Data Processing Addendum — overview

For the SaaS deployment, the customer may be controller of the personal data they put into CAO Studio and CAO Studio may be processor on the customer's behalf, depending on the use case. The DPA documents this split, the security measures CAO Studio applies, and the subprocessors that may process data on CAO Studio's behalf.

For the client-server deployment, the responsibility split is different. The customer operates the application in their own environment; CAO Studio processes data only when support, telemetry, managed services, cloud LLM routing, or maintenance access is enabled. The DPA covers those scoped processor activities; the customer remains responsible for hosting, access control, backups, and local configuration.