Scope & roles
This Data Processing Addendum ("DPA") forms part of the agreement between you (the controller) and BluestarAI (the processor) for the BluestarAI Pipeline OS.
We process personal data only to deliver the service, on your documented instructions, and not for our own purposes.
Subject matter & duration
- Subject matter: lead generation, scoring, signal ranking, enrichment and simulation performed on your workspace data.
- Duration: for the term of your subscription, plus the deletion window described in Retention.
- Categories of data subjects: your prospects, contacts and users.
- Categories of personal data: name, business contact details, employer, role, and interaction/signal metadata.
Our obligations
- Process only on documented instructions from you.
- Ensure personnel are bound by confidentiality.
- Implement the technical and organisational measures in Annex 2.
- Assist you with data-subject requests and impact assessments.
- Notify you without undue delay after becoming aware of a personal-data breach.
- Delete or return personal data at the end of provision.
Sub-processors
You grant general authorisation for the sub-processors listed at bluestarai.world/legal/subprocessors, which we keep current. We impose equivalent data-protection terms on each and give notice before adding or replacing one, so you can object.
International transfers
Where personal data leaves the EEA/UK, we rely on the European Commission's Standard Contractual Clauses and, where required, a Transfer Impact Assessment. Data is hosted in the region you select where available.
Security measures
Encryption in transit (TLS 1.2+), application-layer encryption of stored secrets, hashed credentials, least-privilege access, audit logging, and monitored backups. Full detail is on the trust center.
Retention & deletion
- We retain workspace data while your account is active.
- On termination we delete or return data within 60 days, unless law requires longer retention.
- Backups cycle out within 35 days.
Audit & cooperation
We make available the information needed to demonstrate compliance and allow audits by you or a mandated auditor, subject to confidentiality and reasonable notice. Security reports and our sub-processor list are available on request.
Contact
Questions about Data Processing Addendum? Email privacy@bluestarai.world or write to BluestarAI, New York, NY. For security matters, see our security page and trust center.