Last updated: October 11, 2026
Scope
This Data Processing Addendum (“DPA”) is part of the agreement between Coline Technologies, Inc. (“Coline”) and the customer that has accepted the Coline Terms of Service or signed another agreement for Coline (“Customer”). It applies when Coline processes personal data on Customer’s behalf to provide Coline (“Customer Personal Data”). It takes effect when Customer accepts the agreement, without a separate signature. For a countersigned copy, email legal@coline.app.
If this DPA conflicts with the agreement, this DPA controls for the processing of Customer Personal Data.
Roles
Customer is the controller, or a processor acting for its own controllers, and Coline is its processor or subprocessor. Under the CCPA, Coline is Customer’s service provider. Coline is an independent controller of the account, billing, security and usage data it processes to run its business, as described in its Privacy Policy.
Details of processing
Subject matter and duration. Providing Coline under the agreement, for the term of the agreement and the deletion period below.
Nature and purpose. Hosting, storing, transmitting, indexing and searching data, running AI features, providing support, and other processing needed to provide and secure Coline as Customer instructs.
Data subjects. Customer’s users, and people whose personal data appears in Customer’s content, such as employees, contractors, customers, email correspondents and call participants.
Categories of data. Contact and identity details, account information, and any personal data in workspace content, such as messages, files, emails, calendar events, call recordings, code, and AI prompts and output. Customer decides what it uploads. Coline isn’t designed for special categories of personal data, and Customer shouldn’t upload them unless it needs to and is allowed to.
Frequency. Continuous.
Coline’s obligations
Coline will:
process Customer Personal Data only on Customer’s documented instructions, which are the agreement, this DPA, and Customer’s use and configuration of Coline, unless the law requires otherwise, in which case Coline will tell Customer first unless the law forbids it;
tell Customer if it believes an instruction infringes data protection law;
make sure everyone authorized to process Customer Personal Data is bound by confidentiality;
not sell or share Customer Personal Data, not use it outside the direct business relationship with Customer, including to train AI models, and not combine it with other data except as the CCPA allows;
maintain the security measures described below;
help Customer respond to requests from data subjects, mainly through Coline’s features, taking into account the nature of the processing;
help Customer with data protection impact assessments and consultations with regulators, where the law requires and to a reasonable extent;
make available the information needed to show compliance with this DPA, and allow audits as described below.
Subprocessors
Customer authorizes Coline to use the subprocessors listed at coline.app/subprocessors. Coline will bind each subprocessor to data protection terms at least as protective as this DPA and remains responsible for its subprocessors’ performance.
Coline will update the list at least 30 days before a new subprocessor starts processing Customer Personal Data. Customer can object on reasonable data protection grounds by emailing privacy@coline.app within that period. If we can’t resolve the objection, Customer may end the affected service and receive a refund of fees prepaid for the rest of the term.
Security
Coline maintains technical and organizational measures appropriate to the risk, including:
encryption in transit with TLS, and encryption at rest by our storage providers;
encryption or hashing of secrets, credentials, API keys and tokens;
authentication, role-based workspace permissions, and permission checks on every request;
isolation of customer code in sandboxes with restricted network access;
least-privilege staff access to production systems;
logging, monitoring and rate limiting to detect and stop abuse;
regular backups of the primary database.
Personal data breaches
Coline will notify Customer without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, its likely consequences, and the measures taken or proposed, to the extent that information is available. A notice isn’t an admission of fault.
International transfers
Coline may process Customer Personal Data in the United States, Canada and other countries where Coline or its subprocessors operate.
For transfers of personal data from the EEA to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), which are incorporated by reference: Module Two (controller to processor) or Module Three (processor to processor), as applicable. Clause 7 applies. Option 2 of Clause 9 applies, with the notice period in this DPA. The optional wording in Clause 11 doesn’t apply. Clauses 17 and 18 are governed by the law and courts of Ireland. Annexes I and II are completed by the “Details of processing” and “Security” sections of this DPA.
For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies. For transfers from Switzerland, the SCCs apply with references read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
Audits
Coline will answer a reasonable written security and privacy questionnaire once a year. If the answers don’t reasonably show compliance, or a regulator requires it, Customer may audit Coline’s compliance with this DPA: with 30 days’ notice, during business hours, at Customer’s cost, no more than once a year, under confidentiality terms, and without access to other customers’ data.
Deletion and return
Customer can export and delete Customer Personal Data with Coline’s features during the term. After the agreement ends, Coline will delete Customer Personal Data within 90 days unless the law requires us to keep it. Copies in backups are deleted as the backups expire.
Liability
Each party’s liability under this DPA is subject to the limitations of liability in the agreement.
Questions about this DPA
Email privacy@coline.app with questions about this DPA, or legal@coline.app for a countersigned copy.