Data Processing Addendum

Version 2026-11-02.1 · Effective November 2, 2026

Processing terms for personal data the operator handles on a customer’s behalf.

Parties, scope and precedence

This Addendum is part of the Terms between the customer accepting them and the operator identified on this page. It applies whenever the operator processes personal data as the customer’s processor, or as its subprocessor where the customer acts for another controller. It is not limited to sensitive or regulated-sector data. Controller and processor have the meanings given by applicable data protection law.

The customer determines the lawful purposes, has the necessary authority to give instructions and must provide required notices and a lawful basis for its processing. This Addendum does not cover the operator’s separate controller activities described in the Privacy Policy. For processing within scope it prevails over conflicting Terms, without limiting mandatory law or applicable transfer clauses.

Processing description and instructions

The subject matter is customer-directed agent orchestration. Processing comprises receiving, storing, retrieving, transmitting, executing against, exporting and deleting task, repository, workspace and integration data to provide and support the service. It lasts for the service relationship and subsequent return/deletion handling, not an unlimited right to reuse customer data.

Data subjects may include customer users, employees, contractors, customers, contacts and people mentioned in supplied content. Data may include names, contact details, account identifiers, communications, repository metadata, task content and other personal data the customer is authorized to supply. Customers must assess suitability before supplying special-category or similarly sensitive data; this service makes no regulated-sector certification promise.

Instructions are documented through the agreement, customer settings, authorized tasks and written support requests, including instructions about destinations. The operator will process only on those instructions unless applicable law requires otherwise, in which case it will inform the customer before processing unless legally prohibited. It will promptly flag an instruction it considers contrary to applicable data protection law.

Confidentiality and security

The operator will restrict access to authorized people who need it and are subject to appropriate confidentiality obligations. It will maintain technical and organizational measures appropriate to the processing risks, including access controls, protected credentials, separation of customer work, security logging and recovery procedures. The Security page describes the service safeguards without asserting certifications or a guaranteed recovery time.

The operator will assess these measures and test recovery proportionately. The customer must configure its own accounts, agent permissions and credentials securely. Customer responsibilities do not remove the operator’s obligations for systems it controls.

Subprocessors and customer-selected destinations

The customer gives general authorization for the operator to engage the applicable subprocessors disclosed for its deployment. Before adding or replacing one, the operator will notify affected customers of its identity, function and relevant locations and give a reasonable opportunity to object on data-protection grounds. The parties will seek a practical resolution; if none is possible, the customer may discontinue the affected processing before the change.

The operator will impose equivalent applicable processing obligations by binding contract and remains responsible to the customer for its subprocessors’ performance. Customer-connected independent services are distinguished as described in the Privacy Policy; selecting a service or supplying an API key does not, by itself, determine the parties’ legal roles.

International processing

Customer instructions may involve international processing. For restricted transfers for which the operator is responsible, it will establish a valid adequacy basis or appropriate safeguards required by applicable law before transferring, including the applicable UK or EU transfer instrument and assessment where needed. This Addendum is not itself an executed international-transfer instrument and does not waive those requirements.

The operator will provide information about the applicable safeguards through the DPA contact. It will not represent an unverified region or an unsigned provider agreement as an established safeguard.

Rights, incidents and assistance

Taking account of the nature of processing and information available, the operator will assist the customer with data-subject requests, security obligations, breach assessment and notifications, impact assessments and consultation with supervisory authorities. Requests received directly about customer-controlled data will be referred to the customer unless law requires another response.

The operator will notify the customer without undue delay after becoming aware of a personal-data breach affecting data within this Addendum and supply available information, updates and reasonable cooperation for investigation and mitigation. The customer decides its own notifications where it is controller; no provision postpones either party’s statutory deadlines.

Return, deletion and restricted backups

At the end of the relevant processing, the operator will, at the customer’s choice, return or delete the personal data and delete remaining copies unless applicable law requires retention. Data controls explains the authenticated request and export routes. The operator will confirm the scope and any justified retention, including the applicable backup expiry cycle, rather than treating subscription cancellation as an erasure request.

Where immediate removal from a historical backup is not feasible, the retained data must be put beyond ordinary use and erased as soon as practicable under an appropriate expiry cycle. Any restoration must reapply completed deletion requests before returning affected data to use. Independent destination services and data another customer lawfully retains require separate handling.

Evidence, audits and contact

The operator will make available information necessary to demonstrate compliance with these processing obligations and allow and contribute to audits and inspections by the customer or its appointed auditor. The parties will coordinate proportionate arrangements that protect other customers’ confidentiality and service security, without excluding mandatory audit rights.

Use the DPA contact on this page for deployment details, processing instructions, objections and audit arrangements. A separately negotiated processing agreement may supplement or replace this Addendum when expressly agreed. Its publication does not claim that every operational prerequisite has been verified.