Data processing agreement
The template we sign with a client whose company needs one: Plunge AI as the processor, the client as the controller, for the personal data the agency handles while it makes and checks the client's work.
Version 2026-10-13 · Pending owner sign-off
Template — pending legal review (BIZ-07). Signed copies on request at legal@plungeai.com. Where this template and a signed agreement differ, the signed agreement applies.
1. Parties
Controller: the client company named in the order or the plan it starts in Agency Studio, acting through its approver.
Processor: PlungeAI, Inc. ("Plunge AI"), which runs Plunge AI Agency.
This agreement is part of the terms and lasts as long as Plunge AI processes personal data for the controller under them.
2. Scope of processing
- Subject matter
- Making, checking, reviewing, delivering and, where connected, publishing and measuring marketing work for the controller.
- Data subjects
- The controller's staff who use the workspace; people named in briefs, brand material or claims the controller gives us; recipients of lifecycle email the controller sends; people whose likeness or voice the controller consents to use.
- Categories of data
- Names, work email addresses and roles; the content of briefs, brand profiles, claims and comments; decisions and their reasons; performance numbers from accounts the controller connects; billing contact details. No special categories are needed; the controller agrees not to put them in a brief.
- Duration
- While the controller is a client and until the workspace is erased (§8).
3. Instructions
Plunge AI processes personal data only on the controller's documented instructions: the terms, this agreement, the briefs and decisions the controller's users make in Agency Studio, and the accounts the controller connects. Plunge AI tells the controller at once if it believes an instruction breaks data protection law.
People at Plunge AI who work on the controller's workspace are bound to confidentiality and see only the workspaces of the agency's clients.
4. Security
Plunge AI keeps the measures described on the security page: the agency's own databases and file storage on Cloudflare, separate per workspace; connected-account credentials held in the platform's connection vault encrypted with AES-256-GCM; review links stored only as hashes; cards held by Stripe; every change recorded with the user who made it. Plunge AI updates that page before it changes a measure in a way that lowers protection.
5. Subprocessors
The controller authorises the subprocessors listed at /security#subprocessors, each with its purpose, region and the data it sees. Plunge AI adds a row there before a new subprocessor sees any client data and tells the controller's approver by email; the controller may object within 30 days, in which case the parties find a way around it or the controller may cancel the plan under the terms. Plunge AI stays responsible for each subprocessor's performance.
6. Transfers
The subprocessors process data in the regions the list names. Where a transfer leaves the controller's jurisdiction, it is made under the subprocessor's standard contractual terms or another recognised mechanism, which Plunge AI names on request.
7. Assistance
Plunge AI helps the controller answer data subject requests: a copy of a workspace's data is one download for the controller's approver; a correction is an edit in the workspace; an erasure is §8. Plunge AI helps with impact assessments and consultations with authorities as far as the processing described here needs it.
8. Deletion and return
At the end of the agreement, or whenever the controller asks, the controller's approver downloads the workspace export and Plunge AI erases the workspace: every record in the agency's three databases and every file in its storage, as Privacy describes. What stays: invoices and payment records held by Stripe for tax and accounting, the platform's own records of each model run, and anything already published into accounts the controller owns.
9. Audit
On request, no more than once a year unless an authority requires it, Plunge AI gives the controller the information needed to show it meets this agreement: the security page as it stood, the subprocessor list, the workspace's timeline and the audit line of any erase. Plunge AI holds no third-party certification yet (certifications); when it does, the report stands in for the above.
10. Breach notice
Plunge AI tells the controller's approver without undue delay after becoming aware of a personal data breach that affects the controller's data, with what happened, which data and people it touched, what Plunge AI did and what it recommends, and adds to it as it learns more.