Basecamp changed its DPA

===================================================================
--- before
+++ after
@@ -1,14 +1,15 @@
 PRIVACY POLICY
 
-Last updated: September 15, 2025
+Last updated: August 30, 2026
 
 In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We never sell your data.
 
 This policy is split into sections. For your convenience, links to each of those sections is as follows:
 
  * What we collect and why
  * When we access or disclose your information
+ * Artificial intelligence
  * Your rights with respect to your information
  * How we secure your data
  * What happens when you delete content in your product accounts
  * Data retention
@@ -97,8 +98,16 @@
  * If we are audited by a tax authority, we may be required to disclose billing-related information. If that happens, we will disclose only the minimum needed, such as billing addresses and tax exemption information.
 
 Finally, if 37signals is acquired by or merges with another company — we don’t plan on that, but if it happens — we’ll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.
 
+ARTIFICIAL INTELLIGENCE
+
+Our products don’t include built-in AI features that process your content, and we don’t use your content to train AI models. The AI providers we work with are also contractually prohibited from training their models on your content.
+
+We do use AI assistant tools from providers such as Anthropic and OpenAI internally, to help our own staff with work like writing and reviewing software. Because these tools may process personal data in the course of operating our services, we list them as subprocessors and hold them to the same GDPR-compliant data processing agreements as every other subprocessor. They are not part of the products themselves and do not operate on your content.
+
+Some of our products can be used with AI agents that you bring yourself — for example, by connecting your own agent to Basecamp through the command line. When you do, the agent acts with your own account’s permissions and under your own agreement with your AI provider.
+
 YOUR RIGHTS WITH RESPECT TO YOUR INFORMATION
 
 At 37signals, we strive to apply the same data rights to all customers, regardless of their location. Some of these rights include:
 
@@ -140,9 +149,9 @@
 Our products and other web properties are primarily housed in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using our websites or Services and/or providing us with your personal information, you consent to this transfer.
 
 WHEN TRANSFERRING PERSONAL DATA FROM THE EU
 
-The European Data Protection Board (EDPB) has issued guidance that personal data transferred out of the EU must be treated with the same level of protection that is granted under EU privacy law. UK law provides similar safeguards for UK user data that is transferred out of the UK. Accordingly, 37signals has adopted a data processing addendum with Standard Contractual Clauses to help ensure this protection. 37signals’ DPA is available at: 37signals.com/policies/privacy/regulations/37signals-gdpr-dpa
+The European Data Protection Board (EDPB) has issued guidance that personal data transferred out of the EU must be treated with the same level of protection that is granted under EU privacy law. UK law provides similar safeguards for UK user data that is transferred out of the UK. Accordingly, 37signals has adopted a data processing addendum with Standard Contractual Clauses to help ensure this protection. 37signals’ DPA is available as a PDF, HTML, or Markdown.
 
 There are also a few ad hoc cases where EU personal data may be transferred to the U.S. in connection with 37signals operations, for instance, if an EU user signs up for our newsletter or participates in one of our surveys or buys swag from our company online store. Such transfers are only occasional and data is transferred under the Article 49(1)(b) derogation under GDPR and the UK version of GDPR.
 
 CHANGES AND QUESTIONS