1. Parties and roles
This agreement is between you, the customer that uses Upmo AI Cloud ("you"), and Klassroom, registered with the Netherlands Chamber of Commerce (KvK) under number 95052917, at Banning Cocqgracht 83, 1445 BW Purmerend, the Netherlands ("Klassroom", "we").
For personal data in your workspace, you are the controller and Klassroom is the processor, as defined in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This agreement meets the requirements of Article 28 GDPR.
It doesn't apply to the open-source version of Upmo AI that you run on your own servers. In that case we don't process your data.
2. What we process
We process personal data only to provide Upmo AI Cloud to you, for as long as you use it. Annex 1 lists the types of data, the people it's about, and what we do with it.
3. Your instructions
We process personal data only on your documented instructions. These terms, and the way you set up your workspace, agents and connected tools, are your instructions. If the law requires us to process data in another way, we'll tell you first, unless the law forbids that.
If we believe an instruction breaks the GDPR or other data protection law, we'll tell you straight away.
We don't use your workspace data for our own purposes, and we don't sell it.
4. Confidentiality
Everyone at Klassroom who can access your data is bound by confidentiality and only accesses it when needed to run the service, fix a problem you report, or meet a legal obligation.
5. Security
We take appropriate technical and organisational measures to protect your data, as required by Article 32 GDPR. Annex 2 describes them. We may improve these measures over time, but we won't lower the overall level of protection.
6. Subprocessors
You give us general permission to use subprocessors, such as hosting providers and the AI model providers that run your agents' tasks. For each one:
- we sign a written agreement with data protection obligations at least as strict as these,
- we stay responsible to you for their work.
Email privacy@upmo.ai for the current list. We'll tell you at least 30 days before we add or replace a subprocessor. If you have a reasonable data protection objection, tell us within that period. If we can't resolve it, you can end the affected part of the service.
If you connect your own account with a model provider or another tool, that provider works for you under your own agreement with them. It isn't our subprocessor.
7. Transfers outside the EEA
We only transfer personal data outside the European Economic Area when the GDPR allows it, for example under an adequacy decision or the European Commission's standard contractual clauses.
8. Helping you comply
- Requests from people. If someone asks us directly to see, correct or delete their data, we'll pass the request to you and won't answer it ourselves. Upmo AI lets you find, export and delete data about a person.
- Assessments. We'll give you reasonable help with data protection impact assessments and consultations with a supervisory authority.
9. Data breaches
If we become aware of a personal data breach that affects your data, we'll tell you without undue delay. We'll share what we know: what happened, which data and people are affected, the likely effects, and what we're doing about it. We'll add more details as we learn them.
10. Audits
We'll give you the information you reasonably need to show that we meet this agreement, including answers to security questionnaires. The source code of Upmo AI is open, so you can review how it handles data.
If that isn't enough, you or an independent auditor you choose may audit us, once a year and with at least 30 days' notice, unless a supervisory authority requires otherwise or there's been a breach. Auditors must keep what they learn confidential. You pay the cost of your audit.
11. End of the service
You can export your data at any time. When you close your workspace, we delete your personal data, including copies, unless the law requires us to keep it. Data in backups is deleted when those backups expire.
12. General
This agreement lasts as long as we process personal data for you. The liability rules in the Terms of Use apply. If this agreement and the Terms of Use conflict on data protection, this agreement wins. Dutch law applies.
Questions? Email privacy@upmo.ai.
Annex 1: Processing details
| Subject | Providing Upmo AI Cloud: AI agents that work in the tools you connect |
|---|---|
| Duration | As long as you use Upmo AI Cloud, then until deletion under section 11 |
| What we do with it | Store, read, analyse and change data as your agents' tasks require. Send data to the tools and AI models you set up. Log every action for you. |
| People | Your staff and users, and the people in your data, such as your customers, suppliers, clients and contacts |
| Types of data | Whatever you and your agents put into the workspace, such as names, contact details, invoices, emails, tickets, contracts and documents |
| Special categories | Only if you choose to process them. You're responsible for having a legal basis to do so. |
Annex 2: Security measures
- Sealed workspaces. Each task runs in its own isolated workspace, with no internet access by default.
- Allowed sites only. Agents can only reach the sites and tools on the task's list.
- Keys kept out. Agents never see passwords or API keys. Upmo AI adds the real key on the way out, only for allowed sites.
- Approvals. Actions that send data out, move money or change records wait for a person's approval, depending on the rules you set.
- Separated data. Each customer's data is kept apart at the database level.
- Sign-in. Passkey sign-in, and a second confirmation before changes to roles, keys or security rules.
- Logging. Every agent action is logged with what it read, what it changed and who approved it.
- Encryption in transit. Traffic to and from Upmo AI is encrypted with TLS.
- Access. Our staff only access customer data when needed.
- Open code. The source code is public, so these measures can be checked.