Data Processing Agreement

This Data Processing Agreement ("DPA") is between Agent37.com Inc, a Delaware corporation ("Agent 37"), and the customer that accepts the Agent 37 Terms of Service ("Customer"). It forms part of the Terms or any other agreement between them for the Service (the "Agreement") and applies to all personal data Agent 37 processes on Customer's behalf under it ("Customer Personal Data").

This DPA takes effect when Customer accepts the Terms, and Agent 37 has already signed it below. If you need a signed copy for your records, download this page as a PDF and sign the Customer block. You don't need to send it back.

1. Definitions

"GDPR" means Regulation (EU) 2016/679. "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914. "Customer Instance Data" means all data stored in or processed by Customer's Agent 37 instances, including their storage and backups. Controller, processor, personal data, personal data breach, processing, data subject and supervisory authority have their GDPR meanings.

2. Roles

Customer acts as controller, or as processor on behalf of its own clients. Agent 37 acts as Customer's processor or, where Customer is a processor, as its sub-processor. Customer is responsible for having a lawful basis for the processing and, where it acts for its clients, their instructions. Agent 37 is the controller only of the account, billing and usage data it needs to run and bill the Service, as described in its Privacy Policy.

3. Agent 37's obligations

Agent 37 will:

1. process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use and configuration of the Service, unless EU or member state law requires otherwise, in which case it will tell Customer first unless that law prohibits it;
2. tell Customer immediately if, in its opinion, an instruction infringes the GDPR;
3. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
4. implement the technical and organisational measures in Annex II;
5. engage sub-processors only as set out in section 6;
6. assist Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations under Articles 32 to 36 GDPR;
7. delete or return Customer Personal Data as set out in section 9; and
8. make available the information needed to demonstrate compliance with this DPA and allow audits as set out in section 10.

4. Where data is stored

Customer chooses the region of each instance when it creates it: the United States (the default), the European Union (France) or India. An instance's storage stays in that region. Instance backups, account and billing data, and service logs and metrics are stored in the United States. Data that Customer or its agents send to optional services, such as managed AI models, web search, app integrations or paid tools, is processed where those services operate. Annex III lists every location.

5. No model training

Agent 37 does not use Customer Personal Data, including prompts, messages and instance contents, to train or improve AI models, and does not sell it. Requests to Agent 37's managed AI models are routed only to model providers that do not train on them.

6. Sub-processors

6.1 Customer gives Agent 37 general written authorisation to engage sub-processors. The current sub-processors are listed in Annex III.

6.2 Agent 37 will update Annex III at least 30 days before a new sub-processor starts processing Customer Personal Data, and will email each change to any Customer that asks for these notices at info@agent37.com. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may stop using the affected part of the Service and receive a refund of any prepaid, unused amounts for it.

6.3 Agent 37 imposes data protection terms on each sub-processor that are no less protective than this DPA, and remains liable to Customer for its sub-processors' performance.

7. International transfers

7.1 Where processing under this DPA transfers Customer Personal Data outside the EU/EEA to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and completed as follows: Module 2 applies where Customer is a controller and Module 3 where Customer is a processor; Customer is the data exporter and Agent 37 the data importer; the docking clause in Clause 7 applies; Option 2 of Clause 9 applies, with the notice period in section 6.2; the optional language in Clause 11 does not apply; the competent supervisory authority is determined under Clause 13 and, where none is, is the Irish Data Protection Commission; Option 1 of Clause 17 applies, with the law of Ireland; and the courts of Ireland are chosen under Clause 18. Annexes I to III of this DPA complete the annexes of the SCCs.

7.2 For transfers from the United Kingdom, the International Data Transfer Addendum to the SCCs (version B1.0) issued by the UK Information Commissioner applies, with its Tables 1 to 3 completed from this DPA and its Annexes, and neither party may end it under its Section 19.

7.3 For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as competent supervisory authority, and references to the GDPR are read as references to that Act.

7.4 If the SCCs conflict with this DPA or the Agreement, the SCCs prevail.

8. Personal data breaches

Agent 37 will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects affected, the likely consequences and the measures taken, as far as that information is available, and Agent 37 will update Customer as it learns more.

9. Deletion and return

Customer can access, export and delete Customer Instance Data at any time through the Service. When Customer deletes an instance, its storage is erased at once and its backups are permanently deleted after 7 days. On termination of the Agreement, Agent 37 will delete all remaining Customer Personal Data within 30 days, unless EU or member state law requires it to keep a copy.

10. Audits

Agent 37 will provide, on request and under confidentiality, its most recent SOC 2 report or other security documentation, and reasonable answers to security questionnaires, through its Trust Center. If that is not enough to demonstrate compliance, or a supervisory authority requires it, Customer or an independent auditor bound by confidentiality may audit Agent 37 once a year, with at least 30 days' notice, during business hours and at Customer's cost.

11. General

This DPA lasts as long as Agent 37 processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the Agreement, except where the SCCs or applicable law do not allow it. Apart from section 7, this DPA is governed by the law that governs the Agreement. If this DPA conflicts with the Agreement, this DPA prevails. Agent 37 may update this DPA by posting a new version on this page, and no update will reduce the protection it gives Customer Personal Data. Agent 37's representative in the EU, the UK and Switzerland under Article 27 GDPR is Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin D02 XE80, Ireland, datarequest@datarep.com.

Signatures

Annex I: Description of processing

Data exporter: Customer, as identified by its Agent 37 account. Role: controller, or processor on behalf of its clients.

Data importer: Agent37.com Inc, 555 S 1st St #521, Harrison, NJ 07029, USA, info@agent37.com. Role: processor or sub-processor.

Annex II: Technical and organisational measures

• Isolation. Each instance runs in its own gVisor sandbox or virtual machine with its own network and a hard disk limit. Instances can reach the public internet but are blocked from private networks, including their server and other instances.
• Network access. Servers have no public web endpoints. All instance traffic enters through Cloudflare's edge and is routed over a private network to the server. The edge authenticates each request, except to ports Customer chooses to make public, which Customer protects itself. API keys can be restricted to IP allowlists.
• Encryption. Traffic is encrypted in transit with TLS 1.2 or better. Instance storage is encrypted at rest with LUKS2 (AES-256), with keys released to a server only at boot and never stored on its disks. Backups and account data are encrypted at rest (AES-256).
• Credentials. API keys and instance credentials are verified against one-way hashes. Environment variables set on instances, including any keys placed there, are encrypted at rest.
• Server access. Servers accept only key-based SSH. Password login is disabled, and the set of authorised keys is monitored continuously, with alerts on any change.
• Backups. Instances are backed up daily, with seven daily restore points.
• Monitoring. Servers, firewall rules, backups and the Service are monitored continuously, with automated alerting.
• Organisation. Agent 37 runs a SOC 2 program (Security, Availability and Confidentiality) with continuous control monitoring. Personnel are bound by confidentiality, security policies are reviewed at least once a year, and access to production is limited to personnel who need it.

Annex III: Sub-processors