1. Definitions and roles
“Personal data,” “processing,” “controller,” “processor,” “data subject,” and “personal data breach” have the meanings given to them in the EU General Data Protection Regulation (GDPR) and the UK GDPR. “Customer Personal Data” means personal data contained in the data you or your users submit to, or generate through, the Services.
- You are the controller. You decide what Customer Personal Data goes into the Services, why it is there, and what your Modules do with it. You are responsible for having a lawful basis for that processing and for the accuracy of the data you provide.
- We are the processor. Raileon processes Customer Personal Data only to provide the Services, on your instructions, as described in this DPA.
- We are a controller for our own account data. For the information we need to run Raileon as a business (account registration details, authentication records, billing and payment records, support correspondence, and product usage telemetry), we act as an independent controller. That processing is governed by our Privacy Policy, not by this DPA.
Where this DPA refers to your rights and our obligations, those apply to all Customers regardless of location. Rather than gating protections by geography, we extend the GDPR- and UK GDPR-shaped commitments in this DPA to every Customer.
2. Details of the processing
Annex-style detail of what we process and why, as required by GDPR Art. 28(3):
| Subject matter | Provision of the Raileon platform and the AI Modules you configure on it. |
|---|---|
| Duration | For the term of your Service Agreement, plus the 7-day export window described in Section 10. |
| Nature of processing | Storage, retrieval, transmission, structuring, analysis, generation of text and other output, sending of messages and email on your behalf, backup, and deletion. |
| Purpose | Running the workflows and Module tasks you configure, operating and supporting your dedicated instance, and meeting our obligations under the Service Agreement. |
| Categories of data subjects | Your personnel and authorized users; your clients and prospective clients; your suppliers and other contacts; and any individual whose personal data appears in content you connect or upload. |
| Categories of personal data | Identification and contact details; employment and role information; the content of emails, messages, documents, notes, and files you connect or upload; integration metadata; and any other personal data you choose to submit. The Services are not designed around special-category data, but customers in regulated professions will handle some. Where you submit special-category data (GDPR Art. 9) you warrant that you have an Art. 9(2) condition for doing so and, for criminal-offense data, the authorization Art. 10 requires; we will process it under the measures in Section 5. Health information and payment card data are excluded: the Acceptable Use Policy prohibits them and Raileon signs no Business Associate Agreement. |
3. Processing on documented instructions
We process Customer Personal Data only on your documented instructions. Your instructions are: the Service Agreement, this DPA, the configuration you set in the platform (Modules, workflows, prompts, connected integrations, and settings), and any further written instruction you give us. We will not process Customer Personal Data for our own purposes, and we will not use it to train AI models, unless you hire us to train your own model. Then it is trained only for you, runs on your systems, and you own it. The commercial terms of the AI provider behind Raileon-managed AI prohibit it from training models on customer content. If you connect your own AI provider account, your own terms with that provider govern whether it may train on that data. We have not configured zero data retention, so a provider may keep API data for a limited period under its own policies.
If we are required by law to process Customer Personal Data beyond your instructions, we will tell you before doing so unless the law forbids that notice. If we believe an instruction from you infringes GDPR, UK GDPR, or another applicable data protection law, we will tell you promptly and may pause the affected processing until the issue is resolved.
4. Confidentiality
Access to Customer Personal Data is limited to Raileon personnel who need it to operate or support the Services. We will ensure that everyone we authorize to access Customer Personal Data is bound by a duty of confidentiality, by written agreement or by law, before they are given access. Access is granted on a need-to-know basis and removed when it is no longer needed.
5. Security measures
We implement appropriate technical and organizational measures under GDPR Art. 32. The measures actually in place are:
- Per-customer isolation. Each Customer runs in a dedicated container on shared host infrastructure, using a gVisor sandboxed runtime, a per-customer network, an encrypted volume, a read-only filesystem, a custom seccomp profile, and a non-root user. Records in our shared application database are logically separated by workspace and access-checked; containers and encrypted volumes are per Customer.
- Encryption. TLS 1.2 or higher in transit. At rest, each Customer's instance volume is encrypted at the disk level; integration credentials are encrypted with a separate key per workspace (Fernet: AES-128-CBC with HMAC-SHA256); data held by our database and storage providers is encrypted at rest under those providers' own security programs; and backups are encrypted with our own key before they leave our systems.
- Backups. Daily encrypted backups of each Customer's instance, plus a daily encrypted snapshot of the application database that covers all Customers together. They are stored separately from the live instance and expire on a rolling schedule set by Raileon.
- Access control. Authenticated, role-based access for your users; need-to-know administrative access for our personnel; secrets held in environment configuration rather than in code. When our personnel open a Customer workspace through the support tool, the start and end of that session are recorded.
- Monitoring. Application logging and error monitoring, used to detect and diagnose faults and suspicious activity.
Full detail, including what we do not have, is on our security page. In short: we hold no SOC 2 report, no ISO 27001 certification, no third-party penetration test report, and we do not offer a HIPAA Business Associate Agreement. If your compliance program requires any of those, tell us before you buy.
6. Sub-processors
You give us general written authorization to engage sub-processors to help deliver the Services. The current list, with the purpose of each one, is maintained at raileon.com/subprocessors.
- Written terms. Every sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA.
- Advance notice. Before we add or replace a sub-processor, we will update the sub-processors page and give you at least 30 days' notice by email to your account contact.
- Right to object. If you have a reasonable, data-protection-based objection, tell us within the notice period at privacy@raileon.com. We will work with you to find an alternative. If we cannot, you may terminate the affected Services without penalty and receive a pro-rated refund of prepaid fees for the period after termination, excluding the setup fee.
- Our liability. We remain fully liable to you for the acts and omissions of our sub-processors as if they were our own.
- Client-selected providers. If you choose to connect your own account with an AI provider under Settings → AI provider, that provider processes Customer Personal Data under your own agreement with it, not this DPA. You are responsible for that agreement, including the provider's data protection and retention commitments, and that provider is not our sub-processor for purposes of this Section, so no advance notice applies to it. The sub-processors page lists it for transparency only. We remain the processor for what this DPA otherwise covers: storing your API key in encrypted credential storage, and transmitting Customer Personal Data to the account you connected, on your instruction, without retaining it ourselves beyond the usage metadata described in our Privacy Policy.
7. Assistance with data subject requests
You can export your workspace data at any time from the dashboard. For requests we have to answer from our side, email privacy@raileon.com and we will assist you within 10 business days, so you can respond within your legal deadlines. There is no per-person lookup tool in the dashboard, so we assist with those requests directly.
The self-serve export covers your account and billing details, usage and activity logs, Module conversations and channel transcripts, Module memory and configuration, your contacts and their interaction history, support tickets, and your team roster. Uploaded files are included in the ZIP download (up to 100 MB in total); the JSON export lists them without their contents. Stored integration credentials and other secrets are never exported.
If a data subject contacts us directly about Customer Personal Data, we will not respond on your behalf beyond acknowledging receipt. We will forward the request to your account contact within 10 business days. Reach us for this at privacy@raileon.com.
8. Personal data breach notification
If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 72 hours of becoming aware of it. The notification will include, to the extent known at the time:
- the nature of the breach and the data and data subjects affected;
- the likely consequences;
- the measures we have taken or propose to take to address it and mitigate harm;
- a contact point for further information.
Where we cannot provide all of that at once, we will send what we have and follow up as the investigation develops. We will also help you meet your own notification duties to regulators and data subjects. Notifying you is not an admission of fault. Security matters can be reported to us at security@raileon.com.
9. Data protection impact assessments
On request, we will give you reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority that relates to your use of the Services. In practice this means supplying the information we hold about our processing, security measures, and sub-processors: information that is largely already published on this page, the security page, and the sub-processors page.
10. Deletion or return on termination
When your Service Agreement ends, you have 7 days to export your data. Your Modules stop running, but we keep your data available for export during that window (Settings → Privacy & data → Export your data in your dashboard, for account admins) and will help you extract data you cannot retrieve yourself.
- After the 7-day window closes, your instance and its associated data are permanently deleted.
- Backups are encrypted and expire on a rolling schedule set by Raileon; deleted personal data can remain in them until they expire, and they are not restored or accessed in the meantime except to recover from a failure.
- We retain billing and account records where tax, accounting, or other law requires it, and we may retain anonymized aggregate data that cannot identify you or any data subject.
- If you need deletion certified in writing, ask at privacy@raileon.com.
11. Audits and information rights
We will make available the information reasonably necessary to demonstrate compliance with this DPA. Audits are conducted remotely, by questionnaire and interview. What we offer:
- the documentation published at /security, /subprocessors, and /privacy;
- written responses to a security or data protection questionnaire, once per twelve-month period, within 30 days of your request;
- a call with an engineer to walk through architecture and controls where the questionnaire leaves something unclear;
- additional information where a supervisory authority specifically requires it.
Where a supervisory authority specifically requires an on-site inspection, we will accommodate one on 30 days' written notice, at the Customer's cost, no more than once in any twelve-month period, during business hours, and subject to reasonable confidentiality and security conditions that protect our other customers' data. If those measures are otherwise insufficient for your regulatory obligations, contact privacy@raileon.com and we will discuss what else is workable.
12. International transfers
Raileon is based in the United States. Our sub-processors process Customer Personal Data in the United States and in other countries where they operate, as stated on the sub-processors page. We do not offer regional data residency.
Where you transfer personal data subject to EEA, UK, or Swiss data protection law to us, the following are incorporated into this DPA by reference and take effect on transfer:
- EEA: the European Commission Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), with you as data exporter and SkyRaileon LLC as data importer. Docking is permitted; the governing law and forum are those of Ireland; the appendices are populated by Sections 2, 5, and 6 of this DPA and by the sub-processors page.
- United Kingdom: the UK Information Commissioner's International Data Transfer Addendum to the Standard Contractual Clauses, Approved Addendum version B1.0, with UK law and UK courts governing. In Table 4, neither party may end the Addendum when the ICO issues a revised version. The Addendum's annexes are mirrored from the SCC annexes in Sections 2, 5 and 6 and the sub-processors page.
- Switzerland: the Standard Contractual Clauses as adapted by the Swiss Federal Data Protection and Information Commissioner, with references read to include the Swiss FADP.
Where the Clauses conflict with the rest of this DPA on a transfer matter, the Clauses win.
13. Order of precedence
This DPA is incorporated into the Service Agreement. If documents conflict, the following order applies: the Order Form, for fees, scope and term only; this DPA, for the processing of personal data only; the Service Agreement; the Acceptable Use Policy; and then the Terms of Service and other website policies. If there is a conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail. Nothing here changes the liability caps, governing law, or dispute resolution terms in the Service Agreement, except as the Clauses require.
We may update this DPA. A change that reduces a signed Customer's rights takes effect for that Customer only on 30 days' written notice by email, and never overrides the signed Service Agreement. This DPA is governed by the law stated in the Service Agreement. SkyRaileon LLC is a Florida limited liability company.