Attunr data processing agreement

Draft. Written 2026-10-17 and revised the same day after the legal review in lawyer-review.md. Not in force and not published.

BUILD: marks a promise that is only true once a planned build step ships. Words in [square brackets] are placeholders.

This agreement is part of the Attunr terms of service. It covers the personal information that a customer puts into Attunr, or that Attunr gathers for the customer.

1. Who does what

• The customer decides what personal information goes into Attunr and why. In law, the customer is:
  • the organization accountable for it (PIPEDA);
  • the enterprise that holds it (Quebec's Law 25);
  • the controller (GDPR).
• Figured Media handles it only to provide Attunr, on the customer's instructions. In law, we are:
  • the third party that processes it for the customer (PIPEDA);
  • the service provider under a written mandate (Law 25, section 18.3);
  • the processor (GDPR).
• Agency accounts. An agency is our customer for each client workspace it opens. The client business is usually the controller of its own data, the agency acts for the client, and we act for the agency as its subprocessor. The agency promises that its written contract with its client allows this and gives the client at least the protections in this agreement. BUILD: agency mode is Stage 4.
• The customer's part. The customer must have a lawful reason for each person's information it puts in, give the notices and get the consents the law requires (including telling people a call is recorded when Attunr's spoken notice is off, which is the default), and use Attunr's erase, export and do-not-contact tools to answer people's requests.

This agreement is the written mandate Law 25 section 18.3 asks for. It sets out the protection measures (section 5 and annex 2), limits our use to providing Attunr (section 2), requires us to delete the information when the agreement ends (section 11), commits us to tell the customer's person in charge of any breach or attempted breach (section 9) and lets that person check our compliance (section 12).

2. Instructions

• The customer's instructions are this agreement, the terms and the way the customer sets up and uses Attunr. That includes the settings it picks, the services it connects, the jobs it turns on (autopilot, site watch, calling, call recording) and the retention it sets.
• We use the information only to follow those instructions and to meet the law.
• If we think an instruction breaks the law, we tell the customer and may refuse it.

3. What we handle

Annex 1 lists the people, the kinds of information, the purposes and how long each is kept.

4. Our people

• Only staff who need to, for running Attunr, can reach customer information. Each is bound to keep it confidential.
• Staff open a customer's workspace only when the customer allows it from its settings, for a set time, and every visit is logged where the customer can see it. BUILD: guard 6 in the product plan.
• Without permission, staff may open a workspace only to stop or look into a security incident or abuse, when the law requires it, or to fix an urgent fault in that account when the owner can't be reached in time. We use the least access needed, log it, and tell the owner within 72 hours unless the law forbids it.
• Customer information is not copied to staff computers.

5. Security

We keep the measures in annex 2, and improve them over time. We won't make them weaker in a way that matters without telling the customer.

6. Subprocessors

• The customer agrees to the subprocessors in the subprocessor list, parts A and B, including the companies our subprocessors use that the list names.
• We tell the customer at least 30 days before adding or replacing a subprocessor, by email to the owner and by updating the list.
• If the customer objects for a real privacy reason and we can't solve it, the customer may cancel and get back the unused part of what it prepaid.
• Each subprocessor is bound by a written contract with protections at least as strong as this agreement. We stay responsible for what they do.
• Services the customer connects itself (part C of the list) are not our subprocessors. The customer picks them, and their terms apply between the customer and them.

7. Where the information is

• Attunr stores customer information in Canada: Fly.io in Toronto, database included. BUILD: files are in a Canadian storage region (Stage 3.2).
• Fly.io's own backups of the database and disks may be stored by its backup provider in the US, until Fly.io confirms otherwise in writing.
• Call recordings stay in the customer's own Telnyx account. Telnyx stores them in the US unless the customer picks another region it offers. Attunr plays them from there and doesn't keep its own copy.
• Some subprocessors work outside Canada, mostly in the US, as the list says. Information sent there may be reached by authorities under those countries' laws.
• Quebec. Toronto is outside Quebec, so a customer with information about people in Quebec must assess the transfer before putting it in Attunr (Law 25, section 17). We have done our own privacy impact assessment of Attunr and its subprocessors, and give the customer a summary of it on request, with what section 10 lists. This agreement is the written agreement section 17 asks for.
• The GDPR. Where the GDPR covers information the customer puts into Attunr, its transfer to us in Canada relies on the EU's adequacy decision for Canada (Decision 2002/2/EC, confirmed by the Commission's review in 2024). Each subprocessor outside Canada that receives it must give a GDPR transfer safeguard: the EU-US Data Privacy Framework or the EU's standard contractual clauses (module 3, processor to processor). If one of those stops being valid, we move to the other.

8. Helping with people's requests

• Customers can find, export and correct a person's records in Attunr themselves.
• Erasing one person. The customer's owner or leadership can erase one person. Attunr removes their details, notes, emails, call recordings, transcripts, voice notes and pitch-page visits from the current records and from the history. The history keeps a marker that an erase happened, so it can still be checked. Their email address and phone number stay only as a one-way fingerprint on the do-not-email and do-not-call lists, so the customer keeps honouring their requests. Copies in backups are gone within 30 days.
• BUILD: per-person erase is not built. Until it ships, we erase a person by hand within 30 days of the customer's written instruction.
• If someone writes to us about a customer's records, we send the request to the customer within 5 business days and don't answer it ourselves unless the customer asks us to.

9. Breaches

• If we learn of a breach of customer information, or an attempted breach, we tell the customer's owner and its person in charge of privacy without undue delay, and no later than 48 hours after we become aware of it. We add details as we learn them.
• We tell the customer what happened, what information and how many people may be affected, what we have done and what the customer may need to do.
• We help the customer meet its own duties to tell regulators and people.
• We keep a record of every incident for at least 5 years (PIPEDA asks for 24 months, Law 25 for 5 years).

10. Assessments and questions

• Once a year, or after a breach, we answer the customer's reasonable security questionnaire.
• We give the customer what it needs for a privacy impact assessment, including the subprocessor list, where they are, what each one receives, and a summary of our own assessment.

11. When the agreement ends

• The customer can export its data for 30 days after the account closes.
• Then we delete it from Attunr within 30 days. Backups that hold it age out within a further 30 days, so it is gone within 90 days of closing.
• We confirm deletion in writing when asked.
• We keep only what the law makes us keep, such as invoices, and only for as long as required.
• BUILD: per-account export and full delete is Stage 3.4.

12. Checks

• The customer's person in charge of privacy, or an independent auditor bound by confidentiality, may check that we keep this agreement.
• First, through this agreement, annex 2, the questionnaire in section 10 and any independent reports we have.
• If those don't answer a reasonable concern, or after an incident that affected the customer, the customer may do a deeper check, remotely or on site, with 30 days' notice, during business hours and at its own cost. Not more than once a year, unless a regulator asks.

13. AI

• AI features send the text they need to Google's Gemini API (paid tier), or to Anthropic when Gemini fails. Transcripts, practice voices and images go to fal.ai. Ask Attunr sends only the question and field names.
• None of these providers may use customer information to train AI models. Their contracts with us say so.
• Google and Anthropic keep what they receive only for a short abuse check (Google 55 days, Anthropic 30 days), longer only for content flagged as abuse. We ask fal.ai to keep no history of our requests (X-Fal-Store-IO: 0) and to let files it makes for us expire soon after we have them.
• BUILD: today text AI runs through fal.ai's any-llm service, which passes it through OpenRouter to Google, Anthropic or OpenAI. The move to Google and Anthropic directly, and the "don't store" setting on every fal.ai request, ship before launch. Until then the subprocessor list names every company in that chain.

14. Liability and order

• The limits in section 19 of the terms apply to this agreement. Claims that come from us breaking this agreement or its security measures fall under the higher data cap there.
• If this agreement and the terms disagree about personal information, this agreement wins.

Annex 1: what we handle

People

• The customer's own team: owners, leaders, managers, members, agency staff.
• Prospects and leads: mostly people at other businesses, sometimes sole traders.
• People who book a meeting, sign a proposal, open a pitch page or unsubscribe.
• In agency mode, the customer's clients and the clients' own customers (for example, people who send an enquiry through a client's website form). BUILD: Stage 4.
• Newsletter subscribers.

Information

Profiling

The heat score ranks leads by how much they engage: replies, connected calls, meetings, and proposal and pitch-page opens. For a named person this is profiling under Law 25 and the GDPR. It is not a decision made by automated means alone: people decide what to do. Pitch pages and proposals say they track opens, and for leads in Quebec they record nothing until the visitor agrees. BUILD: the tracking line on pitch pages and proposals, with the Quebec rule.

Purposes

To provide Attunr's features for the customer: storing, showing, searching, syncing, sending, calling, transcribing, summarizing, checking websites, building pitch pages and reports, backing up and supporting.

How long

Annex 2: security measures

In the code today

• HTTPS for every connection.
• Passwords stored as scrypt hashes, with a 12-character minimum for new ones. Passkeys.
• Sign-in protection:
  • Cloudflare Turnstile;
  • a hidden honeypot field and a minimum form age;
  • a single-use token tied to the browser;
  • same-origin checks;
  • limits by network and by account.
• Sessions end after 30 days, or after 7 days without use.
• Mailbox passwords and keys encrypted with AES-256-GCM, never sent back to a browser and never written into the history.
• Every change checked against the person's role on the server (server/policy.mjs).
• Money hidden from people who can't see it, removed on the server before data reaches their browser (src/lib/redact.ts, server/access.mjs).
• Server requests to outside addresses, and the browser that loads outside websites, are blocked from private and internal addresses. Each request goes through a guard that checks every host (server/net.mjs).
• An append-only history, each entry fingerprinted with SHA-256, that can be checked for tampering.
• Public links (proposals, pitch pages, booking changes, unsubscribe) use long unguessable or signed tokens.
• Webhooks from calling and call-tracking providers have their signatures checked. Outgoing webhooks are signed, sent over HTTPS only and refused for private addresses.
• Every response asks search engines not to list it. Security headers on every response.

Before launch

BUILD: these come from the product plan, the walls inventory (docs/accounts-walls.md) and the legal review.

• Attunr runs as a separate deployment from Figured Media's own Relay: its own app, database, files and keys.
• Attunr refuses to start if any of Figured Media's own keys or settings are present.
• Every row and event carries the account it belongs to. Postgres row security is forced, and the app's database role can't skip it, so a query sees only its own account.
• Each account has its own history chain.
• Files are kept in object storage under the account's own folder and downloaded through short-lived signed links.
• Tests that sign in as one account and try every route with another account's ids run before every release, and a leak blocks the release.
• Each account's keys are encrypted with that account's own key, wrapped by a platform key that backups don't contain.
• Background jobs carry their account and check its rights and budget before acting.
• Staff access only with the customer's permission, logged.
• Voice notes and mic recordings open only for the rep, the lead's owner, their manager and the account owner, as call recordings already do (src/lib/calling/rules.ts:56).
• Call recording off until the customer turns it on; when it's on, recording starts only after the rep presses They agreed or after Attunr's spoken notice (an option) ends; and a Stop recording button.
• Erasing one person, history included.
• Server logs deleted after 90 days, sign-in and security records after 12 months.
• Database restore points and nightly per-account copies, with a tested restore of one account.
• Releases run first on Figured Media's own Relay and reach Attunr only after a health check.

Annex 3: subprocessors

See the subprocessor list.