Data Processing Agreement

Last Updated: October 27, 2026

We never train AI models on your data. Ahoy processes Customer Personal Data only to provide the Services to you. Neither Ahoy nor any of our AI model providers may use it to train or fine-tune a model. See Section 5.

This Data Processing Agreement ("DPA") forms part of the Terms of Service, or any other written agreement for the Services (the "Agreement"), between the customer named in the Agreement ("Customer") and Ahoy Technologies Inc. and its subsidiary Ahoy Technologies (Ireland) Limited (together, "Ahoy"). It applies whenever Ahoy processes Customer Personal Data on Customer's behalf, and takes effect without signature when Customer accepts the Agreement. A countersigned copy is available on request from legal@ahoy.ai.

1. DEFINITIONS

Capitalized terms not defined here have the meaning given in the Agreement.

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
"Customer Personal Data" means personal data contained in Customer Data that Ahoy processes on Customer's behalf in providing the Services.
"Subprocessor" means any third party Ahoy engages to process Customer Personal Data.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
"Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR.

2. ROLES AND SCOPE

Customer is the controller, and Ahoy is the processor, of Customer Personal Data. Where Customer is itself a processor on behalf of a third-party controller, Ahoy is Customer's subprocessor, and Customer is responsible for obtaining any authorizations its controller requires. The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

Customer is responsible for the lawfulness of the Customer Personal Data it provides and of its instructions, including having an appropriate legal basis and giving any notices required for Ahoy to process that data as described in this DPA.

3. PROCESSING ON INSTRUCTIONS

Ahoy will process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law, in which case Ahoy will inform Customer of that requirement before processing unless the law prohibits it. The Agreement, this DPA, and Customer's use and configuration of the Services are Customer's complete instructions. Ahoy will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

4. CONFIDENTIALITY

Ahoy will ensure that every person it authorizes to process Customer Personal Data is bound by an appropriate obligation of confidentiality, and that access is limited to those who need it to provide, support, or secure the Services.

5. NO AI MODEL TRAINING

5.1 Ahoy will not use Customer Personal Data or any other Customer Data, including emails, calendar events, meeting recordings and transcripts, messages, notes, files, and CRM records, or any output the Services generate from it, to train or fine-tune any artificial intelligence or machine learning model, whether owned by Ahoy or by a third party. This applies equally to that data in aggregated, de-identified, or anonymized form.

5.2 Where the Services send Customer Data to a third-party AI model provider to generate an output for Customer, that provider is a Subprocessor under Section 6 and is bound by a written agreement that (a) prohibits it from using Customer Data to train or improve its models, and (b) limits its retention of Customer Data to what is needed to return the output and meet its legal and safety obligations.

5.3 Ahoy may use service telemetry, meaning metadata about how the Services are used, such as feature usage, performance, error rates, and whether users accept or reject AI suggestions, to operate, secure, and improve the Services, including their prompts and product logic. Service telemetry does not include the content of Customer Data and is not used to train or fine-tune models.

5.4 Ahoy may use specific Customer Data for model evaluation or improvement only where Customer has expressly agreed to it in writing, and only within the scope agreed. Customer may withdraw that agreement at any time.

5.5 Ahoy will not change this Section 5 except with Customer's prior, express, written agreement. A change to the Terms, Privacy Policy, or this page does not, on its own, constitute that agreement.

6. SUBPROCESSORS

6.1 Customer gives Ahoy general authorization to engage Subprocessors. Ahoy's current Subprocessors, what each does, and where each processes data are listed on its Trust Center at trust.ahoy.ai, which is Annex 3 to this DPA.

6.2 Ahoy will impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, including Section 5, and remains liable to Customer for each Subprocessor's performance of those obligations.

6.3 Ahoy will give Customer at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Trust Center and notifying Customers who subscribe to updates there or ask legal@ahoy.ai to be notified. Customer may object on reasonable data protection grounds within that period. The parties will then discuss a solution in good faith; if none is found, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused part of the term.

7. SECURITY

Ahoy will implement and maintain the technical and organizational measures described in Annex 2, appropriate to the risk of the processing as required by Article 32 GDPR. Ahoy may update those measures over time, provided the overall level of protection is not reduced.

8. SECURITY INCIDENTS

Ahoy will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. Ahoy will take reasonable steps to contain and remediate the incident and will provide further information as it becomes available. Notification is not an acknowledgement of fault or liability.

9. ASSISTANCE

9.1 Data subject requests. Taking into account the nature of the processing, Ahoy will assist Customer by appropriate technical and organizational measures, largely through the Services' own export, correction, and deletion features, to respond to requests from data subjects exercising their rights. If Ahoy receives such a request directly, it will refer the data subject to Customer and will not respond itself, except to confirm the referral or where required by law.

9.2 Other assistance. Ahoy will provide reasonable assistance to Customer with data protection impact assessments, prior consultations with supervisory authorities, and Customer's security obligations, to the extent the information is available to Ahoy and Customer cannot reasonably obtain it otherwise.

10. AUDITS

10.1 Ahoy will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. Ahoy is audited against the AICPA Trust Services Criteria (SOC 2 Type I and Type II), and will provide its most recent reports and a completed security questionnaire on request, under confidentiality.

10.2 Where those materials are not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may, no more than once in any 12-month period and on at least 30 days' written notice, conduct an audit through an independent auditor bound by confidentiality, during business hours and so as not to disrupt Ahoy's operations or compromise the security of other customers' data. Customer bears its own costs of any audit.

11. INTERNATIONAL TRANSFERS

11.1 Ahoy stores Customer Personal Data on Amazon Web Services in the United States and Ireland. Ahoy and its Subprocessors may process Customer Personal Data in other countries in accordance with this Section.

11.2 To the extent Customer Personal Data is transferred from the European Economic Area to a country not recognized as providing adequate protection, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. For the SCCs: the optional docking clause in Clause 7 applies; under Clause 9, option 2 (general written authorization) applies with the notice period in Section 6.3; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the SCCs are governed by the laws of, and disputes are resolved by the courts of, Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.

11.3 For transfers from the United Kingdom, the UK Addendum applies, completed with the information in this DPA, and neither party may end it under its Section 19. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

11.4 Where Ahoy's processing is covered by an adequacy decision or certification framework that Ahoy participates in, Ahoy may rely on it instead of the SCCs.

12. RETURN AND DELETION

During the term, Customer can export Customer Data using the Services. On termination of the Agreement, Ahoy will delete Customer Personal Data within 90 days, unless Customer requests earlier deletion or law requires Ahoy to keep it, in which case Ahoy will keep it confidential and process it only as that law requires. Backup copies are deleted on Ahoy's regular backup cycle and protected under this DPA until then. Ahoy will confirm deletion in writing on request.

13. CALIFORNIA (CCPA)

To the extent the CCPA applies, Ahoy is Customer's service provider. Ahoy will not sell or share Customer Personal Data; will not retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, including outside the direct business relationship with Customer; will not combine it with personal information Ahoy receives from others except as the CCPA permits; and will notify Customer if it can no longer meet its obligations under the CCPA.

14. GENERAL

14.1 Precedence. If there is a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the rest of the Agreement as regards the processing of Customer Personal Data.

14.2 Liability. Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not permit such limitation.

14.3 Term. This DPA lasts for as long as Ahoy processes Customer Personal Data on Customer's behalf.

14.4 Governing law. This DPA is governed by the law that governs the Agreement, except where Data Protection Laws or the SCCs require otherwise.

14.5 Contact. Notices and questions about this DPA go to legal@ahoy.ai. Ahoy Technologies (Ireland) Limited, 27/28 Herbert Place, Dublin 2, Ireland.

ANNEX 1: DETAILS OF PROCESSING

Item	Details
Parties	Data exporter: Customer, as identified in the Agreement (controller, or processor on behalf of its controller). Data importer: Ahoy (processor), contact legal@ahoy.ai.
Subject matter and purpose	Providing the Services: an AI-assisted customer relationship management platform that syncs Customer's connected email, calendar, meeting, and messaging accounts, organizes contacts, companies, and deals, and generates suggestions, drafts, and summaries for Customer's users.
Nature of processing	Collection through connected integrations, storage, organization, retrieval, analysis by AI features to produce outputs for Customer, transmission at Customer's direction (for example, sending emails), and deletion.
Duration and frequency	Continuous, for the term of the Agreement and until deletion under Section 12.
Categories of data subjects	Customer's authorized users; Customer's contacts, customers, prospects, investors, partners, and others with whom Customer's users correspond or meet.
Types of personal data	Names, job titles, employers, business contact details, and social profile URLs; email, calendar, and message content and metadata; meeting recordings and transcripts where connected; notes, files, and CRM records entered by Customer; account and usage data for authorized users.
Special categories	None intended. Customer controls what its connected accounts contain. Customers handling protected health information should sign Ahoy's Business Associate Agreement.
Model training	Not permitted. See Section 5.
Competent supervisory authority	The Irish Data Protection Commission, unless the SCCs require otherwise.

ANNEX 2: TECHNICAL AND ORGANIZATIONAL MEASURES

Encryption: Customer Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.
Hosting: Production systems run on Amazon Web Services in the United States (us-east-1) and Ireland (eu-west-1), in logically isolated environments.
Access control: Role-based, least-privilege access to production systems, single sign-on with multi-factor authentication, and periodic access reviews. Access is removed promptly when no longer needed.
Tenant isolation: Customer Data is logically separated by organization, and authorization is enforced on every request.
Assurance: Independent SOC 2 Type I and Type II audits against the security, availability, and confidentiality criteria, and regular penetration testing.
Logging and monitoring: Security-relevant events are logged and monitored, and alerts are investigated.
Secure development: Peer-reviewed code changes, automated testing, dependency and vulnerability scanning, and separation of development and production environments.
Resilience: Encrypted backups, tested restoration, and infrastructure across multiple availability zones.
Incident response: A documented incident response process, including the customer notification in Section 8.
People: Confidentiality obligations, security and privacy training, and background checks where permitted by law.
Vendor management: Security and privacy review of Subprocessors before engagement, and written terms including the no-training obligation in Section 5.

ANNEX 3: SUBPROCESSORS

The current list of Subprocessors, including AI model providers, is maintained at trust.ahoy.ai. Changes are made in accordance with Section 6.

Questions about this DPA, or need a signed copy? Email legal@ahoy.ai.