Data protection terms
These terms apply when we handle other people’s data for you, such as your customers’ details in AI setup.
- Our standard
- We use the UK and EU GDPR as our standard for every client, wherever they are. These terms form part of your agreement with us.
- Who does what
- You decide what data is used and why, so you’re the controller. We handle it only for you, so we’re your processor. For our own records, such as your contact and billing details, our privacy notice applies.
- What we handle
- The data in the tools you connect, such as emails, calendar entries, files and customer records. It may be about your customers, staff, suppliers and other contacts. We handle it to run the jobs in your package, for as long as your service runs.
- Sensitive data
- Please don’t connect health details or other sensitive personal data unless we’ve agreed it in writing first.
- Your instructions
- We only use your data to provide your service, following your package and your written instructions, unless the law requires something else. We’ll tell you if we think an instruction breaks data protection law. We don’t sell your data or use it to train AI models.
- Your part
- You need a lawful reason to use the data you connect. You’re also responsible for telling your customers how you use it, including that AI helps with the work.
- Confidentiality
- Everyone who works on your data must keep it confidential.
- Security
- We use the lowest access that works, and we connect only what each job needs. You sign in to each tool yourself, and nobody sends a password. Each client’s connections are kept separate. We don’t keep the content of jobs that run normally, and we clear the details of failed jobs regularly.
- Our providers
-
You agree that we can use these providers to run your service:
- n8n runs your automations, in the EU.
- Anthropic provides the AI, in the US.
We’ll give you 30 days’ notice before adding a provider, so you can object or cancel. Each provider must meet the same data protection duties, and we stay responsible for them.
- Transfers abroad
- Some providers are outside the UK and EU. Where your data leaves those areas, we rely on legal safeguards such as standard contractual clauses.
- Data breaches
- If a breach affects your data, we’ll tell you without undue delay, and within 48 hours of finding out. We’ll give you what you need to meet your own legal duties.
- Helping you
- We’ll help you respond to requests from people about their data, keep the data secure, deal with breaches, and complete data protection impact assessments or talk to a regulator if you need to.
- When your service ends
- We’ll disconnect your tools. Your data is deleted automatically 30 days after your service ends, unless the law requires us to keep it. If you’d like a copy first, ask us before then.
- Checking our work
- We’ll give you the information you need to show that we meet these terms, and we’ll allow reasonable audits with notice. Email LeapAI.agency@gmail.com.