Draft outline · in reviewUpdated October 2026
Data Processing Agreement
The DPA will govern personal data that Amino employees handle for customers: what appears in their queues, on their desks and in their receipts.
Draft outline for internal review. It lists the sections the document will contain and the decisions still open. It is not agreement text and has no legal effect.
Scope and roles
Who is controller and who is processor, and when the DPA applies.
Will cover
- Customer as controller, Amino as processor
- Applies to paid plans from general availability
- Order of precedence with the terms of service
Details of processing (Annex I)
What data, whose, for what purpose and for how long.
Will cover
- Subject matter, nature and purpose
- Data subjects: your staff, your customers, contacts in systems the employee uses
- Categories of personal data, including anything visible on screen
- Duration of processing
OpenDo we exclude special-category data by default?
Instructions and the role charter
How a customer’s instructions are documented.
Will cover
- The adopted role charter as a documented instruction
- Charter versions and approvals kept as a record
- What happens if an instruction appears to break the law
OpenIs the charter part of the instructions, or evidence of them?
Confidentiality and personnel
Will cover
- Confidentiality duties for staff with access
- Access limited to need, and logged
Security measures (Annex II)
The technical and organizational measures we commit to.
Will cover
- An isolated desk per employee, with scoped credentials
- Encryption in transit and at rest
- Access control and logging for Amino staff
- Desktop app: what the customer controls on their own machine
OpenWhich certifications or audits do we reference at launch?
Sub-processors
Will cover
- Published list of sub-processors, including model providers
- Notice of changes and a right to object
- Equivalent obligations passed down
OpenNotice period for adding a sub-processor.
Desk recordings and receipts
Specific to how Amino works.
Will cover
- What a desk recording captures
- Default retention and customer-set retention
- Redacting and deleting recordings
- Receipts as part of the customer’s records
OpenDefault retention period for recordings.
Help with data subject requests
Will cover
- Finding and exporting data held in memory, receipts and recordings
- Correcting and deleting memory
Personal data breaches
Will cover
- Notification without undue delay
- What a notice contains
- Cooperation during investigation
OpenCommitted notification window, in hours.
International transfers
Will cover
- Hosting regions
- Standard Contractual Clauses, UK addendum, Swiss amendments
OpenIs EU-only hosting available at launch?
Return and deletion
Will cover
- Export at the end of service
- Deletion timeline, including backups
Audits and information
Will cover
- Reports available on request
- Customer audit rights and notice