Data Processing Addendum

Version 2026-10-07-commercial-us-1 · Effective 2026-10-07

Support and privacy: support@agendity.com

This addendum is automatically incorporated into the Terms of Service when a customer accepts those Terms, actually uses Agendity for business or professional purposes, and Agendity processes personal information on that customer's instructions. It takes effect for that processing when the qualifying service begins. No separate signature or individually negotiated schedule is required. The customer's account, accepted offer and selected services identify that customer and the processing under the standard schedules below.

This addendum takes precedence over the Terms for instructed processing. It does not govern Agendity's independent account, billing or legal-compliance purposes, replace required international-transfer instruments, or cover unrelated customer-selected services. Mandatory privacy rights do not depend on a checkout label, plan name or this contractual business-use designation.

1. Scope and instructions

The customer is the controller, business or authorized processor for instructed information; Agendity acts as a processor or service provider as applicable. Account administration, payments, security and information used for Agendity's own legal duties can have a separate role under the Privacy Policy.

The subject matter is hosting and operating the purchased character workspace and selected integrations. Processing includes receiving, storing, retrieving, generating, transmitting, exporting and deleting information to provide those services. It lasts for the service relationship and the permitted deletion, recovery or legally required retention period.

Data subjects can include the customer's authorized users, people in authorized references and end users of its deployments. Data can include contact information, provided descriptions and references, conversational text and audio, transcripts, generated media, relevant settings, and limited job and usage information. The standard service does not authorize children's information, unnecessary sensitive data, biometric-identification data or companion-style deployments. Schedule A specifies the standard processing description for the selected services.

The agreement, selected features and authorized configuration form the documented instructions. Agendity processes only on those instructions, unless law requires otherwise, in which case it informs the customer where permitted. Agendity informs the customer if it believes an instruction infringes applicable data protection law and may suspend the affected processing pending resolution.

The customer supplies lawful instructions and any required end-user notices, permissions and authority. Each party remains responsible for its own legal duties.

2. Purpose restrictions

Agendity does not sell instructed personal information or share it for cross-context behavioral advertising. To the extent applicable service-provider law requires, it does not retain, use or disclose that information outside the specified service purposes or direct business relationship, or combine it with other personal information except as legally permitted. It understands these restrictions, grants the customer rights to take reasonable compliance steps, and notifies the customer if it can no longer comply so appropriate remediation can occur. Private instructed content is not used for Agendity's own general-purpose model training without separate explicit permission.

3. Confidentiality and security

Authorized personnel are subject to confidentiality duties and receive access appropriate to their work. Agendity maintains measures appropriate to the risk, including encrypted transport, authenticated account-scoped access, restricted private object storage, server-side secret handling, least-privilege operational access and reviewed recovery procedures. It tests and reviews relevant safeguards. This does not represent that any named certification, fixed recovery time or end-to-end encryption scheme has been obtained.

Agendity notifies the customer of a personal information breach affecting instructed information without undue delay after becoming aware of it, provides available information reasonably needed for the customer's obligations, and cooperates on investigation and mitigation. Initial information may be supplemented as the investigation progresses. Notification is not an admission of fault.

4. Subprocessors and locations

The customer gives general written authorization to the subprocessors identified for its selected services in Schedule C and the versioned provider inventory accompanying the accepted Terms, subject to appropriate written obligations. The public provider inventory distinguishes services; listing a payment or identity provider does not make every independent activity a subprocessor. Agendity remains responsible for its subprocessors' performance of the processing obligations it delegates under this addendum.

Agendity gives at least 30 days' prior notice of a planned new or replacement subprocessor for instructed information, using the customer's account-notification email or another agreed channel. The customer may object within that period on reasonable data-protection grounds. The parties seek a reasonable alternative; if they cannot resolve the issue, the customer may terminate the affected service before the change and receive a refund of unused prepaid fees for that service. This process does not silently authorize an unagreed new data use.

Information may be processed where the selected providers and authorized personnel operate, including access from Israel. The provider inventory gives the relevant provider location information; headquarters or a chosen storage region alone is not an exclusive processing-location commitment. Specific additional location commitments must be agreed in writing. Any transfer mechanism required by law, with completed annexes where required, must be in place before the affected processing. Purchase eligibility does not decide the privacy law applicable to end-user data. This addendum does not assert Data Privacy Framework certification or execute EU/UK standard contractual clauses merely by referring to them.

5. Assistance and documentation-first oversight

Agendity assists with valid access, correction, export, deletion and other rights requests, taking account of the nature of processing. It forwards a request concerning instructed information to the customer unless legally required to handle it directly. It reasonably assists with security, impact assessments, required regulatory consultation and incident duties, considering information available to it.

Agendity first provides available documentation, security information and reasonable written answers needed to demonstrate compliance with this addendum. This does not assert that certifications or third-party audit reports exist. An on-site inspection is not an ordinary subscription entitlement. Where an audit or inspection is required by applicable data-protection law or a competent authority, Agendity allows and contributes to it; documentation-first review does not reduce mandatory controller audit or inspection rights.

The parties arrange reasonable notice, scope, independent qualified reviewers, confidentiality and safeguards for other customers' information and security. Ordinary review requests should avoid unnecessary duplication and normally occur no more than once a year; incidents, justified compliance concerns, authority requests and mandatory rights can require more. Cost arrangements must not prevent legally required oversight, and nothing excludes a regulator's powers.

6. Return, deletion and ending service

At the end of the affected service, the customer may request return or deletion of instructed information, unless law requires further retention. Agendity provides available export and reviewed deletion procedures and explains any narrow exception. Deletion requires appropriate identity/scope checks and safe draining of work; these steps do not extend a statutory deadline by themselves.

Restricted recovery copies expire under the agreed lifecycle and remain protected from ordinary use. Recovery must respect applicable closure and deletion records. Agendity does not retain complete conversations merely to preserve financial evidence. On request it provides reasonable confirmation of completed processing and any remaining lawful or backup exception.

Schedule A — standard processing description

The account, offer and supported configuration identify the selected processing; an unselected optional route is not authorized by being listed. Unexpected sensitive content must be reported for scoped handling, not treated as a new use.

Schedule B — security measures

Measures include encrypted transport; authenticated account-scoped access; restricted private object storage; backend-only provider secrets; least-privilege operational access; confidentiality for authorized personnel; durable execution and duplicate-processing controls; and reviewed incident, export, deletion and restore procedures. They must remain appropriate to the actual processing risk and are not a promise of certification or uninterrupted availability.

Schedule C — selected service providers

Only providers used for the customer's selected routes are authorized for instructed information, as identified in the inventory accompanying the accepted Terms:

Stripe's independent payment activities and Google sign-in's independent identity activities are separately described in the provider inventory and Privacy Policy. Optional public-page analytics does not receive private instructed content. This schedule does not authorize every optional AI/voice provider for every input or cover independently selected customer providers. The accepted inventory is retained with the agreement; changes follow section 4 rather than being silently accepted through an edited public URL.

Contact support@agendity.com for instructions, rights requests, provider notices or incident coordination. A signed service-specific amendment or required transfer instrument prevails for the subject it expressly addresses.