Data Processing Agreement

Version 1.0 · Last updated: August 1, 2026

This Data Processing Agreement (“DPA”) governs how Ganju processes personal data on your behalf when you use the hosted service. It applies automatically to every customer — it’s incorporated into the Terms of Service, and you don’t need to sign or request anything to be covered by it.

If your procurement process needs a countersigned copy on paper, email hello@ganju.ai and we’ll sign one. If you self-host Ganju, you don’t need a DPA from us at all — no data reaches us.

Parties and roles

This DPA is between Ganju S.A.S., NIT pending registration, Bogotá, D.C., Colombia (“Ganju”, “we”, “processor”) and the organization that accepted the Terms of Service (“you”, “Customer”, “controller”).

For Customer Content — the files, websites, prompts, tool configurations, conversations, and connected-account data you put into a project — you are the controller and we are the processor. In Colombian terms, you are the responsable del tratamiento and we are the encargado del tratamiento under Ley 1581 de 2012 and Decreto 1074 de 2015. The same split applies under GDPR art. 28, UK GDPR, and comparable regimes.

For account data — who you are, how you sign in, what you pay, and the operational logs we keep to run and secure the service — we are the controller, and our Privacy Policy governs it. This DPA does not cover that data.

Scope of processing

We process personal data only:

  • to provide, maintain, and secure the service under the Terms;
  • on your documented instructions, which are given through your use of the product — the resources you add, the tools you install, the channels you connect, the models you configure — and through any other written instruction you send us; and
  • as required by law that applies to us, in which case we’ll tell you before processing unless the law forbids it.

We will not sell your personal data, use it for our own purposes, use it for advertising, or use Customer Content to train AI models.

If we believe an instruction infringes applicable data protection law, we’ll tell you and may suspend that instruction until it’s resolved.

Our obligations as processor

We will:

  • process personal data only as described above;
  • ensure everyone we authorize to process it is bound by confidentiality;
  • implement and maintain the measures in Annex B;
  • respect the subprocessor conditions below;
  • assist you as described in Assisting you;
  • delete or return personal data as described in Return and deletion;
  • make available the information reasonably necessary to demonstrate compliance, and allow audits on the terms below.

Your obligations as controller

You will:

  • have a lawful basis — and, where Colombian law applies, the autorización previa, expresa e informada required by Ley 1581 — for every piece of personal data you put into the service or let your End Users send;
  • give End Users the privacy notice their law requires, including telling them that an automated assistant handles the conversation where that’s required;
  • configure the service appropriately: which tools an assistant has, what scopes you grant a connected account, who you invite into an organization, and who can reach a channel;
  • not put special-category or otherwise regulated data into the service unless you have the rights and safeguards its law requires — Ganju is not certified for HIPAA, PCI-DSS, or equivalent regimes;
  • respond to your own End Users’ requests, with our assistance where you need it.

Subprocessors

You give general written authorization for us to engage subprocessors. The current list, with each one’s role and location, is at ganju.ai/subprocessors.

Before a new subprocessor starts processing Customer Content we will update that page and give at least 30 days’ notice to the Owner of every paid organization. If you have a reasonable, documented data-protection objection we can’t resolve, you may terminate the affected subscription and we’ll refund the unused portion of the current period.

Every subprocessor is bound by written terms imposing protection at least as protective as this DPA, and we remain fully liable to you for their performance.

Destinations you configure — a remote MCP server connected through mcp-proxy, or your own API connected through http-endpoint — are not our subprocessors. You chose them, you control them, and sending data to them is your instruction.

Security

We maintain the technical and organizational measures in Annex B, appropriate to the risk. We may update them as the service evolves, provided the overall level of protection is not reduced.

Personal data breaches

If we become aware of a personal data breach affecting Customer Content, we’ll notify you without undue delay, and in any case within 72 hours of becoming aware. The notification will describe what happened, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures we’ve taken or propose, and a contact point for more information — to the extent we know it, sent in stages if the picture is still developing.

We will not make any public statement identifying you without your consent, unless the law requires it.

Assisting you

Taking into account the nature of the processing, we will assist you with:

  • Data subject requests. Most requests you can satisfy yourself in the product — export or delete an account from Settings, delete a resource or channel, or remove an organization outright. If a request reaches us directly, we’ll forward it to you rather than answering it, unless you’ve told us otherwise. For anything the product can’t do, email us and we’ll help within a reasonable time.
  • Impact assessments and prior consultation with a supervisory authority, by giving you the information about our processing that you reasonably need.
  • Security obligations, through Annex B and the breach process above.

International transfers

We are established in Colombia and host in the United States, so personal data is transferred internationally for every customer. See Where your data lives.

  • Colombia. Transfers rely on the authorization obtained under Ley 1581 de 2012 together with the contractual safeguards in each subprocessor’s terms.
  • EEA / UK / Switzerland. Where the GDPR or UK GDPR applies, the Standard Contractual Clauses — Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), with the UK International Data Transfer Addendum where relevant — are incorporated into this DPA by reference. Annex A and Annex B populate their appendices. The governing-law and forum options are completed as Colombia and the courts of Bogotá, D.C., except where the Clauses require an EU/UK option, in which case the Clauses prevail.

Where the Standard Contractual Clauses conflict with anything else in this DPA, the Clauses prevail.

Audits

We’ll make available the information reasonably necessary to demonstrate compliance with this DPA. You may request an audit once per twelve-month period, on at least 30 days’ written notice, at your cost, during business hours, without unreasonable disruption to our operations, and subject to confidentiality. If we hold a relevant third-party report or certification at the time, providing it satisfies the request.

We’ll be straight with you: Ganju does not currently hold a SOC 2, ISO 27001, or equivalent certification. We’d rather say so here than let an audit clause imply one exists.

Return and deletion

You can delete Customer Content at any time from the product, and deleting an organization cascades to everything inside it.

On termination of your subscription, we will delete Customer Content within 90 days, except where law requires us to keep it. Backups roll off on our providers’ schedules, so deleted data may persist in backups for a short period after deletion; it stays protected by this DPA until it’s gone. On written request made before that window closes, we’ll return a copy in a structured, machine-readable format.

Liability and precedence

Each party’s liability under this DPA is subject to the limitation of liability in the Terms of Service.

If this DPA conflicts with the Terms of Service, this DPA prevails on data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses prevail. This DPA terminates when your subscription ends and our deletion obligations are fulfilled.

Annex A — Details of processing

Subject matter. Providing the hosted Ganju service: hosting MCP servers, retrieval over Customer Content, tool execution, and chat-channel bots.

Duration. For as long as you use the service, plus the deletion window above.

Nature and purpose. Storage, chunking, embedding, indexing, retrieval, transmission to the model, tool, and platform providers you configure, execution of tool calls, generation of assistant replies, usage metering, audit logging, and security monitoring.

Types of personal data. Whatever you choose to put in, plus what the service generates:

  • identifiers and contact details of your members and invitees (name, email, profile image);
  • chat-platform identifiers and display names of End Users who message your bots;
  • the content of channel conversations in both directions;
  • the content of resources you upload, crawl, or sync, and the text chunks and embeddings derived from them;
  • the arguments and results of tool calls, which may contain email bodies, calendar entries, drive documents, and messages from connected accounts;
  • technical data: IP addresses, user agents, client names and versions, timestamps, latency, token counts, and error traces.

Categories of data subjects. Your members and invitees; End Users who interact with your assistants through a channel or an MCP client; and any individual whose personal data appears inside the content you add or the accounts you connect.

Special categories. None are requested or required. You should not submit them — see Your obligations as controller.

Frequency. Continuous, for as long as the service is in use.

Subprocessors. As listed at ganju.ai/subprocessors.

Annex B — Technical and organizational measures

  • Encryption in transit. All traffic runs over TLS on Cloudflare’s network.
  • Encryption of secrets at rest. OAuth tokens, API keys, bot credentials, and webhook secrets are encrypted with XChaCha20-Poly1305 before storage, decrypted only at the moment of use, never returned to the browser in plaintext, and never written to logs or error traces.
  • Storage. Managed Postgres with encryption at rest and provider-managed backups; object storage in Cloudflare R2.
  • Access control. Every query is scoped to the organization or project the caller is a member of. Roles are enforced server-side on each request, not in the UI.
  • Authentication. Social sign-in through Google or GitHub; sessions carry an expiry, and MCP access is gated by OAuth with scoped tokens.
  • Webhook integrity. Chat-platform callbacks are verified against a per-channel secret before any processing.
  • Egress screening. The crawler, http-endpoint, and mcp-proxy screen target hosts against private and loopback address ranges.
  • Least privilege on connected accounts. Each integration requests only the scopes its tools need; tokens are refreshed automatically and marked for re-authentication when a refresh fails.
  • Auditability. MCP requests, tool, prompt, and resource executions, and channel messages are recorded with actor, source, and timestamp.
  • Retention limits. Detailed request logs, error logs, and channel message history are purged automatically on a schedule — see How long we keep data.
  • Personnel. Access to production is limited to personnel who need it, under confidentiality obligations.
  • Resilience. The platform runs on managed, replicated infrastructure with provider-managed backup and restore.

Contact

Data protection questions, requests, or notices under this DPA:

  • Email — hello@ganju.ai
  • Phone — +57 312 4678519
  • Post — Ganju S.A.S., Bogotá, D.C., Colombia