Data processing addendum

When Chem IRL Solutions handles your customers' emails, you are the data controller and Chem IRL Solutions acts as a processor under GDPR. In summary:

• We process email content solely to provide the service you configure — drafting, tagging, and sending replies.
• Data is hosted in the EU (Supabase, eu-west-1). OAuth tokens are encrypted at rest with AES-256-GCM.
• Subprocessors: Vercel (hosting), Supabase (database, EU), Tensorix / TensorX Ltd (all AI inference — drafts, embeddings, photo checks; EU-hosted, zero retention, no training on customer data), Google (Gmail API), Microsoft (Outlook API), Stripe (payments), Resend (transactional email).
• We notify customers of personal-data breaches without undue delay and assist with data-subject requests.
• On termination, workspace data is deleted; inbox credentials are deleted immediately on disconnect.

A signable DPA (with the full subprocessor list and SCCs where applicable) is available on request: support@chemirl.app.