Data Processing Addendum

Effective date: November 10, 2026

This addendum is part of the Terms of Service between you and FormKit Inc., doing business as Standard Agents ("we," "us"). It applies when we process personal data of your users for you. You accept it when you accept the terms.

1. Definitions

• Your users' data means personal data, or personal information, of the people who use the agents you host with us, and any other personal data you place in your projects.
• Privacy laws means the United States state consumer privacy laws that apply to your users' data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, and similar state laws.
• Terms such as "business," "controller," "service provider," "processor," "sell," and "share" have the meanings the privacy laws give them.

2. Roles

For your users' data, you are the business or controller. We are your service provider or processor. Each of us will follow the privacy laws that apply to it.

This addendum does not cover your own account, billing, and usage data. We handle that data for our own purposes under the Privacy Policy.

3. Your instructions

We process your users' data only on your documented instructions. Your instructions are the terms, this addendum, and the way you configure your projects and agents. The processing has these features:

We will not:

• sell or share your users' data;
• retain, use, or disclose it for any purpose other than the business purposes in this section, including any commercial purpose of our own;
• retain, use, or disclose it outside the direct business relationship between you and us; or
• combine it with personal data we receive from another source, except as the privacy laws allow a service provider to do.

We will tell you if we decide that we can no longer meet our obligations under the privacy laws, or if we believe an instruction breaks them. You may then take reasonable steps to stop and correct any unauthorized use.

4. Your responsibilities

You decide what your agents collect and why. You will give your users the notices the law requires, have the rights and consents needed for us to process their data, and give us only lawful instructions.

5. Confidentiality

Everyone we authorize to process your users' data is bound by a duty of confidentiality. Access is limited to people who need it to operate, secure, or support the service.

6. Security

We maintain reasonable administrative, technical, and physical measures to protect your users' data. We may change those measures over time.

You are responsible for the security of your own agents, your API keys, and the access you give your team.

7. Subprocessors and model providers

Subprocessors. You authorize us to use the subprocessors listed in Section 7 of the Privacy Policy. These are the vendors we use for every customer. We bind each one by written terms that protect your users' data.

We give notice of a new subprocessor by updating that published list. The list is the notice. We send no separate notice, and a change gives no right to a refund. If you do not accept a new subprocessor, you may stop using the service and cancel.

Model providers. Model providers are third-party services that you select. They are not our subprocessors. You choose a provider and a model by writing an agent that uses them, and we require none of them. When your agent calls a model, we send your users' data to that provider on your instruction. Your choice of a provider is your instruction and your authorization for that disclosure. This applies whether the request uses your own provider key or passes through our router. If you choose a model through OpenRouter, OpenRouter selects the host that runs it. No notice duty in this section applies to model providers. The providers we offer are listed in the Providers section of our documentation.

8. Consumer requests and other help

You can access and delete your users' data yourself through the product and its APIs. If one of your users sends a request to us, we will pass it to you and will not answer it ourselves, unless the law requires us to.

Taking into account the nature of the processing and the information we have, we will give you reasonable help to:

• answer verified requests from your users to access, correct, or delete their data;
• carry out a data protection assessment that the privacy laws require of you; and
• meet your duties to keep the data secure.

9. Deletion at the end of service

You can delete a thread or a project at any time, which deletes its data. We may delete your users' data at any time after your account ends, and we delete it within a reasonable time, unless the law requires or allows us to keep it. Keep your own copies; we have no duty to store or back up data. Backups and logs are overwritten in the normal course after that. You can take a copy of your source code through Git before your account ends.

10. Security incidents

If we become aware of a breach of security that leads to unauthorized access to your users' data, we will notify the account owner by email without undue delay. We will describe what we know: what happened, the data involved, and what we are doing about it. You are responsible for any notice the law requires you to give your users or regulators.

11. Audit by written information

Once in any 12-month period, and after a security incident, you may send us a written request for information that shows we follow this addendum. We will answer in writing within a reasonable time with the information reasonably needed, which may include descriptions of our security measures and reports from our hosting provider. Our answers are our confidential information. This section gives no right to an on-site inspection.

12. General

If this addendum and the terms conflict about your users' data, this addendum controls. The liability limits, governing law, and dispute terms of the terms apply to this addendum.

Contact: [email protected]

FormKit Inc., doing business as Standard Agents
961 2nd St SE, Suite 303B
Charlottesville, VA 22902