Vaultin AI Download

Legal

Data processing agreement

Last updated: 29 October 2026 · Applies from the launch of the fully managed plan

1. When this agreement applies

This agreement applies when your firm uses the Vaultin AI fully managed plan, on which we pass anonymised text to an AI provider on your firm’s behalf. It forms part of our terms. Your firm is the controller and Datatech Solutions LLC (“we”) is the processor, under Article 28 of the UK GDPR and the EU GDPR.

On the “Your own AI account” plan we do not process your client data, as requests go straight from your computers to your provider, so this agreement does not apply to it.

2. What we process

  • Subject matter and duration: providing the fully managed plan, for as long as your firm subscribes to it.
  • Nature and purpose: receiving a request from the Vaultin AI app, passing it to an AI provider, and returning the answer to the app.
  • Type of data: the text of questions and document passages, with names and other identifying details already replaced by placeholders on your firm’s computer. It can still contain personal data where a detail was not detected, or where surrounding facts identify a person.
  • Data subjects: your firm’s clients, the people and organisations named in client work, and your firm’s staff.

3. Our obligations

  1. We process the data only on your firm’s documented instructions, which are these terms and your use of the app. We tell you if we believe an instruction breaks data protection law.
  2. We do not store the text of requests or answers. We keep usage records for billing, without the text.
  3. Everyone we authorise to process the data is bound by confidentiality.
  4. We protect the data with appropriate technical and organisational measures, including encryption in transit, processing in the EU, access limited to the people who run the service, and logs that never contain request text.
  5. We help your firm respond to requests from data subjects and with data protection impact assessments, as far as we reasonably can given that we store none of the text.
  6. We tell your firm without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the data.
  7. When the subscription ends there is no stored text to return or delete. We delete usage records when they are no longer needed for billing, tax or accounting.
  8. We make available the information needed to show we meet these obligations, and allow and contribute to audits on reasonable notice, at most once a year, at your firm’s cost.

4. Sub-processors

Your firm authorises us to use the sub-processors listed on our Trust page, including the AI provider behind the managed plan, which we will name before the plan launches. We will email your firm at least 30 days before adding or replacing a sub-processor that handles request text. If your firm objects on reasonable data protection grounds, it can cancel the managed plan and we will refund any prepaid fees for the remaining period. We bind each sub-processor to data protection terms at least as protective as these, and remain responsible for its work.

5. International transfers

The managed plan’s service and its AI provider are hosted in the EU. Where personal data is transferred outside the UK or EEA, including to us in the United Arab Emirates, we use the European Commission’s standard contractual clauses and the UK’s international data transfer addendum.

6. Liability and law

The limits of liability in our terms apply to this agreement, except where the law does not allow them. This agreement is governed by the law of England and Wales.

Signed copies

If your firm needs a countersigned copy, email support@vaultin.ai.