Pilot data-processing summary

Roles and instructions

For company files and workflow content, the company acts as controller or business and AI Buddy acts as processor or service provider. AI Buddy processes that data only to perform the approved pilot scope, secure the service, provide support, and follow documented legal instructions.

Scope

The signed pilot schedule must identify permitted data categories, users, skills, output types, processing locations, subprocessors, retention periods, and prohibited regulated data. Until that schedule is approved, real company files must not be submitted.

Core commitments

• Confidentiality obligations for people authorized to process company data.
• Technical and organizational safeguards appropriate to the pilot risk.
• Subprocessor review and written notice of material changes.
• Reasonable assistance with verified rights requests, incidents, deletion, and compliance information.
• Return or deletion of company content at the end of the pilot, subject to legal retention requirements.
• Run inputs are deleted when processing ends; retained audit metadata excludes the original filename and file content.

International transfers and incidents

Any required transfer mechanism, region commitment, breach-notification period, audit right, or regulated-data addendum must be included in the signed company agreement. This public summary is not a substitute for that signed agreement.