Legal
Data processing agreement
Effective 1 October 2026
1. This agreement
This data processing agreement forms part of the terms of service between you and RIGHTBUILDIO LTD ("RightBuild", "we", "us"). It applies whenever we process personal information in your data on your behalf, and it lasts for as long as we do so.
In this agreement, "data protection law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR and any other data protection law that applies to the processing. "Your data" and "service" have the meanings given in the terms of service. If this agreement and the terms of service differ on how personal information is handled, this agreement takes priority.
2. Roles
For personal information in your data, you are the controller and we are your processor. If you are yourself a processor for someone else, we are your sub-processor, and you confirm that the controller has authorized your instructions to us.
This agreement does not cover personal information we handle for our own purposes, such as your account and billing details. We are the controller of that information, and our privacy policy explains how we use it.
3. What we process
| Subject matter and purpose | Providing, securing and supporting the service for you, including hosting your Workspaces, running the features you use, running AI features on your data and sending service emails |
|---|---|
| Duration | For as long as your account is active, and until your data is deleted as described in section 10 |
| People the information is about | Members of your Workspaces, and the people who raise, vote on or comment on Asks, including your customers and other end users of your Asks portal |
| Types of personal information | Names, email addresses, company names, the content of Asks, comments, votes and attachments, inbound emails forwarded to a Workspace, and any other personal information you or your users choose to add |
| Special category information | The service is not designed for special category information, such as health information, and you should not add it |
4. Our obligations
We will:
- process personal information in your data only on your documented instructions, unless the law requires otherwise. Your instructions are the terms of service, this agreement and the way you and your users use and configure the service
- tell you if we believe an instruction breaks data protection law
- make sure that everyone we authorize to handle your data is bound by a duty of confidentiality
- help you, as far as we reasonably can, to respond to requests from people who want to use their data protection rights. If someone sends such a request to us directly, we will pass it on to you and will not answer it ourselves unless the law requires us to
- give you reasonable help with data protection impact assessments and with consulting a data protection authority, where the law requires them and they relate to our processing
- not use your data to train AI models, and not allow our AI model providers to use it to train theirs
5. Your obligations
You are responsible for:
- having a legal basis for the personal information you and your users add to the service, and for giving people any privacy notice the law requires
- making sure your instructions to us comply with data protection law
- the way you configure the service, including who you invite to a Workspace, who can use your Asks portal and which AI assistants you connect through MCP
6. Security
We protect your data with technical and organizational measures that are appropriate to the risk. They include encryption in transit, encryption at rest, access controls that limit staff access to what their role needs, and a record of changes in each Workspace. We may update these measures over time, as long as the overall level of protection does not fall.
7. Sub-processors
You give us general authorization to use sub-processors to help us provide the service. We use the sub-processors below, and we have a written agreement with each one that protects your data to the same standard as this agreement. We remain responsible to you for what our sub-processors do with your data.
| Sub-processor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | App hosting and data storage | Frankfurt, Germany |
| Cloudflare | Content delivery, security and spam protection | Global network |
| Resend | Sending service emails | Europe |
| Anthropic (Claude) | Running AI features | Europe |
If we plan to add or replace a sub-processor, we will update this page and tell account holders at least 30 days before the change. If you object on reasonable data protection grounds, tell us within that time and we will work with you to find a solution. If we cannot find one, you can close your account and we will refund any fees you have paid in advance for the period after it closes.
8. International transfers
Your data is stored on Oracle Cloud Infrastructure in Frankfurt, Germany, unless you are an Enterprise customer who has chosen another region. If we or a sub-processor transfer personal information in your data outside the UK or the European Economic Area, we will rely on an adequacy decision or put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
9. Personal data breaches
If we become aware of a personal data breach that affects your data, we will tell you without undue delay. We will give you the information we have about what happened, the information affected and what we are doing about it, and we will keep you updated as we learn more, so that you can meet your own duties to report it.
10. Return and deletion
You can export your data while your account is active. When an account is closed, we delete your data straight away. Backups are deleted within 30 days. We keep personal information for longer only where the law requires us to.
11. Information and audits
We will give you the information you reasonably need to show that we comply with this agreement. If that information is not enough, you or an independent auditor you appoint may audit our processing of your data. An audit needs reasonable written notice, must take place during normal working hours, must not disrupt the service or put other customers' data at risk, and can happen no more than once a year unless a data protection authority requires it or there has been a personal data breach.
12. Liability
The limits on liability in the terms of service apply to this agreement. Nothing in this agreement limits the rights that people have under data protection law.
13. Contact us
For questions about this agreement, email privacy@rightbuild.io, write to us at 7 Alder Street, Stewarton, KA3 3EU or use our contact form.