Data Processing Agreement
Last updated: June 2026
1. Roles
Customer is the data controller. Kooshk Tech is the data processor for Customer Data submitted to the service.
2. Subject matter
Provision of AI assistants, knowledge ingestion, embedding, and related platform features described in the Terms.
3. Categories of data
Account data (name, email), workspace content uploaded by Customer (documents, URLs), and end-user chat messages.
4. Sub-processors
Supabase / Lovable Cloud (EU hosting, database), Lovable AI Gateway (model access), Stripe (billing). Updates listed at /trust.
5. Security
TLS in transit, AES-256 at rest, Row Level Security, multi-tenant isolation, role-based access. Details: Security page.
6. Transfers
Primary processing in the EU. Where transfers occur, the EU Standard Contractual Clauses apply.
7. Data-subject requests
We will assist Customer in fulfilling access, rectification, erasure, and portability requests.
8. Term & deletion
On termination, Customer Data is deleted within 30 days unless retention is required by law.
9. Signing
To execute a counter-signed DPA, email legal@datakooshktech.tech.