Legal

Data Processing Agreement

Last updated 2 November 2026

Section 1: Parties and Roles

1.1 Processor: LeMans Labs OÜ, Estonian commercial registry no. 16872044, registered office Valukoja 8/1, 11415 Tallinn, Estonia ("ewpire", "Processor").
1.2 Controller: the account holder, acting for the business or other organisation that uses the Service ("Controller"); where team workspaces are available, the Owner of a team workspace acts for it. This DPA applies where the account holder uses the Service as a controller within the scope of the GDPR or the UK GDPR, and references to the GDPR then include the UK GDPR. Where a person uses the Service personally, the Processor is the controller of that person's data and the Privacy Policy applies instead of this DPA.
1.3 Roles.
- (a) Processor. For the content the Controller's users submit to the Service and the outputs generated from it (Section 1.4), the Processor acts as the Controller's processor and this DPA applies.
- (b) Independent controller. For account management, billing and payment, security and fraud prevention, usage records without content, product improvement and marketing, the Processor decides the purposes and means and acts as an independent controller under its Privacy Policy. The Processor does not train or fine-tune AI models on the Controller's content.
1.4 Data scope: the Personal Data (GDPR Art. 4(1)) contained in the content the Controller's users submit to the Service as available to the Controller (prompts and conversations, uploaded files and their extracted text, reference images, code and project files) and in the outputs generated from it (answers, Consensus results, code, images, videos and music tracks).
1.5 Exclusions. Payment data entered at checkout is processed by the payment provider (Stripe) as an independent controller under its own terms; the Processor does not receive or store card numbers. Content sent to models marked "third-party access" is outside this DPA (Section 5.3).

Section 2: Subject Matter, Duration, Purpose

2.1 Subject matter. Processing necessary to deliver the Service as available to the Controller.
2.2 Duration. From 1 November 2026, or from the day the Controller starts using the Service if later, until the Controller's Personal Data is deleted as set out in Section 3.7 (from live systems without delay on deletion of the account; from database backups within 30 days).
2.3 Nature of processing. Storage (including object storage of files and generated media), text extraction from uploaded files, transmission to model providers for inference, generation of text, code, images, video and music, preview of generated code in a sandboxed browser frame, publication of the sites the Controller chooses to publish, and deletion.
2.4 Purpose limitation. Solely to provide the Service; no other purpose without the Controller's specific documented instruction.
2.5 Data subjects. The Controller's users, and any natural persons whose personal data those users include in content.
2.6 Data categories. Whatever personal data the Controller's users include in the content described in Section 1.4 – typically names, contact details and other information about identifiable people in prompts, files, images and code.
2.7 Special categories (Art. 9). Not intended. The Controller undertakes not to submit special-category data unless the parties have agreed it in writing beforehand.
2.8 Controller warranty and indemnity. The Controller warrants that, for all Personal Data it submits to the Service, including any third party's personal data, it has a lawful basis under Art. 6 GDPR (and where applicable an Art. 9 condition) and has given the data subjects the information required by Art. 13 and 14 GDPR. The Controller indemnifies the Processor against third-party claims and regulatory liability arising from a breach of this warranty. The Processor may refuse or suspend processing of inputs it reasonably suspects to be unlawful or to contain special-category data submitted without such agreement, and tells the Controller when it does.

Section 3: Processor Obligations (Art. 28(3))

3.1 Instruction-only processing. The Processor processes Personal Data only on the Controller's documented instructions, including as to international transfers, unless required otherwise by EU or Estonian law (in which case the Processor informs the Controller before processing, unless that law prohibits such information on important grounds of public interest). The Controller's instructions are this DPA, the Terms of Service, and what the Controller's users do in the Service, including the model they select.
3.2 Confidentiality. Persons authorised to process the data are bound by confidentiality.
3.3 Security (Art. 32). The Processor implements the technical and organisational measures in Annex II.
3.4 Sub-processors. Engaged only in accordance with Section 4.
3.5 Data-subject requests. The Processor assists the Controller, by appropriate measures, to respond to data-subject requests (Art. 12–22); requests received directly are forwarded to the Controller without undue delay, and substantive responses require the Controller's authorisation.
3.6 Compliance assistance. The Processor assists the Controller in ensuring compliance with Art. 32–36 (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and the information available.
3.7 Deletion or return. The Controller can export its data from Settings at any time before the account is deleted. On deletion of the account the Processor deletes the Controller's Personal Data from live systems without delay and confirms the deletion by e-mail to the account address; copies in database backups are overwritten within 30 days and are restored only for disaster recovery. Records the Processor must keep by law are retained as stated in the Privacy Policy. If the Processor ends the Service for the Controller, the Controller can export its data for 30 days after the notice, unless the law forbids it; the Processor then deletes the account as above.
3.8 Audit rights. The Processor makes available the information needed to show compliance with Art. 28, including a written description of its security measures and answers to a reasonable security questionnaire, and allows audits, including inspections, by the Controller or an auditor it mandates, bound by confidentiality, at most once a year on 30 days' notice, and additionally where a supervisory authority requires it or after a personal-data breach affecting the Controller's data. Audits do not extend to other customers' data.
3.9 Instruction-breach notice. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member-State data-protection law.
3.10 California service-provider obligations. To the extent CCPA/CPRA applies, the Processor acts as a service provider: it does not sell or share Personal Data, processes it only for the business purpose specified, does not combine it impermissibly, and notifies the Controller if it can no longer meet its obligations.
3.11 AI transparency. The Service shows users that they are interacting with AI and marks generated files as described in the AI Transparency Notice; the Controller remains responsible for its own disclosure duties when it publishes outputs.

Section 4: Sub-Processors

4.1 General authorisation. The Controller authorises the sub-processors in the list referred to in Annex III, including the API aggregators, the developers and hosts of models its users select, and the Auto developers named there. The authorisation does not cover providers of models marked "third-party access", which are not sub-processors and are outside this DPA.
4.2 Change notice. The Processor gives notice before adding or replacing a provider that processes data for it, an API aggregator or an Auto developer, by updating ewpire.com/subprocessors and e-mailing the account address, naming the provider: at least 30 days for a provider outside the EEA or an addition to the Auto developers, and at least 14 days for a provider in the EEA or a like-for-like replacement. A model the Controller's users select themselves needs no advance notice: its developer is shown in the catalog before it is selected. The Controller may object within the notice period on reasonable data-protection grounds; if the parties cannot agree, the Controller may close the account and the Processor refunds the Credits the Controller purchased and has not used.
4.3 Terms with sub-processors. The Processor engages each sub-processor on written terms. API aggregators, and the developers and hosts they forward requests to, act on the terms they publish for their API customers, which the Processor does not negotiate, which differ between them and which may not match this DPA in every respect; the Processor tells the Controller on request which terms apply to a recipient. The Processor remains fully liable to the Controller for the performance of its sub-processors, including those reached through an API aggregator.

Section 5: International Transfers

5.1 Storage. The Processor's application and database run on a server in Finland. Files the Controller's users upload, media they generate and database backups are kept in the object storage of the Processor's network provider, which is not limited to the EU; Section 5.2 applies to it. Sites published from Code are hosted on a global content-delivery network.
5.2 Transfers to third countries. Transfers outside the EEA rely on an adequacy decision where one applies and on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), in the module that fits the transfer, where the recipient's terms include them; for models marked "third-party access", Section 5.3 applies. Not every recipient is covered by an adequacy decision or by those clauses; where neither applies, content reaches the recipient because the Controller's user sent the request to the model concerned. The Processor tells the Controller on request how a transfer to a particular recipient is made.
5.3 Model inference. To answer a request the Processor sends the content the request needs (the prompt and its conversation, attached files or their extracted text, reference images, code files, and a project-context summary only where the Controller's user switches it on) to the provider of the model that handles it, through an API aggregator; a Consensus session goes to the provider of each model it uses. The model is the one the Controller's user selects or, in Auto, one the Processor selects from the Auto developers named in the sub-processor list; it is shown before the request runs and with the result. Some recipients are outside the EEA, in particular in the United States. For each request the Processor chooses the route, and a request to a model may be served by another provider of the same model. Where a route supports it, the request carries an instruction to use only providers that do not train on inputs, according to the aggregator's records of their terms. Aggregators and providers handle what they receive under the terms in Section 4.3, which may let them keep or use it for periods the Processor does not control: some keep generated media for about 14 days and logs that can include the text of a request for about two months, and others for a shorter or a longer time. The Controller decides what its users submit.

Models developed by labs established in China (named in the sub-processor list) are used only when the Controller's users select them; Auto does not select them. No adequacy decision covers China; the Controller keeps its content away from such providers by not selecting these models.

Models marked "third-party access" in the catalog (the Suno music models) come through an API aggregator and not from Suno itself; the Processor is not affiliated with Suno, Inc. Suno and that aggregator are not sub-processors of the Processor for these models: they handle what they receive as independent controllers under their own terms, may process it outside the EEA, and may keep or use it; Suno's terms allow it to use submissions to improve its models. These models are outside this DPA: the instruction above, Section 4 and Section 5.2 do not apply to them, and the Processor does not act as the Controller's processor for content sent to them. The Controller must not include Personal Data in a request to such a model, and instructs its users accordingly. Each user is shown a notice stating this and must accept it before the first request to such a model (Terms of Service, Section 8.2). These models are never selected by Auto.
5.4 Destinations. Recipients, countries and transfer mechanisms are set out in the list referred to in Annex III.

Section 6: Breach Notification

6.1 The Processor notifies the Controller of a personal-data breach without undue delay after becoming aware of it, with the information in Art. 33(3) as it becomes available.
6.2 The Controller is responsible for notifying supervisory authorities and data subjects where required; the Processor assists as set out in Section 3.6.

Section 7: Liability

7.1 The liability cap in the Terms of Service "Limitation of Liability" section applies to this DPA as between the parties, except that: for damages payable under Art. 82 GDPR a cap of two (2) times the total fees paid by the Controller in the twelve (12) months before the event applies in place of the standard cap; and no cap applies to liability arising from gross negligence or wilful misconduct. Mandatory liability that cannot be limited under applicable law (including supervisory-authority fines borne by the liable party) is unaffected, and nothing in this Section limits what a data subject may claim.
7.2 Where the Processor and Controller are both responsible for damage, liability is allocated in accordance with Art. 82(4) and (5).

Section 8: Term, Conflict, Governing Law

8.1 Term. From the effective date until deletion of the account and for so long as the Processor retains Controller Personal Data.
8.2 Conflict. In case of conflict on data-protection matters, this DPA prevails over the Terms of Service.
8.3 Governing law and forum. This DPA is governed by Estonian law. The courts of Tallinn (Harju County Court) have jurisdiction, without prejudice to the data subject's rights under Art. 79(2) GDPR.

Annex I: Description of Processing

See Sections 1 and 2.

Annex II: Technical & Organizational Measures (Art. 32)

Access. Production access is limited to the personnel who operate the Service. The administration console accepts only allow-listed accounts with a verified sign-in, and records administrative changes in an audit log. User sign-in is by one-time e-mail code; there are no passwords.
Encryption. TLS 1.2 or higher between users and the Service. Environment variables of Code projects are encrypted with AES-256-GCM; API keys, where available, are stored only as keyed hashes.
Isolation. Every request is checked against the requester's membership of the workspace that owns the resource; stored objects are keyed by workspace; Code previews run in a sandboxed frame without access to the ewpire origin; each published site is a separate hosting project.
Logging. Application events, sign-ins and administrative changes are logged; AI request records hold usage figures, never prompt or output text.
Releases. Code and configuration are version-controlled; automated checks run before every release; a release is health-checked before it takes traffic and rolled back if it fails.
Vulnerability management. Weekly automated scanning of code, dependencies, container images and repository history for secrets.
Backups. The database is backed up every night and before every schema change; backups are kept for 30 days in object storage; a restore is tested every month. Files and generated media in object storage are not part of these backups.
Abuse controls. Rate limits on sign-in, sign-up and product endpoints; a bot check on sign-in where enabled.
Deletion. Account deletion removes live data without delay; database backups roll off within 30 days; records required by law are kept as stated in the Privacy Policy.

Annex III: Authorised Sub-Processors

The current list of sub-processors – each with its role, country and transfer mechanism – is published at ewpire.com/subprocessors. It describes the API aggregators by role; their names and addresses are given to the Controller on request at privacy@ewpire.com, without undue delay, and each change notice under Section 4.2 names the provider concerned. The list, with the names so given, forms part of this DPA, as updated under Section 4.2.

Labs established in China. China has no EU adequacy decision. Models developed by labs established there are named in the list and are used only when the Controller's users select them (Section 5.3).

Routing. A request is sent only to the API aggregator that handles it and the provider of the model used (for a Consensus session, of each model used). Models marked third-party access are outside this DPA (Section 5.3).

Annex IV: Notification Contacts

Processor → Controller: the account e-mail address.
Controller → Processor: privacy@ewpire.com.
Supervisory Authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), Tatari 39, 10134 Tallinn, Estonia.