Data Processing Addendum

Last updated: November 5, 2026

This Data Processing Addendum (this "DPA") is part of the Terms of Service (the "Terms") between Webomax LLC, a Delaware limited liability company whose address is 2810 N Church St PMB 93469, Wilmington, Delaware 19802-4447, United States ("Webomax", "we", "us", "our"), and the person or entity that has agreed to the Terms ("Customer", "you", "your"). Simurg is a product of Webomax, provided at simurg.me (the "Service").

How this DPA applies. This DPA is incorporated into the Terms by reference. It applies automatically, without any signature, whenever and to the extent that Webomax processes Customer Personal Data on Customer's behalf in providing the Service and that processing is subject to Data Protection Laws. By accepting the Terms, Customer enters into this DPA, including the Standard Contractual Clauses and the UK Addendum incorporated by Section 12, on its own behalf and, where Customer acts for another controller, as described in Section 2.2. Customer may ask for a copy of this DPA signed by Webomax by writing to info@simurg.me. A signed copy contains the same terms and is not needed for this DPA to be effective.

What this DPA covers. This DPA governs personal data that Customer puts into the Service or causes to flow through it: for example, records about Customer's own customers, leads and contacts, documents and knowledge, conversations with Agents, and data that Agents read from Connected Services or that the Service receives through routines and webhooks. It does not govern personal data that Webomax handles as a controller for its own purposes, such as account, sign-in, billing, security and website data. The Privacy Policy describes that processing.

Precedence. If this DPA conflicts with the Terms, this DPA controls with respect to the processing of Customer Personal Data. Where they apply, the Standard Contractual Clauses control over both, as described in Section 15.2.

1. Definitions

1.1 Terms defined in the Terms

Capitalized terms that are used but not defined in this DPA, including Account, Agent, Authorized Users, BYO Keys, Connected Services, Credits, Customer Content, Output, Subscription, Third-Party AI Providers and Workspace, have the meanings given to them in the Terms.

1.2 Definitions in this DPA

In this DPA:

• "Account Data" means personal data about Customer, its Authorized Users and its other representatives that Webomax processes as an independent controller under the Privacy Policy. It includes account, sign-in and profile details; billing, payment and tax records; communications with Webomax; security, fraud-prevention and anti-abuse records; data about visits to Webomax's websites; and records of how the Service is used, such as Credits consumed, token counts, costs, models used, timestamps, errors, and whether proposed actions were approved or declined ("Usage Data"). Where Customer Content appears inside such records (for example, the title of a task in a usage record), that content remains Customer Content.
• "Aggregated Data" means data derived from Customer Content, Customer Personal Data or Usage Data that has been aggregated or de-identified so that it does not identify, and cannot reasonably be used to infer information about or otherwise be linked to, Customer, any Authorized User or any other identified or identifiable natural person.
• "AI Sub-processors" means the Sub-processors that provide AI models or AI-based checks used by the Service, namely the Third-Party AI Providers that Webomax uses under its own accounts, and TypeSafe, the provider of the Service's automated safety, risk, routing, triage and scoring checks.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended (including by the California Privacy Rights Act of 2020), Cal. Civ. Code § 1798.100 et seq., and its implementing regulations.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given to them in the GDPR, whether or not the GDPR applies. "Controller" includes a "business" and a "controller", "Processor" includes a "service provider", a "contractor" and a "processor", "Data Subject" includes a "consumer", and "Personal Data" includes "personal information" and "personal data", in each case as those terms are defined in the applicable Data Protection Laws. "Process" and "processed" are read accordingly, and lower-case uses of these terms have the same meanings.
• "Customer Personal Data" means Personal Data that Webomax processes on behalf of Customer, as a Processor, in providing the Service. It includes Personal Data contained in Customer Content (such as records, knowledge, files, conversations, tasks, routines, Agent configurations and Outputs), in data that the Service retrieves from Connected Services, and in data that the Service receives through routine webhooks and Connected Service events. It does not include Account Data or Aggregated Data.
• "Customer-Selected Third Parties" means: Connected Services; MCP servers that Customer adds to the Service; Third-Party AI Providers when they are accessed with Customer's BYO Keys; websites and other online services from which Customer or its Agents direct the Service to retrieve data, or to which they direct it to send data; and third-party applications that Customer authorizes to access its Account or Workspaces.
• "Data Protection Laws" means all laws and regulations relating to privacy, data protection or data security that apply to the processing of Customer Personal Data under the Terms, as amended or replaced from time to time, including, where applicable: (a) the EU GDPR and the laws of the member states of the European Economic Area ("EEA") that implement or supplement it; (b) the UK GDPR and the UK Data Protection Act 2018; (c) the Swiss FADP; (d) the CCPA; and (e) the other US State Privacy Laws.
• "EU GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).
• "GDPR" means the EU GDPR or the UK GDPR, or both, as applicable to the relevant processing.
• "Personal Data Breach" means a breach of security of systems under the control of Webomax or its Sub-processors that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as unsuccessful log-in attempts, pings and port scans.
• "Prohibited Data" has the meaning given in Section 3.5.
• "Restricted Transfer" means a transfer of Customer Personal Data (including an onward transfer) that is subject to the EU GDPR, the UK GDPR or the Swiss FADP to a country, territory or recipient that is not covered by an adequacy decision or adequacy regulation applicable to that transfer, where Data Protection Laws require a transfer mechanism for it.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.
• "Security Measures" means the technical and organisational measures described in Part A of Annex II.
• "Sub-processor" means any third party that Webomax engages to process Customer Personal Data on Webomax's behalf in providing the Service. Sub-processors do not include Webomax's own employees, or individual contractors working under Webomax's direct authority, and do not include Customer-Selected Third Parties.
• "Sub-processor List" has the meaning given in Section 6.1.
• "Swiss FADP" means the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 and in force from 21 March 2022, as revised under its own terms or replaced.
• "UK GDPR" means the EU GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.
• "US State Privacy Laws" means the CCPA and the comprehensive consumer privacy laws of other US states, such as those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska, together with their implementing regulations.

1.3 Interpretation

"Including" and similar words mean "including without limitation". Headings are for convenience only. References to Sections and Annexes are to those of this DPA unless stated otherwise. A reference to a law includes its implementing regulations and any amendment or replacement. Where a term is defined differently in different Data Protection Laws, the definition in the law that applies to the relevant processing governs.

2. Roles and scope

2.1 Customer as controller, Webomax as processor

As between the parties, Customer is the Controller of Customer Personal Data and Webomax is a Processor that processes Customer Personal Data on Customer's behalf. For the purposes of US State Privacy Laws, Customer is the "business" or "controller" and Webomax is the "service provider" or "processor".

2.2 Customer acting as a processor

If Customer processes Customer Personal Data as a Processor on behalf of another Controller (for example, an agency or consultant that uses the Service for its own clients), Webomax acts as Customer's sub-processor. In that case Customer warrants that its instructions to Webomax, including its appointment of Webomax and Webomax's Sub-processors and the transfers described in Section 12, have been authorized by the relevant Controller. Customer is the sole point of contact for Webomax. Webomax has no obligation to communicate with, or take instructions from, any other Controller, except where the SCCs or Data Protection Laws require it. Customer will promptly pass on to the relevant Controller any notice or information that Webomax provides under this DPA.

2.3 Webomax as an independent controller

Webomax is an independent Controller (and a "business" under US State Privacy Laws) of Account Data, which it processes as described in the Privacy Policy. Webomax is also an independent Controller for the limited processing described in Section 4.9 (Webomax's legitimate business operations). This DPA does not govern Webomax's processing as a Controller, except where this DPA expressly says so.

2.4 Customer-Selected Third Parties

When Customer connects a Connected Service, adds an MCP server, uses BYO Keys, directs an Agent or the Service to retrieve data from or send data to a website or other online service, or authorizes a third-party application to access its Account, Customer instructs Webomax to transmit Customer Personal Data to that third party and to receive Customer Personal Data from it. Customer-Selected Third Parties are not Webomax's Sub-processors. They process Customer Personal Data under Customer's own agreements with them, and Customer is responsible for having appropriate agreements in place and for their processing. Webomax is not responsible for how Customer-Selected Third Parties process Customer Personal Data, including data that Agents send to them, and Webomax's deletion obligations in Section 10 do not extend to data they hold.

2.5 Individuals whose data is in the Service

Individuals whose personal data a Customer has put into the Service, or has caused to flow through it, should direct their questions and requests to that Customer. Section 7 describes what Webomax does when it receives such a request.

2.6 Scope

This DPA applies only to the extent Data Protection Laws apply to the processing of Customer Personal Data. Provisions that implement a particular law apply only where that law applies: Section 12 applies only to Restricted Transfers, and Section 13 applies only to Customer Personal Data that is subject to US State Privacy Laws. This DPA applies to every Workspace that Customer owns, on every plan, including the Free plan. Annex I describes the subject matter, duration, nature and purpose of the processing, the types of Customer Personal Data and the categories of Data Subjects.

3. Customer instructions and Customer obligations

3.1 Documented instructions

Customer instructs Webomax to process Customer Personal Data to provide the Service in accordance with the Terms and this DPA. Customer's documented instructions consist of:

• (a) the Terms and this DPA;
• (b) Customer's use and configuration of the Service, including its Workspaces; its Agents and their instructions, skills, tools, permissions and autonomy settings; its knowledge, records and files; its routines, schedules, triggers and webhooks; its Connected Services and MCP servers; and its BYO Keys;
• (c) the requests, tasks and messages that Customer or its Authorized Users give to Agents, and the actions that Agents take within the tools, permissions and autonomy settings that Customer has configured;
• (d) the processing described in Annex I, including the transmission of Customer Personal Data to Sub-processors (including AI Sub-processors), to Customer-Selected Third Parties, and to the United States and other countries as described in Section 12; and
• (e) any other reasonable written instructions from Customer that Webomax agrees to in writing and that are consistent with the Terms.

These are Customer's complete instructions to Webomax for the processing of Customer Personal Data.

3.2 Agents and automated processing

Customer acknowledges that Agents are AI-driven software tools. They decide which of the actions available to them to take based on Customer's instructions and configuration and on the content they read, and their behavior is probabilistic. Processing carried out by an Agent within the tools, permissions, Connected Services and autonomy settings that Customer has enabled is processing on Customer's documented instructions for the purposes of this DPA, even where a specific action was not what Customer intended, including where the Agent was influenced by content from a third party (for example, instructions hidden in an email, document, web page or webhook payload).

By default, new Agents act without asking Customer first ("Auto"), including write actions in Connected Services and MCP servers, subject to the automated risk check described below. Customer may instead choose settings under which Agents ask before acting, including "Ask me first", "Ask unless it's routine" and per-tool "Always ask" or "Blocked". Some built-in actions inside the Service, such as creating and updating records, saving new knowledge and deliverables, fetching web pages, generating images and sending internal messages, run without an approval prompt even under the default setting. Customer is responsible for choosing settings that are appropriate for the Customer Personal Data concerned. As the Terms explain, the Service's approval prompts, automated risk checks, red lines, prompt-injection screening, token limits and stop controls help Customer supervise Agents but are not guaranteed to prevent any particular action (see also Section 5.5).

3.3 Additional or changed instructions

Instructions that go beyond the Service's standard functionality require Webomax's written agreement and may be subject to additional fees. If Webomax cannot follow an instruction, it will tell Customer. Customer's remedy is to stop the affected processing and, if Customer chooses, to terminate the affected Subscription or delete the affected Workspace in accordance with the Terms.

3.4 Customer's responsibilities as controller

Customer is solely responsible for:

• (a) the lawfulness of its instructions and of the processing of Customer Personal Data through the Service, including having, and documenting where required, a valid legal basis (such as consent or legitimate interests) for each purpose for which it uses the Service;
• (b) giving all notices and obtaining all consents, permissions and authorizations that Data Protection Laws and other laws require, including notices that tell Data Subjects that their personal data will be processed using AI services by Webomax and its Sub-processors (including AI Sub-processors) and transferred to the United States and other countries;
• (c) the accuracy, quality and legality of Customer Personal Data and of the means by which Customer obtains it, including data obtained from Connected Services, lead-sourcing and web-scraping tools, web pages and imported files;
• (d) responding to Data Subjects, Supervisory Authorities and other regulators about Customer Personal Data;
• (e) carrying out any data protection impact assessment, transfer impact assessment, risk assessment or prior consultation that Data Protection Laws require of the controller;
• (f) complying with laws on direct marketing and electronic communications for messages that Customer or its Agents send, such as the CAN-SPAM Act, the Telephone Consumer Protection Act, Canada's Anti-Spam Legislation, and the EU ePrivacy rules as implemented in EEA member states and in the UK Privacy and Electronic Communications Regulations, including their consent, identification, opt-out and unsubscribe requirements;
• (g) complying with laws on profiling and automated decision-making, including Article 22 of the GDPR and the rules on profiling and automated decision-making technology in US State Privacy Laws, whenever Customer uses the Service (including AI scoring of records) to evaluate, score or rank individuals;
• (h) complying with transparency laws that apply when Agents communicate with people, including laws that require telling a person that they are interacting with an AI system, such as California's Bolstering Online Transparency Act (Cal. Bus. & Prof. Code § 17940 et seq.), Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) to the extent it applies to Customer, and Utah's and other states' AI-disclosure laws;
• (i) deciding whether the Service, including the AI Sub-processors and the processing of data from Connected Services, is appropriate for the Customer Personal Data concerned; and
• (j) ensuring that its Customer-Selected Third Parties process Customer Personal Data lawfully.

3.5 Prohibited Data

Unless Webomax has expressly agreed otherwise in a separate written agreement signed by Webomax, Customer must not submit, upload or store in the Service, or configure the Service (including through Connected Services, routines, webhooks or web fetching) to collect, any of the following ("Prohibited Data"):

• (a) special categories of personal data under Article 9(1) of the GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data processed to uniquely identify a person; data concerning health; and data concerning a person's sex life or sexual orientation), and personal data relating to criminal convictions and offences;
• (b) protected health information under the US Health Insurance Portability and Accountability Act ("HIPAA"), and any other information about an individual's health, medical condition or treatment, including patient records;
• (c) payment card data, such as full card numbers, card security codes and PINs, and financial account numbers together with any code or password that would permit access to the account;
• (d) government-issued identification numbers, such as Social Security, passport, driver's license, state or national identification and individual taxpayer identification numbers, and images of identity documents;
• (e) biometric identifiers or biometric information, such as face geometry, fingerprints and voiceprints;
• (f) personal data of children under 13 years of age, and personal data of any individual whom Customer knows to be under 16 (or under 18 where Data Protection Laws give minors' personal data heightened protection); and
• (g) any other personal data that Data Protection Laws classify as sensitive or subject to heightened protection (such as precise geolocation, citizenship or immigration status, or the log-in credentials of individuals other than Customer and its Authorized Users), except for: (i) credentials that Customer provides to the Service to connect its own Connected Services, MCP servers or BYO Keys; and (ii) the content of communications that Customer sends or receives through its own Connected Services, to the extent that content is not otherwise Prohibited Data.

Webomax is not a "business associate" under HIPAA and will not enter into a business associate agreement. The Service is not designed for cardholder data that is subject to the Payment Card Industry Data Security Standard. Webomax has no obligation to monitor for, detect or filter out Prohibited Data. The incidental appearance of Prohibited Data in a communication or document that Customer processes in the ordinary course of its business is not by itself a breach of this Section 3.5, but Customer must not use the Service to collect, store or process Prohibited Data systematically, and any Prohibited Data in the Service is there at Customer's sole risk. If Prohibited Data is processed through the Service, Customer is solely responsible for it as between the parties, the Security Measures are not designed for it, and Webomax may require Customer to remove it and may suspend the affected processing in accordance with the Terms.

3.6 Prohibited uses

Customer must not, without a separate written agreement signed by Webomax, use the Service to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals, including decisions about employment, credit or lending, housing, insurance, education, healthcare, legal services, or access to essential goods, services or government benefits. AI scores, rankings, triage outcomes and other Outputs are probabilistic, can be wrong, and must be reviewed by a person before they are used in any decision about an individual.

3.7 Customer's security responsibilities

Customer is responsible for:

• (a) the security of its Account credentials and of the devices and browsers used to access the Service, including signing out on shared devices (the Service keeps sign-in sessions and some working data, such as unsent drafts, in the browser's storage);
• (b) controlling who can use its Account and, if the Service later supports additional Authorized Users, granting and removing their access;
• (c) choosing Agents' autonomy levels, tool permissions and red lines, and reviewing Outputs and pending approvals inside the Service (approvals and alerts appear in the Service, and Webomax does not commit to sending them through any other channel);
• (d) the access scopes it grants to Connected Services, and the security of its Connected Services, MCP servers and BYO Keys, including revoking access at the provider when it is no longer needed;
• (e) keeping routine webhook links and their keys secret, and generating a new link if a link may have been exposed, because anyone who has a link can send data into Customer's Workspace and start the routine;
• (f) not uploading as an Agent avatar any image it does not want to be public, because uploaded avatar images can be viewed by anyone who has their link; and
• (g) keeping its own copies of any Customer Personal Data it needs, because the Service is not a backup or archiving service.

3.8 Connected Services

Customer authorizes Webomax and its Sub-processors (including Composio) to access, retrieve data from and act within each Connected Service that Customer connects, to the extent of the permissions that Customer grants and as needed to run what Customer configures. Customer represents that it has all rights and authority needed to grant that access, including under the Connected Service's own terms. Customer acknowledges that connections are generally made through OAuth applications operated by Composio, so a Connected Service's consent screen may name Composio rather than Simurg or Webomax, and that once a Connected Service is connected, Agents in the Workspace can use the actions that the Connected Service makes available through Composio unless Customer blocks those actions or switches the Connected Service off for an Agent.

3.9 Data received from third parties

If Customer configures routines, webhooks or Connected Service events to receive data from third parties (for example, submissions from a form on Customer's website, or incoming emails), Customer is responsible for informing the individuals concerned and for having a legal basis to process their data. The Service stores each incoming item when it is received, up to a size limit, including items that a routine later ignores, skips or rate-limits, and keeps it as described in Annex I.

4. Webomax obligations

4.1 Processing only on instructions

Webomax will process Customer Personal Data only on Customer's documented instructions under Section 3, including with regard to transfers of Customer Personal Data to a third country, unless applicable law to which Webomax is subject requires otherwise. In that case, Webomax will inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 Instructions that may infringe the law

Webomax will immediately inform Customer if, in Webomax's opinion, an instruction infringes Data Protection Laws. Webomax is not obliged to carry out a legal review of Customer's instructions, of Customer Content or of Agent actions, and does not monitor them for this purpose. Webomax may suspend the processing concerned until Customer withdraws or changes the instruction. If the parties cannot resolve the issue, either party may stop the affected processing in accordance with the Terms.

4.3 Confidentiality

Webomax will ensure that every person it authorizes to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

4.4 Access by Webomax personnel

Webomax limits access to Customer Personal Data to personnel who need it, and those personnel access Customer Personal Data only as needed to:

• (a) provide support that Customer requests;
• (b) operate, maintain, debug and secure the Service, including investigating failed tasks and routines, whose failure records show the Workspace name, the task or routine title and the error message;
• (c) review the records of the Service's automated checks for quality, safety and security (these records keep an excerpt of up to 4,000 characters of the content that was checked; Webomax deletes the excerpt after 30 days and keeps only the result of the check);
• (d) investigate suspected abuse, security incidents and violations of the Terms;
• (e) comply with law; and
• (f) carry out Customer's other instructions.

Webomax's in-product administration tools show personnel account, plan, billing and usage information for all Workspaces, the records of automated checks described in (c), and the failure records described in (b). They do not display other Workspaces' records, conversations, knowledge or files. Authorized personnel with access to Webomax's back-end systems can technically access all data stored in the Service, including BYO Keys and MCP server credentials, and may use that access only for the purposes listed above.

4.5 Compliance with Data Protection Laws

Webomax will comply with the obligations that Data Protection Laws impose directly on it as a Processor in connection with the Service.

4.6 Records of processing

Where Article 30(2) of the GDPR requires it, Webomax will maintain a record of the categories of processing it carries out on Customer's behalf and will make it available to a Supervisory Authority on request.

4.7 Restrictions on use

Webomax will not:

• (a) use Customer Personal Data or other Customer Content to train or fine-tune any AI model;
• (b) sell or share Customer Personal Data, as "sell" and "share" are defined in US State Privacy Laws, or use it for targeted advertising or cross-context behavioral advertising;
• (c) use Customer Personal Data to build or enrich profiles of Data Subjects for Webomax's own purposes or for any third party; or
• (d) disclose Customer Personal Data to any third party except to Sub-processors under Section 6, to Customer-Selected Third Parties on Customer's instructions, as required by law under Section 4.11, or with Customer's permission.

4.8 AI Sub-processors and their terms

AI Sub-processors process Customer Personal Data under their own terms. For the commercial API services that Webomax uses, those terms generally do not permit the provider to use API data to train its models by default, but they may allow the provider to retain data for a limited period, for example to monitor for abuse and misuse. Webomax does not promise that AI Sub-processors will not retain Customer Personal Data, and their retention is outside Webomax's control.

4.9 Webomax's legitimate business operations

Customer authorizes Webomax to process Customer Personal Data, to the minimum extent necessary, for the following purposes, for which Webomax acts as an independent Controller and which are permitted purposes for a service provider under US State Privacy Laws:

• (a) preventing, detecting and investigating security incidents, fraud, spam, abuse and violations of the Terms, and protecting the rights, property and safety of Webomax, its customers and others;
• (b) complying with legal obligations, and establishing, exercising or defending legal claims;
• (c) billing, account management and financial reporting;
• (d) maintaining and improving the quality, safety and functionality of the Service, including tuning the Service's automated checks by comparing their results with outcomes such as whether Customer approved or declined a proposed action, provided that Webomax does not use Customer Personal Data to perform services for another person and does not use it to train AI models; and
• (e) creating Aggregated Data.

Where practicable, Webomax will use Aggregated Data, Usage Data or pseudonymized data for these purposes rather than Customer Personal Data. Webomax will not use Customer Personal Data for these purposes in a way that is incompatible with Section 4.7.

4.10 Aggregated Data

Webomax owns Aggregated Data and may use it for any lawful purpose, including to operate, secure, price and improve the Service. Aggregated Data is not Customer Personal Data. Webomax will: (a) take reasonable measures to ensure that Aggregated Data cannot be associated with an identified or identifiable individual or with Customer; (b) maintain and use Aggregated Data only in de-identified form and not attempt to re-identify it, except as permitted by law to test the effectiveness of its de-identification; and (c) contractually require any person to whom it discloses Aggregated Data to comply with the same requirements.

4.11 Requests from public authorities

If Webomax receives a legally binding request from a public authority (including a law-enforcement or national-security authority) for access to Customer Personal Data, Webomax will:

• (a) try to redirect the authority to request the data directly from Customer;
• (b) promptly notify Customer and provide a copy of the request, unless the law prohibits this, in which case Webomax will use reasonable efforts to obtain a waiver of the prohibition so that it can communicate as much information as possible, as soon as possible;
• (c) review the legality of the request and challenge it where, after careful assessment, it concludes that there are reasonable grounds to consider it unlawful under applicable law, including by pursuing available appeals;
• (d) disclose only the minimum Customer Personal Data needed to comply with the request, based on a reasonable interpretation of it; and
• (e) document its assessment and, to the extent the law allows, make that documentation available to Customer on request.

This Section does not prevent Webomax from responding to an emergency that involves a risk of death or serious physical injury, in accordance with applicable law.

4.12 Data obtained through Google APIs

Where Customer Personal Data is obtained through Google APIs (for example, from Gmail, Google Drive or Google Calendar through a Connected Service), Webomax's use of it complies with the Google API Services User Data Policy, including its Limited Use requirements, as further described in the Privacy Policy. In particular, Webomax uses such data only to provide and improve the user-facing features that Customer uses; does not transfer it to others except as needed to provide or improve those features, for security purposes, to comply with law, or as part of a merger, acquisition or sale of assets after obtaining the explicit prior consent of the user concerned; does not use it for advertising; does not use it to develop, improve or train generalized or non-personalized AI or machine-learning models; and does not allow humans to read it except with Customer's affirmative agreement for specific data, where necessary for security purposes (such as investigating abuse or reviewing the operation of the Service's automated security checks), to comply with law, or for internal operations where the data has been aggregated and anonymized.

5. Security

5.1 Security Measures

Webomax will implement and maintain the Security Measures described in Part A of Annex II. They are designed to protect Customer Personal Data against Personal Data Breaches and to provide a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to Data Subjects.

5.2 Changes to the Security Measures

Webomax may update the Security Measures from time to time, provided that an update does not materially reduce the overall security of the Service. Annex II describes the measures in place on the date shown at the top of this DPA.

5.3 Customer's assessment

Customer has reviewed the Security Measures and is responsible for deciding whether they meet its needs and its obligations under Data Protection Laws. Taking into account that Customer must not submit Prohibited Data, Customer agrees that the Security Measures provide an appropriate level of security for Customer Personal Data. Webomax does not hold third-party security certifications or audit reports (such as SOC 2 or ISO/IEC 27001) and does not offer an uptime or availability commitment. No security measure is perfect, and Webomax does not guarantee that Customer Personal Data will never be accessed, disclosed, altered or lost without authorization.

5.4 Shared responsibility

Security of the Service is shared. Webomax is responsible for the Security Measures. Customer is responsible for the matters described in Section 3.7 and for the security of its Customer-Selected Third Parties.

5.5 Agent supervision features

The Service gives Customer features to supervise Agents, described in Part B of Annex II, such as autonomy levels, approval prompts, per-tool permissions, automated risk and prompt-injection checks, red lines, token limits, rate limits and stop controls. These features are tools for Customer to use; they are not Security Measures. Some of them rely on AI judgments, they may not catch every risky action or malicious instruction, and Webomax may change, improve or withdraw them as the Service evolves, as described in the Terms. The fact that one of these features did not prevent an action is not, by itself, a breach of this DPA by Webomax.

6. Sub-processors

6.1 General authorization and the Sub-processor List

Customer gives Webomax a general written authorization to engage Sub-processors. Customer specifically authorizes the Sub-processors listed in the section of the Privacy Policy titled "Service providers and sub-processors", as that list stands when Customer accepts this DPA and as later updated under this Section 6 (the "Sub-processor List"). Annex III summarizes the Sub-processor List. If Annex III and the Sub-processor List differ, the Sub-processor List controls.

6.2 Requirements for Sub-processors

Webomax will:

• (a) before a Sub-processor begins processing Customer Personal Data, take reasonable steps, appropriate to the services it provides, to confirm that it is capable of protecting Customer Personal Data in accordance with this DPA;
• (b) engage each Sub-processor under a written agreement that imposes data protection obligations providing at least the protection required by Article 28(3) and (4) of the GDPR and by other Data Protection Laws, to the extent applicable to the nature of the services the Sub-processor provides; and
• (c) remain responsible to Customer for its Sub-processors' performance of their data protection obligations, as required by Data Protection Laws and subject to Section 14.

Customer acknowledges that many Sub-processors, including cloud infrastructure, AI model and payment providers, offer their services only on their standard terms and data processing agreements, which Webomax cannot negotiate. Customer agrees that such standard terms satisfy Section 6.2(b) where they contain the protections that Data Protection Laws require.

6.3 Copies of Sub-processor terms

On Customer's written request, and to the extent required by Data Protection Laws (including Clause 9(c) of the SCCs), Webomax will provide the data protection terms of its agreement with a Sub-processor, or a link to them where they are publicly available. Webomax may remove or redact commercial information and information that it or the Sub-processor considers confidential or a business secret.

6.4 Changes to Sub-processors

Webomax will notify Customer of any intended addition or replacement of a Sub-processor at least 14 days before the new Sub-processor begins processing Customer Personal Data. Webomax will give notice by updating the Sub-processor List (including its "last updated" date) and by email to each Customer that has asked to receive these notices by writing to info@simurg.me with the subject line "Sub-processor notices". Webomax may also give notice by email to the address associated with Customer's Account or within the Service. Customer is responsible for reviewing the Sub-processor List or subscribing to these notices.

The following are not the addition or replacement of a Sub-processor: (a) a change in the AI model, model version or model developer that the Service uses through an existing Sub-processor, including the model developers and hosting providers to which OpenRouter routes requests; (b) a change in a Sub-processor's name or corporate group where the processing continues on materially the same terms; and (c) the removal of a Sub-processor.

If Webomax needs to replace a Sub-processor urgently, for example because of a security concern, the Sub-processor's failure or withdrawal of its service, or a legal requirement, Webomax may do so immediately. In that case it will notify Customer as soon as reasonably practicable afterwards, and Customer's right to object under Section 6.5 runs from that notice.

6.5 Objections

Customer may object to a new Sub-processor by emailing info@simurg.me within 14 days after notice is given, stating reasonable grounds relating to the protection of Customer Personal Data. The parties will then discuss Customer's concerns in good faith. Webomax may, at its discretion, propose a change to the Service or to Customer's configuration that avoids processing of Customer Personal Data by the new Sub-processor. If Webomax does not do so within 30 days after receiving the objection, Customer's sole and exclusive remedy is to stop using the affected part of the Service and, if Customer chooses, to terminate the affected Subscription and delete the affected Workspace or its Account in accordance with the Terms, without any termination charge. Fees already paid are non-refundable, except where the law requires a refund or the Terms expressly provide for one. If Customer does not object within the 14-day period, Customer is deemed to have authorized the new Sub-processor.

6.6 AI Sub-processors

• (a) Included models. When an Agent uses a model included in Customer's plan, the Service sends the relevant Customer Personal Data to the AI Sub-processor that provides the model Webomax has selected. Webomax may change the models and providers it selects. If a provider is unavailable or a model fails, a request may automatically be sent to another provider on the Sub-processor List.
• (b) Features that always use Webomax's providers. Some features always run through Webomax's AI Sub-processors, including for Workspaces that use BYO Keys: text embeddings for knowledge search and Agent memory (OpenAI); the Service's automated safety, risk, routing, triage and scoring checks (TypeSafe); image generation (through OpenRouter); the builder assistant (ARCHITECT); conversation titles; proposed titles, summaries and layouts for knowledge items; and weekly Agent summaries.
• (c) OpenRouter. OpenRouter routes each request to a model developer or hosting provider that serves the requested model. Those providers may be located in the United States or in other countries.
• (d) BYO Keys. When an Agent is set to use one of Customer's BYO Keys, the requests made with that key are sent under Customer's own account with that provider, which is a Customer-Selected Third Party for those requests.
• (e) Temporary file links. When a file attached to a task or conversation cannot be read as text or as an image (for example, a video), the request sent to the AI Sub-processor may contain a temporary link to the file that remains valid for up to one hour.

6.7 Composio

Composio is the Sub-processor through which the Service connects to most Connected Services. Composio holds the authorizations that Customer grants to those Connected Services, carries out the actions that Agents take in them, and delivers events from them to the Service. The Service identifies each Workspace to Composio by a randomly generated Workspace identifier rather than by Customer's name or email address.

7. Data subject requests

7.1 Self-service tools

The Service lets Customer access, correct, export and delete much of the Customer Personal Data in its Workspaces: for example, by viewing, editing and deleting records; deleting tasks, conversations, knowledge items and Agent memories; and downloading deliverables. Customer is responsible for using these tools to respond to requests from Data Subjects. Some copies of Customer Personal Data cannot be reached through these tools (see Section 10.2 and Annex I), and the export tools do not cover all data. Webomax will help with those under Section 7.3.

7.2 Requests received by Webomax

If Webomax receives a request from a Data Subject that relates to Customer Personal Data and Webomax can identify Customer from the request, Webomax will promptly forward the request to Customer or, if it cannot forward it, tell the requester to contact Customer. Customer authorizes Webomax to tell the requester that the request concerns a Webomax customer and to direct the requester to Customer. Webomax will not otherwise respond to the request unless Customer authorizes it to or the law requires it. Webomax is not responsible for Customer's response, or failure to respond, to any request.

7.3 Assistance

Taking into account the nature of the processing, Webomax will assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests to exercise Data Subjects' rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability and objection and the corresponding rights under US State Privacy Laws, where Customer cannot reasonably fulfill a request through the self-service tools. Customer must send requests for assistance to info@simurg.me with enough information to identify the Workspace and the data concerned. To the extent permitted by law, Webomax may charge a reasonable fee, based on its costs, for assistance beyond the self-service tools, unless the assistance is needed because of Webomax's breach of this DPA.

8. Personal Data Breaches

8.1 Notice to Customer

Webomax will notify Customer without undue delay after becoming aware of a Personal Data Breach.

8.2 Content of the notice

To the extent then known, the notice will describe: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and of Customer Personal Data records concerned; (b) its likely consequences; (c) the measures Webomax has taken or proposes to take to address it, including measures to mitigate its possible adverse effects; and (d) a contact point from which Customer can obtain more information. Where Webomax cannot provide all of this information at the same time, it will provide it in phases without undue further delay.

8.3 Response and cooperation

Webomax will take reasonable steps to contain, investigate and remediate a Personal Data Breach and to mitigate its effects. Webomax will provide reasonable cooperation and information to help Customer meet its own obligations to notify Supervisory Authorities and Data Subjects.

8.4 How notice is given

Webomax will send notices under this Section 8 to the email address associated with Customer's Account and may also give notice within the Service. Customer is responsible for keeping that email address current and monitored.

8.5 Customer's notifications

Customer, as Controller, decides whether to notify Supervisory Authorities, Data Subjects or anyone else about a Personal Data Breach affecting Customer Personal Data, and is responsible for doing so. Webomax will not make those notifications on Customer's behalf unless Customer asks it to and Webomax agrees in writing, or the law requires Webomax to make them.

8.6 No admission of fault

Webomax's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

8.7 Events outside this Section

This Section 8 does not apply to: (a) incidents affecting systems under the control of Customer or of its Customer-Selected Third Parties, such as a compromised Customer password, Connected Service account, BYO Key or MCP server, or a webhook link that has been exposed; or (b) actions carried out by Agents within the tools, permissions and autonomy settings that Customer configured, including actions induced by content from third parties. Customer is responsible for assessing those events and, where required, reporting them. On request, Webomax will provide reasonable assistance, including information that the Service records about the event, such as activity records, task timelines and approval records.

9. Data protection impact assessments and prior consultation

Taking into account the nature of the processing and the information available to Webomax, Webomax will provide Customer with reasonable assistance with any data protection impact assessment, and any prior consultation with a Supervisory Authority, that Data Protection Laws require of Customer in connection with its use of the Service, and with any risk assessment or cybersecurity audit that US State Privacy Laws require of Customer. Webomax will provide this assistance primarily by making available this DPA, including its Annexes, and the Privacy Policy. Additional assistance at Customer's request may be subject to reasonable fees, to the extent permitted by law. Where Data Protection Laws require it, Webomax will cooperate with a Supervisory Authority in the performance of its tasks.

10. Deletion and return of Customer Personal Data

10.1 Deletion by Customer while using the Service

Customer can delete Customer Personal Data at any time through the Service. Deletion in the Service generally takes effect immediately and cannot be undone. Agents that Customer removes ("fires") can be restored for 30 days and are then permanently deleted together with their configuration and memory; the work they produced, such as tasks, deliverables and records, stays in the Workspace.

10.2 Copies that remain after an individual item is deleted

Deleting an individual item does not always delete every copy of the data it contains. Until the Workspace is deleted:

• (a) earlier versions of knowledge items, Agent setups, skills, routines and record types remain in the Workspace's version history, even after the item itself is deleted;
• (b) changes that Agents made to a record remain in the timeline of the task that made them until that task is deleted, even after the record is deleted;
• (c) files attached to a conversation remain in storage after the conversation is deleted;
• (d) the title and summary of a deleted task remain in usage records, and the results of automated checks about it are kept;
• (e) approval requests, notifications and activity records cannot be deleted individually;
• (f) the logs of a routine's runs, including the incoming data that started them, remain after the routine is deleted; and
• (g) Agent memories and knowledge items that have reached their expiry or end date stop being used, but are kept until they are deleted.

Customer can ask Webomax for help deleting specific copies under Section 7.3.

10.3 Deleting a Workspace or the Account

When Customer deletes a Workspace, Webomax immediately and permanently deletes the Workspace and the Customer Personal Data in it from the Service's active systems, including its records, knowledge, tasks, conversations, routines, Agents, files and connection records. When Customer deletes its Account, Webomax does the same for every Workspace that Customer owns and then deletes the Account. There is no grace period and no undo, so Customer must export anything it wants to keep before deleting (see Section 10.5). As the Terms describe, deleting a Workspace or the Account also ends the related paid Subscription immediately. If a deletion does not complete fully, Webomax will complete it once it becomes aware of the failure.

10.4 Data that is not deleted, or not deleted immediately

The following are not deleted, or not deleted immediately, when a Workspace or the Account is deleted:

• (a) copies in backups maintained by Webomax's hosting provider, until those backups are overwritten in the normal backup cycle;
• (b) data in operational and security logs kept by Webomax's hosting and infrastructure providers, until it expires under those providers' retention settings;
• (c) data that Sub-processors retain under their own terms, such as data that AI Sub-processors keep for a limited period to monitor for abuse;
• (d) data that Customer or its Agents sent to Customer-Selected Third Parties, and the authorizations that Customer granted to Connected Services. Deleting a Workspace or the Account may not revoke those authorizations, so before deleting, Customer should disconnect each Connected Service in the Service and also revoke access within the Connected Service itself;
• (e) Agent avatar images that Customer uploaded. These can be viewed by anyone who has their link, and they are not removed by deleting a Workspace or the Account or by the automatic deletion of fired Agents. Customer can remove them by permanently removing the Agent in the Service before deleting, or by asking Webomax at info@simurg.me to remove them; and
• (f) Customer Personal Data that Webomax must keep to comply with law, or that is needed to establish, exercise or defend legal claims.

Account Data that Webomax keeps after deletion, such as billing records and the records used to prevent repeat claims of free Credits, is described in the Privacy Policy. Webomax will continue to protect any Customer Personal Data it retains under this Section 10.4 in accordance with this DPA, will process it only for the purpose for which it is retained, and will delete it when that purpose ends.

10.5 Return of Customer Personal Data

Before deleting a Workspace or the Account, Customer can export Customer Personal Data using the export tools described in Section 7.1. Those tools do not cover all data; for example, they do not export records, Agents, tasks, knowledge, conversations, version history or files in bulk. If Customer needs a copy of other Customer Personal Data, it may ask Webomax at info@simurg.me before deleting, and Webomax will provide reasonable assistance to return that data in a commonly used, machine-readable format, subject to reasonable fees to the extent permitted by law. Webomax cannot return data after it has been deleted.

10.6 End of the Terms

Cancelling a paid Subscription does not delete Customer Personal Data: the Workspace continues on the Free plan, as described in the Terms, until Customer deletes it. If the Terms end, or Webomax closes Customer's Account, other than by Customer deleting it, Webomax will delete Customer Personal Data within 90 days afterwards, subject to Section 10.4. If Customer asks within 30 days after the Terms end or the Account is closed, Webomax will first return Customer Personal Data under Section 10.5, unless the law prohibits it.

10.7 Confirmation of deletion

On Customer's written request, Webomax will confirm in writing that it has deleted Customer Personal Data in accordance with this Section 10, subject to Section 10.4.

11. Audits and information

11.1 Information first

Webomax will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, with the other Data Protection Laws that apply to Webomax as a Processor, and with this DPA. That information consists of: (a) this DPA, including its Annexes, and the Privacy Policy; (b) Webomax's written answers, once in any 12-month period, to a reasonable written information-security and data-protection questionnaire; and (c) any further information that Webomax reasonably agrees to provide. Customer will first seek to exercise its audit and information rights through (a) to (c).

11.2 Certifications and Sub-processor reports

Webomax does not currently hold third-party security certifications or audit reports of its own. Webomax does not operate data centers of its own: the Service runs on infrastructure provided by Sub-processors, many of which make their own audit reports and certifications available under their own terms. Webomax will provide reasonable help to identify those reports. Controls operated by Sub-processors are assessed through those reports, not through audits of Sub-processors' facilities or systems.

11.3 Audits and inspections

Customer may conduct an audit, including an inspection, of Webomax's processing of Customer Personal Data only where: (a) a Supervisory Authority requires it; (b) Data Protection Laws (including the SCCs, where they apply) give Customer a right to it that the information in Section 11.1 cannot reasonably satisfy; or (c) it is reasonably necessary to assess a Personal Data Breach affecting Customer Personal Data. Any such audit:

• (i) requires at least 30 days' written notice to info@simurg.me, with a proposed scope, unless a Supervisory Authority requires a shorter period;
• (ii) may take place no more than once in any 12-month period, except under (a) or (c);
• (iii) will be conducted during normal business hours, remotely wherever possible, and in a way that minimizes disruption to Webomax's business;
• (iv) will be carried out by Customer or by an independent auditor that is reasonably acceptable to Webomax, is not a competitor of Webomax and is bound by written confidentiality obligations;
• (v) will not include access to other customers' data, to Sub-processors' facilities or systems, to information subject to legal privilege, or to information whose disclosure would compromise the security of the Service;
• (vi) is at Customer's expense, including Webomax's reasonable costs for the time its personnel spend on the audit; and
• (vii) will produce results that are Webomax's confidential information, a copy of which Customer will give to Webomax.

11.4 Remediation

If an audit, or the information provided under Section 11.1, shows that Webomax has materially failed to comply with this DPA, Webomax will take reasonable steps to remedy the failure.

11.5 Relationship with the SCCs

The parties agree that the audits described in Clauses 8.9(c) and 8.9(d) of the SCCs will be carried out in accordance with this Section 11, to the extent consistent with the SCCs. Nothing in this Section 11 changes the SCCs or limits the powers of any Supervisory Authority.

12. International transfers

12.1 Where Customer Personal Data is processed

Webomax is located in the United States. The Service's primary data store is in the United States: Webomax's hosting provider, Supabase, runs the Service's database, file storage and server functions on Amazon Web Services infrastructure in the us-east-1 region (Northern Virginia). Sub-processors may process Customer Personal Data in the United States and in other countries, as described in the Sub-processor List, and Webomax's authorized personnel may access Customer Personal Data remotely from the countries in which they are located. Webomax does not offer hosting or data residency in the EEA, the United Kingdom, Switzerland or any other specific location. Customer authorizes these transfers, subject to this Section 12.

12.2 Transfer mechanisms

For each Restricted Transfer from Customer to Webomax, the parties will rely on the first of the following that applies:

• (a) an adequacy decision or adequacy regulation that covers the transfer;
• (b) any other valid transfer mechanism that Webomax adopts in future, such as certification under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework (Webomax is not certified under any of them as of the date of this DPA); or
• (c) the SCCs, as completed and supplemented by Sections 12.3 to 12.6.

If the mechanism being relied on is invalidated or stops applying, the next mechanism in this list applies. If none applies, the parties will cooperate in good faith to put a lawful mechanism in place, and either party may suspend the affected transfers in the meantime.

12.3 EU Standard Contractual Clauses

For Restricted Transfers subject to the EU GDPR, the SCCs are incorporated into this DPA and form part of it as if set out in full, completed as follows:

• (a) Modules. Module Two (controller to processor) applies where Customer is a Controller. Module Three (processor to processor) applies where Customer is a Processor.
• (b) Parties. Customer is the data exporter and Webomax is the data importer.
• (c) Clause 7 (Docking clause). Does not apply.
• (d) Clause 9(a) (Use of sub-processors). Option 2 (general written authorization) applies. The time period for prior notice of intended changes to Sub-processors is 14 days, and notice is given as described in Section 6.4.
• (e) Clause 11(a) (Redress). The optional language does not apply.
• (f) Clause 13(a) (Supervision). The competent supervisory authority is determined as set out in Annex I, Part C.
• (g) Clause 17 (Governing law). Option 1 applies, and the SCCs are governed by the law of Ireland.
• (h) Clause 18(b) (Choice of forum and jurisdiction). Disputes arising from the SCCs will be resolved by the courts of Ireland.
• (i) Annexes. Annex I.A, I.B and I.C of the SCCs are completed with the information in Annex I of this DPA; Annex II of the SCCs with Annex II of this DPA; and Annex III of the SCCs with the Sub-processor List, as summarized in Annex III of this DPA.
• (j) How the SCCs work with this DPA. Customer's instructions under Clause 8.1 are those described in Section 3. The certification of deletion under Clause 8.5 is provided on Customer's request under Section 10.7. Notice of personal data breaches under Clause 8.6(c) is given under Section 8. Audits under Clause 8.9 are carried out under Section 11. Copies of sub-processor agreements under Clause 9(c) are provided under Section 6.3. Data subject requests under Clause 10 are handled under Section 7, and Customer authorizes the responses described in Section 7.2. Requests from public authorities under Clause 15 are handled under Section 4.11. In each case this applies to the extent consistent with the SCCs.
• (k) Execution. Customer's acceptance of the Terms is treated as its execution of the SCCs, and Webomax's publication of this DPA and provision of the Service is treated as Webomax's execution of the SCCs, in each case with effect from the start of the relevant Restricted Transfer.

12.4 United Kingdom

For Restricted Transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated into this DPA. The UK Addendum is completed as follows:

• (a) Table 1 (Parties). The parties, their details and their key contacts are set out in Annex I, Part A.
• (b) Table 2 (Selected SCCs, Modules and Selected Clauses). The Addendum EU SCCs are the SCCs as incorporated by Section 12.3, including the Modules and clause selections described there.
• (c) Table 3 (Appendix Information). The list of parties, the description of the transfer, the technical and organisational measures and the list of sub-processors are set out in Annexes I, II and III.
• (d) Table 4 (Ending this Addendum when the Approved Addendum changes). The importer (Webomax) may end the UK Addendum as set out in Section 19 of the UK Addendum.
• (e) Part 2 (Mandatory Clauses). The Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commissioner and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses, apply.

As the UK Addendum provides, the SCCs as they apply to these transfers are governed by the laws of England and Wales, and disputes arising from them are resolved by the courts of England and Wales. If the UK Government or the Information Commissioner approves a replacement for the UK Addendum, Webomax may adopt it by updating this DPA under Section 15.3.

12.5 Switzerland

For Restricted Transfers subject to the Swiss FADP, alone or together with the EU GDPR, the SCCs as completed under Section 12.3 apply with the following changes:

• (a) references to the GDPR are to be read as references to the Swiss FADP, to the extent the transfer is subject to it;
• (b) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority under Clause 13 for transfers governed by the Swiss FADP, alongside the authority identified in Annex I, Part C where the EU GDPR also applies;
• (c) the term "Member State" in the SCCs must not be interpreted in a way that excludes Data Subjects in Switzerland from bringing claims for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c); and
• (d) Clauses 17 and 18(b) continue to refer to the law and courts of Ireland.

12.6 Other countries

Where other Data Protection Laws require a transfer mechanism for Customer Personal Data that leaves a country, the SCCs as completed under Section 12.3 apply with the changes those laws require, unless Webomax makes another lawful mechanism available.

12.7 Onward transfers to Sub-processors

Webomax will ensure that any onward transfer of Customer Personal Data to a Sub-processor complies with Data Protection Laws and, where the SCCs apply, with Clause 8.7 of the SCCs, including, where needed, by putting the SCCs or another valid transfer mechanism in place between Webomax and the Sub-processor.

12.8 Transfer assessments

Webomax will provide the information that Customer reasonably requests to assess a transfer under Clause 14 of the SCCs, including information about the Security Measures and, to the extent the law allows, about requests from public authorities for Customer Personal Data. If Webomax has reason to believe that it can no longer comply with the SCCs, it will promptly notify Customer, and Customer may suspend the transfer as set out in Clause 16 of the SCCs.

12.9 Conflicts

If this DPA or the Terms conflict with the SCCs, the UK Addendum or the Swiss changes in Section 12.5, the SCCs, the UK Addendum or those changes (as applicable) prevail for the Restricted Transfers they govern.

13. US state privacy laws

13.1 Application

This Section 13 applies to Customer Personal Data that is subject to US State Privacy Laws. With respect to that data, Webomax is a "service provider" (and, where relevant, a "contractor" or "processor"), and Customer discloses Customer Personal Data to Webomax only for the Business Purposes in Section 13.2.

13.2 Business Purposes

Webomax processes Customer Personal Data only for the following specific business purposes (the "Business Purposes"):

• (a) hosting, storing and organizing Customer Personal Data in Customer's Workspaces and making it available to Customer;
• (b) providing the Service's AI features at Customer's direction, including generating responses, Outputs, summaries, titles and images, creating embeddings for search and Agent memory, and running automated safety, risk, routing, triage and scoring checks;
• (c) carrying out the actions that Customer or its Agents direct in Connected Services and MCP servers, and receiving data and events from the Connected Services, webhooks and web pages that Customer configures or directs;
• (d) running Customer's routines, schedules and other automations;
• (e) providing customer support that Customer requests;
• (f) helping to ensure security and integrity, including detecting security incidents and protecting against malicious, deceptive, fraudulent or illegal activity;
• (g) debugging to identify and repair errors that impair existing intended functionality;
• (h) maintaining and improving the quality and safety of the Service, as US State Privacy Laws permit for service providers and as described in Section 4.9; and
• (i) complying with law, and other purposes that US State Privacy Laws permit for service providers.

13.3 Restrictions

Webomax will not:

• (a) sell or share Customer Personal Data;
• (b) retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the Business Purposes or as otherwise permitted by US State Privacy Laws;
• (c) retain, use or disclose Customer Personal Data outside the direct business relationship between Webomax and Customer;
• (d) combine Customer Personal Data with personal information that it receives from or on behalf of another person, or collects from its own interactions with consumers, except as US State Privacy Laws permit (for example, to perform a Business Purpose, or to detect security incidents and protect against fraud); or
• (e) attempt to re-identify Aggregated Data, except as permitted by law.

13.4 Compliance and level of protection

Webomax will comply with the obligations that US State Privacy Laws impose on service providers and processors, and will provide the same level of privacy protection as those laws require of Customer, including by implementing the Security Measures and by assisting Customer with consumer requests as described in Section 7.

13.5 Notice if Webomax cannot comply

Webomax will notify Customer no later than five business days after it determines that it can no longer meet its obligations under US State Privacy Laws.

13.6 Customer's rights to monitor and remediate

Customer may take reasonable and appropriate steps to ensure that Webomax uses Customer Personal Data consistently with Customer's obligations under US State Privacy Laws, by exercising its information and audit rights under Section 11. Upon notice to Webomax, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including by requiring Webomax to stop the unauthorized use, to provide documentation about it and to delete the data concerned, and by stopping its own use of the affected part of the Service.

13.7 Consumer requests

Customer will inform Webomax of any consumer request made under US State Privacy Laws with which Webomax must comply, and will provide the information Webomax needs to comply. Webomax will then assist as described in Section 7, subject to the exceptions that the law allows.

13.8 Subcontractors and other processor requirements

Webomax engages Sub-processors only under written contracts that bind them to restrictions consistent with this Section 13, and notifies Customer of new Sub-processors under Section 6, which gives Customer an opportunity to object. The duty of confidentiality in Section 4.3, the deletion and return obligations in Section 10, and the information and assessment rights in Section 11 also apply to Customer Personal Data that is subject to US State Privacy Laws.

13.9 Certification

Webomax certifies that it understands the restrictions in this Section 13 and will comply with them.

14. Liability

14.1 Limitation of liability

EACH PARTY'S LIABILITY ARISING OUT OF OR RELATING TO THIS DPA (INCLUDING, TO THE EXTENT PERMITTED BY LAW, THE SCCs AND THE UK ADDENDUM), WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, IS SUBJECT TO THE EXCLUSIONS AND LIMITATIONS OF LIABILITY IN THE TERMS THAT APPLY TO THAT PARTY. WEBOMAX'S TOTAL AGGREGATE LIABILITY UNDER THE TERMS AND THIS DPA TOGETHER IS SUBJECT TO THE SINGLE LIMIT SET OUT IN THE TERMS. THIS DPA DOES NOT CREATE A SEPARATE OR ADDITIONAL LIMIT, AND CLAIMS UNDER THIS DPA COUNT TOWARD THAT LIMIT.

14.2 Liability that cannot be limited

Nothing in this DPA limits: (a) either party's liability to Data Subjects under the third-party beneficiary provisions of the SCCs or under Data Protection Laws, where such a limitation is not permitted; or (b) any liability that cannot be limited or excluded under applicable law.

14.3 Allocation between the parties

Where one party has paid compensation, a fine or another amount for damage caused in whole or in part by the other party's breach of this DPA or of Data Protection Laws, it may claim back from the other party the part of that amount that corresponds to the other party's responsibility for the damage, subject to Section 14.1.

14.4 Customer's responsibility

Customer is responsible for, and Customer's defense and indemnification obligations in the Terms extend to, claims, losses, damages, costs and expenses (including, to the extent the law permits, fines and penalties) arising from: (a) Customer's instructions; (b) Customer's breach of this DPA or of Data Protection Laws, including any failure to have a legal basis or to give required notices; (c) Prohibited Data; (d) actions carried out by Agents within the tools, permissions and autonomy settings that Customer configured; and (e) Customer-Selected Third Parties.

14.5 No indemnity by Webomax

This DPA does not create any obligation for Webomax to defend or indemnify Customer.

15. Term, changes and precedence

15.1 Term

This DPA takes effect when Customer accepts the Terms or, if later, on October 13, 2026. It remains in effect for as long as Webomax processes Customer Personal Data, including after the Terms end, until that data has been deleted or returned under Section 10. Provisions that by their nature should survive will survive.

15.2 Order of precedence

If these documents conflict, the following order applies, with the first prevailing: (a) for Restricted Transfers, the SCCs, as supplemented by the UK Addendum and Section 12.5; (b) this DPA, with respect to the processing of Customer Personal Data; and (c) the Terms. The Privacy Policy describes Webomax's processing as a Controller and does not amend this DPA, except that the Sub-processor List forms part of this DPA. Nothing in the Terms or this DPA may be read to contradict the SCCs or to prejudice the fundamental rights or freedoms of Data Subjects.

15.3 Changes to this DPA

Webomax may update this DPA: (a) to reflect changes in Data Protection Laws, regulatory guidance or approved transfer mechanisms, including replacement standard contractual clauses; (b) to reflect changes to the Sub-processor List made under Section 6; and (c) in other ways that do not materially reduce the protection of Customer Personal Data. These updates take effect when posted. Any other update takes effect no earlier than 30 days after Webomax gives notice by email to the address associated with Customer's Account or within the Service. If Customer objects to an update that materially reduces the protection of Customer Personal Data, Customer may, before the update takes effect, stop using the Service, terminate its Subscriptions and delete its Account in accordance with the Terms, without any termination charge. Updates do not change the SCCs, except to replace them with an approved new version, and do not apply to a Personal Data Breach that occurred before the update took effect. The "Last updated" date at the top of this DPA shows when it last changed.

15.4 Governing law and disputes

Except where the SCCs or the UK Addendum require otherwise for disputes arising from them (Clauses 17 and 18 of the SCCs, as completed under Sections 12.3 to 12.5), or where Data Protection Laws require otherwise, this DPA is governed by the law that governs the Terms, and disputes arising out of or relating to this DPA are resolved under the dispute-resolution provisions of the Terms, including binding individual arbitration and the class action waiver.

15.5 Notices

Webomax will give notices under this DPA to the email address associated with Customer's Account or within the Service. Customer must send notices under this DPA to info@simurg.me, and must give legal notices as the Terms require.

15.6 Third-party rights

Except for the rights that the SCCs give Data Subjects as third-party beneficiaries, no third party has any right to enforce this DPA.

15.7 Severability

If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in effect, and the affected provision will be modified to the minimum extent necessary to make it valid and enforceable while preserving the parties' intent or, if that is not possible, removed. This does not affect the SCCs, which apply as approved.

15.8 Language

This DPA is written in English. If it is translated, the English version controls, except where the SCCs or Data Protection Laws require otherwise.

Annex I. Description of the processing

This Annex completes Annex I of the SCCs and sets out the details of processing that Article 28(3) of the GDPR and US State Privacy Laws require.

Part A. List of parties

Part B. Description of the processing and transfer

Subject matter. Webomax's provision of the Service to Customer: an AI business operating system in which Customer's Agents read and write Customer's records and knowledge, converse with Customer, carry out tasks and routines, and act in Customer's Connected Services.

Categories of Data Subjects. Determined by Customer. They may include:

• Customer's current, former and prospective customers, clients and leads, and their representatives;
• Customer's business contacts, partners, suppliers and vendors;
• Customer's employees, contractors and other personnel, including Authorized Users, to the extent they appear in Customer Content;
• senders, recipients and other participants in the communications, calendars and files that the Service processes through Connected Services;
• individuals who submit information to Customer through forms, webhooks or other integrations that Customer connects to routines;
• users of Customer's own products and services whose data is held in Customer's Connected Services (for example, an online store or a CRM); and
• individuals who are mentioned in, or shown in, documents, knowledge, files, images, web pages and Outputs.

Categories of Personal Data. Determined by Customer. They may include:

• identity and contact details, such as names, email addresses, phone and messaging numbers, postal addresses, city and country, and social media handles;
• professional details, such as employer or company, job title or role, and business website;
• relationship, sales and support data, such as lead source, status, stage, notes, interaction history, last-contact dates, support tickets and their resolution, and categories, scores and rankings (including scores generated by AI);
• communications, such as the content and metadata of emails, messages, chats, calendar entries and comments, including drafts and messages that Agents prepare or send;
• commercial and transaction information from Customer's business, such as orders, returns, subscriptions, plans, invoices, payment status and customer value (but not Prohibited Data);
• reviews, ratings and feedback;
• the content of documents, knowledge, files and images, including images of people and metadata embedded in files, such as location data stored in photos, which the Service does not remove;
• data contained in incoming webhook and Connected Service event payloads;
• Outputs about individuals, such as summaries, drafts, classifications, scores and other inferences;
• derived data, such as numeric representations of text (embeddings) used for search and Agent memory; and
• any other Personal Data that Customer chooses to include in custom record types, knowledge, instructions, conversations or files, subject to Section 3.5.

Sensitive data. None is intended to be transferred. Customer must not submit Prohibited Data, which includes special categories of personal data and personal data relating to criminal convictions and offences (Section 3.5). Webomax has not adopted restrictions or safeguards specific to sensitive data beyond the Security Measures in Annex II, which are not designed for it.

Frequency of the transfer. Continuous, for as long as Customer uses the Service.

Nature of the processing. Collection (including retrieval from Connected Services, MCP servers, web pages, webhooks and Connected Service events), recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (to Sub-processors and, on Customer's instructions, to Customer-Selected Third Parties), combination within Customer's Workspaces, restriction and erasure. This includes:

• storing and indexing Customer Content, and creating embeddings so that it can be searched;
• sending prompts and context (such as instructions, conversation history, relevant knowledge, records, file contents, images, temporary links to files, results of actions, and data retrieved from Connected Services) to AI Sub-processors to generate responses, Outputs, images, titles, summaries and proposals;
• automated evaluation of content by AI, including risk checks on proposed actions and deliverables, screening of outside content for hidden instructions, relevance ranking of knowledge, triage of incoming items in routines, and scoring of records against criteria that Customer sets;
• carrying out the actions in Connected Services and MCP servers that Agents take and that Customer approves or permits;
• receiving and storing incoming webhook and Connected Service event data, and starting routines from it;
• fetching public web pages at the request of Customer or an Agent; and
• deletion at Customer's request and as described in Section 10.

Purposes of the processing. To provide the Service to Customer in accordance with the Terms and Customer's instructions under Section 3, for the Business Purposes listed in Section 13.2, and, as an independent Controller, for Webomax's legitimate business operations described in Section 4.9.

Duration and retention. For the term of the Terms and afterwards until deletion under Section 10. Within that period, Customer Personal Data is kept as follows:

Transfers to Sub-processors. Customer Personal Data is transferred to Sub-processors for the subject matter, nature and duration described above, to the extent that each Sub-processor's function described in Annex III requires, for as long as the Sub-processor provides its services to Webomax, and subject to the Sub-processor's own retention as described in Section 10.4.

Part C. Competent supervisory authority

For the purposes of Clause 13 of the SCCs, the competent supervisory authority is:

• (a) where Customer is established in an EEA member state, the supervisory authority of that member state that is responsible for ensuring Customer's compliance with the EU GDPR as regards the transfer;
• (b) where Customer is not established in the EEA but falls within the territorial scope of the EU GDPR under its Article 3(2) and has appointed a representative under its Article 27(1), the supervisory authority of the member state in which that representative is established;
• (c) where Customer is not established in the EEA, falls within the territorial scope of the EU GDPR under its Article 3(2) and is not required to appoint a representative, the supervisory authority of the member state in which the Data Subjects whose personal data is transferred are located or, where they are located in more than one member state, the member state in which most of them are located;
• (d) for Restricted Transfers subject to the UK GDPR, the UK Information Commissioner; and
• (e) for Restricted Transfers subject to the Swiss FADP, the Swiss Federal Data Protection and Information Commissioner, as set out in Section 12.5.

Annex II. Technical and organisational measures

This Annex completes Annex II of the SCCs and describes the measures in place on the date shown at the top of this DPA. Part A lists the Security Measures that Webomax commits to maintain under Section 5. Part B describes features that Customer can use to supervise Agents; they are not Security Measures (see Section 5.5). Part C describes how Webomax helps Customer with Data Subject requests and deletion, and Part D covers Sub-processors.

Part A. Security Measures

1. Hosting, infrastructure and physical security

• The Service's database, authentication, file storage and server functions are hosted by Supabase on Amazon Web Services infrastructure in the us-east-1 region (Northern Virginia, United States). The Simurg web application is delivered through Cloudflare's network.
• Webomax operates no data centers or servers of its own. The physical and environmental security of the infrastructure is provided by the hosting providers under their own security programs.

2. Encryption

• Connections between users' browsers and the Service, and between the Service and its Sub-processors, are encrypted in transit using TLS (HTTPS).
• Data stored in the Service's database and file storage is encrypted at rest by the hosting provider at the storage level.
• Webomax does not apply additional application-level or field-level encryption. Credentials that Customer gives the Service, including BYO Keys, MCP server tokens and routine webhook keys, are stored in the database, where they are protected by the hosting provider's encryption at rest and by the access controls below. The Service displays BYO Keys back to Customer only in masked form.

3. Tenant isolation and access control

• Row-level security is enabled on every table that the Service creates in its database. Customer data is linked to a Workspace and can be read or changed through the Service's application interfaces only by the account that owns that Workspace, except for the limited administrator access described in Section 4.4.
• Each Workspace currently has a single owner account. The Service has no shared, guest or team access to Workspaces.
• Files are kept in private storage, where access is limited to the owning account's Workspace, and are shown and downloaded through signed links that expire after one hour. Agent avatar images that Customer uploads are the exception: they are kept in public storage and can be viewed by anyone who has their link.
• Server functions use privileged credentials that bypass row-level security. Server functions that act at a signed-in user's request check in code that the user owns the Workspace concerned before acting.
• The credentials that the Service uses to reach Sub-processors, and the secrets used to verify incoming events, are stored as server-side environment secrets rather than in the database, and are not sent to browsers.
• Access to Webomax's in-product administration tools requires an administrator role, which only an existing administrator can grant. Access to back-end systems is limited to authorized personnel.

4. User authentication and sessions

• Users sign in with an email address and password, with confirmation of the email address, or, where offered, with Google sign-in. Passwords are handled by the authentication provider and stored only in hashed form; the Service's application code does not store them.
• Sign-ups from known disposable email domains are refused.
• Customer can sign out of the Service on all devices from the Service's security settings.
• The Service does not currently offer multi-factor authentication.

5. Protection of incoming data and endpoints

• Incoming payment events from Stripe and incoming Connected Service events from Composio are authenticated with cryptographic signatures, and events older than five minutes are rejected. Connected Service events for triggers the Service does not recognize are ignored and not stored.
• Each routine webhook link contains a randomly generated secret key, which the Service checks in constant time. Customer can generate a new link at any time. Each routine can be started from outside sources at most 20 times per hour.

6. Application security

• The web application sends security headers that prevent it from being embedded in other sites, prevent content-type sniffing, limit the referrer information sent to third parties, and block access to the camera, microphone and location.
• Web page fetching by Agents and by the knowledge tools accepts only public domain names (not IP addresses or internal host names) on standard web ports, and limits redirects, response size and time.
• Requests to MCP servers that Customer adds must use HTTPS, and redirects are refused.
• Content from outside sources, such as web pages, files, Connected Service results and incoming events, is marked as untrusted when it is given to AI models.
• Webomax uses automated tests in its software development process.

7. Availability and resilience

• The Service relies on the managed infrastructure of its hosting providers and on the backup features available under Webomax's hosting plan. Webomax does not offer an availability commitment.
• Background processing is monitored, and failures of tasks and routines are recorded for Webomax's administrators to review.
• Limits on how many tasks can run at once in each Workspace, and on how often routines can be started from outside sources, help protect the stability of the Service.

8. Logging and accountability

• The Service records Agents' actions in an activity log; records the tools that Agents call, and their arguments, in task timelines; records the changes that Agents make to records; and records who approved, rejected or changed a proposed action or deliverable, and when. Customer can view these records in the Service.
• Webomax's hosting and infrastructure providers keep request and authentication logs, which may include IP addresses, under their own retention settings.

9. Data minimization and limited retention

• The Service identifies each Workspace to Composio by a randomly generated identifier, not by Customer's name or email address.
• Records of the Service's automated checks keep an excerpt of at most 4,000 characters of the content checked, and the excerpt is deleted after 30 days.
• Incoming webhook and Connected Service event data is stored up to 8,000 characters per item.
• Fired Agents are permanently deleted after 30 days, unless restored.
• For documents added to knowledge, the Service stores the extracted text, not the original file.
• The Service's application contains no advertising or analytics trackers.
• Webomax does not use Customer Personal Data to train AI models (Section 4.7).

10. Personnel

• Personnel authorized to process Customer Personal Data are bound by confidentiality obligations and may access it only for the purposes described in Section 4.4.
• Access is granted on a need-to-know basis and removed when it is no longer needed.

11. Incident response

• Webomax investigates suspected security incidents and handles Personal Data Breaches as set out in Section 8.

Part B. Agent supervision features (not Security Measures)

The following features help Customer supervise Agents. As Section 5.5 explains, they are not Security Measures: some rely on AI judgments, they may not catch every risky action or malicious instruction, and Webomax may change, improve or withdraw them.

• Autonomy levels. Each Agent has one of three levels: "Ask me first", "Ask unless it's routine" and "Auto" (the default for new Agents). Under "Ask me first", write actions in Connected Services and MCP servers wait for Customer's approval, and changes to existing knowledge always ask first. Built-in actions inside the Service, such as creating and updating records, saving new knowledge and deliverables, fetching web pages and generating images, run without approval prompts under "Ask me first" and the less restrictive levels.
• Read and write actions. The Service treats an action in a Connected Service or MCP server as a read only when its name identifies it as one (for example, "get", "list" or "search"); all other actions are treated as writes. Reads run without approval. This classification is automatic and may occasionally be wrong.
• Per-tool rules. For actions in Connected Services, Customer can set each tool to "Always allow", "Ask" or "Blocked", and can switch a Connected Service off for an individual Agent.
• "Ask unless it's routine". Under this level, a write action that has no per-tool rule runs without asking only if an automated AI check finds no risk flags and judges it very unlikely to be irreversible, the action contains no email address, and the task has not been flagged for untrusted content. Otherwise, the action waits for approval.
• Approvals. An approval request shows the exact action and its details. Customer can edit the details before approving, and the Service then runs the approved action with the approved details, subject to minor technical adjustments that a Connected Service may require. If one action in a step needs approval, the other write actions in that step wait too. Approval requests that are not answered within a set period (72 hours by default) are cancelled, and the action never runs.
• Risk checks before unattended actions. When an action is about to run without asking (under "Auto" or an "Always allow" rule), an automated AI check assesses risks such as irreversibility, unfilled placeholders, money commitments, legal or medical claims, harsh tone, a wrong recipient and breaches of Customer's red lines. It holds the action for approval when the risk is rated high or the action is flagged for placeholders, a money commitment, a legal or medical claim, a wrong recipient or a red-line breach. If the check cannot be completed, the action is held. An action with no such flags, such as a plain email, may run without approval.
• Prompt-injection screening. Content that Agents receive from outside sources, such as Connected Services, MCP servers, web pages, attachments and incoming events, is screened by an automated AI check for hidden instructions or attempts to send data out. If content is flagged, or the check fails, every write action in that task waits for approval, even if it would otherwise run without asking.
• Red lines. Customer can write up to 10 plain-language rules that its Agents must never break. The automated checks take them into account, but they are not enforced as fixed rules.
• Stop controls. "Halt all agents" stops new and queued automated runs in a Workspace. A run already in progress is not interrupted, and incoming webhook and Connected Service items received while the halt is on are skipped and not replayed later. Customer can also pause individual Agents, stop individual tasks and set Agents' working hours.
• Spend and volume limits. Customer can set daily and monthly token limits, with an optional "Stop new jobs" setting for task runs. Each Workspace has a limit on how many tasks can run at once, each routine can be started from outside sources at most 20 times per hour, and only one task at a time can change a given record.

Part C. Assistance with Data Subject requests and deletion

• Self-service tools to view, correct, export and delete Customer Personal Data (Section 7.1).
• Immediate deletion of Workspaces and of the Account (Section 10.3).
• Assistance by email at info@simurg.me for data that the self-service tools do not reach, and for returning data before deletion (Sections 7.3 and 10.5).

Part D. Sub-processors

Webomax engages Sub-processors under Section 6, under written agreements, and relies on their security programs for the infrastructure and services they provide. The Sub-processors that process Customer Personal Data are listed in the Sub-processor List and summarized in Annex III.

Annex III. Sub-processors

This Annex completes Annex III of the SCCs. The current list of Sub-processors is maintained in the section of the Privacy Policy titled "Service providers and sub-processors" (the Sub-processor List), which also states where each provider processes data. The Sub-processor List forms part of this DPA and controls if it differs from the summary below. Changes are notified as described in Section 6.4.

Summary of the Sub-processors that process Customer Personal Data as of the date shown at the top of this DPA:

Which AI Sub-processors process a given Workspace's data depends on the models that Webomax selects and on the features Customer uses (see Section 6.6). The Sub-processor List also names service providers that Webomax uses only for Account Data, such as Stripe for payments and Resend for sign-in and account emails. They are not Sub-processors under this DPA because they do not process Customer Personal Data.