Data Processing Agreement
Last updated: June 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you and Beijing Zhisuan Cube Technology Co., Ltd., registered in China as Beijing Zhisuanlifang Keji Youxian Gongsi ("PersonWise"), for personwise.ai.
1. Scope and roles
This DPA governs personal data processed through the Service. PersonWise is the controller for data it collects directly from account holders (account, billing, and usage data). Where a Team customer uploads materials or enrolls learners, that customer is the controller of the resulting learner data and PersonWise acts as a processor on the customer's documented instructions.
2. Subject-matter and duration
PersonWise processes personal data to provide the Service for the duration of your account, and afterwards only as required to meet legal obligations before deletion or anonymization.
3. Categories of data
- Account data: name, email, and identity-provider profile basics.
- Content data: materials you upload and the courses you generate.
- Learner data: session progress, voice questions, and assessment responses.
- Technical data: logs, device, usage information, and technical error diagnostics.
4. Sub-processors
We engage a limited set of sub-processors, each under its own data-processing terms:
- Paddle or Dodo Payments — payment merchant of record (subscription billing); the active processor depends on the final merchant-of-record selection.
- Supabase — authentication and database hosting, in the Singapore region.
- Alibaba Cloud — cloud infrastructure, object storage, and GPU rendering, hosted in the Singapore region.
- DashScope International — AI model providers (generation, voice, and Q&A).
- Sentry — EU error monitoring for technical diagnostics only.
- PostHog — consent-gated product analytics and privacy-masked session replay for product diagnostics.
We will give notice of changes to this list and remain responsible for our sub-processors' compliance.
Sentry diagnostics exclude course materials, prompts, transcripts, generated answers, and replay recordings.
5. Data residency and international transfers
Personal data for personwise.ai is hosted and processed in Singapore, kept separate from mainland China and not transferred there. A limited set of sub-processors (payment, error diagnostics, and analytics) operate in their own regions under data-processing terms, with appropriate safeguards for any transfer.
6. Security
We apply technical and organizational measures appropriate to the risk, including access controls, encryption in transit, and least-privilege service credentials.
7. Assistance with data-subject rights
We assist controllers in responding to data-subject requests — access, correction, export, and deletion — taking into account the nature of the processing.
8. Personal-data breach notification
We will notify affected controllers without undue delay after becoming aware of a personal-data breach, with the information needed to meet their own notification duties.
9. Audit and deletion on termination
On termination, and at the controller's choice, we will delete or return personal data, except where retention is required by law. We make available the information reasonably necessary to demonstrate compliance with this DPA.