Data Processing Agreement

1. Parties, scope and definitions

This DPA is between Cofleet AB, company registration number 559594-0965, Finn Malmgrens väg 52, 121 38 Johanneshov, Sweden (Cofleet), and the Customer identified in the accepted Terms and workspace onboarding record. The Customer's legal identity, address, authorised representative and contact email must be recorded there. Cofleet's privacy and security contact is Markus Gür, markus@cofleet.app.

The DPA forms part of the Agreement when Cofleet processes personal data on the Customer's behalf. It takes effect through acceptance of the corresponding Terms by a person authorised to bind the Customer, or a separately agreed written acceptance. A separate signature is unnecessary where the DPA is validly incorporated and electronically accepted. A separately agreed DPA governing the same processing takes priority. An ordinary user's invitation or sign-in does not independently establish authority to bind the Customer.

GDPR means Regulation (EU) 2016/679. Controller, processor, personal data, processing, personal data breach and supervisory authority have their meanings in applicable data-protection law. Customer Personal Data means personal data Cofleet processes on the Customer's documented instructions, including selected content, derived service records and customer content submitted for support. A Subprocessor is a provider Cofleet engages to process that data for the Customer. Applicable Data Protection Law includes the GDPR and national implementing law and, where applicable to the processing, UK and Swiss data-protection law.

Cofleet is processor where the Customer is controller, and subprocessor where the Customer processes for another controller. In the latter case, the Customer must have the necessary upstream authority and ensure its instructions and appointment of Cofleet comply with that arrangement. Annex I defines the processing. Section 3 separately identifies Cofleet's own controller purposes; that distinction does not weaken the contractual field, purpose, security or retention restrictions.

2. Instructions and customer responsibilities

Cofleet will process Customer Personal Data only on the Customer's lawful documented instructions, including instructions about transfers. The Agreement, agreed configuration, selected sources and users, and further written instructions acknowledged by Cofleet define those instructions. Customer-selected integrations do not authorise unrestricted account access or a new processing purpose. No expansion of data categories or purposes follows merely from updating a website notice.

If EU or Member State law requires processing outside those instructions, Cofleet will inform the Customer before processing unless that law prohibits notice on important public-interest grounds. Cofleet will immediately inform the Customer if an instruction appears to infringe applicable data-protection law or cannot be fulfilled, and pause the affected processing while the issue is resolved.

The Customer must establish the lawful basis, notices, permissions and safeguards needed for its source content and instructions. Cofleet remains responsible for its own legal duties. Source selections and source permissions must be assessed by the Customer; Cofleet does not promise to continuously replicate all source-system permissions.

3. Purpose limits, analytics and AI

Processing under customer instructions includes importing and organising selected content, quick-save capture, memory and retrieval, answering questions, managing workspace access, operational security for the Customer's processing, investigating a requested support issue, and providing customer-specific usage/cost reporting where offered.

Cofleet separately determines the purposes of its business-contact and billing administration, agreement records, website enquiries and marketing subscriptions, and protection of its own accounts and business systems. Cofleet also determines the purpose of using the strictly limited metadata in Annex III to improve its own Service across customers and understand its operation and costs. For those own purposes it acts as controller, must identify an appropriate lawful basis and provide the Privacy Policy and applicable rights. A customer's acceptance of this DPA is not consent on behalf of individuals to those controller purposes. Processing the same identifier for a different purpose does not automatically change the role for all uses of that identifier.

The Annex III analytics restrictions, no-training promise and relevant 30-day closure and 12-month maximum limits bind Cofleet for those metadata uses regardless of its role. Cofleet will not use customer source content, prompts, outputs or memories for cross-customer product improvement. It will not sell personal data, use it for advertising or unrelated profiling, or use or authorise its use to train general-purpose or shared AI models. Generation and embeddings needed for the agreed Service remain permitted under instructions. Imported content is not assumed anonymised or redacted.

No optional product-analytics opt-out is offered at launch. Statutory objection, erasure and other data-protection rights remain applicable and must be assessed under law. Neither this clause nor an internal implementation limit removes those rights.

4. Personnel and security

Cofleet will ensure that every person authorised to process Customer Personal Data is bound by confidentiality or an appropriate statutory duty and processes it only as authorised. Administrative access must be limited to what is necessary, reviewed when responsibilities change and revoked when no longer required. Cofleet's three founders currently have administrative access and work from Sweden. Provider access locations are separately described in Annex III.

Cofleet will implement technical and organisational measures appropriate to the risk under GDPR Article 32, including the measures in Annex II, and regularly assess their effectiveness. It will protect confidentiality, integrity, availability and resilience, maintain appropriate recovery arrangements and evaluate security proportionately to the data and processing. These duties do not represent an independent certification or external-audit claim. Changes must not materially reduce the agreed level of protection.

5. Subprocessors

The Customer authorises the completed and reviewed providers listed in Annex III only for their stated purposes and data categories. Before using a new or replacement Subprocessor, Cofleet will give at least 30 days' written notice, with the provider's identity, processing role, locations and relevant safeguards. The Customer may object within that period on reasonable data-protection grounds. Cofleet must resolve the objection or offer termination of the affected service with a proportionate refund of prepaid unused fees before the provider begins the affected processing. Listing a provider on a website alone is not written notice or authorisation.

Cofleet will enter a written agreement imposing substantially equivalent data-protection obligations, including use only for the authorised service, confidentiality, appropriate security, assistance, transfer safeguards and deletion. Cofleet remains responsible for the Subprocessor's performance of those obligations. It will inform the Customer of a material failure by a Subprocessor and take appropriate remedial steps. On request it will provide the relevant agreement or information needed to demonstrate those obligations, with only necessary redactions to protect third-party confidential information and personal data.

A source, destination or identity provider selected and independently engaged by the Customer is not automatically a Cofleet Subprocessor. Where Cofleet engages a provider to receive Customer Personal Data, it must apply this section even if the service is also used for business administration. The distinction must follow the actual arrangement, not a provider label.

6. International transfers

Account data and Customer Content are hosted in the EU as described in Annex III. EU hosting does not mean that all provider support, operations or global network traffic remain within the EU/EEA. Cofleet must identify the relevant transfers, follow documented instructions and put in place a lawful Chapter V mechanism and any necessary supplementary measures before restricted transfers occur. It must make relevant safeguards available on request, subject to proportionate redaction.

The transfer mechanisms for engaged providers are their applicable data-processing agreements and completed transfer clauses, as identified in Annex III. A link to a public template is not evidence that Cofleet has entered it. Where a transfer between the Customer and Cofleet itself requires the European Commission's Standard Contractual Clauses in Decision 2021/914, those unmodified clauses are incorporated to the extent legally applicable, with the selections in Annex IV. UK and Swiss provisions apply only where their respective laws require them. This DPA alone is not a transfer mechanism and does not displace an applicable adequacy decision or mandatory transfer assessment.

7. Personal data breaches

Cofleet will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event no later than 72 hours after awareness. It will promptly investigate, contain and mitigate the breach and provide information as it becomes available, including its nature, affected categories and approximate numbers where known, likely consequences, measures taken or proposed and a contact for follow-up. An incomplete investigation is not a reason to delay the initial notice; further information may follow in phases.

Cofleet will assist the Customer with its notification and remediation obligations, taking account of the processing and information available to Cofleet. The Customer decides its notifications as controller unless law requires otherwise. Notification or assistance does not itself admit fault or liability.

8. Rights requests and assistance

Cofleet will promptly forward requests concerning Customer Personal Data to the Customer and, unless legally required, will not independently decide or respond substantively without the Customer's instructions. It will provide appropriate technical and organisational assistance so the Customer can meet requests for access, correction, deletion, restriction, portability and objection under applicable law. It may direct a requester to the responsible Customer and make proportionate identity and authority checks.

Taking account of the nature of processing and information available, Cofleet will assist with security obligations, breach assessment and notifications, data-protection and transfer impact assessments and required prior consultation with authorities under GDPR Articles 32–36. Mandatory assistance cannot depend on agreeing an additional fee or resolving a fee dispute first. Any optional additional work or charges require prior express agreement and must not obstruct statutory rights or duties.

Requests concerning Cofleet's separate controller processing go to markus@cofleet.app and are handled without undue delay and within applicable statutory time limits, including any legally permitted extension and timely notice of its reasons. No separate three-working-day acknowledgement or forwarding guarantee is added.

9. Information and audits

Cofleet will provide information needed to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the Customer or its appointed qualified auditor. Existing independent reports may help where available, but no certification or report is promised and reports are not the Customer's only means of audit. There is no fixed annual limit that prevents a necessary compliance inquiry or inspection.

The parties will cooperate on reasonable scope, notice, confidentiality and arrangements protecting other customers and systems. Those arrangements must not obstruct statutory rights, necessary inspection or urgent supervisory-authority access. Cofleet must offer an effective alternative where a particular disclosure would expose unrelated data or confidential material.

Cofleet will retain appropriate non-content compliance evidence for three years after this DPA ends. That does not authorise retaining Customer Personal Data contrary to section 10: remove personal content from evidence, and retain any necessary identifying record only where there is a specific documented lawful purpose and period. The rights of individuals and authorities remain unaffected.

10. Return, closure and deletion

The Customer may request account closure, return or deletion by email to markus@cofleet.app. Workspace deletion is handled on request; no self-service workspace-deletion control is promised. At the Customer's choice when processing services end, Cofleet must securely return Customer Personal Data and delete remaining copies, or delete it, unless EU or Member State law requires retention.

Cofleet must complete requested return and remove active Customer Content and associated personal-data-bearing records within 30 days after account closure. This includes originals, published copies, indexes, embeddings, memories, derived history, jobs, logs, personal-data-bearing audit records and identifiable customer analytics. Cofleet-controlled customer support correspondence, messages, screenshots, files and separate copies follow the same closure deadline. During an active relationship, support history may be kept as needed for that relationship; this is not a rolling 30-day limit on active support messages.

Operational logs expire within 30 days. Cofleet-controlled residual backups must be removed within 90 days after closure, remain protected and unavailable for ordinary use meanwhile, and not recreate deleted records on restoration. Google-controlled residual copies may remain for up to 180 days from an irrecoverable deletion instruction under its Cloud Data Processing Addendum; this does not extend Cofleet's active-data or recoverable-backup limits. Cofleet must promptly instruct providers to delete data no longer needed and track completion and residual expiry. Other provider residuals must be specifically identified and lawfully justified, not presumed unlimited.

In Slack Connect, the Customer and Cofleet may each control their own messages and files under Slack's applicable channel permissions. Cofleet must remove the records and copies it controls and coordinate any necessary customer-side action. It does not promise to erase another organisation's independently controlled copies. Archiving or disconnecting a channel does not by itself satisfy deletion. The same limits apply to downloaded files and support exports in Cofleet's possession.

Cofleet must verify the affected stores, prevent retries and reimports from restoring deleted data, and confirm completion in writing, identifying any permitted residual copies and their deadlines. Connector disconnection stops future access and removes its stored credential but does not automatically delete already imported content or another brain's separate copy.

Earlier valid deletion instructions and applicable legal duties still apply. Data required by EU or Member State law may be retained only for the required purpose and period, under continuing protection and restricted access. Other residual retention requires a specifically disclosed, defined and lawful purpose and period consistent with Article 28. Neither ordinary retention policies nor a controller label authorises keeping customer data beyond these restrictions.

11. Liability, precedence and duration

The Agreement's liability provisions apply between the parties, except where mandatory law or applicable transfer clauses provide otherwise. They do not limit liability to individuals for their data-protection rights or the powers of authorities. Contractual claims for the Customer's group are brought by the Customer party, without restricting mandatory third-party or transfer-clause rights.

Applicable mandatory transfer clauses prevail over this DPA, which prevails over inconsistent provisions of the Terms and other Agreement documents on personal-data matters. This DPA continues while Cofleet or its Subprocessors process Customer Personal Data, including permitted residual copies. A website update does not amend an accepted DPA. New versions require express customer acceptance under the Terms; subprocessor changes follow section 5.

Annex I — Processing details

Subject and duration: Hosted shared knowledge and memory for the agreed service period, followed by the restricted return/deletion and residual-retention periods in section 10. Self-hosted enterprise deployments require separately agreed processing arrangements.

Nature and purposes: Receive selected documents, notes, captures and work communications; extract text and facts; store originals and authorised copies; create embeddings, indexes, memories and summaries; answer questions and retrieve context; provide authorised citations and content through the app, API or MCP; manage permissions, connectors and background jobs; provide instructed support and customer-specific usage/cost information where offered; and return or erase data. Cofleet's separate controller purposes and cross-customer improvement are limited by section 3 and Annex III.

Data subjects: Authorised users and employees, and customer, supplier and other business contacts whose information appears in selected sources or support submissions, including people without Cofleet accounts.

Data categories: Names, business contact details, roles, work communications, selected file contents, notes, quick-save selected text and source application/window titles, source metadata, prompts, context and outputs, account/workspace identifiers, permissions, invitations and timestamps, connector identifiers and protected credentials, operational/security/support records, and limited usage/cost metadata described in Annex III. Derived text, embeddings and memories can contain personal data.

Excluded data: Special-category data under GDPR Article 9, criminal-offence data, national identification numbers, payment-card credentials and other data prohibited by the Terms. Adding these needs a separate written agreement and appropriate safeguards. Accidental submission requires restricted handling and removal, not assumed authorisation.

Frequency and sources: Processing occurs on import, update, capture, query, model processing and other authorised use. Customer-approved systems, sources, destinations and access scopes are recorded in the workspace or onboarding record. Quick-save remains supported. When enabled for the Customer, the GitHub connector processes information from customer-selected repositories within the authorised access scope. Listing a connector here does not establish its availability in a particular deployment.

Annex II — Technical and organisational measures

Access: Authenticated user access, isolated workspaces, database access controls, scoped and revocable API/MCP credentials, least-privilege administrative access and confidential personnel handling from Sweden. Cofleet must verify authorised identities, protect credentials, review access when responsibilities change and revoke it when no longer needed. Multi-factor authentication must protect privileged founder access.

Transport and storage: TLS 1.2 or better on every connection, HSTS on externally served HTTPS surfaces, encryption at rest for the database and stored integration credentials, restricted secret storage, private database networking, non-public customer file storage and authenticated internal worker calls. These measures preserve the existing published security commitments; they require implementation evidence rather than a narrower description of an unresolved gap.

Isolation and assurance: Workspace separation enforced through database access policies, tests of cross-workspace isolation before release, dependency pinning, the published package-quarantine and install-script restrictions, and regular assessment of these controls. No independent certification is asserted.

Recovery and incidents: Protected database backups in EU-hosted infrastructure with restricted access, recovery arrangements preserving workspace controls and reapplying deletion instructions, incident investigation and response, and documented request/closure procedures. Retention and verification follow section 10.

Annex III — Providers, purposes and limits

By accepting this DPA, the Customer authorises the providers below for the specified customer-processing purposes. Later additions or replacements are subject to section 5. Providers used solely for Cofleet's own controller purposes are identified separately; their listing does not expand customer instructions.

Google Cloud EMEA Limited — Ireland

Processing: EU application and self-hosted memory infrastructure, databases, files, secrets, identity/access services, operational monitoring, Vertex AI generation and embeddings. Data includes Customer Content and derived data, prompts/outputs, account/access records, protected credentials and necessary operational metadata. Marketing website objects and the separate registration store also use Google Cloud, under Cofleet's relevant controller purposes rather than an automatic expansion of customer instructions.

Locations and safeguards: Configured regional resources in Belgium, generation through the EU endpoint and configured regional embeddings. Provider operations or support may involve other countries under service-specific commitments. Applicable terms: https://cloud.google.com/terms/data-processing-addendum. Provider facilities and subprocessors: https://cloud.google.com/terms/subprocessors. Processing is governed by the applicable incorporated agreement and transfer safeguards.

Gemini abuse monitoring: Prompts flagged for suspected abuse may be retained up to 90 days for abuse review, separately from Cofleet operational logs. This does not permit model training; no abuse-monitoring exemption is claimed. Underlying Google Cloud residual copies follow section 10's distinct 180-day provision.

Cloudflare, Inc. — United States

Processing: DNS, network security and website/application/API traffic delivery, including the app.cofleet.app edge proxy. Data can include IP addresses, request metadata, headers, authentication information and request/response bodies in transit. Domain registration alone does not describe that access.

Locations and safeguards: Global network and provider support, not limited to the EU. The applicable Self-Serve Subscription Agreement incorporates the Customer DPA and relevant transfer safeguards: https://www.cloudflare.com/cloudflare-customer-dpa/. Subprocessor information: https://www.cloudflare.com/gdpr/subprocessors/. Cofleet logs and recoverable copies follow section 10; provider security records are subject to the applicable agreement and law.

PostHog, Inc. — United States

Processing: Server-side product analytics, service feature-availability checks, reliability diagnostics, AI-usage/cost monitoring, Cofleet's own service improvement across customers and customer usage/cost information where offered. Customer-instructed processing and Cofleet's own controller purposes are distinguished in section 3; all are subject to these limits.

Permitted fields: Product events; user/workspace and run/trace identifiers; timestamps; fixed categories and yes-or-no values; model identifiers; input/output token counts; latency; attempt counts; success/failure status and fixed error categories; daily and month-to-date workspace model-cost totals, including generation/embedding breakdowns and currency. User identifiers may be used for feature-availability checks. Such identifiers can remain personal data.

Excluded fields and uses: No Customer Content, document or source text, prompts, outputs, memory content, names, email addresses, URLs, window titles, raw error messages or payloads, session recordings, advertising data or unrestricted automatic capture may be sent. No advertising, sale, unrelated profiling or general-purpose/shared-model training is authorised.

Location, terms and retention: EU Cloud in Frankfurt, Germany, with any permitted outside-EEA support access governed by the applicable PostHog DPA and transfer safeguards, https://posthog.com/dpa. Retain identifiable telemetry only as needed and no longer than 12 months; remove customer-related identifiable records within 30 days after account closure if earlier. The shorter operational-log deadline still applies. A public DPA link does not replace Cofleet's executed agreement evidence.

Slack Technologies Limited — Ireland (Slack support)

Processing: Customer support and coordination in Cofleet AB's paid company workspace, expected to use Slack Connect. Data may include business contacts, messages, screenshots, files and Customer Personal Data submitted for support. This entry expressly replaces the former blanket exclusion of customer data from support Slack. It does not authorise unrelated analytics or training.

Locations and safeguards: Cofleet purchases its paid plan directly through Slack under the standard online terms, https://slack.com/slack-supplemental-terms, and has completed the provider Data Processing Addendum for Cofleet AB. The applicable DPA governs provider processing and international-transfer safeguards; provider information and the current addendum are available at https://slack.com/terms-of-service/data-processing. Slack processing and provider access can occur outside the EU/EEA, including in the United States; no EU-only storage or access commitment is made. Cofleet-controlled support records follow section 10, including in Slack Connect; another organisation's independently controlled copies remain subject to that organisation's arrangements.

Google Cloud EMEA Limited — Ireland (Google Workspace)

Processing: Business email, website registration confirmations and support requests. If support email includes Customer Personal Data, the applicable customer-processing authorisation, confidentiality and deletion obligations apply to that content. Signup confirmations and ordinary business administration remain distinct controller purposes. Google Cloud's product configuration and agreement must not be assumed to cover Workspace email.

Locations and safeguards: Google Workspace is purchased directly from Google under Cofleet AB's Swedish billing address. The Workspace agreement incorporates the Cloud Data Processing Addendum, https://cloud.google.com/terms/data-processing-addendum, including applicable international-transfer safeguards. Provider facilities, affiliates and subprocessors may process data outside the EU/EEA, including in the United States; see https://workspace.google.com/terms/subprocessors.html. No EU-only Workspace storage or access commitment is made. The application's Google Cloud region does not determine Workspace email locations. Cofleet-controlled customer support copies follow section 10.

Other services and customer-selected connections

Self-hosted Hindsight runs inside Cofleet's Google Cloud infrastructure and is not a separate hosted Subprocessor. Google Fonts delivers public marketing fonts and receives request information under its applicable privacy arrangements; it is not authorised to receive Customer Content. Customer-selected sources, identity services and destinations follow Annex I and their own applicable agreements. A separately engaged provider receiving Customer Personal Data must first satisfy section 5.

Annex IV — Conditional transfer-clause selections

Where legally required for a transfer between these parties, use the unmodified clauses in European Commission Decision 2021/914: Module Two for controller-to-processor and Module Three for processor-to-subprocessor transfers. No optional docking or optional third-party dispute-resolution clause is elected. Clause 9 uses general written authorisation with 30 days' advance notice, preserving section 5. The applicable supervisory authority is determined under Clause 13; for Cofleet's Swedish establishment it is IMY where competent. Clause 17 uses Swedish law and Clause 18 the competent Swedish courts, subject to mandatory rights. The party and processing details, safeguards and authorised Subprocessors are in sections 1–6 and Annexes I–III and the completed customer onboarding record.

For a restricted UK transfer requiring the approved UK Addendum, apply the current legally applicable Addendum to those clauses with the same parties and completed annex information; neither party elects the optional termination choice under its section 19, and the parties must cooperate on mandatory updates. For a restricted Swiss transfer, adapt references only as required by Swiss law, including the Swiss supervisory authority and protected individuals' rights. Applicable mandatory clauses control all conflicts. Before relying on any mechanism, confirm its current validity, completed particulars and actual transfer scope; no module is activated merely by listing it here.

Drafting attribution

This standalone revision adapts Cofleet DPA 1.2 and Common Paper DPA Standard Terms 1.1 under CC BY 4.0: https://commonpaper.com/standards/data-processing-agreement/1.1/ and https://creativecommons.org/licenses/by/4.0/. It consolidates and modifies those provisions, including instructions, purpose/role limits, Subprocessor notice, audits, support handling and deletion. Common Paper's standard terms are not incorporated into this version. Mandatory transfer clauses remain a separate legal instrument where applicable.