Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Softriq Ltd ("Softriq", the "Processor") and the business that uses Memlira (the "Customer", the "Controller").
1. Definitions
"Data Protection Law" means the laws that apply to the processing, including the UK GDPR and the Data Protection Act 2018, and, where they apply, the EU GDPR and the data protection laws of the countries where the Customer operates. "Customer Personal Data" means personal data in the data the Customer's systems provide to the Service, and in its members' questions. Other terms have the meaning given in Data Protection Law.
2. Roles
2.1 The Customer is the controller of Customer Personal Data. Softriq processes it on the Customer's behalf.
2.2 For members' account details and security information, Softriq is a controller, as described in the Privacy Policy.
2.3 The Customer is responsible for having a lawful basis for the personal data it connects, for giving any notices required by law to the people in its records, and for making sure its instructions to Softriq comply with Data Protection Law.
3. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing Memlira: syncing data from the Customer's store or systems (including orders, customers, products and stock levels where the source has them), answering members' questions about it, and keeping a record of how each answer was calculated |
| Duration | The term of the Customer's plan, then deletion under section 11 |
| Nature and purpose | Syncing and storing records; searching and calculating answers; transcribing voice questions; showing answers with their sources; quality review to correct errors; security and support |
| Types of personal data | Names, phone numbers, cities and other fields in the Customer's records (for example customers in orders and invoices); members' questions, including text transcribed from voice |
| Data subjects | The Customer's customers and other people named in its records; the Customer's members |
| Special category data | Not intended. The Customer must not connect it (Acceptable Use Policy, item 2) |
4. Instructions
4.1 Softriq processes Customer Personal Data only on the Customer's documented instructions, including for international transfers, unless the law requires otherwise; in that case Softriq tells the Customer first, unless the law forbids it. These Terms, this DPA and the Customer's settings in the Service (for example the sources it connects and its members' permissions) are those instructions.
4.2 Softriq will tell the Customer if it believes an instruction breaks Data Protection Law.
4.3 Softriq does not use Customer Personal Data to train any AI model.
5. AI models
5.1 The AI model does not receive values from the Customer's records. It receives the question, the names of available data types and fields, metric definitions and company terms. Softriq's software queries the data and fills in every value in the answer.
5.2 The only exception is column mapping for an uploaded file: the model receives the column headers and the format of a few values in each column, never the values themselves. A header that is itself data (for example a name, a date or a phone number) is replaced with a placeholder before it is sent.
5.3 Voice recordings are sent to the transcription provider, transcribed and deleted immediately. They are not stored.
6. Confidentiality
Softriq ensures that people it authorises to process Customer Personal Data are bound by confidentiality. Access by Softriq staff to values in Customer Personal Data requires a written reason, is limited in time, and is logged (Annex A).
7. Security
Softriq applies the technical and organisational measures in Annex A. Softriq may improve them, but will not reduce the overall level of protection.
8. Subprocessors
8.1 The Customer authorises the subprocessors in the Subprocessors list.
8.2 Softriq will give at least 14 days' notice before adding or replacing a subprocessor, by email to workspace owners and on the Subprocessors page. The Customer may object on reasonable data protection grounds within that period, by email to [email protected]. If the parties cannot resolve the objection within 30 days, the Customer may end the affected service, and Softriq refunds any prepaid fees for the unused period.
8.3 Softriq imposes data protection terms on each subprocessor that are no less protective than this DPA, and remains responsible for them.
9. International transfers
Customer Personal Data is hosted in Germany (European Union). AI model and transcription providers process data in the United States. Where Data Protection Law requires it, Softriq relies on the European Commission's standard contractual clauses with the UK International Data Transfer Addendum, or another transfer mechanism recognised by Data Protection Law, in its agreements with those providers.
10. Personal data breaches
Softriq will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations.
11. Deletion or return
11.1 The Customer can disconnect a source at any time, which deletes the data synced from it.
11.2 When the owner deletes the workspace, access stops immediately and Customer Personal Data is deleted after 30 days, unless the law requires Softriq to keep it. Before deletion, the Customer can ask for a copy of its data at [email protected], and Softriq will provide it in a common format. This is how the Customer chooses between return and deletion.
11.3 Encrypted backups are kept for up to 30 days and are then deleted.
12. Assistance
12.1 Softriq will help the Customer respond to requests from data subjects, taking into account the nature of the processing. If Softriq receives a request directly, it will refer the person to the Customer.
12.2 Taking into account the nature of the processing and the information available to it, Softriq will provide reasonable help with the Customer's obligations on security, personal data breaches, data protection impact assessments and consultations with authorities.
13. Audits
Softriq will make available the information reasonably needed to show compliance with this DPA, and allow audits on reasonable notice, no more than once a year unless required by an authority or after a breach. Audits must not disrupt the Service or give access to other customers' data, and are subject to confidentiality.
14. Liability and precedence
Each party's liability under this DPA is subject to the limits in section 9 of the Terms, except where the law does not allow it. If this DPA and the Terms conflict on personal data, this DPA applies.
Annex A · Security measures
Only measures that exist in Memlira today are listed.
| Area | Measure |
|---|---|
| Separation between customers | Each workspace's data is separated by row-level security enforced by the database itself. No database role can bypass it, including our own administration role |
| Separation between members | Each member's questions are visible only to that member, also enforced by the database. Members see only the data types their workspace allows |
| Encryption in transit | TLS for all connections. The server accepts connections only through our network provider, with mutual TLS |
| Encryption at rest | Encrypted server disks. Secrets are stored encrypted, and the decryption key is never stored on the server |
| Backups | Encrypted nightly backups, kept 14 days on the server and pulled to a separate encrypted copy controlled by Softriq, which the server cannot reach. Restoring from a backup is tested before launch and then monthly |
| Accounts | Passwords stored as one-way hashes. Two-step verification required for owners and admins, and for all administration accounts. Sensitive changes (email, ownership) require re-authentication and send notices |
| Least privilege | Separate database roles for the application, reading, syncing and administration, each with only the access it needs. Our administration roles are separate from customer accounts |
| Administrative access | Access to values in customer data requires a written reason, expires automatically (60 minutes by default), notifies our senior administrators immediately, and is logged. Quality review hides names and numbers by default |
| Audit | Changes in a workspace are logged and visible to its owner, including changes made by our team. Our administration actions are logged separately |
| Server access | Databases and internal services are not exposed to the internet. Server login by key only, through a private network in production |
| Emails and notifications | Emails and lock-screen notifications never contain values from customer data |
| AI providers | Models do not see values from customer data (section 5). Under their business terms, providers do not train on the data we send |