Data Processing Agreement
The terms on which we process personal data on your behalf.
1. Scope and precedence
This agreement applies where we process personal data on your behalf and forms part of the Customer Agreement. If there is a conflict on any data protection matter, this agreement prevails.
2. Roles and instructions
You are the controller (or a processor acting for another controller). We are the processor (or sub-processor). We process customer personal data only to provide and support the service, on your documented instructions — including instructions given through your use of the service — and as required by law. We will tell you if, in our opinion, an instruction appears to infringe data protection law.
3. Confidentiality
Our personnel are bound by confidentiality obligations and access customer personal data only where needed to perform their role.
4. Security
We implement appropriate technical and organisational measures, appropriate to the risk: encryption in transit and at rest, access controls, multi-factor authentication, database row-level security, EU hosting and audit logging.
5. Sub-processors
You give general authorisation for us to engage sub-processors. The current list is published at jupiter-day.com/subprocessors. We bind each sub-processor to obligations equivalent to those in this agreement and remain responsible for their performance. We give at least 20 business days' notice of any addition or replacement. You may object on reasonable data protection grounds and, if the objection cannot be resolved, terminate the affected part of the service.
6. International transfers
Customer personal data is stored primarily in the EU (Ireland). Where data is transferred outside the UK or EEA — for example to US sub-processors — the EU Standard Contractual Clauses and the UK International Data Transfer Addendum apply, with appropriate safeguards.
7. Assistance
We assist you, so far as reasonably possible, with data-subject requests (and pass on any request we receive directly), with security, with breach notification, and with data protection impact assessments.
8. Personal data breaches
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us to help you meet your own obligations.
9. Return and deletion
On termination or at your request we delete or return customer personal data in line with the service's retention periods — account data is deleted 90 days after closure, and billing and financial records are kept for 6 years for legal reasons — except where retention is legally required. Backups expire on their own schedule and are not accessible in normal operation.
10. Audit
We make available the information reasonably necessary to demonstrate compliance with this agreement and allow for audits, subject to reasonable notice, confidentiality and limits on frequency. We may satisfy audit requests through third-party certifications where available.
11. Liability and governing law
The liability terms of the Customer Agreement apply to this agreement. This agreement prevails on data protection conflicts. It is governed by the laws of England & Wales.
Annex 1 — Details of processing
Subject matter: provision of the Jupiter Day platform. Duration: the term of the Customer Agreement plus the applicable retention periods. Nature and purpose: hosting, storing, organising and displaying your data, service communications, the Aida AI assistant, and support. Types of personal data: names, email addresses, contact details, task and note content, comments, attachments, and anything else you choose to include. Categories of data subjects: your users, staff, contacts and customers. Special category data is not intended for the service. Please do not upload it unless separately agreed with us.
Annex 2 — Sub-processors
Lovable — hosting, content delivery, email and AI gateway (US/EU). Supabase, running on AWS — database, authentication and file storage (EU — Ireland). Google — Gemini AI inference (US). Mailgun, via Lovable — delivery of our service emails (US). Cloudflare, via Lovable — preview images and static asset delivery (Global; no personal data). Zoho Mail — our own business mailboxes (EU). This list is kept current at jupiter-day.com/subprocessors.