Data Processing Addendum

This page summarises bear.ai's Data Processing Addendum ("DPA"), which forms part of the agreement between bear.ai and its business customers and dataset licensees ("Customer"). The full, signable DPA is available on request — email hello@beardata.co.

For how bear.ai handles personal information of RUB players, see our Privacy Policy.

bear.ai anonymises contributor data before it is packaged into a dataset. Datasets are designed not to identify individuals. Where bear.ai processes any personal data on a Customer's behalf, it does so as a processor, acting only on documented instructions and for the purposes set out in the agreement.

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Least-privilege, role-based access with audit logging.
• Quarantined raw data; only scrubbed content reaches the dataset packager.
• Secrets encrypted and rotated; no secrets in source control.
• Documented incident response, with breach notification as required by law.

bear.ai uses a vetted set of sub-processors to deliver the service (including cloud hosting, authentication, and AI model providers). The current list and a mechanism to receive change notices are provided with the signed DPA.

Where personal data is transferred across borders, bear.ai relies on appropriate safeguards, including Standard Contractual Clauses where applicable. We honour applicable data-subject rights under GDPR and CCPA/CPRA.

To request a copy of the full DPA, a security pack, or our sub-processor list, contact hello@beardata.co.