> ## Documentation Index
> Fetch the complete documentation index at: https://docs.there.do/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Processing Agreement (DPA)

> There's commitments as a processor of the personal data it handles on behalf of its customers, under Article 28 of the GDPR.

Last updated October 23, 2026.

This data processing agreement (the "Agreement") governs the processing of personal data that THERE ("There") carries out on behalf of its business customers (the "Customer") as part of the Services, in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").

It is based on the standard contractual clauses between controllers and processors adopted by the European Commission (Implementing Decision (EU) 2021/915).

The French version of this Agreement is the authoritative version. This English version is provided for convenience.

## At a glance

* **Roles:** the Customer is the controller. There is the processor and acts only on the Customer's instructions.
* **Hosting:** the database and files are hosted in the European Union. Transfers outside the EU by some sub-processors are covered by the European Commission's standard contractual clauses.
* **AI:** Customer data is not used to train AI models. With the Business plan, the Customer can restrict AI models to Mistral AI, which processes data in the EU.
* **Data breaches:** There notifies the Customer within forty-eight (48) hours of becoming aware of a breach.
* **Sub-processors:** the list is in Annex 3. Any new sub-processor is announced thirty (30) days in advance, and the Customer can object.
* **Audits:** There provides the necessary documentation and accepts at most one audit per year, at the expense of the requesting Customer.
* **End of the relationship:** data export within thirty (30) days on request, then deletion within thirty (30) days when the Customer deletes its organization or asks for it.
* **Contact:** [privacy@there.do](mailto:privacy@there.do).

## Article 1 — Purpose and scope

1.1. This Agreement forms an integral part of the [Terms of Sale](/legal/terms-of-sale.md) (the "Terms of Sale"), accepted when an organization is created. It applies to every organization, whether on a free or a paid plan, without any separate signature. Administrators of existing organizations are notified of its publication by email. A Customer that wishes to can obtain a signed copy by writing to [privacy@there.do](mailto:privacy@there.do).

1.2. The Agreement applies to the personal data that the Customer and its users enter, import, record or share in the Services, and that There processes on the Customer's behalf ("Customer Data").

1.3. The Agreement does not apply to data that There processes for its own purposes as a controller, in particular customer relationship management, invoicing, prospecting and audience measurement of its websites. That processing is described in the [Privacy Policy](/legal/privacy-policy.md).

1.4. If this Agreement conflicts with the Terms of Sale, the [Terms of Service](/legal/terms-of-service.md) or the Privacy Policy, this Agreement prevails for everything relating to the protection of Customer Data. Standard contractual clauses entered into for a transfer prevail over this Agreement within their scope.

## Article 2 — Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in the GDPR. Other capitalized terms have the meaning given to them in the Terms of Sale.

"Sub-processor" means any provider engaged by There that processes Customer Data.

## Article 3 — Roles of the parties

3.1. The Customer acts as controller. There acts as processor.

3.2. Where the Customer itself acts as a processor on behalf of a third party, There acts as a sub-processor. The Customer then warrants that it is authorized to engage There and that its instructions are consistent with those of its own controller.

## Article 4 — Description of the processing

The subject matter, nature, purpose and duration of the processing, the categories of data and the categories of data subjects are described in Annex 1.

## Article 5 — Customer instructions

5.1. There processes Customer Data only on documented instructions from the Customer, including with regard to transfers outside the European Union, unless required to do so by law. In that case, There informs the Customer of that legal requirement before processing, unless the law prohibits it.

5.2. The Customer's documented instructions are: the Terms of Sale, the Terms of Service and this Agreement; the configuration and use of the Services by the Customer and its authorized users, including the features, AI models and integrations they enable; any other written instruction accepted by There.

5.3. There immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. There may then suspend the instruction concerned until the Customer confirms or amends it.

5.4. Subject to Article 5.5, There does not process Customer Data for its own purposes. In particular, There does not sell Customer Data and does not use it to train artificial intelligence models. Its sub-processors providing AI services have contractually committed not to use it for that purpose.

5.5. There processes, as a controller, data relating to the use of the Services: account and connection data, technical logs, usage events and support exchanges. It uses them to provide, secure, maintain and improve the Services, support users and produce statistics, as described in the Privacy Policy. This processing does not cover the content of the Customer's notes, documents and files, except to the extent needed to diagnose an incident or handle a support request.

## Article 6 — Customer obligations

The Customer:

* ensures that the processing it entrusts to There is lawful and has a legal basis for each processing operation;
* informs data subjects, including people recorded in a voice note (see [Informing participants](/features/notes/informing-participants.md));
* only enters special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) in the Services where strictly necessary, and under its own responsibility;
* manages its users' access and the visibility of its content in the Services.

## Article 7 — Confidentiality

There ensures that persons authorized to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Customer Data is limited to team members who need it to provide, maintain or secure the Services, or to respond to a Customer request.

## Article 8 — Security

8.1. There implements the appropriate technical and organizational measures required by Article 32 of the GDPR, described in Annex 2.

8.2. There regularly tests, assesses and evaluates the effectiveness of these measures. It may update them, provided that the overall level of security of Customer Data is not reduced.

## Article 9 — Sub-processors

9.1. The Customer gives There a general authorization to engage sub-processors. The current list of sub-processors is in Annex 3.

9.2. There informs the Customer of any addition or replacement of a sub-processor at least thirty (30) days in advance, by email to the organization's administrators and by updating Annex 3. Where a replacement is required for an urgent security or service continuity reason, There informs the Customer as soon as possible, and the Customer may object under Article 9.3 from that notice.

9.3. The Customer may object to the change in writing before the notice period expires, on objective and documented grounds relating to the new sub-processor's ability to comply with data protection law. There may then propose a solution, for example not entrusting Customer Data to that sub-processor or disabling the feature concerned for the organization. If no solution is found within thirty (30) days of the objection, the Customer may, as its sole remedy, cancel its subscription and request the deletion of its organization under Article 14.3, without penalty. There then refunds the prepaid sums for the remaining period. If the Customer does not object within the notice period, the change is deemed accepted.

9.4. There contractually imposes on each sub-processor data protection obligations at least equivalent to those of this Agreement. There remains fully liable to the Customer for the performance of those obligations by its sub-processors.

9.5. Integrations that the Customer enables itself in the Services (for example an email account, a calendar or a document management system) are not sub-processors of There. Data sent to those services is sent on the Customer's instructions and is governed by the contract between the Customer and their provider.

## Article 10 — Transfers outside the European Union

10.1. The application database is hosted in Frankfurt, Germany, and files are stored in the European Union.

10.2. Some sub-processors are established outside the European Economic Area or may process Customer Data there, including through remote access. These transfers rely on one of the following mechanisms:

* an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, only where the recipient is certified for the service concerned;
* otherwise, the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), Module 3 (processor to processor), together with the necessary supplementary measures.

The Customer can obtain a copy of the safeguards applied to a transfer by writing to [privacy@there.do](mailto:privacy@there.do).

10.3. If a transfer safeguard ceases to apply, There suspends the transfer concerned until another valid safeguard is in place, or ends the processing concerned. Where the law allows, There informs the Customer of any request for access to Customer Data from a public authority of a third country.

10.4. With the Business plan, the organization's administrators can restrict the AI models available to Mistral AI models only, which process data in the European Union (see [Choose the models your organization allows](/features/document/ai/space-bar.md)). Audio transcription remains provided by AssemblyAI, through its European infrastructure.

## Article 11 — Assistance to the Customer

11.1. Taking into account the nature of the processing, There assists the Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects exercising their rights. The Services let the Customer view, edit, export and delete most Customer Data. If There receives such a request directly, it forwards it to the Customer without responding itself, unless instructed otherwise.

11.2. Taking into account the information available to it, There assists the Customer in meeting its obligations under Articles 32 to 36 of the GDPR: security of processing, notification of data breaches, data protection impact assessments and prior consultation of the supervisory authority.

## Article 12 — Personal data breaches

12.1. There notifies the Customer of any personal data breach affecting Customer Data within forty-eight (48) hours of becoming aware of it, including where a sub-processor reports the breach to There.

12.2. The notification is sent to the organization's administrators. It describes, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Information that is not immediately available is provided as it becomes available: the first notification does not wait for the investigation to be complete.

12.3. There promptly takes the necessary measures to contain the breach and limit its consequences. The Customer decides on notifications to the supervisory authority and communications to data subjects; There only makes them on the Customer's behalf on instruction or where required by law. A notification is not an admission of liability.

## Article 13 — Documentation and audits

13.1. There makes available to the Customer the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR: this Agreement and its annexes, the [Security and privacy](/account/security-and-privacy.md) page and answers to the Customer's reasonable security questionnaires.

13.2. If that information is not sufficient, the Customer may carry out an audit, including an inspection, itself or through an independent auditor who is not a competitor of There and is bound by confidentiality. The audit:

* is limited to once per twelve (12) month period, except after a data breach affecting Customer Data or at the request of a supervisory authority;
* is notified at least thirty (30) days in advance, with a scope defined in advance;
* takes place remotely where possible, during business hours, without disrupting the Services or giving access to other customers' data;
* is carried out at the expense of the requesting Customer, including the time spent by There's team, on the basis of a prior quote.

13.3. The Customer provides There with a copy of the audit report, which is confidential information.

13.4. There makes the information referred to in this article available to the competent supervisory authority on request.

## Article 14 — Duration, return and deletion of data

14.1. This Agreement applies for as long as There processes Customer Data, whether the organization is on a free or a paid plan. Cancelling a paid subscription does not delete the organization or its content, in accordance with the Terms of Sale.

14.2. The Customer can retrieve its data at any time: directly from the Services for part of it, or through a full export prepared by There within thirty (30) days on request at [hello@there.do](mailto:hello@there.do).

14.3. The Customer requests the deletion of its data by deleting its organization from the settings of the Services, or by written request to [privacy@there.do](mailto:privacy@there.do). There then deletes the Customer Data within thirty (30) days. For a written request, There confirms the deletion by email. Copies in backups are erased as the backups rotate, no later than thirty-five (35) days after the deletion. Until then, they remain protected by this Agreement and are only used for a possible restore. If a restore brings back deleted data, There deletes it again.

14.4. Customer Data that There is required to retain under Union or Member State law is retained only for the required period, then deleted.

14.5. There passes deletion instructions on to its sub-processors. Some technical copies remain there for a limited period, set out in Annex 3: logs of the gateway to AI models (7 days), retention by AI model providers for abuse monitoring (up to 30 days, 55 days for Google). On request, There tells the Customer which residual copies remain and when they expire.

14.6. The obligations of this Agreement survive for as long as There holds Customer Data.

## Article 15 — Liability

Notwithstanding the Terms of Sale, There's total liability under this Agreement, for all events combined, is limited to the greater of (i) the sums excluding tax actually paid by the Customer for the Services in the twelve (12) months preceding the first event giving rise to liability and (ii) one thousand (1,000) euros. The other liability provisions of the Terms of Sale apply, including the exclusion of indirect damages. These limitations do not apply in the event of gross negligence or wilful misconduct, or where the law prohibits them. These limitations do not restrict the rights of data subjects, in particular under Article 82 of the GDPR, or the obligations arising from standard contractual clauses entered into for a transfer.

## Article 16 — Changes to the Agreement

There may amend this Agreement to reflect changes in regulation, in the Services or in its sub-processors, without reducing the level of protection of Customer Data. Material changes are notified to the organization's administrators at least thirty (30) days before they take effect. Changes of sub-processors follow the procedure in Article 9.

## Article 17 — Governing law and contact

17.1. This Agreement is governed by French law. Disputes are submitted to the courts designated in the Terms of Sale.

17.2. For any question about this Agreement or the protection of Customer Data, contact There's data protection lead: [privacy@there.do](mailto:privacy@there.do), or THERE, 231 rue Saint-Honoré, 75001 Paris, France.

## Annex 1 — Description of the processing

| Item | Description |
| - | - |
| Subject matter | Provision of the There Services: field note taking, writing and distributing documents and reports, collaboration within an organization. |
| Nature of the operations | Collection, recording, hosting, synchronization across devices, organization, search indexing, audio transcription (voice notes and real-time dictation), on-demand AI content generation, file conversion, PDF generation, sharing, export, notification and deletion. |
| Purpose | Providing, maintaining, securing and supporting the Services for the Customer. |
| Duration | Throughout the Customer's use of the Services, then until deletion under Article 14. |
| Data subjects | The Customer's users (employees, collaborators, guests); recipients of shared documents; people mentioned, photographed or recorded in the Customer's content (for example site workers, the Customer's clients, meeting participants). |
| Categories of data | Identification and contact details (first and last name, email address, phone number, job title, company); connection and usage data (identifiers, technical logs, IP address); content (notes, documents, photos, videos, files, audio recordings and transcriptions, emails and WhatsApp messages sent to There, tasks, attendance, imported calendar events). |
| Sensitive data | None is required by the Services. The Customer may nevertheless enter such data under its own responsibility (Article 6). Audio recordings are not used to identify people. |
| Place of processing | European Union for the database and files; see Annex 3 for sub-processors. |

## Annex 2 — Technical and organizational measures

| Area | Measures |
| - | - |
| Hosting | Database hosted by Neon in Frankfurt (Germany); files stored on Cloudflare R2 in the European Union; application running on Cloudflare's infrastructure, placed in Europe. |
| Encryption | Encryption in transit (HTTPS/TLS); data encrypted at rest by the hosting providers. |
| Access control | Authentication managed by Clerk; data isolated per organization; roles (administrator, member, guest); visibility set note by note; multi-factor authentication required for There's administration accounts; There team access limited to people who need it and removed when they leave. |
| Service protection | Cloudflare network and bot protection; signature verification of incoming webhooks; application secrets centralized in a secrets manager. |
| Backup and continuity | Point-in-time restore over the last 7 days; daily backups kept 30 days, weekly backups 5 weeks, monthly backups 1 month; RTO of 48 hours and RPO of 24 hours. |
| Monitoring | Error tracking (Sentry, hosted in the EU); public status page [status.there.do](https://status.there.do/). |
| Testing and evaluation | AI-assisted security audits of the code and infrastructure (web application and integrations, then authorization and isolation between organizations), with tracked fixes; automated tests; fixes deployed continuously. |
| Vulnerabilities | Dependency monitoring (Dependabot) and regular updates. |
| Incident management | Incident handling and data breach notification procedure (Article 12). |
| Sub-processors | Data protection agreements with each sub-processor; AI providers committed not to train their models on the data sent to them. |
| Personnel | Confidentiality commitment from the people who have access to Customer Data. |

## Annex 3 — Sub-processors

| Sub-processor | Service provided | Place of processing | Transfer safeguards | Sub-processor's own retention |
| - | - | - | - | - |
| Neon, Inc. | Application database | Germany (Frankfurt) | Standard contractual clauses (access from the United States) | Follows There's deletions; backups as in Annex 2 |
| Cloudflare, Inc. | Application hosting, file storage, search, gateway to AI models, network protection | European Union; global network for request routing | Standard contractual clauses | AI gateway logs (requests and responses): 7 days; response cache: 24 hours |
| Clerk, Inc. | User authentication | United States | Standard contractual clauses | As set out in Clerk's terms |
| Journey Mobile, Inc. (PowerSync) | Offline synchronization for the mobile app | European Union | Standard contractual clauses (company established in the United States) | Follows There's deletions |
| AssemblyAI, Inc. | Transcription of voice notes and real-time dictation in the AI assistant | European Union (European infrastructure) | Standard contractual clauses (company established in the United States) | Audio files: 48 hours; transcripts: deleted by There as soon as stored, in practice within minutes of transcription, and in any case from one day after (retention period configured at AssemblyAI); real-time transcription: not retained |
| Anthropic Ireland, Limited | Generative AI features (default model) | United States | Standard contractual clauses | Up to 30 days (abuse monitoring) |
| OpenAI Ireland Ltd | Generative AI features | United States | Standard contractual clauses | Up to 30 days (abuse monitoring) |
| Google (Gemini API) | Generative AI features | United States | Standard contractual clauses | Up to 55 days (abuse monitoring) |
| Mistral AI | Generative AI features | European Union | — | Up to 30 days (abuse monitoring) |
| LlamaIndex, Inc. | Text extraction from imported documents | European Union (European infrastructure) | Standard contractual clauses (company established in the United States) | 48 hours |
| Tiptap GmbH | Conversion of imported Word files | Germany | — | As set out in Tiptap's terms |
| Scaleway SAS | PDF generation | France | — | For the duration of the generation |
| Plus Five Five, Inc. (Resend) | Sending emails and receiving imported emails | Ireland | Standard contractual clauses (company established in the United States) | 30 days |
| Twilio Ireland Limited | Sending SMS | United States | Standard contractual clauses | As set out in Twilio's terms |
| WhatsApp Ireland Limited | Receiving messages and voice notes sent through WhatsApp | European Union and United States | Standard contractual clauses | As set out in the WhatsApp Business terms |
| 650 Industries, Inc. (Expo) | Sending push notifications to the mobile app | United States | Standard contractual clauses | As set out in Expo's terms |
| Functional Software, Inc. (Sentry) | Error tracking | European Union (Germany) | — | 90 days |
| PostHog, Inc. | Product usage analytics and session recording, with editor content masked | European Union | Standard contractual clauses (company established in the United States) | As set in the project settings |
| Gleap GmbH | Support and user feedback | European Union | — | As set out in Gleap's terms |
| Attio Limited | Tracking document import requests: requester's name and email address, organization name, file names and links | United Kingdom | Adequacy decision (United Kingdom) | As set out in Attio's terms |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.