Data Processing Agreement
Enterall Data Processing Agreement
Effective date: November 5, 2026
This Data Processing Agreement (DPA) applies when Enterall processes personal data on behalf of a customer under the Terms of Service or another agreement with Enterall, Inc. (“Enterall”). It consists of this cover page and the Common Paper DPA Standard Terms Version 1.1, which are incorporated by reference without modification. The EU Standard Contractual Clauses (Module 2 and Module 3) and the UK Addendum apply to restricted transfers as set out in those Standard Terms.
The DPA forms part of the Agreement automatically. To receive a countersigned copy, email hello@enterall.co.
Key terms
| Agreement | The Enterall Terms of Service, or the order form or master agreement signed between Customer and Enterall, Inc. |
|---|---|
| Provider | Enterall, Inc., a Delaware corporation, 131 Continental Dr, Suite 305, Newark, DE 19713, USA |
| Approved Subprocessors | The subprocessors listed at enterall.co/subprocessors. |
| Provider Security Contact | hello@enterall.co |
| Security Policy | The technical and organisational measures at enterall.co/legal#security. |
| DPA Liability Cap | Not separately selected. The limitation of liability in the Agreement applies. |
| Governing Law and Chosen Courts | Not separately selected. The governing law and courts in the Agreement apply. |
| Service Provider Relationship (CCPA) | Applies. Enterall acts as a service provider for California personal information. |
| Governing Member State (EEA transfers) | Denmark |
| Governing Member State (UK transfers) | England and Wales |
| EU representative (GDPR Article 27) | Enterall ApS, CVR 46828828, Nikolajgade 17, 4. th, 1068 København K, Denmark |
Description of processing
| Categories of data subjects | Customer’s authorized users (employees and contractors); collaborators and guests invited to Customer’s boards; people who appear in or are named in Customer Content. |
|---|---|
| Categories of personal data | Account data (name, email address, user ID, authentication metadata); Customer Content (boards, documents, comments, uploaded and generated images and video, AI prompts and outputs); collaboration metadata; usage and device data (IP address, browser, product events, consented session replay); support communications; billing contact details. Card data is handled by Stripe. |
| Special category data | None intended. The service is not designed for special category data and Customer should not upload it. |
| Frequency of transfer | Continuous for the term of the Agreement. |
| Nature and purpose of processing | Hosting and storage; real-time collaboration; AI processing of Customer Content at users’ direction (generation, editing, analysis, search); thumbnails and previews; transactional email and push notifications; security, abuse prevention, and troubleshooting; support; aggregated product analytics. |
| Duration of processing | As set out in the Standard Terms. |
Security measures and subprocessors
Enterall's technical and organisational measures are described in the Security Policy, and retention in the Retention and Deletion Policy. Approved subprocessors, their tasks, and locations are listed on the subprocessors page.
Common Paper DPA Standard Terms Version 1.1 are free to use under CC BY 4.0.