Data processing agreement

Who is who

This agreement is between the customer of a workspace (you, or the organisation you act for) and MySmartCoPilot. MySmartCoPilot (mysmartcopilot.com) is operated by MySmartCoPilot Support Team. In these pages, “MySmartCoPilot”, “we”, “us” and “our” mean MySmartCoPilot Support Team. It is part of the workspace terms (version workspace-terms-6), and you accept it with them.

• You decide why and how the personal data you collect with the tools is used: you are its controller, in India its Data Fiduciary, and under the California Consumer Privacy Act the “business”.
• MySmartCoPilot processes it for you: we are your processor, in India your Data Processor, and under the CCPA your “service provider”.
• It covers the personal data in your workspace: what forms collect, the files sent with answers, and the facts and files you give an automated run. The data of your own workspace account (your sign-in, your members, your orders) is ours to look after, as the privacy policy says, and so are quick surveys, whose creators have no account.

What we process

• Purpose. Running the workspace tools for you: storing forms and answers, sending confirmations and notifications, the summaries and analysis you ask for, and the automated runs you start.
• Kinds of data. What your forms ask for, such as names, contact details and answers; files; sealed answers about bank details, health or identity numbers; the facts and files of a run; and a daily keyed code of the connection a form was sent from, unless the form is set so that its owner can’t see who sent it.
• Whose data. The people who fill in your forms, your leads and contacts, and the people named in the files and facts you give us.
• How long. As long as your workspace keeps it, then as Return and deletion says.

Your instructions

We process the personal data in your workspace only on your documented instructions: these terms, this agreement, your workspace’s settings and what you and your members do in it. If we believe an instruction breaks the law, we tell you. If the law makes us process it otherwise, for example to answer a lawful order, we tell you first unless the law forbids it.

Who can see it

The people and automated agents who operate MySmartCoPilot see only counts, states, categories and times, never a workspace’s content. They can read content only under support access that the workspace’s owner gives, for 72 hours, and every read is written to that workspace’s audit log. Everyone who operates MySmartCoPilot is bound to keep what they see confidential.

Security

We protect the personal data in your workspace with the measures of the security schedule, which says plainly what they are and where their limits lie. The India schedule sets them beside each of the reasonable security safeguards that India’s rules list.

Sub-processors

• You allow us to use the kinds of sub-processors on the sub-processor list, which names each by what it does and the countries where it processes data.
• Each is bound by a contract with data-protection duties like ours, and we remain responsible to you for what it does.
• We tell workspace owners by email at least 30 days before we add or replace one. You may object in writing within those days; if we can’t meet the objection, you may stop using the workspace tools and delete your workspace, after exporting what you need.
• Once India’s Digital Personal Data Protection Rules give the people in your data the right to know who processed it, we send the names of our sub-processors to a workspace owner who asks in writing, by email. We never publish them on a page.

Help with requests and duties

• The workspace has the tools you need to answer people about their data: find and delete one person’s answers, export, and correct records.
• When you need more, we help you in time to answer within the 90 days India’s rules give you, and within the time any other law sets. A request we receive directly about your data goes to you, and we answer it ourselves only to say so.
• We help, as far as our information allows, with your assessments of risk and with questions from a regulator about your workspace.

Personal data breaches

If personal data in your workspace is breached, we tell the workspace’s owners and admins by email and in the workspace within 24 hours of our becoming aware, with what India’s rule 7 asks you to give the people affected and the Board:

• what happened: its nature and extent, when it happened and where;
• the consequences it is likely to have for the people affected;
• what we have done and are doing to reduce the risk;
• what the people affected can do to protect themselves;
• how to reach us about it: the MySmartCoPilot Support Team, through the contact form or support@mysmartcopilot.com.

We add details as we learn them, in time for your own reports, and we report incidents to India’s CERT-In within 6 hours of noticing them where its directions ask for it.

Return and deletion

• You can export and delete the data in your workspace at any time; an export is ready to download for its owner and admins after a fresh sign-in.
• When a workspace is deleted, its public pages go dark at once and its data is deleted from our live systems after a 30-day grace period, or at once if you ask.
• Its keys are deleted with it, so its files and sealed answers cannot be opened again once the backups that hold it have aged out: 7 days for our own copies, and on its own schedule for our hosting provider’s daily snapshots.
• Its security log, with the IP addresses sealed, is kept for its 180 days after the workspace is deleted, as India’s CERT-In requires, and so is the sealed copy of each of its days that we keep in India; both are used only to look into incidents and where the law requires it.
• Once rule 8(3) of India’s Digital Personal Data Protection Rules applies, a sealed copy is kept for one year where that rule requires it, used only for what the rule allows, then deleted.
• What another law makes us keep, such as our own orders and receipts, is kept only for that law and used for nothing else.

Information and audits

This agreement, the security schedule and the sub-processor list show how we meet our duties. We answer reasonable written questions about them within 30 days. Where a regulator or the law requires more, we give it the information it needs, in a way that never shows another customer’s data or weakens our security.

India schedule

In India this agreement follows the Digital Personal Data Protection Act 2023 and its Rules and, until those duties apply, the Information Technology Act and its rules on sensitive personal data (the SPDI Rules 2011). You are the Data Fiduciary and we are your Data Processor.

Security safeguards (rule 6)

• Encryption and masking: files and sensitive answers encrypted at rest with your workspace’s own keys, and Aadhaar numbers kept as their last four digits.
• Access control: roles in every workspace, checked on every request, a fresh sign-in before sensitive actions, and operators who see no content.
• Logs and monitoring: a 365-day audit log of who did what in the workspace, and a 180-day security log with the IP addresses sealed, of which a sealed copy of each day is kept in India for 180 days.
• Continued processing: encrypted backups every night, kept 7 nights, and our hosting provider’s own daily snapshots.
• Keeping logs for a year: the audit log is kept 365 days, and once these Rules apply each sealed daily copy of the security log is kept for one year.
• Contracts: this agreement, and contracts with data-protection duties for every sub-processor.
• Organisation: written rules for everyone who operates MySmartCoPilot, requests signed with a key kept off our servers for anything outside our fixed rules, and an incident plan.

Breach notice (rule 7)

Within 24 hours of our becoming aware, with the details of Personal data breaches.

Erasure and the one-year hold (rule 8)

Data is erased as Return and deletion says. Once rule 8(3) of India’s Digital Personal Data Protection Rules applies, a sealed copy is kept for one year where that rule requires it, used only for what the rule allows, then deleted.

Requests from the people in your data

We help you answer them within the 90 days India’s rules give you (see Help with requests).

Sensitive personal data

No form may ask for passwords, PINs, one-time codes, card numbers or CVV. Bank details, health details and identity numbers are sealed to your workspace’s key as soon as they are sent, and a form that asks for them shows this consent text (version spdi1):

Some questions on this form ask for sensitive personal information: bank details, health details or identity numbers. The people who run this form collect it for the purpose this form states. It is sealed as soon as you send it, kept by MySmartCoPilot on their behalf, and only they can open it. You don’t have to answer these questions, and you can withdraw your consent at any time by writing to them. Tick the box to agree to this information being collected and used for that purpose.

Any 12-digit Aadhaar number you enter is kept as its last four digits only.

Children

A form marked as one that people under 18 may answer uses no AI and no tracking. You obtain a parent’s or guardian’s verifiable consent where the law requires it.

United States clause

Where the California Consumer Privacy Act or a similar US state privacy law applies to the personal information in your workspace, MySmartCoPilot acts as your service provider (or processor, as other state laws call it), and:

• we do not sell or share that personal information;
• we do not retain, use or disclose it for any purpose other than running the workspace tools for you as these terms and your instructions describe, nor outside our direct relationship with you;
• we do not combine it with personal information we receive from others or collect ourselves, except as those laws allow;
• we follow those laws and give it the level of privacy protection they require;
• we tell you if we can no longer meet these duties, and you may then take reasonable steps to stop and correct any use that is not allowed;
• you may take reasonable steps to make sure we use it as these terms say.

We understand these restrictions and will comply with them.

Where the workspace tools are not offered

The workspace tools are not offered in the European Union, the European Economic Area, the United Kingdom, Jersey, Guernsey, the Isle of Man, Gibraltar or Switzerland, so this agreement has no annex for their data protection laws and no standard contractual clauses. Please don’t use the tools to collect data about people there (see the acceptable use policy).

Accounts you connect

If you connect an account of your own to a workspace, such as your own AI key or the accounts of your online store, that company processes what the tools send it under your own agreement with it. It is your choice, not our sub-processor. We send it only what the task you asked for needs.

Security schedule

What protects the data in your workspace, stated as it is:

• Separation between our components is in the application: every part of the workspace tools runs in one hosting account.
• Files and sensitive fields are encrypted at rest with per-workspace keys.
• Our backups are encrypted and kept 7 nights in India, on a full-disk-encrypted machine.
• The hosting provider keeps its own daily account snapshots on its own schedule, which hold the rest of the database as stored.
• A 365-day audit log and a 180-day security log.
• Automated runs are made by software, with no person reading the inputs.

Because every part runs in one hosting account, the separation protects against mistakes in our code and our database queries; it does not stand against someone who could run code on that account. Alongside it:

• Every page and answer travels over HTTPS, and every page runs under a strict Content Security Policy.
• Public forms, shared results and files are served from their own addresses, where we set no cookies and run no third-party code except the bot check.
• Uploaded files are encrypted as they arrive, checked for active content and never kept in clear on our servers.
• Deleting a workspace deletes its keys, so its files and sealed answers cannot be opened again once the backups that hold them have aged out.
• Every request to a workspace is checked against its members and their roles; the checks are tested on every release with two test workspaces, each trying to reach the other.
• Sensitive actions ask for a sign-in within the last 10 minutes: exporting, opening sealed answers, changing roles, transferring or deleting a workspace.
• The people and automated agents who operate MySmartCoPilot see counts and states, not a workspace’s content, unless its owner gives support access.
• Refunds, restores and grants outside our fixed rules need a request signed with a key that is kept off our servers.
• A written incident plan covers detection, notice to you within 24 hours, and reports to India’s CERT-In within 6 hours.

Changes to this agreement

A change to this agreement gets a new version id and a new version of the workspace terms, which you accept as the workspace terms say. A change never lowers the protection the version you accepted gives the data already in your workspace without your agreement, unless the law requires it.

This is version dpa-3 of the data processing agreement.

Contact

Questions about this agreement or a request about your workspace’s data? Use the contact form (topic “Privacy or data request”) or email support@mysmartcopilot.com.