Data Governance

Data Processing Agreement

Last updated: March 15, 2026

SOC 2 Type IIAudited security controls for data handling and access management.
256-bit AESAll Brain Data encrypted at rest with AES-256 and in transit with TLS 1.3.
Tenant IsolationEach Executive Twin operates in an isolated database with no cross-tenant access.
GDPR ReadyFull compliance with EU data protection regulations and data subject rights.

1. Scope & Purpose

This Data Processing Agreement ("DPA") governs how StackFast Technologies Inc. ("Processor") processes personal data on behalf of ExecuTwin customers ("Controller") in connection with the ExecuTwin platform and services. This DPA supplements our Terms of Service and Privacy Policy.

2. Categories of Data Processed

Identity Data: Names, email addresses, professional titles, and organizational affiliations.
Brain Data: Interview transcripts, writing samples, voice recordings, social media content, professional documents, and all content used to train your Executive Twin.
Generated Content: Articles, communications, analyses, and other outputs produced by your Executive Twin.
Behavioral Data: Platform interaction logs, feature usage patterns, and performance metrics.

3. Processing Principles

We process data solely for the purpose of operating your Executive Twin and improving service quality. Processing is conducted on a lawful basis, limited to what is necessary, and subject to appropriate security measures. We do not use your Brain Data to train general-purpose AI models or share it with other customers.

4. Sub-Processors

We engage the following categories of sub-processors, each bound by data processing agreements:

Cloud InfrastructureHosting & compute
AI Model ProvidersLLM inference (no training)
Payment ProcessingStripe (PCI DSS compliant)
Email ServicesTransactional email delivery

5. Data Subject Rights

We support your obligations to respond to data subject requests including: right of access, right to rectification, right to erasure, right to data portability, right to restrict processing, and right to object. We will assist you in responding to such requests within the timeframes required by applicable law.

6. Data Breach Notification

In the event of a personal data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

7. International Transfers

Data may be transferred to and processed in the United States. For transfers from the European Economic Area, we rely on Standard Contractual Clauses approved by the European Commission, supplemented by additional technical and organizational measures.

8. Data Deletion

Upon termination of services, all Brain Data and Generated Content will be permanently deleted within 30 days. You may request a complete data export in machine-readable format before deletion. Backup copies are purged within 90 days of the deletion request.

9. Contact

For data processing inquiries, contact our Data Protection Officer at dpo@stackfast.ai or StackFast Technologies Inc., State of Delaware, United States.

Report an Issue