ioReign data processing agreement (DPA)

This DPA is part of the ioReign terms of service. It applies when ioReign handles personal information inside your content. Your owners accept it when they accept the terms. If you need a signed copy, email legal@ioreign.ai.

• "We" means McAlpine Cyber and AI Pty Ltd (ACN 701 577 862, ABN 43 701 577 862), the provider of ioReign.
• "You" means the customer named in your account.
• "Customer personal data" means personal information in your content that we handle for you. For example, names and emails in commit history, tickets or audit records.
• "Data protection law" means the Privacy Act 1988 (Cth), and where it applies to you, the EU or UK GDPR and similar laws.

Words such as controller, processor, processing and personal data breach have their meaning under the GDPR.

1. Roles

• You are the controller (or a processor acting for your own client). You decide what customer personal data goes into ioReign and why.
• We are your processor. We handle customer personal data only to provide ioReign to you.
• For information we collect to run our own business, such as owners' emails and billing, we act for ourselves. Our privacy policy covers that.

2. What we process

3. Our duties

We will:

1. process customer personal data only on your documented instructions. The terms, this DPA and your use of ioReign's features (for example, your agents pushing, exporting or deleting) are your instructions. If we think an instruction breaks data protection law, we tell you;
2. not use customer personal data for any other purpose. We do not sell it, and we do not use it to train AI models;
3. make sure everyone who can access it is bound to keep it confidential;
4. apply the security measures in section 5;
5. help you, as far as reasonably possible given what we can see, to answer requests from data subjects. Most requests can be handled by your agents, because they can read, change, export and delete your content;
6. give you reasonable help with security, breach notices, and privacy impact assessments, given what we know about the processing;
7. at the end, return and delete customer personal data as in section 8.

4. Sub-processors

You authorise us to use these sub-processors:

AI tools. The ioReign product never sends your content to AI model providers. Your agents run on your systems with your own model keys. We never put customer personal data or email sent to our addresses into AI tools.

Changes. We give you at least 14 days' notice by email before adding or replacing a sub-processor that handles your content. If you object on reasonable data protection grounds, tell us within that time. We will try to address it. If we can't, you may cancel without penalty, and we refund fees you paid for time after the cancellation takes effect.

We put contract terms in place with each sub-processor that protect customer personal data at least as well as this DPA. We remain responsible to you for them.

5. Security measures

The measures in place for the beta, described in more detail on the security page:

• strict separation between customers' data, tested on every route;
• owner sign-in by passkey with user verification only;
• scoped agent identities with short-lived tokens that owners can revoke;
• kill switches for your account;
• an audit log of actions in your account;
• encryption in transit, and encryption at rest by Cloudflare;
• card details handled only by Stripe;
• staff access to customer accounts only when needed, and recorded.

During the beta we have not yet had an external penetration test or a full load test. The beta terms say so. We may improve these measures, but we will not reduce the overall level of protection.

6. Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we will:

• tell you without undue delay, and where possible within 72 hours of becoming aware;
• tell you what we know: what happened, the likely data and people affected, the likely consequences, and what we are doing about it. We add details as we learn them;
• take reasonable steps to contain it and reduce harm;
• work with you on any notices you must give. Under Australia's Notifiable Data Breaches scheme, a suspected breach must be assessed within 30 days, and eligible breaches must be notified to the OAIC and affected people as soon as practicable.

Our notice is not an admission of fault.

7. Information and audits

On request, we give you reasonable information to show we comply with this DPA. This includes answering written security questions. We do not hold third-party security certifications yet. If data protection law requires an audit we can't satisfy in writing, we agree a scope, timing and cost with you first, with reasonable notice and confidentiality.

8. Return and deletion

• You can export your content at any time while your account exists, including during read-only and the 30-day window after you cancel, except while your kill switch is on or your account is suspended.
• We delete customer personal data not earlier than 30 days after cancellation, unless a legal or dispute hold applies, and record that the deletion happened.
• If your subscription ends or stays unpaid because a payment failed or was reversed, or ends while a payment is overdue, we first keep your account read-only for 60 days, then the same 30-day process applies (see the beta terms, section 8).
• After deletion, Cloudflare's point-in-time recovery for our storage (Durable Objects) and our account directory database (D1 Time Travel) can restore data from up to about 30 days ago. Those copies then expire. Email sent to our addresses can be recovered from our mailbox provider for about 55 days. Request logs at Cloudflare are kept for up to about 7 days.
• Our records of deletions and staff actions are kept. They hold only ids and counts, never your content.
• Stripe keeps its billing records under its own rules. They don't contain your content.
• We keep data longer only where the law requires it, and then only for that purpose.

9. Your duties

You confirm you have a lawful basis, and gave any notices needed, to put customer personal data into ioReign and to have us process it.

10. Liability

The limits of liability in the terms of service apply to this DPA, except where data protection law does not allow it.

11. EU and UK transfers (placeholder)

[Placeholder. This section applies only if a customer is subject to the EU or UK GDPR and customer personal data is transferred to us in Australia. Australia does not have an EU adequacy decision. Before such a customer signs, we will agree the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor) and, for UK data, the UK International Data Transfer Addendum, and attach them here. Until then, please contact legal@ioreign.ai before putting EU or UK personal data into ioReign.]

12. Order of precedence

If this DPA conflicts with the terms of service about customer personal data, this DPA wins.

Contact

Privacy: privacy@ioreign.ai · Legal: legal@ioreign.ai

McAlpine Cyber and AI Pty Ltd (ACN 701 577 862, ABN 43 701 577 862), Sydney NSW, Australia

Version 0.1.0.