Inklet AI

Data Processing Addendum (DPA)

This DPA forms part of the agreement between you (Controller) and Inklet AI (Processor) under the GDPR / UK GDPR / CCPA. Last updated 2026-05-10. For a signed bilateral copy email hello@inklet.ai.

1. Subject matter & duration

Processor processes Personal Data on behalf of the Controller for the duration of the subscription, plus a 90-day post-termination retention window for export.

2. Nature & purpose

To deliver the Inklet AI service: topic discovery, drafting, voice analysis, SEO scoring, repurpose, conversion-toolkit assets, and integrations to publishing platforms named by the Controller.

3. Categories of data subjects

  • The Controller and the Controller's authorised users.
  • Subscribers / readers indirectly referenced via integrations chosen by the Controller.

4. Categories of personal data

  • Account: email, name.
  • Content: drafts, voice profiles (text + embeddings), CTA / popup assets.
  • Integration tokens (encrypted at rest with libsodium).
  • Usage events: model name, tokens, cost, latency.

5. Sub-processors

See Privacy Policy for the complete list. We notify of changes via the changelog.

6. International transfers

Where data is transferred outside the EEA / UK, we rely on EU Standard Contractual Clauses (2021/914) plus the UK IDTA, and apply supplementary measures (encryption in transit + at rest, named-egress sub-processors).

7. Security

See /legal/security for organisational + technical measures. We notify of breaches without undue delay and within 72 hours where applicable.