Data Processing Agreement

This Data Processing Agreement (“DPA”) is between VersoDocs (Alex Quach, entrepreneur individuel, SIREN 103 907 564, 17 Avenue d’Italie, 75013 Paris, France; “we”, the processor) and the customer that uses the Service (“you”, the controller).

It forms part of the Terms of Service and applies automatically to every customer, on every plan, with no signature needed. It covers personal data in Customer Content that we process on your behalf. Where we decide on our own why and how personal data is used (for example your account, billing and support data), we act as controller under our Privacy Policy.

If you need a countersigned copy for your records, email privacy@versodocs.com. Where this DPA and the Terms conflict on the processing of personal data, this DPA controls.

Subject matter: hosting and processing Customer Content so that we can provide the Service.

Duration: for as long as you use the Service, and until the data is deleted as described in section 9.

Nature and purpose: storing, versioning, displaying, searching, reviewing, exporting and transmitting Customer Content, running the features you turn on (including AI features and integrations), and providing support.

Categories of personal data: names, email addresses and profile photos of your members and guests, and any personal data you or your members put in documents, proposals, comments and uploaded files.

Categories of data subjects: your members, guest reviewers and commenters, and any person mentioned in Customer Content.

Special categories of data: the Service is not designed for them; you decide whether to store any, and remain responsible for having a legal basis to do so.

We process personal data only on your documented instructions, which are these Terms, this DPA and the way you configure and use the Service, unless EU or French law requires otherwise; in that case we will tell you before processing, unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

You are responsible for the lawfulness of the personal data you put in the Service and for the instructions you give.

Anyone we authorize to process personal data is bound by an obligation of confidentiality. We do not access Customer Content except as needed to provide the Service, to comply with the law, or with your explicit permission (for example for support).

We apply technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest by our database and storage providers, additional encryption of stored credentials and API keys, access controls scoped by organization and workspace, immutable version history and an audit trail. The current measures are described on our Security page. We may update them as long as the overall level of protection does not decrease.

You give us general authorization to engage the sub-processors listed below. Each one is bound by a written contract that imposes data protection obligations at least as protective as this DPA, and we remain responsible to you for their performance.

Before we add or replace a sub-processor, we update this list and, where appropriate, notify you by email. You then have 30 days to object on reasonable data protection grounds by emailing privacy@versodocs.com. If we cannot reasonably address your objection, you may stop using the affected feature or terminate the Service, as set out in the Terms.

Current sub-processors (list last changed November 12, 2026):

The following services receive data only when you or your members choose to connect them. Sending data to them is a transfer you instruct, to your own account with that provider, under your own agreement with it. They are not our sub-processors:

Slack, Microsoft Teams, GitHub, Jira, Linear, Zapier, n8n and other webhooks: Receive the events and document details needed for the integration you configured.

OneDrive, SharePoint, Google Drive and Dropbox: Cloud folders, Watch a folder and imports: only the folders and files you choose.

Notion, Confluence and Google Docs: Receive the documents you export to them.

Microsoft Word and Google Docs add-ins: Read and write the document open in the editor only to load or submit the content you pick.

The AI provider of your own API key (OpenAI, Anthropic, Google or another): Receives the proposals an AI reviewer covers, under your own contract with that provider.

The database and uploaded files are stored in the European Union. Where a sub-processor processes personal data outside the EU / EEA, the transfer relies on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified US providers) or on the European Commission’s Standard Contractual Clauses in that sub-processor’s data processing agreement, as shown in the table above.

DeepSeek (China) is off by default. It is used only with explicit consent: by the user, for a single request they confirm, unless an organization admin has blocked it; or by an organization admin who turns it on for the organization. Because China has no adequacy decision and no other safeguard is in place, this transfer relies only on that explicit consent (GDPR article 49(1)(a)). See DeepSeek in the Privacy Policy.

Taking into account the nature of the processing, we help you answer requests from data subjects exercising their GDPR rights (access, rectification, erasure, portability, restriction, objection), mostly through the Service itself: export, editing, deletion of documents, members and organizations. If we receive such a request directly about your data, we forward it to you without undue delay.

We give you the information you reasonably need to carry out data protection impact assessments and prior consultations with a supervisory authority, as far as they concern our processing.

We notify you without undue delay after becoming aware of a personal data breach affecting your personal data, with the information you need to meet your own notification obligations, and we take reasonable steps to contain it and limit its effects.

You can export your documents at any time (Markdown on every plan; PDF, Word and HTML on Team and Pro; a full organization export on Pro). When you delete an organization, its Customer Content is deleted from our active systems, including uploaded files and search index entries; the remaining copies in our database provider’s restore history are overwritten after a limited period. We keep personal data longer only where EU or French law requires it.

On request, we make available the information necessary to demonstrate compliance with GDPR article 28, including answers to reasonable security questionnaires. Where that information is not enough, you may carry out an audit, yourself or through an independent auditor bound by confidentiality, on reasonable prior notice, at your own cost, no more than once a year unless a supervisory authority requires it or a breach has occurred, and in a way that does not compromise other customers’ data.

Liability under this DPA is subject to the limitations in the Terms of Service. Anything this DPA does not address is governed by the Terms. Questions about this DPA: privacy@versodocs.com.