Legal
Data processing agreement
Last updated September 18, 2026
The plain version
When OpenStudio handles personal data on your behalf, we follow your instructions. This agreement covers that work, including security, subprocessors, deletion, and international transfers.
The agreement
This page is the Cover Page for the Common Paper DPA Standard Terms, Version 1.1, incorporated by reference without modification. Together they form our data processing agreement (DPA), supplementing the terms of service (Agreement). The DPA takes effect when you accept it, including by accepting the Agreement, and applies to personal data we process on your behalf.
Key terms and parties (Annex I(A))
- Provider and data importer: Costa Security Inc., 3790 El Camino Real #1090, Palo Alto, CA 94306, acting as processor or subprocessor. Its privacy and security contact is hello@openstudio.tech at the same address.
- Customer and data exporter: you, or the organization you represent, acting as controller or processor. Your name, address, and contact details are those in your account or order form. Each party’s relevant activities are described below.
- Approved subprocessors (Annex III): listed with their locations and tasks at trust.costa.app.
- Security Policy (Annex II): as defined in the Agreement, including our security controls and the control descriptions at trust.costa.app.
Processing details (Annex I(B))
- Service and purpose: providing OpenStudio as instructed by you under the Agreement — building, deploying, and running software, including the connectors you authorize. Processing includes collecting, storing, retrieving, using, updating, transmitting, protecting, returning, and deleting data. The Agreement’s training restrictions continue to apply.
- People and data: your users, employees, contractors, customers, and people whose data you supply through content or connected services. Data includes names, contact and professional details, account identifiers, and personal data within that content and connected-service data. Special category data is not permitted.
- Frequency and duration: ongoing as you use OpenStudio, for the term of the Agreement and until return or deletion under DPA section 7 and our retention policy, except where retention is required by law.
International transfers
The Standard Terms incorporate the applicable EU Standard Contractual Clauses and UK Addendum. The Governing Member State is Ireland for EEA transfers, and England and Wales for UK transfers. The competent supervisory authority (Annex I(C)) is determined under clause 13 of the EU Standard Contractual Clauses or the UK Addendum, as applicable. Swiss transfers follow DPA section 3.4.
This Cover Page controls over the DPA Standard Terms; the applicable Standard Contractual Clauses and UK Addendum control over both.
Adapted from the Common Paper Data Processing Agreement (Version 1.1), free to use under CC BY 4.0.