Data Processing Addendum

Effective date: October 13, 2026
Last updated: October 13, 2026

This Data Processing Addendum ("DPA") is between Trigi Inc., a Delaware corporation ("Trigi," the processor), and the organization that holds the Trigi account ("Customer," the controller). It covers Customer Content that Trigi processes on the Customer's behalf to provide Trigi.

Mailing address: 2017 Creekview, Seguin, TX 78155. Questions: privacy@trigi.ai.

Trigi's handling of account and website information, where Trigi is the controller, is described in the Privacy Policy. This DPA does not change that role.

1. Scope, nature, and purpose

  • Scope. This DPA applies to Customer Content the Customer uploads or connects, and to the quotes, atoms, themes, and other material Trigi derives from it, for as long as the Customer uses Trigi and through the deletion timelines below.
  • Nature of the processing. Trigi hosts, stores, retrieves, analyzes, and deletes Customer Content.
  • Purpose. Trigi processes Customer Content only to provide Trigi to the Customer, on the Customer's instructions, including this DPA and the way the Customer configures the service. That includes turning conversations into quotes, atoms, and themes, and showing them in the app and through the API and connectors the Customer sets up.
  • Data categories. Conversation transcripts and files; CRM records the Customer connects; prospect lists; names, job titles, and companies of people on those records; quotes, atoms, themes, summaries, and embeddings; and company context taken from public sources.
  • Data subjects. The Customer's users, and the people named in the Customer's conversations and CRM records, such as buyers and prospects.

2. Confidentiality of personnel

Trigi limits access to Customer Content to people who need it to provide the service. Those people are bound by a duty of confidentiality.

3. Security

Trigi uses the safeguards in section 8 of the Privacy Policy:

  • Workspace isolation enforced in the database itself, so each workspace can reach only its own data
  • Encryption in transit (TLS) and at rest, plus additional application-level encryption for stored integration credentials
  • A private database network with no public internet access
  • Hashed, scoped, rate-limited, revocable API keys with audit logging
  • Sign-in throttling and session revocation
  • Least-privilege access for our own systems and staff

4. Subprocessors

Trigi uses the subprocessors listed in the subprocessor table. The same table is published at /subprocessors.

Trigi will give the Customer advance notice before adding or replacing a subprocessor. The Customer may object on reasonable grounds related to data protection. If the objection cannot be resolved, the Customer may stop using the part of the service that depends on that subprocessor.

5. Personal data breaches

Trigi will notify the Customer of a personal data breach that affects Customer Content without undue delay and within 72 hours of becoming aware of it. The notice will include the information Trigi has that the Customer reasonably needs to meet the Customer's own notice duties.

6. Data subject requests

Taking into account the nature of the processing, Trigi will help the Customer respond to requests from data subjects. If a person contacts Trigi about Customer Content, Trigi will pass the request to the Customer and help the Customer respond.

7. Deletion or return

When the service ends, Trigi will delete Customer Content or return it to the Customer, at the Customer's choice, and then delete remaining copies, on the timelines in section 9 of the Privacy Policy. Those timelines include:

  • Free-trial data is deleted 90 days after the trial ends.
  • Canceled-account data is kept 90 days, then deleted.
  • Customer Content is deleted when the Customer deletes it, or within 30 days after the workspace is closed.
  • Deleted data is removed from backups within 35 days as backups expire.

Trigi may keep information it is required to keep by law, such as billing records for tax purposes.

8. Audits and information requests

Trigi will make available the information reasonably needed to show that it complies with this DPA. Trigi will allow for and contribute to audits and written information requests that the Customer reasonably makes for that purpose. The Customer will give reasonable notice, keep the request to what compliance requires, and protect Trigi's confidential information.

9. International transfers

Trigi hosts the service in the United States. Where a transfer of personal data from the European Economic Area, Switzerland, or the United Kingdom needs a transfer tool, the parties incorporate the following by reference:

  • The Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor). The Customer is the data exporter and Trigi is the data importer. The description of the processing in this DPA, and sections 7, 8, and 9 of the Privacy Policy, complete the annexes.
  • The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (the UK Addendum), for transfers from the United Kingdom.

10. Order of precedence and governing terms

If this DPA conflicts with the rest of the agreement between the Customer and Trigi about the processing of Customer Content, this DPA controls. The rest of that agreement governs every other subject. This DPA is governed by the same law and the same courts as that agreement.