isolation.

We will assist you, to the extent reasonably possible, with data-subject requests, and will notify you without undue delay if we become aware of a personal data breach affecting your data.

You authorize us to engage sub-processors for cloud hosting and database, payment processing, transactional email, and AI inference, each under written data protection terms no less protective than this DPA. We remain responsible for their performance. A current list is available on request at info@corgage.com.

Where processing involves transfers outside your jurisdiction, we rely on appropriate safeguards provided by our sub-processors, such as standard contractual clauses.

You may delete uploaded datasets at any time from your history. On account termination, we delete or return personal data within a reasonable period unless law requires retention.

We will make available information reasonably necessary to demonstrate compliance with this DPA and will respond to reasonable written audit inquiries.