Data Processing Agreement

1. Roles and scope

1. The Customer is the controller of the personal data in its organization’s content (“Customer Data”). Gorila is its processor.
2. Gorila processes Customer Data only to provide Gorila as described in Annex I, and only on the Customer’s documented instructions. Using Gorila — directly or through an AI client or agent the Customer connects — and configuring it in Settings are such instructions. Gorila tells the Customer if it believes an instruction breaks the GDPR. If EU or Member State law requires Gorila to process Customer Data otherwise, Gorila tells the Customer first, unless that law forbids it.
3. Gorila is a separate controller for account data it needs to run the service (sign-in, billing, security) and for aggregate usage counts across organizations, which never include content or identify who did what, as described in its privacy policy.

2. Gorila’s obligations

1. Confidentiality. Only people who need it to run the service can access Customer Data, and they are bound to confidentiality.
2. Security. Gorila keeps the measures in Annex II and may improve them, never lowering the overall level of protection.
3. Data minimization. Gorila does not ingest the Customer’s files, emails or chat logs, runs no AI model that reasons over or generates content from Customer Data, and never uses it to train any model. It stores the distilled text and source pointers the Customer’s AI sends. The only model it calls is an embedding model (Annex III) that turns distilled text into vectors for search: the title, summary, trigger phrases and first 1,000 characters of each knowledge entry, the title of each open task, and search queries, private items included. The provider processes this text in the EU only to compute the vector, does not store or log it and does not train on it; the vectors are stored in Gorila’s database under the same access rules as their item.
4. Data subject requests. Gorila gives the Customer tools to answer them (export, correction through the AI, deletion) and helps where those are not enough. A request Gorila receives directly is passed to the Customer without delay.
5. Assistance. Gorila helps the Customer with security, breach notification, impact assessments and prior consultation (GDPR arts. 32–36), taking into account the information available to it.
6. Personal data breaches. Gorila notifies the Customer’s owners without undue delay, and within 48 hours of becoming aware of a breach affecting Customer Data, with what is known and what is being done; it updates the notice as it learns more.
7. Audits. Gorila makes available the information needed to show compliance with this DPA and allows audits by the Customer or an auditor it mandates, with 30 days’ notice, once a year (more often after a breach or when an authority requires it), at the Customer’s cost and under confidentiality.

3. Subprocessors

1. The Customer authorizes the subprocessors in Annex III. Gorila binds each one to data protection terms at least as protective as this DPA and remains responsible for them.
2. Gorila tells the Customer’s owners at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the service and is refunded any prepaid fees for the remaining term.

4. International transfers

Customer Data is stored and processed in the European Union. Where a subprocessor may access it from outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, as listed in Annex III.

5. Return and deletion

At any time the Customer can export its data (Settings → Export: JSON plus Markdown). When an owner deletes the organization, or at the end of the service, Gorila deletes all Customer Data at once — tasks, knowledge and its history, members, tokens, agents and usage events — unless the law requires it to keep some. Copies in backups expire within 7 days.

6. Term and precedence

This DPA lasts as long as Gorila processes Customer Data. If it conflicts with other terms between the parties on data protection, this DPA prevails. It is governed by the law of Spain.

Annex I — Description of the processing

• Nature and purpose: storing and serving a team task board and company knowledge to the Customer’s members and to the AI clients and agents they connect; onboarding; approvals; search over that content, including computing vectors of its distilled text (Annex III); usage metrics without content.
• Data subjects: the Customer’s members and invitees; people mentioned in tasks or knowledge (for example customers or suppliers).
• Personal data: names, work emails, avatars, roles and job titles; task and knowledge text the Customer’s AI writes, and source links; activity records (who did what, when, from which AI client).
• Special categories: none intended. The Customer decides what its members write and is responsible for having a legal basis for any special category data (GDPR art. 9) or data on criminal offences (art. 10) it puts in Gorila, and for keeping it to what is necessary. Tasks about sensitive matters (hiring, salaries, health, legal) can be marked private, so only their creator and assignee see them.
• Frequency and duration: continuous, for as long as the Customer uses Gorila.

Annex II — Technical and organizational measures

• Hosting in the EU (database in Ireland, compute in Dublin); encryption in transit (TLS) and at rest.
• Tenant isolation in the database: every table carries the organization and row-level security, so one organization can never read another’s data, and private items are enforced there too.
• Access as the user: requests from the web app, AI clients and agents run with the user’s own permissions. Access tokens are stored only as hashes and can be revoked; agents can be paused or removed.
• Least privilege for staff: production access is limited to the people who run the service; secrets live only in the hosting provider’s encrypted settings.
• Integrity and accountability: knowledge changes need a person’s approval and keep a full version history; usage events record actions without their content.
• Abuse protection: per-member rate limits; deleting an organization is web-only.
• Availability: daily backups by the database provider, kept 7 days.

Annex III — Subprocessors