Data processing agreement

Last updated: 03.10.2026

This Data Processing Agreement ("DPA") is an addendum to the Service Agreement ("Agreement") between Ruler GmbH ("Tale", "we", "us", "our") and the entity or person accepting the Agreement ("Customer", "you", "your"). It applies whenever Tale processes Personal Data on behalf of the Customer in providing the services. By executing the Agreement, the Customer enters into this DPA on its own behalf and, where Applicable Data Protection Law requires, on behalf of its authorized users and affiliates. This DPA takes effect on the date of the Agreement.

1. Definitions

Capitalized terms not defined here have the meanings set out in the Agreement.

"Applicable Data Protection Law" — the Swiss Federal Act on Data Protection (FADP/nDSG) and its ordinances, the EU General Data Protection Regulation (GDPR), and any other data protection or privacy legislation that applies, as amended or replaced from time to time.

"Controller" — the entity that determines the purposes and means of processing Personal Data. For this DPA, the Customer is the Controller.

"Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data that Tale processes on behalf of the Customer.

"Data Subject" — an identified or identifiable natural person to whom the Personal Data relates.

"Personal Data" — any information relating to an identified or identifiable natural person that Tale processes on behalf of the Customer in connection with the services.

"Processing" — any operation performed on Personal Data, whether or not by automated means.

"Processor" — the entity that processes Personal Data on behalf of the Controller. For this DPA, Tale is the Processor.

"Sub-processor" — any third party Tale engages to process Personal Data on behalf of the Customer. The current list is in Appendix A.

2. Scope and details of processing

2.1 Roles

The Customer is the Controller. Tale is the Processor. Tale processes Personal Data only to provide and maintain the services under the Agreement, and only on the Customer's documented instructions.

2.2 Processing details

2.3 Customer responsibilities

The Customer:

a) has a valid legal basis under Applicable Data Protection Law for the processing of Personal Data and for instructing Tale;

b) has provided all required notices to, and obtained all required consents or authorizations from, Data Subjects;

c) ensures its instructions to Tale comply with Applicable Data Protection Law;

d) is solely responsible for the accuracy, quality, and legality of the Personal Data it submits.

3. Customer instructions

The Customer instructs Tale to process Personal Data to the extent necessary to provide the services under the Agreement. Additional or alternative instructions must be agreed in writing. If Tale concludes that an instruction infringes Applicable Data Protection Law, Tale notifies the Customer promptly and may suspend the affected processing until a lawful instruction is given.

4. Tale's obligations as Processor

Tale:

a) processes Personal Data only on the Customer's documented instructions, including this DPA and the Agreement, unless applicable law requires otherwise (in which case Tale informs the Customer before processing, unless prohibited from doing so);

b) ensures that persons authorized to process Personal Data are bound by confidentiality;

c) implements and maintains the technical and organizational measures set out in Section 7;

d) does not engage any Sub-processor except in line with Section 6;

e) assists the Customer — taking into account the nature of the processing and the information available to Tale — with Data Subject requests (Section 9), data security, breach notification, data protection impact assessments, and prior consultations with supervisory authorities;

f) at the Customer's choice, returns or deletes all Personal Data at the end of the services (Section 13);

g) makes available all information reasonably necessary to demonstrate compliance with this DPA, and contributes to audits (Section 10).

5. AI processing — no use for training or improvement

5.1 No training, fine-tuning, or model improvement

Tale does not use Personal Data — including prompts, inputs, outputs, embeddings, audio payloads, images, or any derived artifacts — to train, fine-tune, evaluate, benchmark, or otherwise improve any AI or machine-learning model, whether Tale's own or any third party's. Personal Data is processed only to deliver the requested output for the specific call.

5.2 Sub-processor obligations regarding training

Each AI Sub-processor listed in Appendix A is contractually bound — via the enterprise or API terms in effect between Tale and that provider — not to use Customer-submitted payloads to train, fine-tune, or improve its models or services. Tale provides evidence of these terms on reasonable written request under Section 10.

5.3 Opt-in — separate written agreement required

Sections 5.1 and 5.2 may only be varied by a separate written agreement signed by both Parties that identifies (a) the scope of Personal Data involved, (b) the permitted training or improvement purpose, (c) the duration, and (d) the safeguards that apply. Continued use of the services, acceptance of updated terms, in-product toggles, or any form of implicit consent do not constitute opt-in.

6. Sub-processors

6.1 General authorization

The Customer grants Tale a general written authorization to engage Sub-processors to process Personal Data. The current list of Sub-processors is set out in Appendix A and mirrored at docs.tale.dev/legal/subprocessors.

6.2 Notification of changes

Tale notifies the Customer at least 30 days before engaging a new Sub-processor or replacing an existing one, by updating Appendix A and the public list, and — where the Customer subscribes to such notifications — by email.

6.3 Right to object

The Customer may object to a new or replacement Sub-processor in writing within 30 days of notification, on reasonable data protection grounds. Tale then uses commercially reasonable efforts to offer an alternative. If no resolution is reached within 30 days of the objection, either Party may terminate the affected services under the Agreement.

6.4 Pass-through obligations and liability

Tale imposes on each Sub-processor, by written agreement, data protection obligations no less protective than those set out in this DPA — including the no-training commitment in Section 5. Tale remains fully liable to the Customer for the performance of each Sub-processor's obligations.

7. Technical and organizational measures

7.1 Security measures

Tale implements and maintains appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, or disclosure, including:

a) encryption of Personal Data in transit and at rest;

b) measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

c) measures to restore the availability of and access to Personal Data in a timely manner after a physical or technical incident;

d) access controls that limit access to Personal Data to authorized personnel on a need-to-know basis;

e) regular testing, assessment, and evaluation of the effectiveness of the measures;

f) physical security measures for data centers and infrastructure;

g) security awareness training for personnel.

7.2 Certifications

Ruler GmbH maintains ISO 27001 certification covering Tale Enterprise and professional services and provides evidence of current certification on reasonable request.

7.3 Updates

Tale may update its security measures from time to time, provided the overall level of protection afforded to Personal Data does not materially decrease.

8. Data breach notification

8.1 Notification to the Customer

Tale notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Data Breach affecting Personal Data processed on behalf of the Customer.

8.2 Content of notification

The notification includes, to the extent then reasonably available:

a) the nature of the Data Breach, including — where possible — the categories and approximate number of Data Subjects and records concerned;

b) the contact details of Tale's point of contact for further information;

c) the likely consequences of the Data Breach;

d) the measures taken or proposed to address it, including measures to mitigate possible adverse effects.

8.3 Cooperation

Tale cooperates with the Customer and takes commercially reasonable steps to assist in investigating, mitigating, and remediating the Data Breach.

8.4 No admission

A notification under this Section is not an admission of fault or liability. The Customer is solely responsible for determining whether the Data Breach triggers notification obligations under Applicable Data Protection Law and for fulfilling them.

9. Data subject rights

9.1 Assistance

Tale assists the Customer — taking into account the nature of the processing — with appropriate technical and organizational measures to respond to Data Subject requests under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, objection).

9.2 Forwarding requests

If Tale receives a request directly from a Data Subject regarding Personal Data processed on behalf of the Customer, Tale forwards the request to the Customer promptly and does not respond directly unless the Customer instructs Tale to do so or applicable law requires it.

9.3 Costs

Where assistance with Data Subject requests requires significant effort beyond what is reasonably expected, Tale may charge the Customer a reasonable fee based on its administrative costs.

10. Audits and inspections

10.1 Audit reports

Tale makes available, on reasonable request and no more than once per year, copies of relevant third-party audit reports or certifications (such as ISO 27001 certificates) to demonstrate compliance with this DPA.

10.2 Additional audits

If the Customer reasonably determines that the information provided under Section 10.1 is insufficient to verify compliance, the Customer may request an additional audit. Such audits are:

a) at the Customer's expense, unless the audit reveals a material breach by Tale;

b) preceded by at least 30 days' written notice;

c) carried out during normal business hours and in a way that minimizes disruption to Tale's operations;

d) conducted by the Customer or by an independent third-party auditor that is not a competitor of Tale and that is bound by appropriate confidentiality obligations;

e) limited in scope to the processing of the Customer's Personal Data.

10.3 Confidentiality of findings

Audit reports, findings, and information obtained through audits are confidential information of Tale and subject to the confidentiality provisions of the Agreement.

11. International data transfers

11.1 Processing locations

Tale hosts the platform and stores Personal Data in Switzerland for Swiss customers and in the European Union for all other customers. AI calls (LLM inference, audio, and image processing) are processed in the European Union/EEA for all customers — no AI Sub-processor Tale engages operates a Swiss processing region. For Swiss customers, that processing relies on the adequacy of EU/EEA countries under Art. 16 FADP (the Federal Council's country list). The place of processing for each Sub-processor is listed in Appendix A. Where the Customer deploys Tale on its own infrastructure (on-premises or private cloud), the Customer determines the processing locations.

11.2 Adequate countries

Tale may process Personal Data in countries recognized by the Swiss Federal Council under Art. 16 FADP, or by the European Commission under Art. 45 GDPR, as providing an adequate level of data protection.

11.3 Safeguards for other transfers

Tale does not transfer Personal Data to countries without an adequate level of data protection unless appropriate safeguards are in place — such as Standard Contractual Clauses approved by the European Commission or recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or another legally recognized transfer mechanism.

11.4 Transparency

The current processing locations and any relevant transfer mechanisms are listed in Appendix A.

12. Confidentiality

Tale treats all Personal Data processed under this DPA as confidential. This obligation survives termination of this DPA and the Agreement. Tale ensures that all personnel with access to Personal Data are bound by appropriate confidentiality obligations.

13. Data retention and deletion

13.1 During the Agreement

Tale retains Personal Data for the term of the Agreement and in accordance with the Customer's documented instructions.

13.2 On termination

On termination or expiration of the Agreement, Tale — at the Customer's written request — either:

a) returns all Personal Data to the Customer in a commonly used, machine-readable format; or

b) securely deletes all Personal Data and provides written confirmation of deletion.

If the Customer does not make a written request within 30 days of termination, Tale deletes all Personal Data within 90 days of termination.

13.3 Legal retention

Where applicable law requires Tale to retain certain Personal Data beyond termination, Tale informs the Customer, limits further processing to what the law requires, and continues to protect the data in accordance with this DPA.

14. Liability

Liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Applicable Data Protection Law. Nothing in this DPA or the Agreement limits or excludes either Party's liability for damages arising from a willful or grossly negligent breach of Applicable Data Protection Law.

15. Relationship with the Agreement

15.1 Precedence

In the event of any conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Personal Data.

15.2 Incorporation

This DPA is incorporated into and forms part of the Agreement. All other provisions of the Agreement remain in full force.

15.3 Severability

If any provision of this DPA is found invalid or unenforceable, the remaining provisions remain in full force.

15.4 Amendments

Tale may update this DPA from time to time to reflect changes in its processing practices or in Applicable Data Protection Law. Material changes are communicated to the Customer in advance. The Customer's continued use of the services after the changes take effect constitutes acceptance of the updated DPA. Changes that vary Section 5 (AI processing — no use for training or improvement) require a separate written agreement under Section 5.3 and never take effect by continued use.

16. Governing law and jurisdiction

This DPA is governed by the substantive laws of Switzerland, excluding its conflict-of-law provisions and the United Nations Convention on Contracts for the International Sale of Goods (CISG). Any disputes arising out of or in connection with this DPA are subject to the exclusive jurisdiction of the competent courts of the Canton of Bern, Switzerland, unless mandatory law requires otherwise.

17. Contact

For any questions regarding this DPA or Tale's processing activities, contact us via our contact form.

Ruler GmbH Seestrasse 4 3700 Spiez Switzerland

---

Appendix A — Sub-processors

This appendix lists the third parties Tale engages to process Personal Data on behalf of the Customer for Tale Cloud — each with its legal entity, registered address, type of service, and place of processing. Self-hosted deployments are operated by the Customer; for those, the Sub-processor list is whichever providers the Customer assembles.

Current Sub-processors

Each name links to that provider's publicly available DPA (or equivalent terms); certifications and trust pages are listed below the tables. Platform hosting follows the Customer's data-residency choice: table A.1 applies to customers in the EU/EEA, table A.2 to Swiss customers. AI calls (LLM inference, audio, and image processing) are processed in the EU/EEA for all customers; they do not leave the EU/EEA and are at no point processed in third countries such as the USA.

A.1 — Customers in the EU/EEA

A.2 — Swiss customers

For Swiss customers, platform hosting stays entirely in Switzerland. The AI Sub-processor does not offer a Swiss processing region; those calls are processed in the EU/EEA. All EU/EEA countries are on the Swiss Federal Council's adequacy list under Art. 16 FADP — the transfer requires no additional safeguards.

Data categories and training prohibition

Certifications and trust pages

Each Sub-processor maintains its own security certifications and publishes them on a trust page:

• Akenes SA (Exoscale) — ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, SOC 2 Type II, PCI DSS v4.0, HDS, BSI C5, TISAX. Trust page: exoscale.com/compliance.
• OpenRouter, Inc. — SOC 2; evidence available through the access-gated trust portal trust.openrouter.ai. EU Standard Contractual Clauses apply to transfers outside the EU/EEA.

Notes

• The AI Sub-processor is engaged only when an AI feature routes a call to it. An organization that uses no LLM inference, audio, or image features sends no data to OpenRouter, Inc.
• Model providers reachable through OpenRouter (such as Anthropic, Google, Meta, Mistral, OpenAI) are upstream providers of OpenRouter and are not Tale's direct Sub-processors. The default audio models — Whisper for speech-to-text and gpt-4o-mini-tts for text-to-speech — are OpenAI models reached this way. They operate under OpenRouter's own contractual terms, which forbid training on routed payloads; in-region routing restricts every call to provider endpoints inside the EU.
• Each Sub-processor engages its own sub-processors (cloud hosting, CDN, secret stores). Those lists are public on the providers' trust pages above; Tale tracks material changes through the same 30-day notice mechanism in Section 6.2.
• Tale Cloud's middleware, application state, and supporting infrastructure run on Exoscale in the Customer's selected region. Each AI call is routed to the provider's EU/EEA region.