Sub-processor / DPA disclosure
Copy-paste language naming ARCY AI as a sub-processor in your own DPA or sub-processor list, and what to confirm before you sign it.
If you are the data controller for your end users and you sign data processing agreements with your own customers, you need to list ARCY AI as a sub-processor, together with ARCY AI's own sub-processors.
Update your policies on ARCY MCP adds ARCY AI as one row in your own sub-processor list or DPA annex.
This is boilerplate, not legal advice. Have your own counsel review it, and request ARCY AI's own DPA before relying on it for a regulated customer relationship.
What to paste
Sub-processor: ARCY AI
Purpose: In-product user guidance, assistance, and behavioral analytics
within [Your Product Name], including offering or starting a guided flow
based on how a user behaves in [Your Product Name].
Data processed: Session and interaction data described in our Privacy
Policy's "Third-Party Product Assistance" section, and any account
identifiers or attributes we choose to share with ARCY AI. ARCY AI never
stores payment or credential data (card numbers, card security codes, PINs,
passwords, bank account numbers) as an account detail; such values are
refused before storage.
A helpdesk we connected ourselves is not one of ARCY AI's
sub-processors: it is our own provider under our own agreement with it. Where
an end user agrees to it, ARCY AI opens one ticket there carrying the
conversation as ARCY AI stored it, the summary that end user read, and an
email address to reply to, and nothing else.
Location of processing: ARCY AI's infrastructure runs on Amazon Web
Services: hosting, database, storage and AI inference through Amazon Bedrock in eu-north-1 (Stockholm, Sweden); Amazon Bedrock may answer an inference request from another AWS region in the EU.
ARCY AI's own sub-processors are listed and kept current at
https://docs.arcyai.com/compliance/sub-processors. ARCY AI does not sell or
share sub-processor data with third parties for their own purposes. To
request ARCY AI's Data Processing Agreement or security questionnaire,
contact contact@arcyai.com.Notes on filling this in
- Keep the location of processing as written: the region and the Amazon Bedrock sentence after it.
- Keep the payment sentence under Data processed as written. It describes a refusal ARCY applies to every attribute value, by every path that writes one (Attributes), not a setting you choose. It says nothing about a chat message: nothing checks one for those values, and an older annex claiming it does promises a protection ARCY does not provide, so delete that clause.
- Link to Sub-processors rather than copying its table into a document you do not intend to keep updated.
- The helpdesk paragraph is true only once you connected one on Integrations. Without one, delete it. Keep it as written where you keep it: the helpdesk is your own processor under your own agreement, so it does not belong in your list of ARCY AI's sub-processors, and ARCY AI sends it only what the end user agreed to send.
- ARCY AI's GDPR posture is in progress, not certified; see Certification status. If your DPA makes you represent your sub-processors' certification status, state it as it stands.
- A signed DPA with ARCY AI is available on request. If you are in a regulated industry, request it and confirm terms before relying on this disclosure in a customer contract.