Grounded AI
← Back to Home

Data Processing Agreement (DPA)

Last updated: 10 November 2026

This Data Processing Agreement ("DPA") supplements the Services Agreement between the Client ("Data Controller") and Grounded AI Ltd ("Data Processor"). It governs the processing of personal data by Grounded AI on behalf of the Client to provide the Veracity citation verification API and related services.

1. Definitions and Roles

  • 1.1 Compliance: Grounded AI operates in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This framework provides a high standard of data protection suitable for clients globally, including within the European Union.
  • 1.2 Roles: For the purposes of Data Protection Legislation, the Client acts as the Data Controller and Grounded AI acts as the Data Processor.
  • 1.3 Controller Authority: The Client represents and warrants that it has the necessary authority, rights, and consents to share submitted documents and personal data with Grounded AI for processing.

2. Details of Processing

Grounded AI applies data minimisation principles, collecting and processing only the information necessary to perform the requested services.

  • 2.1 Subject Matter and Purpose: The processing is strictly for providing citation verification, factual claim analysis, and, where specifically instructed by the Client, detecting coordinated citation manipulation (Citation Cartels).
  • 2.2 Categories of Data Subjects: Authorised users of the Client's platform and the authors of the academic manuscripts submitted for analysis.
  • 2.3 Categories of Personal Data:
    • Authentication Data: Personally identifiable information used for user authentication and login (e.g., user login details).
    • Author Metadata (Citation Cartel Tool Only): Where the Client subscribes to the Citation Cartel anomaly detection service, Grounded AI processes Author Metadata, including author names, institutional affiliations, research topics, and publication disposition statuses (e.g., retractions or rejections).

3. Security Measures

Grounded AI implements industry-standard technical and organizational measures to ensure the security and confidentiality of Client data.

  • 3.1 Encryption: All manuscripts and associated metadata are encrypted both in transit (using TLS 1.2 or higher) and at rest.
  • 3.2 Environment Isolation: Manuscripts and derived metadata never leave Grounded AI’s private, access-controlled environment. The system utilizes private open-source AI/LLM models in its processing pipeline.
  • 3.3 Audit and Monitoring: All access to user data is logged and monitored to ensure accountability and traceability.

4. Approved Sub-processors

The Client grants Grounded AI general written authorization to use the following specific, GDPR-compliant sub-processors:

  • Auth0: Utilized for secure identity management and user authentication.
  • Datadog: Utilized for system health and performance monitoring. Grounded AI remains responsible for ensuring these sub-processors are bound by data protection obligations compatible with this DPA.

5. AI Model Training and Profiling

Grounded AI does not use client manuscripts, authorship information, or contextual content to train, fine-tune, or influence any general-purpose AI or language models.

  • 5.1 Standard Model Improvement ("Bad Papers"): Subject to the terms of the main Agreement, the Client grants Grounded AI a license to use purely anonymised citation-level metadata and in-text citations from errors or hallucinations. This dataset contains no narrative manuscript text or contextual content, cannot be reconstructed into the original manuscript, and is used solely to improve internal validation tools.
  • 5.2 Citation Cartel Risk Modeling: Where instructed by the Client, Grounded AI may build identity-based risk models using the Author Metadata defined in Section 2.3 to detect anomalous citation patterns. No underlying narrative manuscript text is used for this purpose.
  • 5.3 Opt-Out: Participation in dataset contributions for internal model improvement is entirely optional. Clients may opt out at any time by written request.

6. Data Retention and Deletion

  • 6.1 Retention Period: Client data are retained only for the duration necessary to perform the analysis and generate reports.
  • 6.2 Deletion: Upon completion of the services, or upon the Client's written request or termination of the Agreement, Grounded AI will securely delete Client data from all active and backup systems using industry-standard protocols.
  • 6.3 Exclusions: This deletion obligation does not apply to fully anonymised, non-attributable statistical data or anonymised citation-level metadata extracted in accordance with Section 5.1, as such data no longer constitutes Personal Data.

7. Governing Law

Consistent with the Terms and Conditions, this DPA and any disputes arising from it shall be governed by, and construed in accordance with, the laws of England and Wales.