Data Processing Agreement

Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meaning given by the EU General Data Protection Regulation 2016/679 ("GDPR"). "Data Protection Laws" means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection and any other data protection law that applies to the processing. "Customer Content" means the instructions, conversations, files, memory, routines, tables, connected-account data and other content the Customer or its agents put into the service.

This DPA covers the personal data contained in Customer Content. Data that Molted processes as a controller to run its business (account, billing, support, security and website data) is governed by the Privacy Policy.

• The Customer is the controller of the personal data in Customer Content, or a processor acting for its own clients. Molted is its processor or, in the second case, its sub-processor.
• The Customer is responsible for having a lawful basis for the personal data it entrusts to its agents, for informing data subjects and for the instructions it gives.
• The AI model provider the Customer connects (for example its own ChatGPT, Claude or API account) and the third-party apps the Customer authorizes its agent to use are chosen by the Customer and act under their own terms. They are not sub-processors of Molted.

Molted processes personal data only on the Customer's documented instructions, including for transfers outside the European Economic Area, unless a law to which Molted is subject requires otherwise; in that case Molted informs the Customer before processing unless that law forbids it. The Terms of Service, this DPA, the Customer's settings and the instructions it gives its agents through the service are the Customer's complete instructions.

Molted informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Laws. Molted does not sell Customer Content and does not use it to train AI models.

• Everyone at Molted authorized to process Customer Content is bound by an obligation of confidentiality.
• The team does not consult an agent's workspace in the normal course of operations. Access is limited to a small number of authorized people and to what is strictly necessary: when the Customer asks for help, when our systems detect potentially illegal or dangerous activity as described in the Terms of Service, or when the law requires it.

Molted implements the technical and organizational measures described in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. Molted may update these measures provided the overall level of protection is not reduced.

• Molted notifies the Customer of any personal data breach affecting Customer Content without undue delay and no later than 48 hours after becoming aware of it, by email to the account address.
• The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not available at first is provided as soon as possible.
• Molted takes reasonable steps to contain the breach and to limit its effects and helps the Customer meet its own notification obligations. Notification is not an admission of fault.

• The Customer gives Molted a general authorization to engage the sub-processors in the categories listed in Annex III.
• Molted imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA and remains liable to the Customer for its sub-processors.
• The current list of sub-processors is available on request from support@molted.cloud. For security reasons it is provided to customers under confidentiality rather than published.
• Molted informs customers by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot find a solution, the Customer may terminate the affected service and receive a refund of prepaid fees for the period after termination.

Molted is established in the United States. Where the Customer is subject to the GDPR and its use of the service involves a transfer of personal data to Molted outside the European Economic Area, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 ("SCCs") apply and are incorporated into this DPA by reference: Module 2 where the Customer is a controller, Module 3 where the Customer is a processor. The Customer is the data exporter and Molted the data importer.

• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorization) applies, with the 30-day notice period of section 7.
• Clause 11: the optional redress wording does not apply.
• Clause 13: the competent supervisory authority is that of the Member State in which the data exporter is established; if the exporter is not established in the EU, that of the Member State of its representative under Article 27 GDPR; failing that, the French CNIL.
• Clause 17: the SCCs are governed by French law. Clause 18: disputes arising from the SCCs are resolved by the courts of Paris, France.
• Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.
• For transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies, with the information in this DPA; either party may end it as allowed by its Section 19.
• For transfers subject to Swiss law, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner: references to the GDPR include the Swiss FADP and the competent authority is that Commissioner.
• Molted relies on the SCCs or an adequacy decision for its own onward transfers to sub-processors.

• Taking into account the nature of the processing, Molted helps the Customer respond to requests from data subjects. Most requests can be handled directly by the Customer from the dashboard, where it can read, export and delete its agents' content. If Molted receives a request directly, it redirects the person to the Customer.
• Molted provides reasonable help with data protection impact assessments and prior consultations, using the information available to it.
• Molted informs the Customer of any request from a public authority concerning Customer Content, unless the law forbids it and challenges requests it considers unlawful.

• Molted makes available the information needed to demonstrate compliance with this DPA and answers one reasonable security questionnaire per year.
• If this information is not enough, the Customer may have an audit carried out at its own cost by an independent auditor bound by confidentiality, at most once every 12 months, with 30 days' notice, during business hours and without disrupting the service or other customers' data. This frequency limit does not apply after a personal data breach or at the request of a supervisory authority.
• Molted does not hold a third-party security certification at this date.

• The Customer can export the files of its agents at any time from the dashboard.
• When a subscription ends, the agent is stopped and its workspace is kept for 30 days so the Customer can reactivate or export it. Molted then deletes Customer Content, residual copies included, no later than 90 days after the end of the subscription, unless the law requires it to be kept.
• Deleting an agent or the account at the Customer's request deletes its workspace and disconnects its accounts. Molted confirms deletion in writing on request.

• Each party's liability under this DPA is subject to the limitations of the Terms of Service, except where Data Protection Laws or the SCCs do not allow it.
• This DPA applies as long as Molted processes Customer Content, including after the end of the Terms of Service until deletion.
• In case of conflict, the SCCs prevail over this DPA and this DPA prevails over the Terms of Service.
• Molted may update this DPA to reflect changes in the law, a decision of an authority or a change in the service, without reducing the protection it provides. Material changes are announced by email 30 days in advance.

• Data exporter: the Customer, identified by its account. Data importer: Third Layer LLC, 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, USA, contact support@molted.cloud, acting as processor or sub-processor.
• Data subjects: the Customer's users and the people whose data the Customer or its agents put into the service, such as its employees, clients, prospects, suppliers and correspondents.
• Categories of data: whatever the Customer entrusts to its agents, typically identification and contact data, professional information, messages, documents and data from connected accounts.
• Special categories: none are required by the service. The Customer decides whether to entrust any and is then responsible for the additional safeguards they need.
• Nature and purpose: hosting and operating the Customer's AI agents on a dedicated computer, storing their workspace, carrying out the tasks the Customer asks for and providing support.
• Frequency: continuous for the duration of the service.
• Duration and retention: for the duration of the service, then until deletion as described in section 11.

• Isolation: each agent runs on its own isolated computer, never shared between customers.
• Encryption: all traffic with the website, the dashboard and agents is encrypted in transit (HTTPS); credentials and API keys are encrypted at rest (AES-256) and kept separate from workspace files and conversation output.
• Access control: passwordless sign-in by one-time code or passkey; access to production systems limited to authorized people, on a need-to-know basis.
• Abuse prevention: rate limiting and automated detection of abuse signals.
• Data location: an agent's workspace is stored in the region the Customer chooses when it creates the agent, currently Europe or North America.
• Minimization: features that rely on an AI provider chosen by Molted, such as voice dictation and automatic conversation titles, receive only what the feature needs.
• Incidents: error monitoring, breach handling and notification as described in section 6.
• Portability: instructions, memory, skills and documents remain readable files the Customer can export.

• Cloud infrastructure and data centers that run agents: in the region chosen for each agent (Europe or North America).
• Hosting of the website and dashboard and content delivery: global network, United States.
• Managed database and file storage for account and dashboard data: European Union or United States.
• Integrations and cloud browser that let an agent use the apps it is connected to and browse the web: United States.
• AI providers for voice dictation and conversation titles: United States.
• Transactional email, error monitoring and security: European Union or United States.
• Support and contact tools: European Union or United States.

Questions about this DPA, or a request for a countersigned copy or the list of sub-processors: support@molted.cloud.