Data Processing Agreement

Article 28 GDPR terms for organisation and institution customers. Effective date: 9 October 2026

1. Scope and roles

This Data Processing Agreement ("DPA") applies whenever you use Scraiber on behalf of an organisation, institution or other legal entity (the "Customer") and personal data of the Customer's members is processed in the Services. It forms part of, and is incorporated into, our Terms of Use. No signature is required: it takes effect when the Customer accepts the Terms of Use. If the Customer requires a countersigned copy for its procurement process, write to [email protected].

For the personal data processed on the Customer's instructions, the Customer is the controller and Scraiber GmbH is the processor within the meaning of Article 4 GDPR. For data we process for our own purposes - billing, security, and operating and improving the Services - we act as an independent controller and our Privacy Notice applies.

2. Subject matter, duration, nature and purpose

We process the personal data for the sole purpose of providing the Services described in the Terms of Use: hosting documents, running the editor and library, enabling real-time collaboration, executing the AI features the user triggers, and providing support. Processing lasts for as long as the Customer's account exists and ends with its deletion.

3. Categories of data subjects and personal data

Data subjects: members of the Customer's organisation who use the Services. Personal data: account data (name, email address, job title, institution, profile picture), authentication data, usage and log data, and any personal data the Customer's members themselves place in documents, uploads or prompts.

4. Instructions

We process the personal data only on the Customer's documented instructions. The Terms of Use, this DPA, and the configuration the Customer chooses in the admin area constitute those instructions. If we believe an instruction infringes data protection law, we will inform the Customer and may suspend the affected processing. Where we are required by EU or Member State law to process beyond the Customer's instructions, we will inform the Customer before processing unless that law prohibits it.

5. AI features

When a member uses an AI feature, the content required for it is sent to the provider of the AI model the member selected (OpenAI, Anthropic, Google or Fireworks AI, as listed in section 8): the prompt, any selected text and, for a rewrite, the full text of the document. Independently of that selection: Google processes the opening of a document (up to 1,000 characters) and the target journal name when a document's field model is chosen automatically, a literature-search query, an assignment brief uploaded before sign-up, and the rewrite prepared from a manuscript staged before sign-up, including the paragraphs re-run after the account is created; Anthropic processes every rewrite preview requested in the editor by a free account; Mathpix processes uploaded images and formulas. Each provider processes this content under its own API terms at the location stated in section 8. Scraiber AI conversations, including prompts, replies and edits held for review, are stored in our database until the member deletes the conversation or the document, or the account is deleted. Diagnostic request traces can include prompts and are used for operating and troubleshooting the Services. Autocompletion sends the text around the cursor through our servers at Amazon Web Services to the sub-processor listed for autocompletion in section 8. We also operate our own autocompletion models on our own servers at Amazon Web Services; at the Customer's written request, its autocompletion runs on those servers in a deployment set up for the Customer, and its input is then not sent to a model provider. Our own domain models are trained only on public preprints from arXiv, bioRxiv, medRxiv, chemRxiv and SSRN held in a separate database; the Customer's documents are not read by that training. A personal model is created only where a member whose seat is covered by the Customer's subscription, or who holds a Scientist subscription, has the personalised autocompletion setting switched on in their account settings; the setting is on by default and the member can switch it off at any time. Text submitted through that member's autocompletion sessions is collected for the personal model while that setting is on. The model is served only to that member's account. Turning the setting off does not by itself erase previously collected text or model files. Account deletion starts background deletion of the collected training text and personal model files. Database backups can retain deleted data for up to 35 days; section 12 describes the contractual deletion obligations.

6. Confidentiality

Every person authorised to process the personal data is bound by a written confidentiality obligation or an appropriate statutory duty of confidentiality, and that obligation survives the end of their engagement.

7. Security of processing

We implement technical and organisational measures appropriate to the risk under Article 32 GDPR. These include encryption in transit and at rest, production databases reachable only from inside our private network, access to the production cluster restricted to allow-listed IP addresses, separate cache credentials for each application service, two organisation roles in the Services, administrator and member, where only administrators manage members, administrators, billing and organisation settings, separated production and development environments, logging and monitoring, product analytics with email addresses and account identifiers scrubbed, and automated backups. A current description of the measures is available on request.

8. Sub-processors

The Customer grants general authorisation for the sub-processors listed below. We impose data protection obligations on each of them that are no less protective than those in this DPA, and we remain fully liable for their performance. We will announce any intended addition or replacement at least 30 days in advance by email to the Customer's administrators. The Customer may object on reasonable data protection grounds within that period; if we cannot accommodate the objection, the Customer may terminate the affected Services without penalty.

9. International transfers

Personal data is processed in the United States, where our hosting runs in the AWS us-east-1 region, and backup copies of stored files are kept in the United Kingdom (London) and Singapore. The sub-processors in section 8 process data at the locations stated there. Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses, together with supplementary measures where required. The Customer authorises us to conclude the Standard Contractual Clauses with sub-processors on its behalf.

10. Assistance with data subject rights

The Customer may send Scraiber requests to access, correct, export or delete personal data processed on its behalf. We will assist the Customer with appropriate technical and organisational measures in responding to requests under Chapter III GDPR. If a data subject contacts us directly, we will refer them to the Customer.

11. Breach notification and assistance

We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, and will provide the information the Customer needs for its own notification duties. We will also assist the Customer with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR.

12. Return and deletion

On termination the Customer may export its data from the Services. We delete the personal data within 30 days of the end of the contract, except where EU or Member State law requires longer retention. Backups are overwritten on their normal rotation and are isolated from further processing until then. Removing a member frees their seat but does not delete their account. A member who deletes their own account, or an invitee who never creates one, leaves an inactive record holding the email address and a technical account identifier. That record keeps its seat until an administrator removes it, and we delete it on the Customer's request or with the other personal data at the end of the contract. An administrator who deletes only their product account keeps an administrator-only account holding their name and email address.

13. Audits

On request we provide the information necessary to demonstrate compliance with Article 28 GDPR. The Customer may audit us, or mandate an independent auditor bound by confidentiality, at most once per year and on 30 days' notice, at reasonable times and without disrupting our operations. The Customer bears the cost unless the audit reveals a material breach.

14. Contact

For any matter arising under this DPA, including requests for a countersigned copy, the description of security measures or notice of sub-processor changes, write to [email protected].