Legal
Data Processing Addendum
A2Zai · A2Z Agentic Solutions Ltd · Version 2026-09-23 · accompanies Terms 2026-09-23c
1. Roles
For personal data in Customer content processed through the Service, the Customer is the controller and A2Z Agentic Solutions Ltd is the processor (UK GDPR / Data Protection Act 2018). For account and billing data needed to operate the Service, A2Z Agentic Solutions Ltd acts as an independent controller.
2. Purpose & instructions
We process Customer personal data only to provide A2Zai (administrative intake, drafting assistance, security, audit, support, and billing) and in accordance with documented instructions in the Agreement, including these Terms and this DPA.
3. Location & training prohibition
Processing for inference and draft handling occurs on United Kingdom hardware in Staffordshire. Customer content and prompts are not used to train public or Vendor foundation models. Binding zero-data-retention for training applies. Edge authentication and card payments may use named processors (Cloudflare Access; Stripe) as disclosed in the Agreement — those processors do not run inference. Default draft mode is ephemeral (session/RAM) unless durable retention is enabled.
4. Security measures
Appropriate technical and organisational measures include access controls, session idle timeouts, upload type/size limits, optional IP allowlisting, De-ID / Stay-on-Page where configured (Documents extractive; chat buffered-strip), hash-chained operator audit events, and encryption in transit to the Service. De-ID is pattern-based scrubbing, not a guarantee of full anonymisation.
5. Sub-processors & retention
Card payments are processed by Stripe (payment data does not touch A2Zai). Optional email/SMS providers (if enabled by the Customer) process only what those channels require. Customer content defaults to session/RAM unless durable mode is enabled. Operational logs are limited to what is necessary for security, audit, and support.
6. Assistance & deletion
We assist with data-subject requests and deletion where technically feasible given the selected draft mode. On written request after end of Service, we delete or return Customer content under our control, except records we must retain by law or for billing disputes.