Data Processing Agreement (DPA)

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service and governs the processing of personal data by Utopian, Inc. (“Processor”) on behalf of its customers (“Controller”) in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

1. Parties

This Agreement is between Utopian, Inc., 3790 El Camino Real, Palo Alto, CA 94306, USA and the Customer agreeing to the Terms of Service.

2. Subject Matter and Duration

This Agreement applies to personal data submitted by the Customer and processed by Utopian in the course of providing the Services. It remains in effect as long as Utopian processes data on the Customer’s behalf.

3. Nature and Purpose of Processing

Personal data is processed solely to provide, maintain, and improve the Services, including logging, security, monitoring, and support.

4. Categories of Data Subjects

End users, employees, leads, or other individuals whose data is submitted to the platform by the Customer.

5. Types of Personal Data

Email addresses, names, company data, messages, and any other personal data submitted through the Services. No special categories of data are processed.

6. Controller Obligations

Customer confirms it has a legal basis for processing all data submitted
Customer agrees not to upload unlawful or special category data without consent
Customer remains responsible for compliance with applicable data laws

7. Processor Obligations

Only process data based on Customer’s documented instructions
Maintain appropriate technical and organizational security measures
Ensure confidentiality agreements with all personnel and sub-processors
Assist with data subject rights requests
Notify the Customer promptly in the event of a data breach
Support audits or assessments related to data processing

8. Sub-Processors

Authorized sub-processors include, but are not limited to:

Google Cloud Platform – Infrastructure
Amazon Web Services – Infrastructure
Clerk – Authentication
Vercel – Infrastructure
Stripe – Payment processing
Upstash – Infrastructure
Sendgrid – Transactional email
Mixpanel – Analytics
Segment – Analytics
New Relic – Logging and tracing
LangSmith – Tracing
OpenAI – AI models
Anthropic – AI models
xAI – AI models
Perplexity – Search
Groq – Inference
Modal – Inference

Customer will be notified of any changes and may object on reasonable grounds.

9. International Transfers

All personal data is stored and processed within the European Union.

10. Data Retention

We retain data only as long as necessary to provide the Services. No fixed retention limit is applied.

11. Deletion and Return of Data

Customers may request deletion or export of data at any time. Utopian will comply within a reasonable timeframe unless required to retain it by law.

12. Governing Law

These Terms are governed by the laws of the State of California, excluding its conflict of laws principles. Any dispute will be resolved in the courts of Santa Clara County, California.