Data processing agreement
Version history.
Every dated version of the data processing agreement, newest first, with what changed in each and whether this site published it before a later version replaced it.
Versions
- 2026-10-08Corrects two statements about email. Deleting an account sends no confirmation email, and the addendum no longer gives as the reason that the product sends no account email. The breach-notice paragraph now says the product emails one account at a time and that no procedure for emailing a set of affected users has been built or exercised. The age rule changes: the children row no longer says accounts are for adults. Sign-up asks for an age and refuses anyone under 13, anyone under 18 needs permission from a parent or guardian, and we still perform no age verification and no verifiable parental consent. Annex I now says the ban on submitting health records applies to what a business customer submits under the DPA, and that the HealthEx connector is a separate personal feature, offered only in the United States and not inside an organisation workspace, which the DPA does not cover. Also states that on the Free plan a chat on the default model goes to a provider AGI chooses, not one you pick: Alibaba Cloud Model Studio, at its international endpoint in Singapore, or OpenRouter’s free router, depending on what is available for that turn. Current version
- 2026-08-17The earliest recorded version. This version applied until the version dated 2026-10-08 replaced it on this site. Read this version
A version’s date is the day its text was settled, which can be earlier than the day this site published it. Earlier versions are shown for reference only; the current version is the one that applies.