[DRAFT — counsel to finalise.] This Data Processing Agreement (Version 1.0) forms part of the agreement between Frutebox ("Processor") and the customer organisation ("Controller") and governs Frutebox's processing of personal data on the Controller's behalf under the GDPR (Art. 28).
1. Scope & roles
The Controller determines the purposes and means of processing; Frutebox processes personal data only on the Controller's documented instructions, including the configured region and policy.
2. Nature & purpose
Processing is limited to operating the Frutebox service for the Controller: routing prompts to compute, metering, and storing the Controller's data as configured. Conversation content is encrypted and not used for model training; Frutebox staff cannot read conversation content.
3. Sub-processors
Frutebox uses a documented list of sub-processors (infrastructure, payment, email, web search). The Controller is notified of changes and may object on reasonable data-protection grounds.
Web search — named, because a search query is Controller data. When web search is enabled for an organisation, the query is sent to ONE third-party search provider:
| sub-processor | what it receives | why |
|---|---|---|
Brave Search (api.search.brave.com, Brave Software Inc.) | the search query — in the request URL — and a result count | to answer a question that needs current public web information |
Tavily (api.tavily.com, Tavily AI) | the search query — in a POST body — and a result count | the same, where the Controller's deployment is configured for Tavily instead |
A query is Controller data: it is what the person typed, or what the model derived from what they typed. Accordingly:
- What is NOT sent: conversation history or content, the user's account identifier, email or organisation, and any cookie or session token. The API key in the request identifies Frutebox, not the user. Secrets never reach the provider — the model only ever sees redacted placeholders, and any leftover placeholder token is scrubbed from the query before it leaves.
- The user's IP address is not disclosed to the provider. The request is made by Frutebox's server, so the provider sees Frutebox's address and not the person's.
- Only one provider is active at a time, and only when a key is configured. With no key the feature is off and nothing is sent to either.
- A self-hosted option exists and uses no sub-processor at all: a SearXNG instance Frutebox runs itself. A Controller who wants no third-party search processor can be served by it.
*(Counsel: the enumerated list for the other three categories, the notice period and objection window in this clause, and whether publishing an amended DPA requires fresh acceptance from Controllers who accepted Version 1.0, are open — see docs/OPEN_DECISIONS.md. The web-search rows above are statements of fact verified against web/src/lib/tools/web-search.ts, not legal drafting.)*
4. Security
Encryption in transit and at rest, keyed access, blind-indexed identity, audit logging, and the §6 zero-trust processing model. Personal data is never routed in the clear to an untrusted node (secrets are redacted before leaving the trusted boundary).
5. Data subject rights & assistance
Frutebox assists the Controller in responding to data-subject requests and provides export and deletion mechanisms (self-serve in-app).
6. Breach notification
Frutebox notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.
7. International transfers
Where processing occurs outside the configured region, appropriate safeguards (e.g. SCCs) apply. The Controller may pin a region.
8. Deletion / return
On termination, the Controller's data is deleted or returned per the service's export/delete tools, subject to legal retention.
9. Audit
Frutebox makes available the information necessary to demonstrate compliance with Art. 28 and allows for reasonable audits.
An authorised representative of the Controller accepts this DPA electronically from the organisation's settings; the acceptance (who, when, version) is recorded.