Data Processing Addendum (DPA)
This Data Processing Addendum ("DPA") supplements the Tayeno Terms of Service and applies where Tayeno processes personal data on behalf of business customers ("Controllers") in the United Kingdom or European Economic Area.
1. Scope and Processing Details
Subject Matter: Provision of AI chief-of-staff services (email triage, meeting prep, drafting).
Duration: The duration of the active subscription plus a 30-day post-termination deletion buffer.
Data Subjects: Customer's employees, correspondents, clients, and prospective business contacts.
Categories of Data: Names, email addresses, email message headers & bodies, calendar event metadata, publicly accessible company web data, and search terms supplied for /dossier (which may include a company or personal name). Only those search terms are sent to the web search providers.
2. Obligations of Processor (Tayeno)
- Process personal data strictly on documented instructions from the Controller.
- Ensure all personnel and subprocessors are bound by statutory confidentiality duties.
- Maintain technical measures including AES-256-GCM vault encryption, per-tenant Linux isolation, and outside-LLM secret resolution.
- Notify the Controller without undue delay and in any event within 24 hours upon becoming aware of any confirmed personal data breach.
- Delete or return all customer personal data upon termination of the subscription.
3. Sub-Processors & International Transfers
Controller grants general authorization for Tayeno to engage the sub-processors listed in our Privacy Policy (Cloudflare, Inc. (Pages, Workers, R2), OpenRouter, Inc., OVHcloud, DeepSeek (Hangzhou DeepSeek AI Co., Ltd.), Replicate, Inc., Resend, Stripe Payments UK Ltd and Telegram FZ-LLC). For /dossier, search terms may also be sent through the open-source ddgs 9.16.0 package to one or more public search providers named in that policy: Wikipedia, Grokipedia, Brave, DuckDuckGo, Google, Mojeek, Startpage and Yahoo. Tayeno has no separate processing contract or DPA for this search flow; the providers' legal roles and transfer arrangements have not been verified by Tayeno.
For /dossier, Tayeno sends only the search terms entered by the user, after surrounding whitespace is removed. The ddgs library selects provider or providers for each search; Tayeno does not control which one is used. Tayeno does not add account data, email contents or other tenant data to the search terms. The request is made from Tayeno's server unless a runtime proxy is set; providers see the outgoing IP address and standard web request metadata. Some providers are outside the UK. Tayeno does not configure or verify each provider's processing location or transfer safeguards.
Inference prompts and email processing requests are routed via OpenRouter, Inc. or transmitted directly to DeepSeek API infrastructure; image generation requests are dispatched to Replicate, Inc. only on Controller's instruction. International transfers for model inference and image generation outside the UK/EEA are conducted under UK International Data Transfer Addendums (IDTA) / Standard Contractual Clauses (SCCs), or explicit consent under UK GDPR Article 49(1)(a) provided upon mailbox connection. Tayeno will notify Controller of any intended changes to sub-processors at least 14 days in advance.
4. Processor Information & Legal Notices
Processor Entity: Clint Bailo (trading as Tayeno)
Trading & Correspondence Address: Tayeno, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England
ICO Registration: Registered with the UK Information Commissioner's Office under data protection registration reference ZC228768
Data Protection Contact: hello@tayeno.com
Note: This address is a registered commercial correspondence office for postal and legal service. It is not open for unscheduled public visits.