This DPA forms part of the agreement between the customer (“Controller”) and Juno AI Labs, Inc. (“Processor”) for the hosted Document Lake service, and applies where we process personal data in customer documents on your behalf.
Processing details
- Subject matter & purpose: storage, organization, indexing, and AI-assisted retrieval of documents the Controller uploads.
- Data categories: whatever personal data the Controller’s documents contain (typically names, contact details, signatures, equity holdings of founders, employees, and investors), plus member account data.
- Duration: the subscription term, until deletion by the Controller or account termination.
Our obligations
- Process personal data only on the Controller’s documented instructions (using the service is the instruction).
- Apply the technical and organizational measures on the security page — per-tenant isolation, envelope encryption, RBAC, audit logging — and not reduce them materially during the term.
- Ensure persons processing the data are bound by confidentiality.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting their workspace, with the information reasonably needed for their own notifications.
- Assist with data subject requests and, where the Controller cannot self-serve via export/deletion in the product, delete or return personal data at termination (deletion is cryptographic and permanent).
Sub-processors
The Controller authorizes the sub-processors listed at /legal/subprocessors. We will update that page at least 30 days before adding a sub-processor that processes document content; Controllers who object may terminate and export their data.
International transfers
Where processing involves transfers out of the EEA/UK, we rely on the sub-processors’ EU-approved transfer mechanisms (Standard Contractual Clauses or adequacy decisions). EU-region workspaces keep primary document storage in EU jurisdiction; AI inference requests are processed by the model providers listed as sub-processors and may occur outside the region.
Audit
The software is open source (AGPL-3.0), so the exact processing logic is publicly auditable. We additionally make available documentation reasonably necessary to demonstrate compliance, and per-workspace audit logs are exportable in-product.
To execute a signed copy of this DPA, contact legal@document-lake.com.