Tebelis AI — Data Processing Agreement (DPA)

How this DPA applies: this DPA is incorporated by reference into the Terms of Service and forms part of them. It applies to every customer, on every plan, without a separate signature. Enterprise customers who require a signed copy may request one; its terms are the same. Where this DPA conflicts with the Terms on data-protection matters, this DPA prevails.

Effective date: 1 October 2026

Last updated: 5 October 2026 (§7, §9 and Annex II, effective from that date)

This Data Processing Agreement ("DPA") is between the customer ("Customer", the controller) and Tebelis AI, a French SASU (registered office 173 rue de Courcelles, 75017 Paris; RCS Paris / SIREN 107 153 819) ("Tebelis AI", the processor), and governs the processing of Customer Personal Data in connection with the Tebelis AI platform (the "Service"). Capitalised terms not defined here have the meaning given in the Terms.

1. Definitions

"GDPR" means Regulation (EU) 2016/679, and "UK GDPR" the UK-retained version. "Data Protection Law" means the GDPR, the UK GDPR, the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978) and any other data-protection law that applies to the Processing of Customer Personal Data. "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Personal Data Breach", and "Supervisory Authority" have the meanings in the GDPR. "Customer Personal Data" means Personal Data within Customer Data that Tebelis AI Processes on the Customer's behalf. "Sub-processor" means a third party engaged by Tebelis AI to Process Customer Personal Data. "SCCs" means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and "UK Addendum" the UK International Data Transfer Addendum.

2. Roles and scope

2.1 The Customer is the Controller (or, where the Customer is itself a processor for a third party, the processor) of Customer Personal Data; Tebelis AI is the Processor (or Sub-processor). Each party complies with its obligations under Data Protection Law.

2.2 This DPA applies to Tebelis AI's Processing of Customer Personal Data for as long as that Processing continues (see §12.2). Annex I describes the Processing.

2.3 This DPA does not apply to Personal Data for which Tebelis AI acts as an independent controller (account registration, billing, security, and website data); that processing is described in the Privacy Policy.

3. Processing on instructions

3.1 Tebelis AI Processes Customer Personal Data only on the Customer's documented instructions, including as set out in this DPA and the Terms and as configured by the Customer through the Service. Operating, securing, and supporting the Service in accordance with the Terms constitutes such instructions. This includes diagnosing and correcting faults in the Service, which may require authorised Tebelis AI personnel to review the content of an AI-assistant conversation to establish why the assistant behaved incorrectly. Such review is limited to what is necessary to identify and fix the fault, is carried out on the same EU-region infrastructure and by the same Sub-processors listed in Annex III, and is never used to train any AI model (see §3.2).

3.2 Tebelis AI will inform the Customer if, in its opinion, an instruction infringes Data Protection Law (without obligation to provide legal advice). Tebelis AI will not Process Customer Personal Data for its own purposes, and will not use Customer Personal Data to train its or any third party's AI/foundation models except on the Customer's documented instruction.

3.3 If Tebelis AI is required by EU or Member-State law to Process beyond the instructions, it will inform the Customer first unless that law prohibits it.

4. Confidentiality

Tebelis AI ensures that personnel authorised to Process Customer Personal Data are bound by confidentiality and are trained on their obligations, and limits access to those who need it to provide the Service (least privilege).

5. Security

Tebelis AI implements appropriate technical and organisational measures under Article 32, as described in Annex II, and may update them provided the level of protection is not materially reduced.

6. Sub-processors

6.1 The Customer gives general authorisation for Tebelis AI to engage Sub-processors to Process Customer Personal Data. The current Sub-processors are listed in Annex III (the public sub-processor list).

6.2 Tebelis AI imposes data-protection obligations on each Sub-processor that are substantially equivalent to those in this DPA, and remains liable for its Sub-processors' performance.

6.3 Tebelis AI will give the Customer prior notice, at least 30 days in advance, of any new or replacement Sub-processor (by updating the Sub-processors page, and by email to every Customer that has subscribed to sub-processor updates by writing to [email protected]). The Customer may object on reasonable data-protection grounds within 30 days of that notice; the parties will work in good faith to resolve it, and if they cannot, the Customer may terminate the affected part of the Service.

7. Data-subject requests

Taking into account the nature of the Processing, Tebelis AI assists the Customer, by appropriate technical and organisational measures and insofar as possible, to respond to Data-Subject requests (access, rectification, erasure, restriction, portability, objection). The Service provides self-serve tools for the Customer to export a user's data and to erase a user's account. Where a user also belongs to another workspace, the Customer removes the user from its own workspace, and Tebelis AI erases the account at the user's request. The Customer cannot erase the account of its only administrator either: where other users have activated accounts in the workspace, the erasure is refused until one of them is made an administrator; where that administrator is the only user, Tebelis AI erases the account at the user's request, and the workspace is deleted with it as set out in §9.2. Erasure disables the account immediately and, after a 30-day grace period, irreversibly anonymises it and deletes the user's own AI-assistant conversations. The user's name remains on the records they created or took part in, which remain records of the Customer as controller (see the Privacy Policy, §10). If a Data Subject contacts Tebelis AI directly about Customer Data, Tebelis AI will refer them to the Customer.

8. Assistance, breach notification, DPIAs

8.1 Tebelis AI assists the Customer in ensuring compliance with Articles 32–36 (security, breach notification, and data-protection impact assessments / prior consultation), taking into account the nature of Processing and the information available to Tebelis AI.

8.2 Tebelis AI notifies the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information reasonably available to help the Customer meet its own notification duties.

9. Deletion and return

9.1 On termination of the Service, Tebelis AI deletes or returns Customer Personal Data per the Customer's choice, subject to the retention described in the Terms and Privacy Policy: a post-termination export window, then deletion/anonymisation, with recoverable (recycle-bin) records purged on their schedule and routine backups expiring on a rolling cycle. Tebelis AI may retain data where required by law (for example, billing records), and keeps append-only audit and security logs until the end of the retention periods stated in the Privacy Policy.

9.2 Where the Customer's only user, who is also the administrator of the Customer's workspace (no other user has activated an account in it), asks for their account to be deleted, Tebelis AI treats the request as the Customer's instruction to delete the workspace, and §9.1's post-termination export window does not apply. When Tebelis AI schedules the deletion, the workspace is locked at once: none of its users can use it, and its API keys, connected applications, public form links and routines stop working. The deletion date is 30 days after Tebelis AI schedules the deletion. Until that date, at the user's request, Tebelis AI may cancel the deletion, which unlocks the workspace (unless Tebelis AI had suspended it for another reason); once the deletion has started on that date, it can no longer be cancelled. On that date, Tebelis AI permanently deletes the workspace's content, including its records (also those in the recycle bin), attachments, files and AI-assistant conversations, deletes the workspace's API service account and the accounts of people invited to the workspace who never activated them (unless they also belong to another workspace), and erases the user's account as described in §7. Tebelis AI keeps the workspace's audit-log entries, which can include earlier values of record fields, until the end of the audit-log period stated in §8 of the Privacy Policy, keeps AI-usage and billing records for the periods stated there, and keeps an anonymised placeholder of the workspace to which those records refer. Backups expire on their rolling cycle.

10. Audits

Tebelis AI makes available to the Customer information reasonably necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections. To minimise disruption, audits are on reasonable prior notice, no more than once per 12 months (unless required by a Supervisory Authority or following a Personal Data Breach), during business hours, subject to confidentiality, and may be satisfied by Tebelis AI's then-current third-party reports or documentation where available.

11. International transfers

11.1 Tebelis AI hosts Customer Personal Data in the EU (see Annex III for hosting region(s)); some Sub-processors listed in Annex III process limited data outside the EEA. Where Customer Personal Data is transferred to a country without an adequacy decision, the parties rely on an appropriate safeguard, primarily the SCCs (Module Two, controller-to-processor, or Module Three, processor-to-processor, as applicable) and the UK Addendum for UK data, which are incorporated by reference into this DPA and completed with the details in the Annexes. If this DPA conflicts with the SCCs, the SCCs prevail.

11.2 For each Sub-processor outside the EEA, the relevant transfer mechanism is identified in Annex III.

12. Liability, term, governing law

12.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.

12.2 This DPA takes effect on the later of the date the Customer accepts the Terms and the effective date stated above, and remains in force for as long as Tebelis AI Processes Customer Personal Data, including after the Terms end; the obligations survive accordingly.

12.3 This DPA is governed by the laws of France, consistent with the Terms, except where Data Protection Law requires otherwise.

Annex I — Description of the Processing

Subject matter: provision of the Tebelis AI platform (forms, records, workflows, projects, people management, analytics, and AI assistance) to the Customer.
Duration: the term of the Terms, plus the retention/deletion periods described above.
Nature and purpose: hosting, storage, organisation, retrieval, display, transmission, and AI-assisted processing of Customer Data to operate the Service on the Customer's instructions.
Types of Personal Data: identification and contact details (name, email, role); profile data (avatar, language); activity data (the audit trail of actions taken in the workspace); content the Customer chooses to store in forms, records, attachments (including photos: embedded image metadata, including GPS, is removed from the stored file on upload, but where the Customer turns on photo location capture, a photo's GPS coordinates and capture time are kept as a visible field), comments, and public-form submissions; the content of AI-assistant conversations; and, in the mobile app and only with the user's permission, the device's current location, used to suggest the nearest project site and not saved in the workspace. The Customer controls what categories it enters.
Special-category and restricted data: as §2 of the Acceptable Use Policy permits, the Customer may record health information where its own business processes need it, for example injuries in incident and near-miss reports, or information needed for occupational health and safety measures, including in forms it asks the Tebelis agent (the AI assistant in the Service) to build. The Customer is the Controller of that data (or the processor, where §2.1 applies). It is responsible for having a lawful basis, and any additional condition required for health data, under applicable data-protection law, and for using the Service's roles and permissions to decide who can see it. The Customer must not enter other special-category data, or the other restricted data types listed in that section, unless agreed in writing.
Categories of Data Subjects: the Customer's authorised users (employees, contractors), the people recorded in the Customer's forms/records, and respondents to the Customer's public forms.
Frequency: continuous, for the duration of the Service.

Annex II — Technical and organisational security measures (Article 32)

Tenant isolation between Customer workspaces, enforced at the database with row-level security.
Encryption in transit (TLS); encryption at rest of sensitive stored credentials.
Access control on least-privilege principles; per-user, per-role, and per-project permissions; hashed passwords (argon2); session and token-based authentication.
Data minimisation on upload: image (EXIF/GPS) metadata stripped from images; AI-conversation storage replaces images with a placeholder.
Auditability: append-only audit logging of significant actions; security events (authentication failures, lockouts, permission denials) are logged and monitored with alerting.
Retention controls: deleted records are held in a recycle bin and purged after 14 days; AI-assistant conversations are deleted after 90 days of inactivity; user erasure irreversibly anonymises the account after a 30-day grace period; a workspace deleted at the request of its only user is locked at once and its content permanently deleted after 30 days (§9.2).
Resilience: managed cloud infrastructure with backups; logging and monitoring.
Sub-processor management under Section 6.

(This annex states measures in force as of the effective date and is kept current.)

Annex III — Sub-processors

The current list of Sub-processors, the service each provides, the categories of data, the hosting region, and the applicable transfer safeguard is maintained on our Sub-processors page, which forms part of this DPA.

Annex IV — SCC signature details

Data exporter: the Customer, as identified in its account or Order, acting as controller (or as processor where §2.1 applies).
Data importer: Tebelis AI (SASU), 173 rue de Courcelles, 75017 Paris, France; SIREN 107 153 819; represented by its President Alexandre Batzakakis; contact [email protected].
Modules: Two (controller→processor) and Three (processor→sub-processor) as applicable.
Clause options: Clause 7 (docking clause) applies. Clause 9(a): Option 2 (general written authorisation); the data importer informs the data exporter in writing of any intended addition or replacement of a sub-processor at least 30 days in advance, and the data exporter may object as set out in §6.3. Clause 11(a): the optional language does not apply. Clause 13: the supervisory authority competent for the data exporter, determined in accordance with Clause 13(a). Clause 17: Option 1, the laws of France. Clause 18: the courts of Paris, France.
UK Addendum: Tables 1 to 3 are completed with the information in this Annex and in Annexes I to III; for Table 4, neither party may end the UK Addendum under its Section 19.
Signature: the SCCs are incorporated by reference and apply without a separate signature. An Enterprise customer may request a countersigned copy; its terms are the same.