Data Processing Addendum
Effective date: March 9, 2026 · Instructeer
This Data Processing Addendum ("DPA") supplements the Instructeer Terms of Service and applies where Customer submits personal data to the Service. It establishes the obligations of each party under applicable data protection law, including GDPR and CCPA.
1. Roles
Customer is the data controller. Instructeer is the data processor. Instructeer processes personal data only on Customer's instructions as described in these Terms and this DPA.
2. Purpose and scope of processing
Instructeer processes Customer data solely to provide the Service — detecting entities in text or analyzing SQL queries — and returns results to Customer. Processing is limited to the duration of each API request. Instructeer does not process Customer data for any other purpose.
3. Data retention
Instructeer does not retain request content after the API response is returned. Input text and SQL queries are processed in memory and are not written to persistent storage, logs, or databases. Usage metadata (request counts, timestamps, API key identifiers) is retained for billing and quota purposes.
4. No training on Customer data
Instructeer does not use Customer data to train models, improve detection algorithms, or build datasets. Customer data is never shared with third parties for these purposes.
5. Security measures
Instructeer implements technical and organizational measures appropriate to the risk, including:
- TLS encryption for all data in transit
- Encryption at rest for all persistent data stores
- API key authentication required on every request
- Access to production infrastructure restricted to authorized personnel
6. Sub-processors
Instructeer uses the following sub-processors to deliver the Service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Compute and data infrastructure | US East, US West |
| Stripe | Payment processing | United States |
| Clerk | Authentication | United States |
7. Data subject rights
Because Instructeer does not retain request content, most data subject rights (access, erasure, portability) apply to the data controller (Customer), not to Instructeer. Instructeer will assist Customer in responding to data subject requests to the extent technically feasible given the processing described in Section 3.
8. Data breach notification
Instructeer will notify Customer without undue delay upon becoming aware of a personal data breach affecting Customer data, to the extent such data was under Instructeer's control at the time of the breach.
9. Term
This DPA is effective for the duration of the Terms of Service and terminates automatically upon termination of the Terms.
10. Contact
Data protection inquiries: legal@instructeer.com