# Agent Smith — Data Processing Addendum (DPA) — Beta template **Effective date:** 2026-08-16 · **Last updated:** 2026-08-16 · **First published:** 2026-04-04 **Processor:** Alessandro Scire Calabrisotto, sole proprietor, operating the "Agent Smith" service, Seebahnstrasse 121, 8003 Zürich, Switzerland **Registered firm:** The Swiss Standard by Alessandro Scire Calabrisotto — UID CHE-228.447.426, register reference CH-020.1.087.436-7, entered and active in the Commercial Register of the Canton of Zurich. The registered name differs from the "Agent Smith" brand because the service is provided through the owner's existing registered sole proprietorship; a sole proprietorship is the same legal person as its owner and may run more than one business activity. **Processor status:** Swiss sole proprietorship / Einzelunternehmen (no separate legal personality; the owner is the contracting party). Not registered for Swiss VAT — liability begins at CHF 100,000 annual turnover. **Planned successor:** a Swiss company (AG or GmbH) with its seat in Zurich or Zug. On incorporation this DPA is intended to transfer to that company; the Customer will be notified and may terminate instead of being transferred (see §13). **Contacts:** support@agentsmith.ch (operational / privacy requests), legal@agentsmith.ch (legal notices) > This Markdown file is a publication-ready twin of the web page at `/dpa-template` on agentsmith.ch. It is not legal advice. ## Executive summary This DPA template is suitable for beta B2B customers: the Customer (workspace owner) is the **Controller**, and Agent Smith is the **Processor** under GDPR Art. 28. It includes (a) processing details, (b) a subprocessor list with optional/conditional flags and indicative repo file-path evidence, and (c) a TOMs annex mapped to code-backed controls (RLS, bucket access patterns, Supabase Auth, OAuth token handling, rate limiting, and retention/deletion jobs). It states a deletion **target** (access removed promptly; completion typically ~30 days, subject to legal holds and operational constraints) and flags items **not fully provable from code** in §10. Security measures are framed around GDPR Art. 32; international transfers around GDPR Chapter V (Art. 44+) with Switzerland in the Commission’s adequacy framework where applicable. --- ## 1. Roles and scope This Data Processing Addendum (“DPA”) supplements the agreement under which the Customer uses Agent Smith. The Customer (as workspace owner) is the **Controller** for personal data the Customer uploads or causes to be processed in workspaces; **Alessandro Scire Calabrisotto, sole proprietor (registered firm “The Swiss Standard by Alessandro Scire Calabrisotto”, UID CHE-228.447.426), operating the “Agent Smith” service** is the **Processor** and processes such data on the Customer’s instructions to provide the Service, in accordance with GDPR Article 28. Because Agent Smith is operated as a Swiss sole proprietorship, the Processor is a natural person and not a company. The Processor intends to incorporate a Swiss company (AG or GmbH, seat in Zurich or Zug) and to transfer this DPA and the underlying agreement to it. The Customer will receive advance notice of that transfer, the successor will assume the Processor’s obligations under this DPA in full, and the Customer may terminate rather than accept the transfer. ## 2. Processing details (Art. 28(3) schedule) - **Subject matter:** Hosting, storage, and processing of personal data that the Customer (or users the Customer authorizes) submits to the Service within workspaces. - **Duration:** For the term of the Customer’s subscription or use of the Service, plus a limited period thereafter to complete deletion, backups, and legal obligations, as described in the Privacy Policy and this DPA. - **Nature and purpose:** Cloud software services: collaboration, document and message handling, AI-assisted features the Customer enables, integrations the Customer connects, authentication, security, abuse prevention, and support. - **Type of personal data:** Identifiers and contact data, account and profile data, employment/HR-like data the Customer chooses to store, communications, file content, usage metadata, billing-related identifiers, OAuth connection metadata, and AI prompts/outputs where those features are used. - **Categories of data subjects:** The Customer’s personnel, contractors, clients, end users, or any other individuals whose personal data the Customer uploads or integrates. **Instructions:** The Customer’s configuration and use of the Service (including workspace settings, invites, integrations, and AI options) constitute documented instructions unless otherwise agreed in writing. The Processor will not process personal data for incompatible purposes unless required by EU or Member State law (in which case the Processor will inform the Customer unless prohibited). **AI routing privacy control:** For non-free text models sent through OpenRouter, the Processor requests Zero Data Retention (ZDR) and denies provider data collection with `data_collection=deny`. OpenRouter may use only endpoints that declare those controls. Nemotron Free is an explicit exception: its upstream terms state that inputs may be logged and used for NVIDIA product improvement. A direct-provider fallback is outside the OpenRouter ZDR request and follows that provider’s API terms and the applicable agreement. The Customer must not treat every AI route as ZDR. ## 3. Subprocessors The Customer authorizes the Processor to engage subprocessors reasonably required to provide the Service. A public list is maintained on the website (“Subprocessor List” page). The table below adds **status** and **indicative evidence** (repository paths for internal verification; not a warranty of completeness). | Subprocessor | Function | Status | Indicative evidence (repo) | | ------------------------------ | ----------------------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------- | | Supabase | Auth, database, storage, Edge Functions | Active (core) | `supabase/`, `src/integrations/supabase/` | | Vercel | Application hosting, CDN, edge routing | Active (core) | Infrastructure-level | | Stripe | Payments, subscriptions | Active | `supabase/functions/stripe-*`, `src/pages/account/AccountBillingPage.tsx` | | Resend | Transactional email | Active / optional (env) | `supabase/functions/*` | | Sentry | Error monitoring | Optional | Env-gated SDK if present | | OpenAI | AI inference | Active | `supabase/functions/_shared/ai/modelRouting.ts` | | Anthropic | AI inference | Active | `supabase/functions/_shared/ai/modelRouting.ts` | | Google (Gemini) | AI inference | Active | `supabase/functions/_shared/ai/modelRouting.ts` | | xAI (Grok) | AI inference | Active | `supabase/functions/_shared/ai/modelRouting.ts` | | OpenRouter | Primary AI model routing and endpoint aggregation | Active (primary text route) | `supabase/functions/_shared/ai/llmCascade.ts` | | NVIDIA | Nemotron model inference and Free-route improvement | Active (Free route has separate terms) | `supabase/functions/_shared/ai/llmCascade.ts` | | DeepSeek | DeepSeek model inference through OpenRouter endpoints | Active (model-dependent) | `supabase/functions/_shared/ai/llmCascade.ts` | | Browserbase | Managed cloud browser runtime | Optional (env-gated) | `supabase/functions/execute-browser-action/` | | Captcha (hCaptcha / Turnstile) | Abuse prevention | Optional (env) | Frontend / edge integration when enabled | | Connected integrations | User-enabled integrations | User-enabled | OAuth token storage patterns in DB | The Processor will impose data protection terms on subprocessors materially consistent with this DPA. The Customer may object to new or replacement subprocessors on reasonable grounds; where no alternative exists, either party may terminate the affected Service components as described in the main agreement. ## 4. Technical and organizational measures (Art. 32) The Processor implements TOMs appropriate to the risk (confidentiality, integrity, availability, resilience). The annex below maps **high-level controls** to **indicative** implementation. It does not replace a penetration test report or ISO certificate. | Measure (Art. 32) | Summary | Indicative evidence (repo) | | ---------------------------- | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | Access control & segregation | Authenticated access; workspace-scoped data access in app and DB | `supabase/migrations/*.sql` (RLS), `src/pages/platform/` | | Object storage restrictions | Buckets for uploads/avatars/docs with policies aligned to workspace membership | `supabase/migrations/*bucket*.sql` | | Authentication | Email magic link / OTP via Supabase Auth | `src/lib/supabaseClient.ts`, `src/pages/auth/` | | Transport security | TLS / HTTPS | Standard deployment / Supabase hosted endpoints | | Secrets & integration tokens | OAuth and integration credentials stored with platform-appropriate protection | DB columns — **verify** encryption/KMS in production (see §10) | | Abuse prevention | Rate limits, optional captcha, invite/share controls | Edge functions, `supabase/functions/invite-lookup/`, share link flows | | Retention & deletion | Account/workspace deletion; jobs for some AI-related data; ~30-day completion **target** | `supabase/functions/delete-account/`, AI chat migrations — **full matrix not proven** (see §10) | ## 5. International transfers (Chapter V / Art. 44+) The Processor is established in Switzerland. EU Commission adequacy for Switzerland can support transfers from the EEA without additional safeguards in many cases. Where subprocessors process personal data outside the EEA/CH, the Processor will use appropriate safeguards (e.g. Standard Contractual Clauses) or other lawful mechanisms as required. ## 6. Confidentiality; personnel The Processor ensures that persons authorized to process personal data are bound by appropriate confidentiality obligations. ## 7. Security incidents The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data in the Processor’s control, where notification is required by applicable law, and will provide information reasonably available to assist the Customer in meeting Controller obligations. ## 8. Assistance (data subjects & DPIA) Taking into account the nature of processing, the Processor will assist the Customer—by appropriate technical and organizational measures, insofar as possible—with responding to data subject requests and with DPIA/consultation obligations where applicable. During beta, response times and tooling may be limited; requests should be sent to support@agentsmith.ch with sufficient detail. ## 9. Return and deletion On termination of the Service (or on the Customer’s written request where agreed), the Processor will delete or return personal data in accordance with the Privacy Policy and product deletion flows. **Target:** access removed promptly; completion of deletion typically within approximately **30 days**, subject to backup cycles, security investigations, and mandatory legal retention. ## 10. Audit The Customer may request information reasonably necessary to confirm compliance with this DPA. On-site audits may be agreed where required by law or a signed enterprise agreement, subject to confidentiality, security, and minimum-interruption constraints. ## 11. Gaps and items not fully provable from code - End-to-end **retention matrix** for every table, bucket, log stream, and backup generation (deletion within ~30 days across all copies). - **OAuth / integration token encryption** at rest—confirm production configuration and key management. - **Optional tooling** (e.g. Sentry, marketing analytics): confirm what is enabled per environment. - **Cookie / consent banner** and blocking of non-essential scripts until consent (policy may precede full implementation). - **EU representative** under Art. 27 if required—appoint and publish if applicable. - **Formal registration** of the Swiss entity; update party names and registration numbers in contracts when available. - **AI vendor contract and account verification** — confirm executed DPAs/SCCs, OpenRouter prompt-logging and training settings, and retention terms for every direct-provider fallback before making a customer-specific zero-retention commitment. ## 12. Enterprise SCC-aligned DPA This is a **beta short-form** DPA. Enterprise customers may request a full GDPR Article 28 + SCC package via support@agentsmith.ch (company name, workspace, jurisdiction). ## 13. Assignment on incorporation The Processor is currently a Swiss sole proprietorship and intends to incorporate a Swiss company (AG or GmbH, seat in Zurich or Zug) into which the Agent Smith business will be transferred. On that transfer: - the incorporated company becomes the Processor under this DPA and assumes the Processor's obligations in full, including those toward Customer personal data already processed; - the Customer receives advance written notice at the account contact address before the transfer takes effect; - the Customer may terminate the underlying agreement and this DPA before the transfer takes effect rather than accept the successor, in which case §9 (Return and deletion) applies; - the subprocessor list, transfer safeguards and technical and organizational measures described in this DPA continue to apply to the successor unless and until the Customer is notified of a change under §3. The Processor may also assign this DPA together with the underlying agreement in a restructuring, financing, merger or sale of the business, on the same notice and termination terms. --- _Not legal advice. For the Customer’s obligations as Controller, obtain independent counsel._