Data Processing Agreement

1. Subject matter and parties

This Data Processing Agreement (DPA) is part of The Book Companion Terms and applies whenever your Book Companion processes personal data of your readers. You, the author who accepted the Terms, are the controller. Resmind (operated by Shahd Safarani, contact info@resmind.io) is the processor.

It is concluded in electronic form under Art. 28(9) GDPR: accepting The Book Companion Terms at upload accepts this DPA, and the acceptance is recorded with its version in your Book Companion's audit log.

2. Nature, purpose, and duration of processing

Processing consists of hosting your AI, storing reader accounts and conversations in your Book Companion's own isolated database, and sending reader questions with your book text to the AI provider to generate cited answers. The purpose is solely to provide the service to you.

Processing lasts as long as your Book Companion exists and ends with its deletion.

3. Data and data subjects

Data subjects: your readers, and you as the author. Data categories: email addresses, sign-in records, consent records, conversations with the AI, and usage metadata. Conversations may include sensitive information a reader chooses to share; where a book's subject matter makes that likely, readers are asked for explicit consent at signup before they can chat.

4. Instructions

Resmind processes reader data only to run the service as described, which constitutes your documented instruction. Additional instructions require written agreement. If Resmind believes an instruction violates data protection law, it will say so instead of following it.

5. Confidentiality and security

Access to reader data is limited to what operating the service requires, and the people involved are bound to confidentiality. Technical measures include: one isolated database per Book Companion in the EU (Frankfurt), credentials stored encrypted (AES-256-GCM), TLS everywhere, no third-party analytics or trackers on reader pages, no conversation content in any email, and append-only audit logging of auth, consent, and admin access events in your Book Companion's database.

6. Sub-processors

You authorize the sub-processors listed at resmind.app/sub-processors. That page is the living list; changes to it are announced by email to every author with a live Book Companion before new sub-processors process reader data, and you may object by deleting your Book Companion (which you can do at any time, at no cost).

Where a sub-processor is outside the EU, transfers rest on an adequacy decision or Standard Contractual Clauses in that sub-processor's DPA.

7. Assistance

Resmind assists you with data subject requests concerning your Book Companion (access, deletion, export) and with your own GDPR obligations where they concern the processing described here. Reader deletion and export are handled on request to info@resmind.io.

8. Personal data breaches

Resmind notifies you without undue delay after becoming aware of a personal data breach affecting your Book Companion's data, with what is known about its nature, scope, and the measures taken.

9. Deletion and return

When your Book Companion ends, everything it stored is deleted: the database with all conversations and reader accounts, the registry entry, and any remaining uploaded file. You can trigger this yourself at any time from your dashboard, and it happens by default when a Book Companion goes inactive (with notice first, as the Terms describe). Backups held by infrastructure sub-processors expire on their standard schedules.

10. Information and audits

Resmind makes available the information necessary to demonstrate compliance with this DPA, including the sub-processor list, this document's version history, and the audit log of your own Book Companion on request to info@resmind.io.