Data Processing Agreement

Processor: Lukas Buck, Dorfstraße 11, 72660 Beuren, Germany (SixSentences_). Controller: the customer who owns the workspace and decides which content is processed and why. SixSentences_' own controller processing for accounts, billing, the website, the waitlist and service-usage metadata is described in the Privacy Policy and is outside this DPA.

The processing covers hosting and storage of customer content, text extraction from documents and photos, transcription and analysis of interview audio, direct streaming of live-interview audio between a participant browser and Google Gemini Live, continuation of the same active interview across connection rotations, surveys and responses, AI-assisted search, screening, writing and figure generation, Browser Capture, the Companion and exports. Processing is solely for providing those features. This DPA runs while the account exists and ends with deletion, subject to section 9.

Data can include uploaded documents, source photos, research files, interview audio and transcripts, technical connection data generated by a participant browser during a live interview, survey responses and optional participant labels, reviewer comments, and names or contact details contained in those materials. Data subjects can include interview participants, survey respondents, persons mentioned in source material, authors, reviewers, collaborators and others whose data appears in customer content. The customer determines the concrete content and legal basis. OpenRouter's standard DPA does not contemplate Sensitive Data or GDPR Art. 9 categories unless expressly amended. The customer must not send such content through an OpenRouter-routed feature until the required amendment and an appropriate route are confirmed.

SixSentences_ processes workspace content only on documented instructions: this DPA, the customer's use and configuration of the Service, and the feature and model selected for an AI request. OpenRouter may dynamically select an eligible downstream endpoint for general AI requests, so a model selection does not always identify the legal entity operating that endpoint. Optional live web search is an exception and is pinned exclusively to the Perplexity Sonar route identified in section 7. Additional instructions can be sent in text form to hello@sixsentences.com. SixSentences_ will inform the customer without undue delay if an instruction appears unlawful and may suspend it pending clarification. Workspace content is not used for SixSentences_' own purposes or to train models.

Only persons bound to confidentiality may process workspace content. Any future employee or contractor will be bound in writing before access. SixSentences_ accesses content only where technically unavoidable for operation, legally required, or explicitly requested by the customer, for example for support.

Measures under Art. 32 GDPR include: hosting in German Hetzner data centres under an Art. 28 agreement; TLS in transit; salted PBKDF2 password hashes and SHA-256 API-token hashes; application-layer workspace isolation; interactive authentication for administration and least-privilege production access; locally encrypted disaster-recovery backups in a private Backblaze B2 EU Central bucket in Amsterdam with up to 14 daily, 8 weekly and 12 monthly snapshots; short-lived server logs, typically no longer than 14 days; and self-service export and deletion. Measures may evolve without reducing the agreed protection level.

The customer gives general written authorization for:

• Hetzner Online GmbH, Germany, for hosting and stored content.
• IONOS SE, Germany, for transactional-email transport.
• Backblaze, Inc., USA, for client-side encrypted disaster-recovery backups in EU Central (Amsterdam), under its DPA, SCCs and stated EU-US DPF participation.
• Google Cloud EMEA Limited, Ireland, with Google affiliates and processors, for paid Gemini figure, transcription, photo and live-voice processing. In an AI-led live interview, the participant browser streams audio directly to the Gemini Live API. Session resumption is configured only to continue that same active interview across Google's periodic connection rotation. Google states that generating a resumption handle can retain the related conversation state, including audio and text, for up to 24 hours. This live-resumption route is therefore not a Zero Data Retention path, and a transcript-only workspace setting does not shorten that provider-side period. Paid EEA processing is governed by the applicable Google processor terms, and Google states that prompts and responses are not used to improve Google products. Separately from the live-resumption state described above, the terms for Paid Services state that Google logs prompts and responses for a limited period that those terms do not specify, solely to detect and prevent prohibited use, maintain service safety and security, and make required legal or regulatory disclosures. For a live interview, this may include submitted audio or text and generated responses. Google states that this data may be stored transiently or cached in any country in which Google or its agents maintain facilities.
• OpenRouter, Inc., USA, as an AI gateway, including Perplexity AI, Inc., USA, as the exclusively selected downstream operator for optional live web search. OpenRouter's DPA includes the EU Standard Contractual Clauses, Module Two, and identifies US Google Cloud regions for its standard service; no EU inference endpoint is promised for this route. General AI requests can be routed among eligible endpoints. Live web search is instead pinned to perplexity/sonar, without provider fallback. Only a server-scrubbed, minimized search query is transmitted: account details, uploaded files, source full text, transcripts and manuscripts are not included. The generated Sonar answer is discarded after SixSentences_ extracts source metadata such as title, URL, snippet and publication date. Every request sets data_collection=deny and Zero Data Retention; under those route controls, prompt and response content may not be retained or used for provider training. The request fails if the pinned ZDR route is unavailable. Technical usage metadata can remain available for billing and operations. This route is not authorized for Sensitive Data, GDPR Art. 9 categories or confidential personal data; OpenRouter's standard DPA does not cover such use unless expressly amended.

AI sub-processors receive only the material needed for the triggered request, not the account profile. Additions or replacements under SixSentences_' direct control are announced to active customers in advance with a reasonable opportunity to object on data-protection grounds. OpenRouter excludes dynamic AI Model Providers from its ordinary 30-day sub-processor notice, so no fixed notice period is promised for a dynamically selected endpoint. The optional web-search route is not dynamic and may not be replaced silently. If an affected provider is unacceptable, the customer must not use it and may terminate the affected processing if no reasonable alternative exists. No provider may receive customer personal data until the required Art. 28(4) terms and transfer safeguards are active; a public privacy notice alone is insufficient.

Taking account of the nature of processing, SixSentences_ assists with data subject rights and Art. 32-36 duties. Content can be inspected, exported and deleted through the Service. Requests received directly are forwarded to the controller without undue delay. A personal-data breach affecting customer content is reported without undue delay with Art. 33(3) information as it becomes available.

During the agreement, the customer can export and delete content or the whole account. At the end, at the customer's choice, SixSentences_ makes personal data available in a supported export format and then deletes remaining copies, or deletes without return. A legally required retained copy is disclosed where permitted and isolated. Active-system deletion is immediate in the ordinary workflow. Encrypted disaster-recovery copies expire under the 14 daily, 8 weekly and 12 monthly rotation, and a deletion ledger prevents silent restore. A Gemini Live resumption state expires under Google's stated maximum 24-hour period; deleting or choosing not to retain a SixSentences_ recording does not promise earlier deletion of that separate provider state. Separately, Google retains the Paid Services abuse-monitoring prompt and response logs for the limited period described in its terms, which do not specify a duration; deleting workspace content does not promise earlier deletion of those provider logs.

SixSentences_ provides information necessary to demonstrate Art. 28 compliance, initially through this DPA, the Privacy Policy and written answers. It permits and contributes to reasonable customer or mandated-independent-auditor audits. Scope, timing and security are coordinated on reasonable notice. Current reports may be used first where sufficient but do not replace a reasonably necessary inspection. Shorter notice or additional audits remain possible where required by an authority, after a breach or on credible material non-compliance. Auditors must protect confidentiality and follow reasonable security requirements.

Active workspace content is stored in Germany; encrypted disaster-recovery snapshots are stored in Amsterdam. Transfers can occur to the US providers in section 7 under the safeguards stated there and only when the relevant feature is used. OpenRouter's standard DPA describes US hosting and includes the EU Standard Contractual Clauses, Module Two; no EU endpoint is promised for the OpenRouter and Perplexity Sonar route. Google states that the abuse-monitoring prompt and response logs described in section 7 may be stored transiently or cached in any country in which Google or its agents maintain facilities. The temporary Gemini Live resumption state can likewise be processed outside the EEA. The applicable Google terms and DPA govern this processing; SixSentences_ does not promise a specific processing location for either path. Copies of applicable SCCs can be requested from the provider or SixSentences_.

The customer ensures a legal basis, including Art. 9 where applicable; gives Art. 13/14 notices; keeps survey and interview disclosures accurate; and obtains consent before recording conversations as required by § 201 StGB. The live interviewer consent step supports this; prior recordings require prior consent. Information for an AI-led live interview must cover direct Google audio processing, the possible provider-side retention of resumption state for up to 24 hours, and the separate Paid Services logging of prompts and responses for a limited, unspecified period with possible transient storage or caching in any country where Google or its agents maintain facilities. The customer must not include Sensitive Data, Art. 9 data or confidential personal data in a live-web-search query.

Liability follows Art. 82 GDPR and the general agreement. This DPA prevails for workspace-content processing. German law applies. Invalid provisions do not affect the remainder and are replaced by the closest lawful provision. Material changes are announced in advance like sub-processor changes. The version and effective date identify the applicable text.