Data processing agreement

Last updated: 11 October 2026 · Version 2.0

This data processing agreement ("DPA") is part of the agreement between you, the customer, and Smidt Beheer, trading as Recall ("Recall", "we", "us"), Binnendelta 11M, 1261 WZ Blaricum, the Netherlands (KvK 99124254), under our terms of service. It sets out how we process personal data on your behalf, as Article 28 of the General Data Protection Regulation (GDPR) requires.

1. Scope

• This DPA applies automatically to every customer who accepts the terms of service, from the moment we process Customer Personal Data. It is concluded electronically and needs no signature. On request we send a countersigned copy.
• "Customer Personal Data" means the personal data in the content you or your software send to Recall (messages, files, names and metadata) and in what Recall derives from it (facts, peer cards, summaries and embeddings). Other terms, such as controller, processor and personal data breach, have the meaning the GDPR gives them.
• This DPA does not cover the account, billing and usage data we process as a controller. Our privacy policy covers that data.

2. Roles

You are the controller of Customer Personal Data and we are your processor. If you process the data as a processor for someone else, you confirm that your controller has authorised you to engage us, and we are your sub-processor. Annex 1 describes the processing.

3. Instructions

• We process Customer Personal Data only on your documented instructions, also for transfers to countries outside the European Economic Area (EEA). Your instructions are: the terms of service and this DPA; how you use and configure the service through the API, SDKs, MCP server, plugins and dashboard (for example the webhooks you set up and the MCP clients you connect); and other written instructions we agree to.
• If EU or member state law requires us to process the data otherwise, we tell you before we do, unless that law forbids it on important grounds of public interest.
• We tell you at once if we believe an instruction infringes the GDPR or other data protection law. We may suspend that processing until you confirm or change the instruction.
• We do not use Customer Personal Data for our own purposes: not to train AI models, not to sell, not for advertising and not for profiling. We do keep usage figures that identify nobody, such as token and request counts, for billing, capacity planning and security.

4. Confidentiality

Only people who need access to run, support or secure the service can access Customer Personal Data, and each of them is bound by a duty of confidentiality, by contract or by law. They access it only to give support you ask for, to investigate abuse or a security incident, or to comply with the law.

5. Security

• We take the technical and organisational measures in Annex 2 to protect Customer Personal Data, as Article 32 of the GDPR requires. We may change them, as long as the overall level of protection does not go down.
• You are responsible for keeping your API keys, accounts and own systems secure, and for deciding whether these measures are appropriate for the data you send.

6. Sub-processors

• You give us general written authorisation to engage sub-processors. The current sub-processors are listed in Annex 3.
• We tell you at least 30 days before we add or replace a sub-processor, by email to account owners and by updating Annex 3 on this page.
• You may object within those 30 days, on reasonable grounds relating to data protection, by email to privacy@recallmem.dev. We will discuss your objection with you. If we cannot resolve it, you may end the agreement before the change takes effect, and we refund your unused purchased credit.
• We bind each sub-processor by a written contract with data protection obligations that offer at least the same level of protection as this DPA. We remain fully liable to you for the performance of our sub-processors.

7. International transfers

• Customer Personal Data is stored in the EU (Frankfurt). Some sub-processors process it in the United States (see Annex 3).
• We transfer Customer Personal Data outside the EEA only with safeguards under Chapter V of the GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for certified recipients, or otherwise the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module 3 (processor to processor), with a transfer impact assessment and additional measures where needed.

8. Requests from authorities

If an authority asks us for Customer Personal Data, we refer it to you where we can. We disclose data only when a law that binds us obliges us to, after checking the request, and we challenge requests that we consider unlawful. We disclose only what is required and tell you about the request, unless the law forbids that.

9. Assistance

• Data subjects' requests. The service lets you find, export, correct and delete Customer Personal Data: export in the dashboard, reads through the API, and deletion of a person (peer), a session, a workspace, a single fact or the whole account. If a data subject contacts us directly, we forward the request to you without undue delay and do not answer it ourselves unless you instruct us to.
• Security, impact assessments and prior consultation. We help you meet your obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to us, for example with this DPA and its annexes.
• Reasonable assistance is free of charge. If a request takes substantial effort, we agree a reasonable fee with you in advance.

10. Personal data breaches

• We notify you without undue delay, and at the latest within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data. We send the notice to the email addresses of the account's owners.
• The notice describes, as far as we know at that point: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where we do not have all the information at once, we provide it in phases without further undue delay.
• We take reasonable steps to contain the breach and limit its consequences, and keep you informed. You decide whether to notify the supervisory authority and the data subjects.

11. Deletion and return

• While the agreement runs, you can export Customer Personal Data in the dashboard and delete it at any time.
• When you delete your account, we delete all Customer Personal Data from our database at once.
• If the agreement ends in another way, you can export your data during at least 30 days from our notice, and we delete all Customer Personal Data within 30 days after the agreement ends.
• We keep Customer Personal Data longer only where EU or member state law requires it. We then keep it confidential and process it only for that purpose.

12. Information and audits

• We make available all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA: this DPA and its annexes, written answers to reasonable questions, and our sub-processors' audit reports and certifications where they are available to us.
• If that information is not enough, or a supervisory authority requires it, you may audit us, including by inspection, yourself or through an independent auditor bound by confidentiality. You give at least 30 days' written notice (less after a personal data breach or when an authority requires it). Audits take place during business hours, at most once every 12 months unless there has been a breach or an authority requires more, without access to other customers' data, and at your own cost.

13. Your obligations

• You have a lawful basis for all processing you instruct us to carry out, and your instructions comply with the law.
• You inform the data subjects as Articles 13 and 14 of the GDPR require, including that their data is processed by an AI memory service and the model providers it uses.
• You send special categories of personal data, data about criminal convictions, or data about children only where the law allows it and with the safeguards it requires, including a data protection impact assessment where one is required.
• You handle data subjects' requests, using the tools of the service, and delete data you no longer need.

14. Liability, precedence and law

• Liability. The liability provisions of the terms of service apply to this DPA. They do not limit either party's liability towards data subjects under Article 82 of the GDPR.
• Precedence. Where this DPA and the terms of service conflict on the processing of personal data, this DPA prevails. Where Standard Contractual Clauses apply, they prevail over this DPA.
• Duration. This DPA applies for as long as we process Customer Personal Data.
• Changes. We change this DPA in the same way as the terms of service, with at least 30 days' notice of material changes.
• Law and courts. Dutch law governs this DPA. Disputes go to the competent court of the Rechtbank Midden-Nederland, unless Standard Contractual Clauses or mandatory law provide otherwise.

Annex 1: Processing details

Annex 2: Security measures

Access to the service

• API keys are random, shown once and stored only as SHA-256 hashes. They can be limited to one workspace, peer or session, and revoked at any time.
• The dashboard uses passwordless sign-in links that work once and expire after 15 minutes; only their hash is stored. Session cookies are signed, HttpOnly, Secure, SameSite=Lax and __Host- prefixed. Every form is protected against cross-site request forgery, and pages carry a strict Content Security Policy. Accounts have roles (owner, admin, member).
• MCP clients connect with OAuth 2.1 and PKCE (S256), with short-lived access tokens and rotating refresh tokens with reuse detection. Tokens are stored as hashes, and connections can be revoked in the dashboard.
• Requests are rate-limited, and repeated failed credentials from one network are blocked for a while.

Separation

• Every request is scoped to one account. Automated tests check that one account cannot read another account's data.
• The database provider's public data interface cannot read or write our tables: row-level security is on for every table, with no access rules.

Encryption

• All public endpoints are served over HTTPS (TLS). Requests to model, email and payment providers use HTTPS.
• The database provider encrypts stored data at rest.

Data minimisation

• IP addresses are not stored in our database. Where a limit needs one, we store a keyed hash.
• Card details go directly to Stripe; we never receive them.
• Requests to AI models, for text generation and for embeddings, ask OpenRouter to use only model providers that do not collect the data they process.
• Customer Personal Data is not used to train models.

Organisation and operations

• Access to production systems and data is limited to the people who run Recall, and only where their work requires it.
• Error alerts to the operator contain the error's name and message, never request bodies.
• An automated check monitors that the service is up.
• You can delete a person, a session, a workspace, a single fact or the whole account, and export your data, at any time.
• Vulnerabilities can be reported under our security policy.

Annex 3: Sub-processors

These providers do not receive Customer Personal Data and are therefore not sub-processors; we list them for transparency: Resend (sign-in and account emails to account members), Stripe Payments Europe, Ltd., Ireland (payments, invoices and tax), Cloudflare (DNS) and GitHub (an automated uptime check of our health endpoint).