Data processing agreement

1. Scope

This data processing agreement ("DPA") is part of the terms of use between Saira SAS, which publishes Waken ("we", the processor), and the customer using Waken ("you", the controller).

It applies whenever we process personal data on your behalf while running your agents, as required by article 28 of Regulation (EU) 2016/679 ("GDPR"). It does not cover the data of your own Waken account, such as your email and your plan, which we process as a controller under our privacy policy.

2. Details of the processing

• Subject and purpose: hosting and running your agents: storing their files, memory, checkpoints and conversation history, relaying their messages, and running the code you deploy.
• Data subjects: whoever your agents hold data about, such as your users, your customers, your team, or the people your agents talk to through Telegram, Discord or Slack.
• Categories of data: whatever you or your agents put in them: files, messages, logs, and the data your code collects. We do not choose or inspect it.
• Special categories: you decide what your agents process. If they process special categories of data, you are responsible for having a legal basis and for the extra safeguards it requires.
• Duration: as long as you use Waken, then until deletion under section 9.

3. Instructions

We process personal data only on your documented instructions: the terms of use, this DPA, and the way you configure and use Waken. We tell you if we think an instruction breaks data protection law.

Your agents call AI models with your own API key or subscription, under your own agreement with the model provider. That provider, and Telegram, Discord or Slack when you connect them, are chosen and contracted by you: they are not our sub-processors.

4. Confidentiality and security

The people who can access your data are bound by confidentiality. We apply technical and organisational measures that include:

• each agent in its own virtual machine, isolated from the others;
• encryption in transit (TLS) and at rest for agent disks, checkpoints and our database;
• model API keys kept only in the agent's memory, never in our database or logs;
• Waken API keys and sign-in tokens stored as hashes, and administrative access limited to a short named list;
• daily encrypted backups kept in the European Union.

5. Sub-processors

You authorise us to use the sub-processors below. We bind them to data protection obligations equivalent to this DPA and remain liable for them. We announce any new sub-processor by email at least 30 days in advance. You can object on reasonable grounds and, if we cannot agree, end the affected service.

• Scaleway SAS, France (EU): Runs the agents and the API, stores their disks and checkpoints, keeps our encrypted backups.
• Vercel Inc., United States: Hosts the dashboard, which displays agent files, logs and conversations when you open them.

6. International transfers

Your agents run and stay in the European Union. When personal data leaves the European Economic Area, for example when you open your agent in the dashboard, the transfer relies on an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, or on the standard contractual clauses of the European Commission.

7. Assistance

You can find, download and delete your agents' files yourself, from the dashboard, the CLI or the API, which lets you answer requests from data subjects. We also help you, as far as the nature of the processing allows, with security, impact assessments and prior consultation of a supervisory authority.

8. Personal data breaches

We tell you without undue delay, and within 48 hours where we can, after becoming aware of a personal data breach that affects your data, with the information we have to help you meet your own obligations.

9. Deletion and return

When you delete an agent or your account, its machines, files and checkpoints are erased from our servers at once, and from our backups within 30 days, unless the law requires us to keep them. Before that, you can download your files at any time.

10. Audits

We make available the information needed to show that we comply with this DPA. Once a year, at your own cost and with 30 days of written notice, you can have an audit carried out by an independent auditor bound by confidentiality, during business hours and without disrupting the service.

11. Contact

For a question about this DPA or a countersigned copy, write to hello@waken.sh. Saira SAS, 173 rue de Courcelles, 75017 Paris, France.