Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between ApeTec Ltd (trading as Clonebased, "we", the processor) and you, the Builder who publishes a clone on Clonebased (the controller), whenever that clone's students use it. It is part of the Terms of Service, which you accept when you create your account.

1. Roles and scope

• You are the controller of the personal data of the students you give access to a clone: the logins you issue (each username, and any label you type, such as a first name or an email address the creator gave you) and what students send to the clone. Where you run the clone for a creator and the students are the creator's, you act for the creator in deciding who has access, and you are responsible for having their agreement to do so (see the Terms).
• We are your processor: we store students' logins, check their sign-ins, and send their messages to the AI provider to answer them. We process students' data only for these purposes.
• For your own account data (your email, billing records, your AI key), we remain the controller — see the Privacy Policy.
• What we don't hold. Students' conversations live on their own devices, in their browsers. We do not store the questions or the answers, and nobody — you, the creator or us — can read them through Clonebased.

2. Your instructions

We process students' data only on your documented instructions, which are: keep the logins you issue, renew or delete them when you do, let a student sign in with one, and answer their questions with the clone you built. To answer, a student's message, the conversation so far and the relevant course excerpts are sent to the AI provider — under your own Anthropic account and key for a Pro Builder's clone — and the answer is returned to the student's device. We never use students' data for advertising, profiling, or training, and we never sell it.

3. Confidentiality and security

Everyone we authorise to process students' data is bound by confidentiality. We apply the technical and organisational measures described in the Privacy Policy: encryption in transit and at rest, a one-way hash of every password (never the password itself), access controls and row-level security on stored data, and a limit on failed sign-ins. Privileged database access runs server-side only and is never exposed to browsers.

4. Sub-processors

You authorise the sub-processors listed in the Privacy Policy. If we add or replace one, we update that list. Continuing to use Clonebased after an update constitutes acceptance. Sub-processors are bound by terms no less protective than this DPA. For a Pro Builder's clone, students' messages go to Anthropic under your own account, so Anthropic's terms with you apply to them.

5. Assistance

Taking into account the nature of the processing, we assist you with your controller obligations through your dashboard: every login a clone has is listed in its Students section, with its label, which answers a student's request for access; there you can delete a login, which stops it working at once and removes its label. Deleting the clone, or your account, deletes all of its logins. If a student asks us directly, we redirect them to whoever gave them their login.

6. Personal data breach

If we become aware of a personal data breach affecting your students' data, we will notify you without undue delay at your account email with the information reasonably available to us.

7. Retention and deletion

• A login expires one month after it was issued or renewed. It can be renewed for 30 days after that, and is then deleted with its hash, automatically.
• A login you delete stops working at once and loses its label; its username and hash are kept for at most 30 days, only so its student is told their access has ended, and are then deleted.
• A clone's logins are deleted with the clone: when you delete it or your account, and otherwise 30 days after your subscription ends.
• A failed sign-in leaves a keyed one-way hash of the IP address and of the username tried, kept no longer than a day. A student's usage allowance counter is removed after two days unused.

8. Audit

On written request (no more than once per year), we will provide the information reasonably necessary to demonstrate compliance with this DPA.

9. Legal framework

This DPA is governed by the law of England and Wales and is intended to satisfy Article 28 UK GDPR. If any conflict arises between this DPA and the Terms of Service, this DPA prevails for students' personal data.

Contact

Questions? Email hello@clonebased.com.

Clonebased is a product of ApeTec Ltd, registered in England and Wales, company number 17065917. Registered office: 124–128 City Road, London EC1V 2NX.