Last updated 8 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Danish Shah, trading as Cusentra Mail ("we", "us") and every customer who uses Cusentra Mail for a business, profession or organisation ("you"). It applies automatically from the moment you accept the Terms; nothing needs to be signed. If you would like a countersigned copy, write to danish@cusentra.com.
1.1 For the personal data in the mail, contacts and files your users bring to the Service ("Customer Personal Data"), you are the controller (or a processor acting for your own customer) and we are your processor. For the data we need to run the account itself - sign-in, billing status, security logs - we are an independent controller, as our Privacy Policy explains.
1.2 "Data Protection Laws" means every law on personal data that applies to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act, India's Digital Personal Data Protection Act 2023 and its Rules, and Brazil's LGPD. Terms not defined here have the meaning those laws give them.
1.3 What we process, about whom, why and for how long is set out in Annex I.
2.1 Instructions. We process Customer Personal Data only on your documented instructions: these Terms, this DPA, and what your users do in the Service - the features they use and the settings they choose. If we believe an instruction breaks Data Protection Laws we tell you, and if the law makes us process the data for another purpose, we tell you first unless the law forbids that.
2.2 Confidentiality. Everyone who can reach Customer Personal Data is bound to keep it confidential. Mail content is encrypted at rest with a key for each account, so the people who run our database see ciphertext. We read Customer Personal Data in readable form only (a) when you ask us to, for example in a support request; (b) to investigate a security incident or a report of abuse; (c) where the law requires it; or (d) when keeping the Service running needs it and there is no other way. Each such access is recorded in our audit log.
2.3 Security. We maintain the technical and organisational measures in Annex II, and we may improve them but never lower their overall protection.
2.4 No other use. We do not sell Customer Personal Data, use it for advertising, or use it to train or fine-tune AI models, and neither do our sub-processors.
3.1 You authorise us to use the sub-processors in Annex III. Each is bound by a written contract that gives Customer Personal Data at least the protection this DPA does, and we remain responsible to you for them.
3.2 Changes. We give at least 30 days' notice before adding or replacing a sub-processor, by updating Annex III with the date and by emailing the address of each account. You may object on reasonable data-protection grounds within those 30 days. If we cannot resolve the objection, you may end the affected part of the Service before the change applies, and we refund the unused part of the period you paid for.
3.3 The services your users choose to connect - Slack, Microsoft Teams, Discord, Notion, OneNote, Google Drive, Docs and Calendar - and Gmail itself are not our sub-processors: they act on your users' instructions under their own terms, and we send them only what a feature your users set up sends.
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data. We tell you what happened, the categories and approximate number of people and records concerned, the likely consequences, what we have done and will do, and a contact; where we cannot yet give everything, we give it in stages. We do not notify your users or a regulator about your data in your name unless you ask us to or the law requires it.
When an account is deleted, or the agreement ends, we delete the Customer Personal Data we hold for it at once. Before that, your users can download a copy (Connections, Export my data). Database backups age out within 7 days, and because each account's encryption key is destroyed when the account is deleted, its content in those backups cannot be read from that moment. We keep nothing longer unless the law requires it.
We make available the information needed to show we meet this DPA: this document, our Security page, and written answers to a reasonable security questionnaire once a year. If that is not enough - because a regulator requires it, or after a breach affecting your data - you may audit us, or have an independent auditor bound by confidentiality do so, on at least 30 days' notice, during business hours, at your cost, no more than once a year, without access to other customers' data. We do not hold an ISO 27001 or SOC 2 certificate of our own; our hosting and database providers do.
8.1 Where the data is. Customer Personal Data is stored in the European Union (Frankfurt, Germany). It leaves there in three ways: our team, based in India, can reach it remotely to run and support the Service (section 2.2); an AI feature your users choose sends the part of an email it needs to OpenAI or Google (Annex III), which may process it in the United States or elsewhere; and Amazon's email service sends account notices from the EU.
8.2 EU Standard Contractual Clauses. Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914 are incorporated into this DPA and apply as follows: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor; Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorisation) with the 30 days' notice in section 3.2; the optional wording in Clause 11(a) does not apply; under Clause 13, the supervisory authority is the one of the EU member state where you are established, or if you are not established in the EU, that of the member state where your EU representative is; Clauses 17 and 18: the law and the courts of Ireland. Annexes I, II and III of this DPA are the Annexes to the Clauses. Our transfers onward to our sub-processors are made on the same Clauses or another lawful basis (Annex III).
8.3 United Kingdom. For data subject to the UK GDPR, the International Data Transfer Addendum to the EU Clauses issued by the UK Information Commissioner (version B1.0) is incorporated: Table 1 is completed by the details in Annex I; Table 2 selects the Modules and options in 8.2; Table 3 is Annexes I to III; in Table 4, neither party may end the Addendum when it is revised.
8.4 Switzerland. For data subject to the Swiss FADP, the Clauses in 8.2 apply with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to EU law include the FADP; and people in Switzerland may enforce their rights in their place of habitual residence.
8.5 Brazil. Where you transfer personal data subject to the LGPD to us, the standard contractual clauses approved by Brazil's ANPD (Resolution CD/ANPD No. 19/2024) are incorporated, with the details in Annex I.
8.6 Other countries. Where another law requires a transfer instrument, we will agree to its standard terms on request.
For personal information governed by the California Consumer Privacy Act and similar state laws, we are your service provider (or processor). We process it only for the business purposes in Annex I and the Terms; we do not sell or share it, or retain, use or disclose it for any other purpose or outside our direct business relationship with you; we do not combine it with personal information from elsewhere except as those laws allow; we give it the same level of privacy protection the law requires of you and comply with the law; we tell you if we can no longer meet these obligations; and you may take reasonable steps to stop and remedy unauthorised use. We certify that we understand these restrictions and will comply with them.
For personal data under India's Digital Personal Data Protection Act 2023, we are your Data Processor under this valid contract: we process only for the purposes you set, keep the reasonable security safeguards in Annex II (including encryption, access control and logs kept for at least one year), tell you of a personal data breach without delay so that you can inform the Data Protection Board and the people affected, and erase the data when the purpose is served or the agreement ends.
Each party's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or Data Protection Laws do not allow a limit. If this DPA conflicts with the Terms, this DPA prevails; if the Clauses conflict with this DPA, the Clauses prevail. This DPA lasts as long as we process Customer Personal Data for you.
| Parties | The data exporter is you, the customer, as identified by your account. The data importer is Danish Shah, trading as Cusentra Mail, contact danish@cusentra.com. |
|---|---|
| People concerned | Your users; the people who write to them or whom they write to; anyone named in that mail or its attachments. |
| Personal data | Names and email addresses; message headers, subjects, bodies and attachment names; the content of attachments a user opens or asks the AI about; labels, rules, notes and drafts; any other personal data the mail contains. |
| Sensitive data | Mail can contain special categories of data (for example health information) if your users receive it. Safeguards: encryption at rest with a key per account, access limited and logged (section 2.2), AI only on a user's request and switchable off, optional removal of identifiers before AI requests. |
| Frequency | Continuous, while the account is connected. |
| Nature and purpose | Storing a working copy of the mailbox, showing it, sorting it by rules, searching it, and - when a user asks - producing summaries, drafts and answers with an AI model; sending what a user sends. Solely to provide the Service to you. |
| Duration and retention | For as long as the account exists, subject to the periods in our Privacy Policy; backups age out within 7 days. |
| Competent supervisory authority | As set by Clause 13 (section 8.2). |
| Who | What for | Where | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services | Hosting the application servers; sending account notices (Amazon SES) | Frankfurt, Germany | Stored in the EU; AWS data processing terms, with the EU Clauses |
| Supabase | Database, authentication and backups | Frankfurt, Germany | Stored in the EU; Supabase data processing agreement, with the EU Clauses |
| OpenAI | AI summaries, drafts and answers, when a user asks | United States | EU Clauses in OpenAI's data processing addendum; no training on API data; kept up to 30 days for abuse monitoring |
| Google (Gemini API) | AI summaries, drafts and answers, when a user asks | United States and other Google locations | Google's data processing terms and EU-US Data Privacy Framework certification; paid tier, no use to improve Google's products; kept for a limited period for abuse monitoring |
Not sub-processors, because they act for themselves or for your users: Paddle.com Market Ltd (our reseller, which processes payment data as an independent controller), Google as your Gmail provider, and the services your users connect. Last change to this list: 8 October 2026.