DATA PROCESSING AGREEMENT — ENGINORA

Version 1.0
Effective date: September 1, 2026

This Data Processing Agreement, hereinafter the “DPA”, supplements the Enginora Terms and Conditions of Sale and Use.

It governs the processing of personal data carried out by I AND YOO on behalf of the Client in connection with the use of Enginora.

1. PARTIES

1.1 Processor

The Enginora Service is published by:

I AND YOO
French simplified joint-stock company (société par actions simplifiée) with share capital of EUR 3,000
105 avenue des Grésillons
92230 Gennevilliers
France

SIREN: 831 208 277
SIRET: 831 208 277 00028
RCS Nanterre
EU VAT number: FR59831208277

Contract contact: contact form
Data protection contact: privacy@iandyoo.com

Hereinafter “Enginora”, “I AND YOO” or the “Processor”.

1.2 Client

The “Client” means the natural or legal person acting in a professional capacity that uses Enginora in accordance with the Terms.

Where the Client determines the purposes and means of personal-data processing carried out using Enginora, it acts as controller.

Where an agency, consultant or other service provider uses Enginora on behalf of its own client, I AND YOO may act as a subprocessor in the processing chain.

2. PURPOSE

This DPA defines the conditions under which I AND YOO processes personal data on behalf of the Client in accordance in particular with Article 28 of Regulation (EU) 2016/679, known as the “GDPR”.

The DPA applies only to processing for which I AND YOO acts on behalf of the Client.

It does not apply to processing for which I AND YOO itself determines the purposes and means, including certain processing relating to:

• creation and management of Accounts;
• billing;
• the commercial relationship;
• support;
• security of the Service;
• compliance with I AND YOO’s legal obligations.

Such processing is described in the Enginora Privacy Policy.

3. DESCRIPTION OF PROCESSING

The characteristics of the processing are detailed in Appendix 1.

Processing is carried out for the duration of use of the Service and, after it ends, for the period strictly necessary for return, deletion or legally required retention of the relevant data.

4. CLIENT INSTRUCTIONS

I AND YOO processes personal data on behalf of the Client only on the Client’s documented instructions.

Documented instructions include in particular:

• the Terms;
• this DPA;
• actions and settings selected by the Client in Enginora;
• information, content and instructions transmitted by the Client;
• requests sent to Enginora through the support or contact channels provided for in the contract.

I AND YOO does not use entrusted data for its own purpose that is incompatible with its role as processor.

If I AND YOO considers that an instruction from the Client infringes applicable data-protection regulations, it informs the Client.

Where processing is required of I AND YOO by European Union or French law independently of the Client’s instructions, I AND YOO informs the Client beforehand, unless prohibited by law.

5. CLIENT OBLIGATIONS

The Client remains responsible for:

• the lawfulness of the processing it decides to carry out;
• determining the purposes of the processing;
• having an appropriate legal basis;
• informing data subjects;
• handling the exercise of their rights;
• the data it chooses to transmit to Enginora.

The Client agrees to transmit only data necessary for its use of the Service.

Unless I AND YOO has given prior written approval, Enginora is not designed to intentionally process:

• special categories of data referred to in Article 9 GDPR;
• data relating to criminal convictions and offences;
• health data;
• data requiring a specific level of protection not provided for by the Service.

Where the Client itself acts as a processor, it warrants that it has the necessary authorization to appoint Enginora as a subprocessor.

6. CONFIDENTIALITY

I AND YOO ensures that persons authorized to process personal data:

• access it only to the extent necessary for their duties;
• are subject to an appropriate confidentiality obligation;
• process the data only in accordance with the applicable instructions.

This obligation continues after their access to the data ends.

7. SECURITY

I AND YOO implements technical and organizational measures proportionate to the nature of the Service and the risks presented by the processing.

As of the effective date of this DPA, these measures include in particular:

• user authentication through Firebase Authentication;
• individual application Accounts;
• email/password authentication or Google OAuth;
• email-address verification;
• application-level access controls for projects and data associated with the Account;
• separate control of administrator functions;
• access to the Service through HTTPS;
• configuration of HTTP security headers;
• HMAC authentication of n8n callbacks;
• anti-replay protection for n8n callbacks;
• idempotency mechanisms for the relevant events;
• cryptographic verification of Stripe webhooks;
• management of application secrets using dedicated variables and credential mechanisms.

Isolation between Clients currently relies primarily on application-level authorization and project-ownership controls.

This DPA does not constitute a guarantee of a specific service level, RPO, RTO or availability.

I AND YOO may change its security measures in order to maintain or improve the overall level of protection of the Service.

8. SUBPROCESSORS

The Client generally authorizes I AND YOO to use subprocessors where necessary to provide Enginora.

I AND YOO imposes on the relevant subprocessors data-protection obligations appropriate to the processing they carry out.

I AND YOO remains responsible to the Client for performance of the obligations imposed on its subprocessors in accordance with Article 28 GDPR.

The list of the main subprocessors that may process Client data is set out in Appendix 2 and kept up to date on Enginora’s dedicated subprocessor page.

I AND YOO informs the Client of material additions or replacements so that the Client may raise a reasonably substantiated objection relating to data protection.

Where the parties are unable to resolve a legitimate objection, the Client may terminate the relevant Service in accordance with the Terms.

9. ARTIFICIAL INTELLIGENCE PROVIDERS

Certain Enginora operations use third-party artificial-intelligence providers.

As of the effective date of this DPA, the main providers used are:

• OpenAI;
• Anthropic;
• Perplexity.

The data transmitted depends on the requested operation and may include in particular:

• the topic being processed;
• the project context;
• editorial information;
• personas and guidelines;
• SEO or semantic data;
• intermediate content;
• elements required to generate a Draft.

I AND YOO limits these transmissions to the data necessary to perform the relevant operation.

I AND YOO does not use Client data to train an artificial-intelligence model of its own.

OpenAI states that data transmitted to its API is not used by default to train its models unless there is an explicit opt-in.

Anthropic also states that inputs and outputs from its commercial offerings and API are not used by default to train its models; its DPA and Standard Contractual Clauses are incorporated into its commercial terms.

Perplexity states that it applies a Zero Data Retention policy to its Chat Completions/Sonar API and does not use content submitted to the API to train its models.

I AND YOO may change the models or providers used where necessary for the operation or evolution of the Service, subject to compliance with this DPA.

10. INTERNATIONAL TRANSFERS

Where processing involves a transfer of personal data outside the European Economic Area, I AND YOO ensures that a mechanism provided for under Chapter V GDPR applies to the relevant transfer.

Such a mechanism may in particular be based on:

• an adequacy decision of the European Commission;
• the European Commission’s Standard Contractual Clauses;
• any other legally applicable mechanism.

The cloud and AI providers used by Enginora have contractual data-protection frameworks intended to govern their processing.

Google publishes a Cloud Data Processing Addendum applicable to its Cloud services.

OVHcloud also publishes a Data Processing Agreement governing processing carried out on behalf of its customers.

OpenAI has a Data Processing Addendum applicable to its professional services.

Anthropic incorporates its DPA and the applicable SCCs into its commercial terms.

The Client may request from privacy@iandyoo.com reasonable additional information concerning the applicable transfer mechanisms.

11. EXERCISE OF DATA-SUBJECT RIGHTS

The Client remains responsible for responding to requests by data subjects to exercise their rights.

Taking into account the nature of the processing, I AND YOO provides the Client with reasonable assistance to enable it to respond in particular to requests for:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability where applicable.

Where a person contacts I AND YOO directly concerning data processed exclusively on behalf of the Client, I AND YOO forwards the request to the Client where it can reasonably identify the Client concerned.

I AND YOO does not respond on the merits in place of the Client except on the Client’s instruction or where required by law.

12. PERSONAL DATA BREACH

Where I AND YOO becomes aware of a personal-data breach concerning data it processes on behalf of the Client, it informs the Client without undue delay.

To the extent the information is available, the notification includes:

• the known nature of the breach;
• the categories of data concerned;
• the known likely consequences;
• the measures taken or contemplated;
• information reasonably necessary for the Client to comply with its own obligations.

Where all information is not immediately available, it may be provided progressively.

This notification does not constitute an admission of liability.

The processor’s obligation to notify the controller without undue delay arises from Article 33(2) GDPR.

13. COMPLIANCE ASSISTANCE

Taking into account the nature of the processing and the information available to it, I AND YOO provides reasonable assistance to the Client regarding:

• security of processing;
• personal-data breaches;
• data-protection impact assessments where necessary;
• prior consultations with a supervisory authority where they may be required.

This assistance does not transfer to I AND YOO obligations that fall on the Client in its capacity as controller.

14. AUDIT AND INFORMATION

I AND YOO makes available to the Client the information reasonably necessary to demonstrate compliance with the obligations under this DPA and Article 28 GDPR.

Where sufficient, the parties give preference to:

• written information;
• questionnaires;
• available security policies or documents;
• other appropriate evidence.

The Client may request an audit where it has reasonable grounds to verify compliance with this DPA.

The audit must be organized proportionately, taking into account in particular:

• the size of Enginora;
• the nature and risk of the processing;
• confidentiality;
• security of the Service;
• the rights of other Clients.

The practical arrangements for an audit may not have the effect of making it impossible to exercise the rights provided for under Article 28 GDPR.

15. RETURN AND DELETION

When processing carried out on behalf of the Client ends, I AND YOO, in accordance with the Client’s documented instructions:

allows the Client to retrieve the relevant data using the export features available in Enginora or, where necessary, through an additional return procedure; or proceeds with its deletion,

unless a legal provision requires retention.

The Service’s export features allow in particular the retrieval of exportable data in structured, commonly used and machine-readable formats where applicable. Reversibility and provider-switching arrangements are described in the Terms and on Enginora’s Data Act / Switching page.

15.1 Current procedure

As of the effective date of this DPA, complete deletion of an Account is not offered on a self-service basis.

A request may be sent to:

privacy@iandyoo.com

I AND YOO handles the request manually after carrying out the checks reasonably necessary regarding the identity and authority of the requester.

Deletion may require operations across several systems used to provide the Service.

I AND YOO carries out those operations within a reasonable period having regard to their nature and its legal obligations.

15.2 Backups

Where deleted data remains temporarily present in a technical backup, it must not be reintroduced into ordinary processing unless required by a technical restoration.

It is deleted in accordance with the normal rotation cycle applicable to backups.

15.3 Legal retention

Data that must be retained under a legal obligation may be isolated and retained for the legally required period.

Such retention does not permit reuse for a purpose incompatible with that obligation.

16. END OF THE DPA

This DPA takes effect at the same time as the contract or as soon as I AND YOO begins processing personal data on behalf of the Client.

It remains applicable for as long as I AND YOO retains or processes such data on behalf of the Client.

The obligations relating to confidentiality, security, return and deletion survive termination of the contract for as long as necessary.

The DPA is governed by French law, without prejudice to the direct application of the GDPR and the powers of the competent supervisory authorities.

APPENDIX 1 — DESCRIPTION OF PROCESSING

Subject matter

Provision of the Enginora SaaS Service and performance of operations requested by the Client.

Duration

Duration of use of the Service, plus the period necessary for return, deletion or legally required retention.

Nature of operations

Depending on use of the Service:

• receipt;
• storage;
• organization;
• consultation;
• analysis;
• transformation;
• generation;
• transmission to necessary subprocessors;
• return;
• deletion.

Purposes

Including:

• creation and management of projects;
• construction of SEO/GEO territories;
• processing of editorial context;
• generation of metadata;
• internal-link recommendations;
• generation and retention of Drafts;
• technical execution of workflows;
• support and diagnosis where necessary.

Categories of data subjects

Depending on data voluntarily entered by the Client:

• users and staff of the Client;
• clients of the Client;
• prospects or professional contacts;
• authors or persons mentioned in analyzed content;
• any other person whose data the Client lawfully enters into Enginora.

Categories of data

Depending on the Client’s use:

• first and last names;
• roles and professional information;
• professional contact details;
• content of websites or pages analyzed;
• project context;
• personas;
• editorial instructions and guidelines;
• texts and Drafts;
• information contained in content provided or produced;
• metadata relating to projects and Deliverables;
• technical identifiers necessary for the operation of the Service.

Enginora is not designed to intentionally receive special categories of personal data within the meaning of Article 9 GDPR.

APPENDIX 2 — MAIN SUBPROCESSORS

The up-to-date public list is available at:

https://enginora.co/legal/subprocessors/

Google has a Cloud Data Processing Addendum for data processed in its Cloud services.

OVHcloud governs by DPA the processing it carries out on behalf of its customers.

OpenAI publishes its DPA and states that API data is not used to train its models by default.

Anthropic states that its DPA, including the SCCs, is incorporated into its commercial terms.

Perplexity states that its API currently applies a Zero Data Retention policy to request and response content and does not use that content for training.

Stripe and the Tawk.to support service are not included in this Appendix where they are involved in processing for which I AND YOO acts as controller. Such processing is described in the Privacy Policy.

APPENDIX 3 — TECHNICAL AND ORGANIZATIONAL MEASURES

The main measures implemented as of the effective date of this DPA include:

Authentication and access

• Firebase Authentication;
• individual user Accounts;
• email/password sign-in and Google OAuth;
• email-address verification;
• separate roles for administrative functions;
• server-side controls over administrative functions.

Logical separation

Projects are associated with their user’s identifier.

Regular application access checks that association before allowing access to the related data.

Isolation is primarily ensured at application level.

Communications and application security

• public access to the Service through HTTPS;
• HSTS configured;
• HTTP security headers;
• HMAC authentication of n8n callbacks;
• anti-replay time window;
• idempotency mechanisms for the relevant callbacks;
• verification of Stripe signatures for payment events.

Secret management

Secrets necessary for the operation of the Service are provided to the application and workflows through environment variables or dedicated credential mechanisms.

They are not intended to be exposed to the Client side.

Technical logging

Enginora retains certain technical data necessary in particular for:

• execution of generations;
• diagnosis;
• error handling;
• idempotency of callbacks and events.

Access to this information is limited to persons who need it to operate or support the Service.

Data and files

In its current version, Enginora does not offer a general file-upload feature.

Evolving security

I AND YOO may adapt and strengthen the measures described in this Appendix according to:

• identified risks;
• technical developments;
• incidents;
• changes to the Service;

provided that the overall level of data protection is not materially reduced.

End of the Enginora DPA — Version 1.0