Data processing agreement

*Version 3 — drafted by the build session from an automated legal review of 28 September 2026; it has not been reviewed by a lawyer. It replaces version 2 once it is published.* # Data processing agreement This agreement covers what we may and may not do with the personal data you give us while running your agents. It forms part of your contract with us. **Between** - **You**, the customer named on the workspace ("you"). You decide what data goes into ZenOS and why. In data-protection law you are the *controller*. - **The company that operates ZenOS**, whose registered details are published on the Legal notice at https://zen-os.net/imprint before paid plans open ("we", "us"). We process that data on your behalf. In data-protection law we are the *processor*. Where this agreement says "data protection law", it means the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the Slovenian Personal Data Protection Act (ZVOP-2), and, where they apply to you, any other EU member state's law supplementing that Regulation and the UK General Data Protection Regulation and Data Protection Act 2018. --- ## 1. What we process, and for how long We process the personal data described in **Schedule 1**, for as long as your subscription lasts, plus the retention periods in **Schedule 5**. ## 2. We act only on your instructions We process your personal data only to provide the service, and only on your instructions. Your instructions are the ones you give through the product itself: the agents you switch on, the instructions you publish to them, the documents you upload, the connections you authorise, and the approvals you give. We do not process your data for our own purposes. **We do not use your data to train any model.** We send your data to the model providers listed in **Schedule 4** only to produce the output you asked for. What each provider's own terms say about training on and keeping that data, and whether our agreement with it is in force yet, is recorded per company on the Sub-processors page at https://zen-os.net/sub-processors. We do not claim more about a provider than that page records. That statement is about what we do. It is not a promise about every company we send data to. **Voyage AI**, which turns your documents into a form we can search, has terms that allow it to train on the content sent to it unless the account opts out, and we have not yet confirmed that our account has opted out. We ask **OpenRouter**, through which every model request goes, to use only model companies that do not collect or train on request data; we have not switched on zero data retention, so we do not say that requests are not kept. Schedule 4 sets both out. If we ever believe an instruction from you would break data protection law, we will tell you and will not act on it until it is resolved. ## 3. Confidentiality Everyone we allow to access your personal data is bound by a duty of confidentiality, whether as an employee or under contract. ## 4. Security We keep your personal data secure using the measures in **Schedule 3**. Those measures are technical facts about how the product is built, not intentions. If we change them, we will not weaken the overall level of protection. ## 5. Other companies that help us (sub-processors) **Schedule 4** lists every company that processes your personal data on our behalf, what each one does, and where it processes. You agree to our using the companies listed there. We will publish any addition or replacement of a sub-processor on https://zen-os.net/sub-processors and notify the workspace owner in the product at least 30 days before it takes effect. If you object on reasonable data-protection grounds within that period, you may end the affected part of the service without penalty. We remain responsible to you for what these companies do with your data, and we put obligations on them that are equivalent to the ones in this agreement. **Schedule 4 records, honestly and per company, whether that written agreement is currently in force.** Where it is not, that is stated plainly rather than implied. On the date of this version the agreements with **Fly.io** and **Composio** are not in force: each has to be accepted in the company's own dashboard, and we have not done that yet. ## 6. Helping you when someone exercises their rights If someone asks you for a copy of their data, asks you to correct it, or asks you to delete it, we will help you respond. The product includes an erasure tool you can use yourself. It removes personal data while leaving our record of decisions verifiable, so we can still show that the record was not altered afterwards. If someone contacts us directly about data you control, we will not respond to them ourselves beyond acknowledging receipt. We will pass it to you. ## 7. Helping you with security incidents and assessments If we become aware of a personal data breach affecting your data, we will tell you without undue delay after we become aware of it, and in any event in time for you to meet your own 72-hour obligation to report it to your supervisory authority. We will tell you what we know, what we are doing about it, and what we recommend you do. We will also help you with data protection impact assessments and any prior consultation with a regulator, by giving you the information we hold about how the processing works. ## 8. Getting your data back, and deletion An export of your workspace's data is produced when your workspace is cancelled, as part of offboarding. You can also ask for an export at any other time by writing to us, and we will produce one. When your subscription ends, we delete your personal data on the timetable in **Schedule 5**, unless the law requires us to keep it. If you ask us in writing before then, we will return it to you first. ## 9. Showing you we comply We will give you the information you reasonably need to show that we are meeting our obligations under this agreement, and we will allow and contribute to audits. On written request, we will answer with the evidence the service records: the audit record for your workspace, the sub-processor list, and our security documentation. On-site audits are available by separate agreement, at your cost, and no more than once a year unless a supervisory authority requires otherwise. ## 10. Sending data outside the UK and the European Economic Area Your workspace data is stored in a named region in **Frankfurt, Germany** — deliberately a specific German region, not a general "Europe" grouping, which can place data in London or Zurich. Some of the companies in Schedule 4 process data outside the European Economic Area. Schedule 4 records, per company, what makes each transfer lawful. In short, on the date of this version: - Model requests are processed in the United States, by OpenRouter and by Anthropic, under the European Commission's standard contractual clauses. Neither is on the EU–US Data Privacy Framework list. - Voyage AI processes in the United States under the standard contractual clauses, and is also covered by the Data Privacy Framework certification of MongoDB, Inc. - Supabase's support staff may reach your data from the United States or Singapore, under the standard contractual clauses. - Vercel is covered by the Data Privacy Framework and by the standard contractual clauses. Stripe relies on the Data Privacy Framework first and on the standard contractual clauses after that. - Fly.io has an active Data Privacy Framework certification and no standard contractual clauses in place, because its agreement is not in force yet. Composio, in the United States, has no transfer mechanism in place until its agreement is accepted. The standard contractual clauses are standard promises, written by the European Commission, that a company outside the European Union signs so data can lawfully be sent to it. The Data Privacy Framework is a scheme under which a company in the United States certifies that it protects European data. ## 11. Liability Each party's liability under this agreement is as set out in the Terms of service at https://zen-os.net/terms. Nothing in this agreement limits any liability under data protection law that cannot be limited by law. ## 12. How long this lasts This agreement lasts as long as we process personal data for you. Clauses that by their nature should survive — confidentiality, deletion, liability — continue afterwards. ## 13. Law and jurisdiction The law of the Republic of Slovenia applies, and the courts of Ljubljana have jurisdiction, unless mandatory law says otherwise. --- # Schedule 1 — What we process **Why.** To run AI agents against your own business data, produce proposals and internal reports for you, and carry out the actions you approve. **What the agents do.** Every agent produces proposals and internal reports. A deterministic gate — ordinary code, not a model — decides what may proceed, and a named person approves anything the gate does not clear automatically. In this build every action that reaches outside your workspace needs a person's approval before it happens. The gate clears an action automatically only when it stays inside your workspace — for example saving an internal report — and only after the agent has earned that trust and within limits you set. For three kinds of action — issuing an invoice, cold first-contact outreach and publishing to a public social account — the need for a person's approval is permanent: no plan, setting or approval history changes it. In ZenTwin, proposing a target design and sending a process change request to your own change process are permanent in the same way. Which kinds of action, which agents and which connections are open at any time is shown on https://zen-os.net/pricing, read from the same records the service checks before it lets anything run. **What the agents read.** What you upload, and the connections you authorise where that connection is open (for example an email account, LinkedIn or Google Ads). Content that arrives from outside your company is treated as untrusted, as Schedule 3 describes. **What the agents write.** No agent writes to your systems directly. Anything that reaches an outside system is an action a person approved, which the service itself then carries out. ZenTwin never writes to the systems its extracts come from. **Types of personal data.** Whatever you choose to upload or connect. In practice this is likely to include names and contact details of your own staff and your clients' staff, project notes, time records and commercial correspondence. **You must not upload** special-category data (such as health, ethnicity, religion, biometrics or sexual orientation) or data about criminal offences. The product has no specific safeguards for these categories. **ZenTwin.** If you use ZenTwin, you deliver extracts from your own systems — for example case events, organisational units and positions, and unit costs. Identifiers must be replaced with keyed hashes before you deliver a file, and the key stays with you, so we cannot re-identify anyone. An extract that contains a direct identifier — a national identification number, a tax number, an email address, a bank account number, a phone number or a person's name — is refused, the refusal is recorded, and the file is deleted. Nothing about a group smaller than your minimum group size (at least five people) is shown to anyone or to any agent, and nothing is ever shown about a single employee. ZenTwin analyses processes in aggregate; it never creates, changes or decides a decision about an individual person. Extracts are kept until you delete them or ask us to, and in any case no longer than Schedule 5 allows. **Whose data.** Your employees and contractors, and the employees and contacts of your own clients. For ZenTwin, also the pseudonymised records of the people whose cases pass through the processes you analyse. **How long.** The term of your subscription, plus Schedule 5. # Schedule 2 — Your instructions Your documented instructions are the configuration you set in the product: - which agents you enable, and at what level of autonomy - the instructions you publish to each agent, each recorded with a version - the documents you upload as knowledge, and the connections you authorise - the approvals and rejections you give Every agent run records the exact instruction version and the exact pieces of your knowledge that produced its output, so what we acted on is always recoverable. # Schedule 3 — Security measures - **Where your data lives.** A named region in Frankfurt, Germany. - **Separation between customers.** Enforced by the database itself, not by application code. A test that deliberately attempts to read another customer's data, and must fail, runs before every release. - **Least privilege.** The website, the background worker and the administrative connection are three separate database identities. The administrative one, which can change the structure of the database, is used only for upgrades and is never given to a running application. - **No agent ever holds a working key.** An AI model cannot call anything that changes the world. It writes a proposal; ordinary, deterministic code decides whether that proposal happens. - **Untrusted content is contained.** If a run reads anything originating outside your company, it immediately loses the ability to reach any tool that acts outside your company, for the rest of that run. This is enforced in two independent places. - **A record that cannot be quietly rewritten.** Every decision is written in the same database transaction as the change it describes, and the records are linked by cryptographic hash. The chain still verifies after an erasure, so we can show the history was not altered. - **Credentials.** Keys for connected services are stored as pointers, never as values in our database, and never appear in a log, an error message or a stack trace. - **Access.** Two-factor authentication is supported, and re-authentication is required before the highest-risk actions. # Schedule 4 — Companies that process your data for us The current list, with each company's purpose, processing region, what its own terms say about training on and keeping data, and whether its agreement and clauses are in force, is published at https://zen-os.net/sub-processors and is generated from the same records the service runs on. On the date of this version it reads as below. If the two ever differ, the published list is the more recent, and section 5 governs how it changes. **Companies that process your data for us** | Company | What it does for us | Where it processes | Agreement | How data leaves the European Economic Area | | --- | --- | --- | --- | --- | | Supabase | Stores your workspace data. | Frankfurt, Germany (AWS eu-central-1) | In force: part of Supabase's terms, so it applies automatically. | Standard contractual clauses, signed by accepting the agreement. Support staff may reach your data from the United States or Singapore under them. | | Vercel Inc. | Hosts the website, the dashboard and the console our own staff use. | Frankfurt, Germany (fra1) for application functions; static files from Vercel's global network; may also process in the United States | In force: part of Vercel's terms of service. | Data Privacy Framework (certification active) and standard contractual clauses. | | Fly.io | Runs the background workers that carry out agent runs. | Frankfurt, Germany (fra) | **Not in force yet.** It has to be accepted in Fly.io's own dashboard, and we have not accepted it. | Data Privacy Framework (certification active). No standard contractual clauses in place. | | OpenRouter, Inc. | Receives every model request and passes it on to the company that runs the model. | United States (Google Cloud US regions) | In force: part of OpenRouter's terms of service. | Standard contractual clauses (Module 2). Not on the Data Privacy Framework list. | | Anthropic | Makes the models your agents run on; today our requests reach its models through OpenRouter. | United States | In force: part of Anthropic's commercial terms. | Standard contractual clauses (Modules 2 and 3), with Anthropic Ireland. Not on the Data Privacy Framework list. | | Voyage AI | Turns your documents into a form we can search by meaning. | United States (Voyage AI does not publish which region) | In force: part of Voyage AI's terms of service. | Standard contractual clauses, and the Data Privacy Framework certification of MongoDB, Inc. | | Composio | Holds the connections to some of the tools you link. | United States | **Not in force yet.** It has to be accepted in Composio's own dashboard, and we have not accepted it. | Standard contractual clauses, once the agreement is accepted. Not on the Data Privacy Framework list. | | Stripe | Takes payment. | Ireland (Stripe Payments Europe), with processing in the United States | In force: part of Stripe's services agreement. Stripe acts as our processor and also as a controller in its own right. | Data Privacy Framework first, then standard contractual clauses. | **What the companies' own terms say about training on and keeping your data** - **Voyage AI.** Its terms allow it to train on the content sent to it unless the account opts out. We have not yet confirmed that our account has opted out, so do not assume it has. - **OpenRouter.** We ask it to use only model companies that do not collect or train on request data. Zero data retention is not switched on yet, and we have not confirmed that every model we use is served with it. - **Anthropic.** Under its own API terms it does not train on what is sent to it by default, and it deletes inputs and outputs within 30 days. - For every other company, the published list records only what we can show. We do not claim that any company keeps nothing. **Services you connect yourself.** Google, Meta Platforms and LinkedIn Corporation are independent controllers of the accounts you connect at them, under their own terms with you, which are terms between two controllers and not a data processing agreement. They are not our sub-processors, and no processor agreement applies between us and them. **Listed but not in use.** Better Stack is listed so the list is complete. Nothing is sent to it today. # Schedule 5 — Keeping and deleting data While your workspace is open, the full text of what an agent read and produced is kept for the period your plan sets. The Privacy notice at https://zen-os.net/privacy shows the current periods, read from the same plan records the service uses. On the date of this version they are: | Your plan | Kept for | | --- | --- | | Free | 7 days | | Own key | 90 days | | Pro | 90 days | | Max | 180 days | | Ultra | 365 days | The record of *decisions* — who decided what, when and on what basis — is kept for the life of the workspace and for 12 months after it is closed, as our record that the audit trail was not altered. It contains no document contents. Everything else in your workspace is deleted within 30 days of cancellation, unless the law requires us to keep it. --- **Version 3. Draft of 2026-09-29; effective from the date it is published.**