Agentfy
Get started

Data Processing Agreement

Last updated:

1. Parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Agentfy.io ("Processor") and the customer entity accepting these terms ("Controller").

2. Roles

  • You (Customer) are the Data Controller — you decide what data is processed and why.
  • Agentfy is the Data Processor — we process data on your instructions.
  • Where Agentfy uses sub-processors (PayPal, email transactional provider, cloud hosting), they are sub-processors to us.

3. Nature and Purpose of Processing

  • Authentication and account management.
  • Macro / agent / scheduled-task execution against your paired iPhones.
  • Billing transaction processing.
  • Audit and security event logging.

4. Categories of Data Subjects

  • Your tenant's users (employees, contractors, members).
  • End users of apps that your macros / agents interact with — only to the extent data flows through your iPhones during execution.

5. Categories of Personal Data

  • Identification: email, display name, role.
  • Authentication: scrypt-hashed passwords, JWT tokens.
  • Operational: device IDs, login IPs, audit log entries.
  • Transactional: PayPal payer email, wallet ledger.

6. Security Measures

Agentfy implements the following technical and organizational measures:

  • Vault contents encrypted at rest with AES-256-GCM, tenant-scoped keys.
  • All HTTPS traffic terminated at Cloudflare; LetsEncrypt certificates rotated automatically.
  • Database passwords + JWT secrets stored in 1Password, never committed to source control.
  • Role-based access control (5 roles: owner / admin / operator / member / viewer).
  • Per-device API token allowlist for fine-grained access control.
  • Full audit trail with 90-day retention (90 days operational; longer on request for compliance investigations).
  • Automated dependency vulnerability scanning + security audits before each major release (see ADR-38).

7. Sub-processors

Current sub-processors:

  • DigitalOcean, Inc. — primary hosting (US, SFO3 region).
  • Cloudflare, Inc. — DNS, CDN, DDoS protection.
  • PayPal Holdings, Inc. — payment processing.
  • Resend / SendGrid (TBD) — transactional email delivery.

We will notify Controllers of changes to sub-processors at least 30 days before they take effect.

8. Data Subject Rights

Agentfy will assist the Controller in responding to data-subject requests (access / rectification / deletion / portability) using appropriate technical and organizational measures.

9. Data Breach Notification

Agentfy will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach affecting Controller data.

10. Termination

On termination of the Service, Agentfy will return or delete all Controller personal data within 30 days, except where retention is required by law (e.g., billing records for tax purposes).

11. Contact

DPA contact: [email protected]