Data Processing Agreement

This agreement governs how Hamid Soheili, doing business as AgencyOS processes personal data on behalf of an agency subscribing to AgencyOS. It forms part of the Terms of Service and applies automatically to every subscription — you do not need to sign a separate copy, though we will sign one on request.

In this agreement you are the controller and we are the processor. You decide what to record about your clients, why, and how long to keep it. We process that data only to provide the service to you.

1. Subject matter and duration

We process your clients' personal data, and your own team's account data, so that you can run projects, assign and track work, exchange deliverables, and record approvals and time. Processing lasts for as long as your subscription is active, plus the deletion period in section 8.

2. Nature and purpose of processing

Storing the client, project, component, task, milestone, and time records your team creates; displaying them to the people in your workspace who are permitted to see them; storing and serving the documents and attachments you upload; recording comments, checklist items, activity history, and approval decisions; giving your own clients a scoped view of their projects; and sending the notifications your team's actions trigger.

AgencyOS performs no automated decision-making or profiling within the meaning of Article 22 GDPR. It does not score or rank people. Every evaluation and decision is made by your team.

3. Categories of data subject and personal data

Data subjects: the client contacts you record, any of your clients you give a sign-in to, and the members of your own team who use the workspace.

Client data: name, email address, phone number, company, preferred language, and everything your team records against their projects — task titles and descriptions, comments, notes, activity history, approval and review decisions, and the contents of any document or attachment you upload.

Team member data: username, email address, optional mobile number, preferred language, notification preferences, a salted Argon2 hash of their password, workspace role, and audit records of security-relevant actions including the IP address a request came from.

We do not ask you for special category data. What you record about your clients is yours to decide, so please do not use the workspace to collect special category data without a lawful basis under Article 9 GDPR.

4. Our obligations

• We process personal data only on your documented instructions. Your use of the service, and this agreement, are those instructions.
• We tell you if an instruction appears to us to infringe applicable data protection law.
• Everyone with access is bound by confidentiality obligations.
• We do not sell personal data, use your workspace content to train machine learning models, or process it for our own purposes.
• Platform administrator access to your workspace happens through an explicit, time-limited support session, and entering and leaving that session is recorded in an audit log available to us.

5. Security

The measures we maintain are described in the Privacy Policy and include:

• encryption in transit with TLS;
• salted Argon2 password hashing;
• signed, expiring sessions delivered only as HTTP-only cookies that browser code cannot read, with a session version that invalidates existing sessions on a password change;
• rate limiting of repeated failed sign-ins for the same identifier;
• strict separation between agencies, so one customer's client data is not reachable from another's, and role-based limits within a workspace;
• an audit log of security-relevant and platform-administrator actions;
• daily backups of the database and uploaded files, retained for 30 days, encrypted before they leave the server to a key the server does not hold, with a copy kept off the server;
• automated health checks with service recovery, and a scheduled restore drill against the most recent backup.

6. Sub-processors

You authorise the following sub-processors:

• Stripe — subscription payments and billing. Processes your billing contact data, not your client data.
• Our email delivery provider — transactional email. Processes the names and email addresses of the people a notification is sent to.
• Our hosting provider — the private server and database running the service.

We impose data protection obligations on each sub-processor no less protective than those in this agreement, and remain liable to you for their performance. We will give you reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

AgencyOS AI currently runs on our own server and sends nothing to an external model provider. If we change that, OpenAI or another named provider will be added to this list and you will be notified before the change takes effect.

7. Location and transfers

Application data is stored in Ashburn, Virginia, United States. Our payment, email sub-processors may process data outside that region. Where a transfer requires a safeguard under Chapter V GDPR, it is made under Standard Contractual Clauses or another lawful transfer mechanism.

8. Deletion and return

• Your team can permanently delete a client, and the records attached to that client, at any time from the application.
• User accounts are deactivated rather than erased by default, so that project history stays accurate. Ask us if you need an account and its personal details erased outright.
• There is currently no self-service way to close a whole workspace and have it erased. Ask us and we will delete your agency's data; export anything you need first.
• Backups are point-in-time copies and are not rewritten on deletion, so deleted data persists in them for up to 30 days and is then removed on the retention cycle.

9. Assisting you

Taking into account the nature of the processing, we will assist you with:

• responding to people exercising rights of access, correction, deletion, restriction, objection or portability. Most of these you can satisfy yourself from the workspace; where you cannot, ask us;
• your obligations under Articles 32 to 36 GDPR, including security, breach notification, and any data protection impact assessment.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, with the information we hold about its nature, likely consequences and the measures taken.

10. Audit

We will make available the information reasonably necessary to demonstrate compliance with this agreement and will contribute to audits conducted by you or an auditor you mandate, on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, and subject to confidentiality.

11. Precedence

Where this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.

Contact

Data protection questions, sub-processor objections, and requests for a signed copy: privacy@getagencyos.co.