Data Processing Addendum

This addendum applies where you use SOYL Cloud to process personal data and forms part of the Terms of Service. Where the two conflict on data protection, this document prevails.

Under the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary and we are a Data Processor acting on your behalf. Under the GDPR the equivalent roles are controller and processor.

If you would prefer a signed copy on your own paper, write to ryan.gomez@soyl.cloud and we will sign one.

Subject matter. Providing a service that answers questions from documents you upload.

Duration. For as long as your account is open, plus the deletion window in clause 8.

Nature and purpose. Storage, text extraction, indexing, retrieval, and generating answers using a language model.

Categories of data subject. Your staff who use the service, and any individuals named in documents you choose to upload.

Categories of personal data. Account identifiers and authentication data for your staff. For document content, whatever you upload — which is within your control, and which clause 3 asks you to keep minimal.

We will:

• process personal data only on your documented instructions, which include your use of the service itself;
• not use your content to train models, ours or anyone else’s, and not permit our sub-processors to;
• ensure people with access are bound by confidentiality and have access only where their role requires it;
• implement the measures in clause 6;
• assist you in responding to data principal requests;
• tell you if in our opinion an instruction you give us would breach applicable law.

What we ask of you. SOYL is designed for operational documents. Please do not upload guest databases, payment card data, or health records. The service has no feature that needs them, and uploading them creates obligations for you that the product is not designed to help you meet.

You give general authorisation for the sub-processors below. We will update this page and email your nominated contact at least thirty days before adding a new one. If you object on reasonable data protection grounds, tell us within those thirty days and we will either find an alternative or let you terminate without penalty.

We remain liable to you for our sub-processors’ acts and omissions as if they were our own.

This clause is separated out because it is the one most likely to matter to your own review, and we would rather you read it here than discover it later.

Microsoft retains prompts and the model's responses for up to thirty days for abuse monitoring, and may review them where automated systems flag a potential policy violation. Microsoft does not use this content to train its models. We have chosen to leave abuse monitoring enabled because it is currently the only control watching for misuse of the model, and we will disclose here if that changes.

In practice, what reaches the model is your question plus the passages retrieved to answer it — never a whole document, and never your document library. We strip identifiable personal data patterns before the call where we can detect them.

If your own obligations require zero retention by the model provider, tell us. Disabling abuse monitoring is possible and we will discuss it with you, along with what we would put in its place.

Separation between customersis enforced in the database, not in application code. Every table carrying customer data has a policy attached to it that the application cannot bypass, and an automated test suite proves one customer cannot read another’s rows. That suite cannot be skipped before a release.

Encryption. TLS in transit; encryption at rest for both the database and document storage.

Authentication. Passwords hashed with Argon2id. Sessions are revocable immediately rather than expiring on their own.

Access control and logging. Production access is limited to those who require it. Every access to customer data through administrative tools is recorded in an append-only audit log.

Provenance. Every factual statement in an answer must reference a passage that was actually retrieved. Statements that cannot be traced are removed before the answer is shown, and the removal is logged.

We will notify your nominated contact without undue delay, and in any case within seventy-two hours of becoming aware of a personal data breach affecting your data. The notification will describe what happened, what data was involved, what we have done, and what we recommend you do.

We will not delay notification while we complete an investigation. You will hear from us with an incomplete picture rather than late with a complete one.

On termination, or at any point on request, we will return your data in a usable format and delete it. Deletion covers the original files, extracted text, all derived passages and all embeddings.

Encrypted backups may hold a copy for up to thirty days, after which they expire on their own schedule. We will confirm deletion in writing on request.

On reasonable notice and no more than once a year, we will answer a written security questionnaire and provide evidence of the measures in clause 6. Where that is insufficient for your own obligations, we will discuss an on-site or third-party audit at your cost.

Some sub-processors in clause 4 operate outside India. Where personal data is transferred outside India, we rely on the transfer mechanisms permitted under the DPDP Act and, where the GDPR applies, on Standard Contractual Clauses.

If you require data residency within a specific jurisdiction, tell us before you upload anything. It is a solvable problem, but it is a configuration decision rather than something we can apply retrospectively.