Data processing agreement

1 · The parties and the roles

You are the controller of your customers’ personal data. Alongrail is the processor, and processes it only to provide Alongrail Desk to you and only on your instructions. Setting up a desk, publishing a workflow, sending a link, writing a help article and turning on its embed are those instructions.

2 · What is processed

• Your material. The documentation you upload or paste, the readable text of the help-centre pages you ask us to fetch, and the workflows drafted from them.
• Your team. The email address and, if given, the name of each member: the person who started your desk and everyone who accepted an invite. Your contact name and work email. Who reached our start page while signed in. The name and email address of the member who pays, which we send to Dodo Payments at checkout.
• Your customers, during a session. Their screen, sent to Anthropic to be read and not stored by us. What they type and the buttons they press. The instructions they are given, and each check’s result with the checker’s description of the screen, which can quote text from it. Whether they shared a tab, a window or a whole screen, and its size. How long it took.
• Your help articles. The words of each help article your team writes, and the screenshots it keeps in them; your team can cover anything private before saving each one. The screens before and after each captured step are sent to Anthropic to be read; we keep only the screenshots your team saves.
• People reading a help article you show on your website. Nothing is asked of them or kept by us; their network address passes through Vercel and is in its request logs for 30 days.

We do not ask a customer for a name, an email address or a phone number. They can still type one, and their screen can show one, and either can then be saved in the session record.

3 · What is kept, and for how long

Everything is kept until it is deleted; nothing expires on its own. No image of a customer’s screen is kept by us at any point. Anthropic, which reads the frames, deletes what it receives within 30 days, or keeps it for up to 2 years if its safety systems flag it.

Delete a document, a workflow or a single session from your dashboard and it is removed immediately. Deleting one session removes its record, its steps and what the customer typed, and nothing else. Deleting a workflow also deletes every session record under it. The dashboard asks first before deleting a session or a workflow. Earlier versions of a workflow are kept with it until the workflow is deleted. Deleting a document leaves its title, its address or file name, and the sentences quoted from it inside the workflow steps that use them, earlier versions included, until the workflow is deleted. A help article can be deleted the same way, and its pictures go with it. If it was shown on your website, its pictures stop being served there within 10 minutes.

Any member can delete your whole desk from its dashboard, or write to us and we will. A desk bought before session packs may still have a monthly subscription; if it does, we cancel it with Dodo Payments first, and if that fails nothing is deleted. Any sessions left in your balance go with the desk; write to us first if an unused pack should be refunded. Then, in one step, everything tied to your desk is deleted: material, workflows, help articles and their pictures, session records with everything your customers typed, your team’s access, invites, usage, your balance and its history, and your details. We keep payment records for our accounts (amount, currency, date, Dodo’s payment id and the kind of payment) with nothing linking them to your desk; your members’ Alongrail accounts, without their access to your desk; and our record of any letter we wrote to you before you signed up, any reply, and what was done on the page we made for you.

Outside our control after that: Resend keeps copies of the email we sent you for 30 days; Anthropic, as above; Vercel keeps request logs for 30 days; copies of the pictures of a help article you showed on your website, kept by Vercel’s network and visitors’ browsers, stop being served within 10 minutes; a copy a reader saves themselves is outside our control; our database can be restored to any moment in the last 6 hours, and we do not restore from it; PostHog keeps page views of our site, and the events noting which desk’s link someone arrived from, for 1 year on its free plan and 7 years on paid plans; Dodo Payments keeps its own record of your purchases. Whoever asked for the deletion gets an email listing all of this. The details are on the security page.

4 · Confidentiality and security

A person is on your desk only if they started it or accepted an invite link, which works for one person, once, within seven days. Every request for your desk’s material first checks that the signed-in person is a member, except the page of a finished help article that a member has chosen to show on your website, and its pictures; that check is made by our application, not by the database.

At Alongrail, our admin page opens for one account, the founder’s. It shows every desk’s members and the titles of its documents and workflows, but not their text or what customers typed. Whoever holds our database credentials can read every table; they are kept in our hosting provider’s settings and on the founder’s computer.

Data travels encrypted. At rest it is encrypted by our database and hosting providers (AES-256, under their terms); we add no encryption of our own. Members sign in with a one-time emailed link or with Google, with no second factor. We hold no security certifications and claim none.

5 · Sub-processors

Every third party that receives your data or your customers’ data, what each one receives, and where it operates. The same list, with the date it last changed, stands on its own at Sub-processors.

6 · Where data goes

Our application and our database run in Singapore. Frames, PDFs and text go to Anthropic, which may process them in any region and stores them in the United States. The other sub-processors operate where the list above says. The EU standard contractual clauses (processor module) are available on request, as section 9 says. If you need another transfer mechanism, please write to us before you buy and we’ll tell you plainly whether we can meet it.

7 · Helping you with requests

If one of your customers asks what was held about them, your dashboard shows each session’s full record: every step they were given, what they typed and how each check went. To remove it, open that session on your dashboard and delete it: its record goes on its own, and nothing else does.

If we learn of a breach affecting your data, we will tell you without undue delay, and within 72 hours of becoming aware. What we have to notice one: automated checks that the site and its database answer, scheduled every hour on GitHub (which runs about 22 a day, with an occasional gap of up to five hours), and an alert when our AI provider refuses a request for billing reasons. We have no intrusion detection and no log of who read what.

8 · Ending

When you stop paying, nothing is deleted: your material, your workflows and your records stay where they are and your dashboard still opens. Delete your desk from its dashboard, or ask us to, and it goes as section 3 describes.

9 · Contact

hello@alongrail.com. One address, and a person reads every message.

If you need a signed copy of this agreement as a PDF, or the EU standard contractual clauses (processor module), please write to us and we’ll send them.

10 · For article writing only: what we keep

The help-article maker is the one part of Desk that keeps a picture. Everything above about your customers’ screens is unchanged.