Data Processing Agreement
Between Daria Guseva Brighter Analytics (Czerniakowska street 174, Warsaw 00-440,
Poland, VAT NIP 7011303570) - the Processor - and the Customer - the Controller.
This DPA is intended to be accepted as part of the Terms of Use, so every business customer has one without a signature round.
1. Why this document is needed
A Brighter user uploads a .pbix file from their job. That file routinely contains personal data of people who never met us - the customer's clients, patients or staff. For that data the customer's employer is the controller and Brighter is the processor, which makes art. 28(3) GDPR mandatory. Without this agreement every business customer is in breach simply by using the product, and their own security review will find it.
2. Subject matter and duration
Processing lasts for the term of the customer's subscription plus the retention periods in section 7. Subject matter: providing an AI mentoring service for Power BI.
3. Nature and purpose
• Storing uploaded files and chat history
• Extracting the data model, DAX and layout from `.pbix` files
• Sending content to AI providers to generate answers
• Recording prompts and responses for debugging and quality
4. Categories of data and data subjects
Data subjects: the customer's own users, and any individual whose data appears inside an uploaded file.
Categories: account identifiers (email, name), usage and progress data, technical data (IP, device), and whatever the customer chooses to upload - which we do not control and do not inspect.
Special categories (art. 9): the Terms prohibit uploading them. We have no technical means of detecting them, so this is a contractual prohibition, and the customer warrants compliance.
5. Processor obligations
We will: - process only on documented instructions, including for transfers - ensure that anyone authorised to process is bound by confidentiality - apply the measures in Annex II - respect the conditions in section 6 for engaging another processor - assist with data subject requests, taking into account the nature of processing - assist with art. 32-36 obligations - delete or return data at the end of the service, at the customer's choice - make available the information needed to demonstrate compliance and allow audits
6. Subprocessors
The customer gives general authorisation to the subprocessors listed at https://brighter.rocks/subprocessors. We will announce additions on that page before they begin processing, and the customer may object on reasonable data protection grounds; if the objection cannot be resolved, the customer may terminate.
7. Retention and deletion
Account data - For the subscription, then up to 90 days
Uploaded files - Until deleted by the user, or 90 days after account deletion
Chat history - Same as account data
LLM traces - TO SET - proposed 90 days
Application logs - TO SET - proposed 30 days
Backups - TO SET - proposed 35 days rolling
Financial records - 5 years (Polish accounting law)
Deletion from backups happens as backups expire rather than on request; this is standard and must be stated openly rather than promised away.
8. International transfers
Where a subprocessor sits outside the EEA, transfers rely on an adequacy decision, or on Standard Contractual Clauses plus the measures in Annex II. The relevant module is Module Two (controller to processor); where a subprocessor is engaged, Module Three.
9. Security incidents
We notify the customer without undue delay after becoming aware of a personal data breach affecting their data, with the information available at that time, and follow up as the picture becomes clear.
Annex II - Technical and organisational measures
Written from what is actually in place as of July 2026:
• TLS for all traffic; the database has no public network route
• Files isolated per user in object storage, access via scoped keys, not root
• Authentication through Keycloak; sessions expire; admin surfaces are separate
• Secrets held in the platform's encrypted store, rotated on personnel change - the
• Nightly encrypted off-site backups, restore tested
• Access limited to named individuals; developer access is revoked on departure
• Uploads are validated before reaching the privileged extraction worker
• No public API documentation exposing the route map
This DPA is intended to be accepted as part of the Terms of Use, so every business customer has one without a signature round.
1. Why this document is needed
A Brighter user uploads a .pbix file from their job. That file routinely contains personal data of people who never met us - the customer's clients, patients or staff. For that data the customer's employer is the controller and Brighter is the processor, which makes art. 28(3) GDPR mandatory. Without this agreement every business customer is in breach simply by using the product, and their own security review will find it.
2. Subject matter and duration
Processing lasts for the term of the customer's subscription plus the retention periods in section 7. Subject matter: providing an AI mentoring service for Power BI.
3. Nature and purpose
• Storing uploaded files and chat history
• Extracting the data model, DAX and layout from `.pbix` files
• Sending content to AI providers to generate answers
• Recording prompts and responses for debugging and quality
4. Categories of data and data subjects
Data subjects: the customer's own users, and any individual whose data appears inside an uploaded file.
Categories: account identifiers (email, name), usage and progress data, technical data (IP, device), and whatever the customer chooses to upload - which we do not control and do not inspect.
Special categories (art. 9): the Terms prohibit uploading them. We have no technical means of detecting them, so this is a contractual prohibition, and the customer warrants compliance.
5. Processor obligations
We will: - process only on documented instructions, including for transfers - ensure that anyone authorised to process is bound by confidentiality - apply the measures in Annex II - respect the conditions in section 6 for engaging another processor - assist with data subject requests, taking into account the nature of processing - assist with art. 32-36 obligations - delete or return data at the end of the service, at the customer's choice - make available the information needed to demonstrate compliance and allow audits
6. Subprocessors
The customer gives general authorisation to the subprocessors listed at https://brighter.rocks/subprocessors. We will announce additions on that page before they begin processing, and the customer may object on reasonable data protection grounds; if the objection cannot be resolved, the customer may terminate.
7. Retention and deletion
Account data - For the subscription, then up to 90 days
Uploaded files - Until deleted by the user, or 90 days after account deletion
Chat history - Same as account data
LLM traces - TO SET - proposed 90 days
Application logs - TO SET - proposed 30 days
Backups - TO SET - proposed 35 days rolling
Financial records - 5 years (Polish accounting law)
Deletion from backups happens as backups expire rather than on request; this is standard and must be stated openly rather than promised away.
8. International transfers
Where a subprocessor sits outside the EEA, transfers rely on an adequacy decision, or on Standard Contractual Clauses plus the measures in Annex II. The relevant module is Module Two (controller to processor); where a subprocessor is engaged, Module Three.
9. Security incidents
We notify the customer without undue delay after becoming aware of a personal data breach affecting their data, with the information available at that time, and follow up as the picture becomes clear.
Annex II - Technical and organisational measures
Written from what is actually in place as of July 2026:
• TLS for all traffic; the database has no public network route
• Files isolated per user in object storage, access via scoped keys, not root
• Authentication through Keycloak; sessions expire; admin surfaces are separate
• Secrets held in the platform's encrypted store, rotated on personnel change - the
• Nightly encrypted off-site backups, restore tested
• Access limited to named individuals; developer access is revoked on departure
• Uploads are validated before reaching the privileged extraction worker
• No public API documentation exposing the route map