Data Processing Agreement
This Data Processing Agreement ("DPA") is between Immersive Fusion LLC ("Immersive Fusion", the "Processor") and the customer (the "Customer"). It forms part of each of these that applies to the Customer (together, the "Agreement"): the Terms of Service, a signed Subscription License Agreement, and the End User License Agreement for the DeepCube desktop clients (the "EULA"). It applies automatically whenever Immersive Fusion processes Customer Personal Data, without a separate signature. Customers who need a signed copy can ask legal@immersivefusion.com.
1. Definitions
- "Customer Personal Data" means personal data that Immersive Fusion processes for the Customer: personal data in telemetry the Customer sends, in Tessa prompts, and in the Customer's user accounts.
- "Data Protection Laws" means the laws that apply to that processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
- "Subprocessor" means a third party Immersive Fusion engages to process Customer Personal Data.
- Other terms (controller, processor, data subject, personal data breach, processing) have their GDPR meanings, and the CCPA equivalents (business, service provider) apply where the CCPA governs.
2. Roles and instructions
2.1 The Customer is the controller, or a processor acting for its own customers, and Immersive Fusion is the processor of Customer Personal Data. Under the CCPA, the Customer is the business and Immersive Fusion the service provider.
2.2 Immersive Fusion processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case it tells the Customer before processing unless the law forbids that. The Agreement, this DPA and the Customer's configuration of the Service are the instructions. Immersive Fusion will immediately tell the Customer if it believes an instruction breaks Data Protection Laws.
2.3 Annex 1 describes the processing.
2.4 The Customer is responsible for having a lawful basis for the data it sends, and for its instructions. The Service stores telemetry as the Customer sends it and does not remove or mask personal data in it. The Customer decides what its applications send and should configure them not to send personal data the Service does not need.
2.5 Immersive Fusion's own records. Immersive Fusion processes some data as a controller, not for the Customer: billing records, including billing contacts, and the record of which users opened which views and traces, which it keeps to secure the Service until it sets a retention period for it, which it will publish in its Privacy Policy. Its Privacy Policy covers that processing.
3. What Immersive Fusion commits to
3.1 Purpose limitation. Immersive Fusion processes Customer Personal Data only for the business purposes in Annex 1: providing, securing and supporting the Service. It will not: sell or share it (as the CCPA defines those terms); retain, use or disclose it for any other purpose or outside its direct business relationship with the Customer; combine it with personal data from other sources except as the CCPA allows a service provider to; use it for advertising; or use it to train, fine-tune or evaluate any AI model. It may produce aggregated statistics that cannot identify the Customer or any person, to keep the Service stable and secure.
3.2 CCPA. Immersive Fusion gives Customer Personal Data the same level of privacy protection the CCPA requires, will tell the Customer if it can no longer meet its CCPA obligations, and lets the Customer take reasonable steps to stop and remedy unauthorized use.
3.3 Confidentiality. Everyone Immersive Fusion authorizes to process Customer Personal Data is bound by a duty of confidentiality.
3.4 Security. Immersive Fusion maintains the measures in Annex 2, appropriate to the risk as GDPR Article 32 requires. It may change them, as long as the overall level of protection does not go down.
3.5 Data subject requests. Immersive Fusion helps the Customer answer requests from data subjects to exercise their rights, taking into account the nature of the processing. If a data subject contacts Immersive Fusion directly about Customer Personal Data, Immersive Fusion passes the request to the Customer and does not answer it itself unless the Customer asks. For telemetry, Immersive Fusion can delete a tenant's data, or data in a time range, on the Customer's request within one month.
3.6 Helping with compliance. Immersive Fusion gives the Customer reasonable help with security (GDPR Article 32), breach notification, data protection impact assessments and prior consultations with regulators, as far as they concern the Service.
4. Personal data breaches
4.1 Immersive Fusion will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
4.2 The notice will describe, as far as then known: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what Immersive Fusion has done or proposes to do. Information not yet known follows as it becomes available.
4.3 Notifying a breach is not an admission of fault.
5. Subprocessors
5.1 The Customer gives general authorization for Immersive Fusion to use Subprocessors. They are listed in Annex 3, published at AI Subprocessors.
5.2 Immersive Fusion will give at least 30 days' notice before it engages a Subprocessor that is not already in Annex 3, by updating the list and emailing customers who have asked for notice at legal@immersivefusion.com. Moving work to a Subprocessor already listed, or stopping using one, needs no advance notice; the list is updated when it happens.
5.3 The Customer may object on reasonable data protection grounds within that period. The parties will discuss it in good faith. If they cannot resolve it, the Customer may end the affected part of the Service and receive a refund of prepaid fees for it.
5.4 Immersive Fusion engages each Subprocessor under written terms that impose data protection obligations equivalent to those in this DPA, and remains responsible to the Customer for its Subprocessors' performance.
5.5 AI model providers must be contractually barred from training on what is sent to them. Immersive Fusion's current AI provider, Microsoft Azure OpenAI, may keep prompts and answers for up to 30 days to detect abuse, and authorized Microsoft staff may review content flagged as abuse. Immersive Fusion reviews its AI providers' terms at least quarterly. This section, and Annex 3, qualify section 7.4 of the EULA.
6. International transfers
6.1 Immersive Fusion stores Customer Personal Data in the United States and processes customer telemetry on its own servers in the United States. Tessa prompts go to Azure OpenAI, whose service for Immersive Fusion is based in the United States but may process prompts in other Microsoft regions until Immersive Fusion completes its move to US-only processing.
6.2 EU. For transfers of personal data subject to the GDPR to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 (the "Clauses"): Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. The options are: Clause 7 (docking) applies; Clause 9 option 2, general authorization, with the notice period in section 5.2; the optional wording in Clause 11 does not apply; Clause 13, the supervisory authority of the Member State where the Customer is established or, if it is not established in the EU, where its EU representative is, or otherwise the Irish Data Protection Commission; Clause 17 option 1, the law of Ireland; Clause 18, the courts of Ireland. Annex I of the Clauses is completed by Annex 1, Annex II by Annex 2, and Annex III by Annex 3 of this DPA. Accepting the Agreement counts as signing the Clauses. Onward transfers to Subprocessors are made under section 5.4. Immersive Fusion is not certified under the EU-US Data Privacy Framework.
6.3 UK. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses applies, with its Table 1 completed by Annex 1, Table 2 by section 6.2, Table 3 by Annexes 1 to 3, and in Table 4 neither party may end the Addendum early. It is governed by the law of England and Wales.
6.4 Switzerland. For transfers subject to Swiss law, the Clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority, references to the GDPR read as references to Swiss law, and data subjects in Switzerland able to bring claims there (Clause 18(c)).
6.5 If the Clauses conflict with this DPA, the Clauses prevail.
7. Audits
7.1 Immersive Fusion makes available the information reasonably necessary to show it complies with this DPA.
7.2 The Customer may audit that compliance no more than once a year, on 30 days' written notice, during business hours, under confidentiality terms and at its own cost, unless a regulator requires otherwise or a personal data breach justifies an extra audit. Immersive Fusion does not yet hold an independent audit report such as SOC 2; when it does, it may offer that report in place of an on-site audit.
8. Return and deletion
8.1 When the Agreement ends, the Customer chooses whether Customer Personal Data is returned or deleted. Return means an export, which the Customer can request from support@immersivefusion.com within 30 days.
8.2 After those 30 days, Immersive Fusion deletes Customer Personal Data: telemetry at the end of its retention period, and account data on request or at closure within one month, except the basic account record of each user (name, email and sign-in identity), which Immersive Fusion's system cannot yet remove and which it keeps, used only to secure the Service, until it can. Immersive Fusion also instructs its Subprocessors to delete what they hold for the Customer, where they keep it. Deleted data stays in backups, which are encrypted, protected against deletion and kept for disaster recovery, until they expire within 12 months; it is not used, and if a backup is restored it is deleted again before the Service returns to normal use. Immersive Fusion keeps only data the law requires it to keep, and its own records under section 2.5, and keeps them confidential.
8.3 On request, Immersive Fusion confirms in writing what it deleted and what it kept.
9. General
9.1 This DPA lasts as long as Immersive Fusion processes Customer Personal Data.
9.2 The limitations of liability in the Agreement apply to this DPA, except where Data Protection Laws or the Clauses do not allow it.
9.3 If this DPA and any part of the Agreement conflict on data protection, this DPA prevails.
9.4 Immersive Fusion may update this DPA to reflect changes in law or in the Service. Updates will not reduce the protection of Customer Personal Data, and material changes are notified as the Agreement describes.
Annex 1: Description of the processing
| Data exporter | The Customer, as identified in its account; contact: the account's administrator email. Role: controller, or processor for its own customers |
| Data importer | Immersive Fusion LLC, 600 N Broad St, Ste 5, PMB 3407, Middletown, DE 19709-1032, USA. Contact: legal@immersivefusion.com. Role: processor |
| Data subjects | The Customer's users of the Service; and people whose personal data appears in the Customer's telemetry, which depends on the Customer's applications (typically the Customer's end users and staff) |
| Categories of data | Account data (name, email, sign-in identifiers, organization contacts); invitations; usage records; interaction events in the web app; IP addresses and emails in application logs; any personal data the Customer's applications include in traces, logs and metrics, stored as sent; Tessa prompts and context; voice audio and transcripts for speech; computer names of desktop clients |
| Special categories | None intended. The Acceptable Use Policy asks Customers not to send them |
| Frequency | Continuous, while the Service is used |
| Business purposes | Collecting, storing, indexing, analyzing and visualizing application telemetry; answering Tessa prompts; speech to text and text to speech; account administration; security and support |
| Retention | Telemetry: the plan's retention period. Account data: while the account is open, then section 8 |
| Subprocessor transfers | As in Annex 3, for the purposes stated there |
Annex 2: Technical and organizational measures
| Area | Measure |
|---|---|
| Encryption | TLS for data in transit; data stored in Microsoft Azure is encrypted at rest |
| Access | Multi-factor authentication for administrative access; least-privilege access for staff and services |
| Secrets | Stored in Azure Key Vault or in Azure's encrypted application settings |
| Hosting | Microsoft Azure, United States regions; customer telemetry processed on Immersive Fusion's own servers in the United States; Tessa prompts as section 6.1 describes |
| Logging | Application logs kept 90 days, with IP masking in Azure Application Insights |
| Retention | Telemetry deleted at the end of the plan's retention period; backups kept up to 12 months, encrypted and protected against deletion, with deletions re-applied after any restore |
| Incidents | A monitored security@ inbox, a written first-response procedure, and breach notification within 72 hours (section 4) |
| Vulnerabilities | Coordinated disclosure through security@immersivefusion.com |
Measures are added to this annex only once they are in operation.
Annex 3: Subprocessors
The Subprocessors of Customer Personal Data, with what each does, what it receives and where it is based, are the companies listed under "Subprocessors of customer data" at AI Subprocessors. That list forms this Annex 3. It is a separate document so that it can be updated under section 5.2 without a new version of this DPA.