Data Processing Addendum

1. Roles and scope

Customer is the controller and Processor is the processor of personal data contained in content Customer sends to the Service (tasks, agent outputs, evidence, invoices and related fields). Processor is a controller only for its own account, billing, security and abuse-prevention data, which the privacy notice covers.

Details of processing are in Annex 1.

2. Processor obligations

Processor will: (a) process personal data only on Customer's documented instructions, which are the Terms, this DPA and Customer's API calls and settings, unless law requires otherwise, in which case Processor will tell Customer unless the law forbids it; (b) ensure people authorised to process the data are bound by confidentiality; (c) implement the security measures in Annex 2; (d) assist Customer, taking into account the nature of processing, with data subject requests, security, breach notification, data protection impact assessments and prior consultations; (e) make available information needed to demonstrate compliance and allow for audits as set out in section 7.

Processor will tell Customer if, in its opinion, an instruction infringes data protection law.

3. Subprocessors

Customer gives general authorisation for Processor to use the subprocessors listed in Annex 3. Processor will impose data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance.

Processor will announce a new subprocessor on https://screwtape.ai/trust/ at least 14 days before it starts processing Customer personal data. Customer may object on reasonable data protection grounds by email within that period; if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

4. International transfers

Processor is not established in the EU or EEA and its subprocessors process data in the United States. To the extent Customer's use of the Service involves a transfer of personal data subject to the GDPR to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) by reference: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. Clause 7 (docking) applies. In Clause 9, Option 2 (general authorisation) applies with the notice period in section 3. In Clause 11, the optional language does not apply. In Clauses 17 and 18, the law and courts are those of Ireland. Annexes I to III of the Clauses are completed by Annexes 1 to 3 of this DPA.

For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies. For Swiss transfers, the SCCs apply with references to the GDPR read as references to the Swiss FADP and the FDPIC as the competent authority. Onward transfers to subprocessors rely on their own SCCs or the EU-U.S. Data Privacy Framework, as listed in Annex 3.

5. Personal data breaches

Processor will notify Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting Customer personal data, by email to the address on the key or account, and will provide the information Customer reasonably needs to meet its own notification duties. Customers should keep a reachable email on their key or tell screwtapedev@gmail.com where to send notices.

6. Deletion and return

Receipts are kept for audit (1 year on Team, 7 years on Finance Control); judged content is not stored by default. Content stored by opt-in retention is deleted when its retention period ends, when the row is deleted, or when the API key is deleted with DELETE /v1/keys/me. At the end of the Service, Customer can export receipts with GET /v1/receipts/export and then delete the key, which deletes the remaining Customer personal data, except where law requires Processor to keep it.

7. Audits

Processor will answer reasonable written questions about its processing and security, and will make this DPA, the trust page and its subprocessors' certifications available. Where that is not enough to demonstrate compliance, Customer may, on 30 days' notice and no more than once a year (unless a regulator requires or after a breach), audit Processor through an independent auditor bound by confidentiality, at Customer's cost.

8. U.S. state privacy laws

Where U.S. state privacy laws apply, Processor acts as a service provider or processor. It will not sell or share personal data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, will not combine it with other data except as those laws allow, and will notify Customer if it can no longer meet these obligations.

9. Liability and precedence

Liability under this DPA is subject to the limits in the Terms, except where the SCCs or law do not allow that. If this DPA conflicts with the Terms, this DPA prevails for personal data processing; if it conflicts with the SCCs, the SCCs prevail.

Annex 1: Details of processing

Data exporter: the Customer. Data importer: Screwtape.ai, contact screwtapedev@gmail.com, the operator of an API that checks AI agent output and payment documents.

Data subjects: individuals whose personal data appears in content Customer sends, such as Customer staff, vendors' contact people, and end users named in tasks, outputs or invoices.

Categories of personal data: names, business contact details, invoice and payment-related fields, and any other personal data Customer includes in judged content. Customer must not send special categories of data or payment card numbers.

Nature and purpose: automated checking of agent outputs, consensus scoring, duplicate-invoice detection (which stores salted fingerprints, not the invoice fields), and issuing signed receipts, at Customer's request.

Frequency: continuous, per API call. Duration: for the term of the Service, then deletion under section 6.

Retention: content in memory for the duration of the request unless Customer opts in to retention (0, 1, 30 or 90 days on free keys; up to the plan's retention period on plans) or to data sharing (redacted samples, 90 days).

Annex 2: Technical and organisational measures

• Encryption in transit with HTTPS (TLS) on every endpoint; data at rest encrypted by Cloudflare D1.

• API keys stored only as SHA-256 hashes; caller IP addresses stored only as hashes; no raw judged content in logs.

• Data minimisation: judged content is not stored by default; retention is opt-in with fixed expiry and an hourly deletion job.

• Access control: operator routes require a separate secret; production access is limited to the operator account.

• Integrity: receipts are signed with Ed25519 and can be verified with the published public key.

• Availability: Cloudflare's global network; database backups are taken before schema changes.

• Secure development: automated tests and a secret scan run before every deploy; dependencies are kept minimal.

• Incident response: breach assessment and customer notification under section 5.

Annex 3: Subprocessors

• Cloudflare, Inc.: Hosting (Workers), database (D1), CDN, DNS and the Workers AI fallback model. Location: United States and Cloudflare's global network. Safeguard: Cloudflare DPA with EU Standard Contractual Clauses (Modules 2 and 3) and EU-U.S. Data Privacy Framework certification.

• Groq, Inc.: Model inference for judge and consensus calls (default model openai/gpt-oss-120b). Location: United States. Safeguard: Groq Customer Data Processing Addendum with EU Standard Contractual Clauses.

• PayPal: Card and PayPal payments for packs and plans (PayPal acts as an independent controller for payment data). Location: United States and PayPal's regions. Safeguard: PayPal's own privacy statement and transfer safeguards.

• x402 facilitators (x402.dexter.cash, facilitator.xpay.sh): Verify and settle USDC payments; they receive the payment payload only, never judged content. Location: Operator-hosted, location not published. Safeguard: No personal data beyond a public wallet address is sent.

• Public blockchain RPC providers (Base, Solana): Read on-chain payment status. Location: Various. Safeguard: Only public transaction data is read.