Data Processing Agreement

1. Roles

Where you process personal data through the AI Store, you are the controllerand OpsVanguard is the processor. Where we process personal data for our own account-management or fraud-prevention purposes we are an independent controller for that limited scope.

2. Subject matter and duration

Subject matter: provision of the AI Store and the agents you have subscribed to. Duration: the term of your subscription plus any retention period required by law or agreed in writing.

3. Categories of data & data subjects

• Categories: business contact details, prompts and attachments you submit, generated outputs, and operational telemetry.
• Subjects: your employees, customers, and any individuals referenced in the data you process through the agents.

4. Processor obligations

• Process personal data only on documented instructions from the controller (the configuration of the agents you choose to use).
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures listed in Annex II below.
• Assist the controller with data-subject requests within 30 days.
• Notify the controller within 72 hours of becoming aware of a personal data breach.
• On termination, return or delete all personal data within 30 days unless retention is required by law.

5. Subprocessors

We use the subprocessors listed on our public subprocessor page. We will give you 30 days' notice of any new subprocessor; you may object on reasonable grounds, in which case we will work in good faith on a workaround or you may terminate the affected service.

6. International transfers

EU/UK personal data is processed in EU-Frankfurt by default. Where transferred outside the EU/UK, we rely on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum, plus supplementary measures (encryption in transit and at rest, access logging, no clear-text storage of regulated identifiers).

7. Audit rights

You may audit our compliance with this DPA once per year on 30 days' written notice, during business hours, at your cost. Our SOC 2 / ISO 27001 reports satisfy most audit requests; on-site audits are reserved for material concerns.

Annex I — Processing details

• Nature and purpose: running the AI agents you subscribe to and providing the surrounding billing, support and analytics.
• Frequency: continuous during the subscription term.
• Retention: as described in our Privacy Policy and configurable per regulator.

Annex II — Technical and organisational measures

• Encryption in transit: TLS 1.3 plus ML-KEM-768 + AES-256-GCM envelope encryption between UI and API.
• Encryption at rest: AES-256 with customer-managed keys on Enterprise plans.
• Access control: role-based access, least privilege, session-tied audit logging.
• Vulnerability management: SAST + DAST in CI, dependency scanning, weekly upgrade cadence.
• Incident response: 24/7 on-call, documented runbooks, 72-hour breach-notification SLA.
• Employee training: annual security and privacy training; targeted training for engineers handling production data.