Agent OS
for business

Data Processing Agreement — draft

Version 1.7 · effective September 3, 2026

This document is a working draft for customers whose own compliance requires a signed DPA. The final text is agreed with a manager and a lawyer before signing. The version and date are synced with the Terms (below).

1. Parties and roles

Agent OS acts as a processor of personal data that the customer (the "controller") sends to the assistant or collects through "Client mode" (replies to the business owner's own customers). The customer remains the controller and is responsible for the lawfulness of its own basis for processing.

2. Subject and duration

Processing lasts for the term of the customer's subscription and the retention period set out in the Privacy Policy (section 6). After the subscription ends, data is deleted within those same periods, except for payment and accounting records we're required to keep by law.

3. Categories of data and data subjects

Messages and files that the customer or their end customers (in "Client mode") send to the assistant; technical request and account metadata. Full list — section 2 of the Privacy Policy.

4. Subprocessors

The current list lives on a dedicated "Subprocessors" page, which updates automatically when a new processor is connected. We notify customers of material changes (see the version log on /privacy) and, on request, sign a separate subprocessor-change notice for customers whose contract requires it.

5. Security measures

Encrypted transmission channels, per-customer data isolation at the level of a dedicated assistant server, restricted access to production systems within the Agent OS team. Details — section 9 of the Privacy Policy.

6. Assistance with data subject requests

On the customer's request, we provide the data needed to respond to a request from their end user (export/deletion under "Client mode") within a reasonable time through a manager.

7. Incident notification

We notify the customer of an incident affecting their data without undue delay, through a manager or the contact e-mail the customer has provided.

8. Audit

The customer may request information confirming compliance with this DPA (documentation of security measures, the subprocessor list) within a reasonable time and on prior notice.

9. Effect

This draft doesn't replace a signed agreement. For business customers who need a signed copy, the final version is prepared individually on request through a manager.