Data Processing Agreement

Standard template · last updated July 25, 2026

1. Parties and roles

This DPA is between the Customer ("Customer", the controller) and Astral AI Inc. ("Rampt", the processor), and forms part of the agreement under which Rampt provides its service. Where GDPR or similar law applies, "controller" and "processor" carry their statutory meanings.

2. Details of processing (Annex A)

• Subject matter: behavioral events from the first sessions of the Customer's end users inside the Customer's product.
• Duration: the term of the agreement, plus the 30-day deletion window.
• Nature and purpose: guiding new users through first-session setup with Customer-authored content; diagnosing where and why users stall; measuring activation lift against a holdout control.
• Categories of personal data: a user identifier assigned by the Customer; behavioral interaction events and timings; text the end user typed into intake questions, including cleared partial text where the Customer has enabled its storage; the Customer-authored messages shown. Special categories of data are neither sought nor permitted: the Customer agrees not to configure intake questions designed to elicit them.
• Data subjects: the Customer's end users.

3. Rampt's obligations

Rampt shall: (a) process personal data only on the Customer's documented instructions, the configuration file being the primary standing instruction; (b) ensure persons processing the data are bound by confidentiality; (c) implement the technical and organizational measures of Annex B; (d) not use personal data to train AI models, and make no AI model calls against end-user personal data at service runtime; (e) assist the Customer, taking into account the nature of processing, in responding to data subject requests (access, deletion, portability), noting that the Customer can serve most such requests self-serve via the raw export and deletion controls; (f) notify the Customer without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting the Customer's workspace; (g) delete or return all personal data within 30 days of termination, deletion confirmed in writing on request; (h) make available information reasonably necessary to demonstrate compliance, and allow audits as set out in section 5.

4. Subprocessors (Annex C)

Current subprocessors: Vercel Inc. (hosting), Neon Inc. (managed database). The Customer authorizes these and grants general authorization for replacements, subject to 30 days' advance notice and the right to object on reasonable data-protection grounds; equivalent obligations flow down to every subprocessor by contract.

5. Transparency and audit

Rampt's processing is inspectable by design: the complete event schema is public, every message shown to an end user is logged verbatim and exportable, denied actions are logged (including Rampt's own per-session enforcement probe), and the Customer can export its raw data at any time without Rampt's involvement. On written request, Rampt will additionally provide its then-current security documentation and reasonable written responses to audit questionnaires, no more than twice per year absent a breach or regulator requirement.

6. International transfers

Where personal data is transferred from jurisdictions requiring a transfer mechanism, the parties incorporate the applicable Standard Contractual Clauses, and Rampt will maintain records of subprocessor hosting regions.

7. Liability and order of precedence

Liability under this DPA is subject to the limitations of the main agreement, except where data protection law does not permit such limits. Where this DPA conflicts with the main agreement on data protection matters, this DPA prevails.

Annex B: technical and organizational measures

In place now:

• Access model: strict key separation per workspace; the ingest key can only write events and can read nothing; dashboards, exports, and administration require a separate admin token; tenant isolation is verified by automated tests at every server start.
• Content control: the in-product panel renders only Customer-authored templates; non-approved content is refused at runtime and the refusal is logged.
• Action control: an allow-list runtime; denied actions cannot be performed and refusals are logged; the denial branch performs no page interaction by construction.
• Data minimization: no payment data, no passwords, no special categories; partial-text storage is Customer-disableable and auto-redacts after a configurable window (default 30 days).
• Transport and storage: TLS in transit; managed Postgres (encryption at rest per provider) in production.
• Change safety: fail-closed drift detection; when the Customer's product no longer matches its verified baseline, guided sessions decline to run and the Customer is alerted.

Planned, stated as roadmap and not as current fact: SOC 2 Type II examination; independent penetration test. Rampt will not represent either as complete until it is, and will provide reports to the Customer when they exist.

Annex C: subprocessor list

Vercel Inc., hosting, USA. Neon Inc., managed Postgres, region per workspace. (Stripe Inc. processes Customer billing as an independent controller and is listed here for completeness, not as a subprocessor of end-user data.)