Last updated: October 9, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Individual Entrepreneur ALEKSANDR SHAMAEV, trading as Pathbound (identification number 105656718 in the Registry of Entrepreneurs of Georgia), of v. Akhalsopeli, Kharagauli region, 4802, Georgia (“Pathbound”, “we”, “us”, “our”), and the customer that has accepted the Terms (“Customer”, “you”). It applies whenever we process personal data on your behalf while providing the Services.
You do not need to sign it: it takes effect together with the Terms. If your procedures call for a signed copy, email [email protected] and we will countersign one.
“Controller”, “processor”, “data subject”, “personal data”, “processing”, and “supervisory authority” have the meanings the GDPR gives them. Other capitalized terms have the meanings given in the Terms.
2.1 Your role and ours. You are the controller of Customer Personal Data, or a processor acting for your own customers. We are your processor, or your sub-processor where you act as a processor.
2.2 When you are a processor. You confirm that the controller has authorized your instructions to us and our appointment, including the Sub-processors under Section 7.
2.3 Data we control. We are an independent controller of data about the people who hold Pathbound accounts, of billing data, and of the security and usage records we keep to run the Services. Our Privacy Policy covers that processing; this DPA does not.
2.4 Details. Schedule 1 describes the processing: whose data, which data, why, and for how long.
3.1 Documented instructions. We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and your configuration and use of the Services are those instructions: the sources you connect, the people you invite, the API keys and AI Clients you authorize, the streams you set up, and the settings you choose. Any further instruction needs our written agreement.
3.2 Unlawful instructions. We will tell you if we believe an instruction infringes Data Protection Laws. If a law that applies to us requires other processing, we will tell you before we do it, unless that law forbids us to.
3.3 What we never do. We do not sell Customer Personal Data, use it for advertising, or use it to train AI or machine-learning models, and we do not allow our Sub-processors to.
4.1 Lawfulness. You are responsible for the lawfulness of the Customer Personal Data you bring into the Services and of your instructions. That includes having a legal basis, giving the notices, and obtaining the consents the law requires, among them the ones for the cookies and the device fingerprint of the Pathbound Tracker.
4.2 Data the Services are not built for. You will not use the Services to process protected health information under HIPAA (we are not a business associate and do not sign business associate agreements), cardholder data covered by PCI DSS, or government-issued identification numbers of individuals, such as social security, passport, or driver’s license numbers. The Services are not intended for special categories of personal data under Article 9 of the GDPR. Free text that you sync, such as conversations and transcripts, contains whatever its authors wrote, and you remain responsible for it. If we learn that your workspace holds data of a kind this section rules out, we will tell you and you will remove it without delay; we may delete it ourselves if it is still there 14 days after our notice.
4.3 Your configuration. You decide who has access to your workspace and which clients and destinations receive its data, and you are responsible for the security of the connections you set up to your own systems, for example by enabling TLS on a database connection.
Only people who need Customer Personal Data to operate, secure, or support the Services have access to it, and each of them is bound by a duty of confidentiality that outlasts their engagement.
We maintain the technical and organizational measures described in Schedule 2. We may change them as the Services and the threats change, but not in a way that lowers the overall level of protection.
7.1 Authorization. You authorize us to engage the Sub-processors listed at pathbound.ai/subprocessors, which is Schedule 3, and to add or replace Sub-processors as this section describes.
7.2 Our obligations. Before a Sub-processor processes Customer Personal Data, we enter into a written agreement with it that imposes data-protection obligations no less protective than those in this DPA. We remain liable to you for what each Sub-processor does with Customer Personal Data.
7.3 Notice of changes. At least 14 days before a new Sub-processor starts processing Customer Personal Data, we will email the owner and admins of your workspace and update the list.
7.4 Objections. You may object within that period, on reasonable grounds relating to data protection, by writing to [email protected]. We will work with you in good faith on an alternative, such as not using that Sub-processor for your workspace. If we cannot agree on one within 30 days of your objection, you may terminate the affected Services, and we will refund any prepaid fees for the period after termination.
7.5 Urgent replacements. If we have to replace a Sub-processor sooner to protect the security or the availability of the Services, we will tell you as early as we can, and Section 7.4 applies from that notice.
7.6 Services you connect. The integrations you connect, the AI Clients you authorize and their AI providers, your own databases, and the destinations of your streams are your providers, not our Sub-processors. We exchange Customer Personal Data with them on your instructions.
8.1 Where the data is. We store Customer Personal Data in the United States. Our personnel access it remotely from wherever they are working. We are established in Georgia (Schedule 1), and Schedule 3 gives the location of each Sub-processor.
8.2 Transfer mechanisms. Where the Data Protection Laws of the European Economic Area, the United Kingdom, or Switzerland restrict a transfer of Customer Personal Data to us, Schedule 4 applies to it.
8.3 Requests from public authorities. If a public authority demands Customer Personal Data from us, we will tell you before we disclose anything, unless the law forbids it. We will direct the authority to you where we can, challenge a demand we believe is unlawful, and disclose no more than the law requires.
9.1 Notice. We will notify you of a Security Incident without undue delay, and in any case within 72 hours of becoming aware of it, or sooner where a law that applies requires it, by email to the owner and admins of your workspace.
9.2 Content. The notice will describe what we know at that point: the nature of the incident, the kinds of data and the approximate number of people and records affected, the likely consequences, and what we have done and propose to do. We will add to it as we learn more.
9.3 Response. We will take reasonable steps to contain the incident and to limit its effects, and we will give you the information you reasonably need to meet your own notification duties.
9.4 Scope. An unsuccessful attempt that does not compromise Customer Personal Data, such as a blocked login or a port scan, is not a Security Incident. A notice under this section is not an admission of fault.
10.1 Requests from data subjects. The Services let you find, correct, export, and delete the records in your workspace. A record you delete in Pathbound comes back on the next sync if it still exists in a connected source, so delete it there as well. The workspace’s activity history keeps a copy of a record that was deleted; when a person’s data has to be erased completely, write to [email protected] and we will remove it. If a data subject writes to us about data we hold for you, we will pass the request to you without undue delay and will not answer it ourselves, other than to refer the person to you, unless the law requires us to.
10.2 Assessments. Taking into account the nature of the processing and the information we have, we will give you reasonable help with data protection impact assessments and with consultations with supervisory authorities.
10.3 Cost. Help that the Services already provide is included. For anything that takes substantial work beyond that, we may charge our reasonable costs, agreed with you beforehand.
11.1 Export. While your account is open, an owner or admin can export the workspace’s records at any time from Settings → Data.
11.2 Deletion. Within 30 days of the end of the Terms, or of your written request, we will delete Customer Personal Data from our production database and file storage, and we will confirm the deletion in writing if you ask. Backup copies expire within a further 7 days. Service logs, which can hold an identifier such as an email address in an error line, are rotated by size on the server, and their offsite archives are deleted after 14 days; they are not used for anything else.
11.3 Legal retention. If a law that applies to us requires us to keep some Customer Personal Data longer, we will keep only that data, protect it as this DPA requires, and process it for no other purpose.
12.1 Information. On request we will give you the information reasonably needed to show that we comply with this DPA, including answers to security questionnaires and summaries of our security reviews. Much of it is published on our Trust page. We hold no third-party attestation such as SOC 2 or ISO 27001.
12.2 Audits. If that information is not enough, you may audit our processing of your Customer Personal Data once in any 12-month period, and additionally after a Security Incident or when a supervisory authority requires it. An audit needs 30 days’ written notice and is carried out by you or by an independent auditor bound by confidentiality, during business hours, and remotely (a review of documents, written questions, and a live walkthrough of our configuration) unless Data Protection Laws or the Standard Contractual Clauses entitle you to more. It may not expose another customer’s data, and we cannot give you physical access to our hosting provider’s data centers.
12.3 Cost. Each party bears its own costs. If an audit takes more than one business day of our time, we may charge our reasonable costs for the rest.
For personal information subject to the CCPA or a comparable US state law, we are your service provider or processor. You disclose that information to us only for these limited and specified business purposes: collecting it from the sources you connect, storing it, matching records that belong to the same person or company, making it available to your users, API keys, and AI Clients, sending it to the destinations you configure, deleting it, and keeping the Services secure. We will:
14.1 Liability. The limitations and exclusions of liability in the Terms apply to our liability under this DPA. Nothing in this DPA limits a data subject’s rights under the Standard Contractual Clauses or any liability that the law does not allow to be limited.
14.2 Order of precedence. If documents conflict on the protection of personal data, the Standard Contractual Clauses and the UK Addendum prevail over this DPA, and this DPA prevails over the rest of the Terms.
14.3 Term. This DPA applies for as long as we process Customer Personal Data.
14.4 Changes. We may update this DPA to reflect a change in the law or in the Services. We will email the owner and admins of your workspace at least 30 days before a change to its terms takes effect. Using the Services after that date is your approval of the change; if you do not approve it, you may terminate the Services before it takes effect. Changes to the security measures follow Section 6, and changes of Sub-processors follow Section 7.
14.5 Successor. If the operation of the Services passes to a company formed by our operator, this DPA passes to that company together with the Terms, on notice to you.
14.6 Governing law. The law that governs the Terms governs this DPA, except where Schedule 4 provides otherwise for the Standard Contractual Clauses and the UK Addendum.
This schedule is also Annex I of the Standard Contractual Clauses.
The supervisory authority of the EU member state where the data exporter is established. If the exporter is not established in the EU, it is the authority of the member state where its representative under Article 27 of the GDPR is established, or, if it has none, the Irish Data Protection Commission.
This schedule is also Annex II of the Standard Contractual Clauses. It describes what is in place on the date above.
This schedule is also Annex III of the Standard Contractual Clauses. The current list is kept at pathbound.ai/subprocessors and is reproduced here.
| Sub-processor | What it does for us | Where |
|---|---|---|
| Hetzner Online GmbH Germany | Hosting: the servers that run the application, the database, the cache, and the local backup copies | Hillsboro, Oregon, United States |
| Cloudflare, Inc. United States | DNS and TLS proxy for the pathbound.ai domains; storage of our database backups and log archives | Cloudflare’s global network for traffic; backups in its Western North America region |
| Unipile SAS France | Connects a mailbox or messaging account a member chooses to link, and carries our requests to read it and to send from it Only if a member of your workspace links a mailbox or messaging account through Unipile. | Stored in France. Connections to the linked account may be routed through network providers in the European Union, Israel, Singapore, or the United States |
For a transfer of Customer Personal Data that the GDPR restricts, the Standard Contractual Clauses are incorporated into this DPA and completed as follows. Accepting the Terms counts as signing them, with their annexes.
Audits under Clause 8.9 are carried out as Section 12 describes, and we certify deletion under Clauses 8.5 and 16(d) when you ask. Where Module Three applies, our notices and answers go to you, and you pass them to the controller.
If the European Commission adopts standard contractual clauses for transfers to importers that are themselves subject to the GDPR, and a transfer under this DPA requires them, the parties will rely on those clauses for that transfer, completed with the same choices.
For a transfer that the UK GDPR restricts, the UK Addendum is incorporated into this DPA and applies to the Standard Contractual Clauses as completed in part A. Table 1 is completed with the parties in Schedule 1, Table 2 with the modules and choices in part A, and Table 3 with Schedules 1 to 3. For Table 4, neither party may end the UK Addendum under its Section 19.
For a transfer that the FADP restricts, the Standard Contractual Clauses as completed in part A apply with these changes: references to the GDPR are read as references to the FADP; the supervisory authority is the Swiss Federal Data Protection and Information Commissioner; “member state” is not read in a way that prevents data subjects in Switzerland from claiming their rights at their place of habitual residence; and where only the FADP applies to a transfer, Swiss law governs the clauses.
If we adopt another lawful mechanism for a transfer, such as a certification under an adequacy framework, it applies in place of this schedule to the transfers it covers, on notice to you.
Questions about this DPA, requests for a countersigned copy, and objections to a Sub-processor go to [email protected]. Security reports go to [email protected].
This copy reproduces the Data Processing Agreement published at pathbound.ai/dpa on the date above. Signing it is optional: the agreement applies together with the Terms.
| Pathbound Individual Entrepreneur ALEKSANDR SHAMAEV, trading as Pathbound Identification number 105656718 Signature: ______________________________ Date: ______________________________ | Customer Company: ______________________________ Name and title: ______________________________ Signature: ______________________________ Date: ______________________________ |