# Migaru data processing agreement

How Migaru processes the personal data in your workspace on your behalf. Last updated October 29, 2026.

This data processing agreement is part of the agreement between Migaru LLC (“Migaru”, “we” or “us”) and the organization that uses Migaru (“you”) under the [terms of service](https://www.migaru.ai/terms), and applies whenever we process personal data on your behalf. It needs no signature: it takes effect with the terms. If you would like a countersigned copy, email [support@migaru.ai](mailto:support@migaru.ai).

It is written to meet Article 28 of the GDPR and of the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA, and words it uses the way those laws do (personal data, controller, processor, data subject, personal data breach) mean what those laws say they mean.

## 1. Who does what

For the personal data in your workspace (the people in your records, mail, meetings, calls and notes, and your own users), you are the controller and Migaru is your processor. Under the CCPA, Migaru is your service provider.

For the data we need to run our own business with you (your account, billing, and visits to our website), Migaru is the controller, under the [privacy policy](https://www.migaru.ai/privacy).

What is processed, why, for how long and about whom is in Annex 1.

## 2. Your instructions

We process your personal data only on your documented instructions, which are the terms, this agreement, and how your workspace is set up and used (what it connects, what it turns on, and what its people ask it to do), unless the law requires otherwise, in which case we tell you first where we lawfully can. If we think an instruction breaks data protection law, we tell you.

We do not sell or share it, use it for any purpose but providing the service to you, combine it with data from elsewhere except as the service does on your instruction (such as enrichment), or use it to train AI models.

## 3. People and security

Everyone at or for us who can reach your personal data is bound to keep it confidential and reaches only what their work needs.

We keep the technical and organizational measures in Annex 2 in place, and do not make them materially weaker during your subscription.

## 4. Subprocessors

You authorize us to use the subprocessors in Annex 3. Each is bound in writing to protect your personal data at least as this agreement does, and we are responsible to you for what they do with it.

We tell your workspace’s owners by email, and update Annex 3, at least 30 days before a new subprocessor starts processing your personal data. If you object on reasonable data-protection grounds within that time, we will work with you to find a way round it. If we can’t, you can end the affected part of the service before the change takes effect, and we refund what you prepaid for the rest of its term.

## 5. Helping you

Most of what a data subject can ask for, your workspace can do itself: find, correct, export or delete a person’s records. If a request reaches us instead, we pass it to you and answer it only as you tell us. We also help you, where it is reasonable, with security, breach notices, data protection impact assessments and consulting a supervisory authority.

## 6. Personal data breaches

If we become aware of a personal data breach affecting your personal data, we tell your workspace’s owners without undue delay, and no later than 72 hours after we became aware of it. We say what happened, what data and how many people it may affect, what it is likely to mean, and what we have done and will do about it, and we add what we learn as we learn it. Notifying you is not an admission of fault.

To report a security problem to us, write to [security@migaru.ai](mailto:security@migaru.ai).

## 7. Transfers out of Europe and the UK

Where personal data protected by EU, UK or Swiss law is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply and are part of this agreement: Module Two where you are a controller and Module Three where you are a processor, with you as data exporter and us as data importer. In them, the optional Clause 7 applies; under Clause 9, option 2 applies with the notice in section 4; the option in Clause 11 does not apply; under Clause 17, the law of Ireland governs, and under Clause 18, the courts of Ireland decide disputes. Annexes 1 to 3 of this agreement complete the Clauses’ annexes.

For UK data, the International Data Transfer Addendum issued by the UK Information Commissioner applies alongside them. For Swiss data, references to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority.

Where we transfer personal data onward to a subprocessor outside those countries, we do so under the Standard Contractual Clauses or another lawful transfer mechanism.

## 8. Audits

We answer your reasonable security questionnaires, and once our SOC 2 Type II report is issued, we share it with you under confidentiality. If those are not enough to show we meet this agreement, or a supervisory authority asks, you can audit us, or have an independent auditor bound to confidentiality do so, once a year, with 30 days’ notice, at your cost, and in a way that does not disrupt the service or expose other customers’ data.

## 9. When it ends

When your subscription ends, your workspace stays readable and exportable for 90 days, so you can take your personal data with you. Within 30 days after that we delete it, unless the law requires us to keep some of it, and email your workspace’s owners to confirm. It is gone from our database backups within [Neon history retention, e.g. 7 days] after that. The [terms](https://www.migaru.ai/terms) say more, including what happens if we close the service.

This agreement lasts as long as we process personal data for you, and its liability terms are the terms’ own.

## Annex 1: What is processed

- **Subject matter and nature:** hosting, storing, organizing, analysing and transmitting personal data to provide Migaru, a CRM that files mail, meetings and calls on the right records and drafts what comes next for people to approve.
- **Purpose:** providing the service to you as the terms describe, and supporting and securing it.
- **Duration:** the term of your subscription, then the 90-day read-only period and deletion as in section 9.
- **Data subjects:** your users; and your contacts, customers, prospects and other people who appear in your records, the mail and calendars you connect, the calls the notetaker records, and the data you import.
- **Personal data:** names, email addresses, phone numbers, job titles and companies; who wrote to whom and when, and the subjects and short snippets of messages (message bodies are never stored); calendar events and attendees; call recordings and transcripts; notes, tasks, deals and the other fields of your records; and your users’ account and security records, as the privacy policy describes.
- **Special categories:** none are needed for the service. If your records hold any, you are responsible for having a lawful basis for them.
- **Frequency:** continuous, for as long as the workspace is connected and used.

## Annex 2: Security measures

- **Encryption:** all data in transit over TLS, with every page served over HTTPS alone; all data encrypted at rest; mailbox and connector credentials encrypted a second time inside the database; API keys and connected apps’ tokens kept only as hashes.
- **Signing in:** optional two-step verification by authenticator app, with single-use backup codes; ten wrong passwords for an address within fifteen minutes, or ten wrong codes in a row, stop further attempts for fifteen minutes; sign-ins that end when idle and after a set time, which an admin can shorten; every person can see and end their own sessions.
- **Access within a workspace:** owner, admin, member and Pages-only roles, and view, edit and full access on pages.
- **AI:** model requests only to providers that keep no data and do not train on it; analysis run in an isolated sandbox with no network access; no email sent to a customer’s customer without a person approving it; every change to a record’s fields kept in its history.
- **Backups and recovery:** the database can be restored to any point within the last [Neon history retention, e.g. 7 days].
- **Incidents:** breach notice as in section 6, and vulnerability reports to [security@migaru.ai](mailto:security@migaru.ai).

## Annex 3: Subprocessors

The providers that process personal data in your workspace for us, what each does, and where:

- **Vercel**: hosting, file storage, the AI Gateway, and sandboxed analysis. Location: [Vercel function and Blob region].
- **Neon**: our database. Location: [Neon database region].
- **Anthropic**: the language models behind the AI features. Location: United States [to confirm]. Reached only through Vercel’s AI Gateway, which sends a request only to a provider that has agreed with Vercel to keep none of it and not to train on it, and refuses the request when none has.
- **Resend**: the emails the service sends, such as sign-in links and invitations. Location: United States [to confirm].
- **Recall.ai**: the notetaker that joins, records and transcribes calls, for the people who turn it on. Once a recording is copied to our storage, Recall’s copy is deleted. Location: United States (Oregon) [to confirm].
- **Exa**, through Vercel’s AI Gateway: web search, on plans that include it. Location: United States [to confirm].
- **Lusha**: company and contact enrichment, on plans that include it. For a company we send its website domain. For a contact somebody looks up, we send what identifies them: their name, company, email address or LinkedIn profile. Location: [to confirm].

Stripe and Google also work for us, on our own account and billing data and our website, for which we are the controller, and receive none of the data in your workspace.

---

Canonical page: https://www.migaru.ai/dpa
Last updated: 2026-10-29