Data Processing Addendum

Draft outline — final DPA will be attached to the Master Services Agreement for enterprise customers.

Roles

You are the Controller of your users' personal data. BlueprintPro AI is the Processor. For your individual account, we act as Controller for account-level data.

Scope

This DPA applies to all personal data processed by BlueprintPro AI on your behalf in connection with the service.

Subprocessors

Listed at /trust. Advance notice of new subprocessors is provided; you may object within 14 days.

International transfers

EU Standard Contractual Clauses (module 2 and module 3) attached by reference. Transfer Impact Assessments available on request.

Security measures

See /security and /docs/security for a summary.

Breach notification

We notify the Controller without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting their data.

Data subject rights assistance

We provide machine-readable export of a subject's data within 30 days of a valid request through legal@blueprintproai.app.