Data Processing Addendum

Last updated: July 18, 2026

This Data Processing Addendum ("DPA") supplements and forms part of the Terms of Service (the "Agreement") between you ("Customer", "Controller", "you") and AIEmployees ("AIEmployees", "we", "us", or "our"), operator of Terminal Skills — our AI-agent-skills marketplace, open-source skills library, and Agent Playground available at terminalskills.io. It governs the Processing of Personal Data that AIEmployees carries out on your behalf as a Processor in connection with the Service.

AIEmployees is the business name under which an independent entrepreneur operates; it is a sole proprietorship, not an incorporated or registered company, and not a separately registered legal entity. "Terminal Skills" and "AIEmployees" are unregistered trade names, and "Terminal Skills" is an unregistered trademark. Nothing in this DPA asserts any corporate, state, or trademark registration.

When this DPA applies. This DPA applies to the extent that AIEmployees Processes Personal Data on your behalf as a Processor — for example, where a business or agency uses the Agent Playground to run tasks or handle files containing the personal data of its own customers, employees, or other individuals. Many individual users are their own Controller, and for their own account, authentication, billing, and security data AIEmployees acts as an independent Controller governed by the Privacy Policy. This DPA still governs any processor-role Processing that occurs. Where a term is defined in the Agreement, it has the same meaning here; if this DPA conflicts with the Agreement on the subject of data protection, this DPA controls.

1. Definitions

• "Data Protection Laws" — all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("Swiss DPA"), and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA") and comparable laws in Colorado, Connecticut, Virginia, Texas, and other states.
• "Personal Data", "Processing", "Data Subject", "Controller", "Processor", and "Sub-processor" — have the meanings given in the applicable Data Protection Laws. Under US state laws, "Controller" and "Processor" include the equivalent "business" and "service provider"/"processor" concepts.
• "Customer Personal Data" — Personal Data contained within Customer Data (as defined in the Agreement) that AIEmployees Processes on your behalf as a Processor — principally the task prompts, uploaded files, and skill content you submit into the Agent Playground, together with related usage and diagnostic data.
• "Standard Contractual Clauses" ("SCCs") — the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission (Decision 2021/914), together with the UK International Data Transfer Addendum ("UK IDTA") and any Swiss adaptations, as applicable.
• "Sub-processor" — any third party engaged by AIEmployees to Process Customer Personal Data on our behalf, as listed in Annex II.

2. Roles and Scope

2.1 Processor and Controller. As between the parties, and with respect to Customer Personal Data, you are the Controller (or a Processor acting on behalf of a further Controller) and AIEmployees is the Processor. AIEmployees will Process Customer Personal Data only to provide, secure, and support the Service and otherwise in accordance with your documented instructions and this DPA.

2.2 AIEmployees as independent Controller. AIEmployees acts as an independent Controller, governed by its Privacy Policy rather than this Section, when it Processes Personal Data to: operate, maintain, and secure the Service; create and authenticate accounts; meter compute and administer the credit wallet; process payments and maintain billing and usage records; prevent abuse, fraud, and security incidents; and comply with law. Account email, hashed credentials, billing references, and usage counters fall into this category.

2.3 Scope. This DPA applies to Processing carried out by AIEmployees and its Sub-processors in the course of providing the Service, for the duration of the Agreement, and to the limited extent described in Section 10 following termination.

3. Processing Details (Annex I)

This Section, together with Annex II (Sub-processors) and Annex III (Technical and Organizational Measures), constitutes the description required by Article 28(3) GDPR and, where the SCCs apply, completes their Annexes.

4. Processor Obligations

Where AIEmployees acts as a Processor, it will:

4.1 Documented instructions. Process Customer Personal Data only on your documented instructions — including with regard to international transfers — unless required to do otherwise by law, in which case AIEmployees will inform you of that legal requirement before Processing (unless the law prohibits such notice). The Agreement, this DPA, and your configuration and use of the Service constitute your complete and final instructions. AIEmployees will inform you if, in its opinion, an instruction infringes Data Protection Laws.

4.2 Confidentiality. Ensure that persons authorized to Process Customer Personal Data are bound by an appropriate duty of confidentiality and Process the data only as instructed.

4.3 Security. Implement and maintain the technical and organizational measures described in Annex III (Technical and Organizational Measures), appropriate to the risk. AIEmployees may update these measures provided the level of protection is not materially reduced.

4.4 Sub-processors. You provide general authorization for AIEmployees to engage the Sub-processors listed in Annex II. AIEmployees will: (a) impose data-protection obligations on each Sub-processor that are substantially equivalent to those in this DPA; (b) remain responsible for each Sub-processor's performance; and (c) give you prior notice of any intended addition or replacement of a Sub-processor (by updating this page and its "Last updated" date, or by other reasonable means), giving you a reasonable opportunity to object on reasonable data-protection grounds before that Sub-processor begins Processing Customer Personal Data. If you reasonably object and the parties cannot resolve the matter, you may terminate the affected part of the Service as your sole remedy.

4.5 Assistance with Data-Subject requests. Taking into account the nature of the Processing, assist you by appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection). Because self-service export and deletion are not yet built into the product, such assistance is currently provided through a manual, email-based process (see Section 10 and the Privacy Policy); if a Data Subject contacts AIEmployees directly regarding Customer Personal Data, AIEmployees will, where lawful, refer them to you.

4.6 Personal-data breach notification. Notify you without undue delay — and, where feasible, within 72 hours — after becoming aware of a personal-data breach affecting Customer Personal Data, and provide information reasonably available to help you meet your own notification obligations.

4.7 DPIAs and prior consultation. Provide reasonable assistance with data-protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the Processing and the information available to AIEmployees.

4.8 Records and audits. Make available to you information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allow for and contribute to audits, including inspections, conducted by you or an independent auditor you mandate. Audits will be conducted on reasonable prior written notice, no more than once per twelve months (except where required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and in a manner that does not disrupt AIEmployees' operations or compromise the security or data of other customers. AIEmployees may satisfy audit requests by providing relevant documentation about its security measures.

5. Controller Obligations

You will:

5.1 comply with your obligations as a Controller (or Processor) under Data Protection Laws, and ensure you have a valid lawful basis for the Processing you instruct;

5.2 provide all required notices to, and obtain all required consents from, Data Subjects for the Processing carried out through the Service;

5.3 ensure you hold the necessary rights in, and that your instructions with respect to, the Customer Personal Data you submit are lawful; and

5.4 be responsible for the accuracy, quality, and legality of the Customer Personal Data and the means by which you acquired it, and for not submitting special-category or sensitive Personal Data except as permitted under Section 3.

6. International Transfers

6.1 Where data is Processed. AIEmployees' hosting infrastructure is provided by Hetzner Online GmbH (a Germany-based provider) under a self-hosted Coolify control plane; our MongoDB database and authentication are self-hosted on that infrastructure, and per-run agent workspaces are stored on its local filesystem. Several Sub-processors — Google Cloud / Vertex AI (with a "global" region setting), Stripe, and GitHub — Process data in the United States and other regions. The exact data-center region of our hosting is available from AIEmployees on request.

6.2 Transfer mechanisms. Where Customer Personal Data is transferred out of the EEA, UK, or Switzerland to a country without an adequacy decision, the transfer is made under an appropriate safeguard — the Standard Contractual Clauses, the UK IDTA, and/or Swiss adaptations, as applicable. The SCCs are incorporated into this DPA by reference and are deemed completed by the details in Section 3 and Annexes II–III; module two (Controller-to-Processor) or module three (Processor-to-Processor) applies according to your role.

6.3 Order of precedence. In the event of a conflict between the SCCs and this DPA, the SCCs prevail with respect to the transfer they govern. This Section does not alter the governing law of the Agreement.

7. Sub-processors (Annex II)

AIEmployees engages only the following Sub-processors to Process Customer Personal Data. This list reflects the vendors actually used by Terminal Skills.

Our database and authentication are self-hosted — we do not use a managed database service (such as MongoDB Atlas) or a third-party identity/OAuth provider. We do not use a third-party object-storage or CDN service for your uploaded files.

8. Technical and Organizational Measures (Annex III)

AIEmployees maintains the following measures, described accurately rather than aspirationally:

• Password hashing. Account passwords are hashed with bcrypt (cost factor 10). Plaintext passwords are never stored.
• Sessions. Authentication uses stateless JSON Web Tokens (HS256, signed with a server secret of at least 32 characters), carried in an httpOnly, SameSite=Lax cookie (ts_session) marked Secure in production and expiring after ~7 days. Logging out clears the cookie. Because sessions are stateless, an individual token cannot be centrally revoked before it expires; administrative role changes are re-checked against the database on every privileged request.
• Encryption in transit. HTTPS/TLS is terminated by our hosting reverse proxy; the session cookie is marked Secure in production.
• Access control. Role-based access control with two roles (user and admin). Administrative endpoints re-verify the admin role against the database on every request, so a revoked administrator loses access immediately.
• Secrets management. Application secrets are supplied through environment variables and are not stored in the database.
• Hosting and isolation. The database is self-hosted; the Agent Playground executes each run in a per-run isolated workspace, refuses to stage skills flagged suspicious or malicious by our tooling, and enforces per-run cost caps.

At-rest protection. AIEmployees does not currently apply field-level or application-layer encryption to data at rest; any at-rest protection is provided at the database/host layer, not per field. We do not operate an AES-256-GCM token-encryption scheme, a Redis-backed token revocation list, or short-lived (e.g. 15-minute) tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Controller-to-Processor Assistance and Cooperation

AIEmployees will provide reasonable cooperation to help you comply with Data Protection Laws in connection with the Processing described in this DPA, including the assistance described in Sections 4.5–4.8, taking into account the nature of the Processing and the information available to AIEmployees.

10. Data Return and Deletion

10.1 On termination. Following expiry or termination of the Agreement, and on your written request, AIEmployees will delete or return Customer Personal Data Processed on your behalf, except to the extent retention is required by law or for legitimate business records (such as billing and tax records).

10.2 Current mechanism. Because self-service export and deletion are not yet built into the product, return and deletion are currently handled through a manual, email-based request to support@terminalskills.io (subject "Attn: Privacy"). AIEmployees will action valid requests within a reasonable period consistent with applicable law.

10.3 Retention baseline. As described in the Privacy Policy, account records, security-scan records, the Stripe billing-event ledger, and the MongoDB run summary are currently retained indefinitely absent a deletion request; on-disk run workspaces, run files, and event transcripts are intended to be short-lived (the Agent Playground states uploaded files are deleted after 7 days); and transient caches and the in-memory rate-limiting IP window are short-lived (seconds to minutes).

11. Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement (including its Limitation of Liability section), and any reference in the Agreement to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together. These limitations extend, to the fullest extent permitted by law, to AIEmployees' Sub-processors.

12. Term and Termination

This DPA takes effect on your first use of the Service (or acceptance of the Agreement) and remains in force for as long as AIEmployees Processes Customer Personal Data on your behalf. The obligations that by their nature should survive — including confidentiality, international transfers, data return and deletion, and liability — survive termination until fulfilled.

13. Changes to This DPA

We may update this DPA as the Service and applicable law evolve. The "Last updated" date at the top reflects the most recent revision, and changes to the Sub-processor list are notified as described in Section 4.4. Continued use of the Service after an update constitutes acceptance of the revised DPA.

14. How to Execute and Contact

This DPA applies automatically as part of the Agreement and requires no signature to be effective. If your organization requires a countersigned copy, email support@terminalskills.io with the subject "Attn: Legal", and we will arrange one on reasonable terms. Data-subject and privacy requests should be sent to the same address with the subject "Attn: Privacy". You may also reach AIEmployees at aiemployees.us.

See also our related policies: Privacy Policy, Terms of Service, Cookies Policy, Acceptable Use Policy, and Do Not Sell or Share My Personal Information.