Last updated: April 18, 2026

This Data Processing Addendum (“DPA”) supplements the Terms of Service and EULA between the operator of autonomousengine.org (“Processor”, “we”, “us”) and the subscribing customer (“Controller”, “you”). It applies to any personal data (as defined by applicable data-protection law) that we process on your behalf. If there is any conflict between this DPA and the Terms, this DPA controls for matters of data protection.

Enterprise customers may request a counter-signed version of this DPA at [email protected].

1. Scope and the narrow processor role

Because the Autonomous Engine software is self-hosted on infrastructure you control, we do not act as a processor of the personal data you process with it. Your code, customers, tickets, prompts, and model traffic do not reach our servers. See the Privacy Policy, Section 4.

We do act as a processor in the narrow sense of the account and license data described in Section 2 of our Privacy Policy (billing metadata, license issuance log, operational logs, mailing-list email). That narrow scope is the entirety of the processing to which this DPA applies.

2. Subject matter, duration, nature, purpose, and categories

• Subject matter. Personal data you (or your personnel) submit to us via the website or license server.
• Duration. The term of your Subscription plus any retention period described in the Privacy Policy.
• Nature and purpose. Operating the website and license server, provisioning licenses, billing and support, as described in the Privacy Policy.
• Categories of data subjects. Your personnel who interact with the site, license server, or support; your authorized signatory for billing; your named GitHub users for source-access; your end subscribers to the marketing list.
• Categories of personal data. Name, business email, business address, billing metadata, Subscription tier and status, invoice IDs, GitHub usernames, license-key identifiers, host fingerprints, IP address (operational logs only), mailing-list email and consent record.

3. Processor obligations

We will:

(a) process personal data only on your documented instructions (the Terms, this DPA, and any written instructions you send to [email protected]);

(b) ensure that personnel authorized to process personal data are under a duty of confidentiality;

(c) implement appropriate technical and organizational measures (Section 5);

(d) not engage any subprocessor except as described in Section 4;

(e) assist you, to the extent reasonably practicable, to respond to data-subject requests and to carry out data-protection impact assessments and prior consultations;

(f) make available all information reasonably necessary to demonstrate compliance with this DPA; and

(g) on the termination of your Subscription, and subject to legal retention obligations, delete or return the personal data as described in the Privacy Policy.

4. Subprocessors

You authorize us to engage the subprocessors listed in Section 6 of the Privacy Policy, and any successor subprocessor notified to you at least 30 days before engagement. Enterprise customers may object to a new subprocessor in writing within 30 days of notification, in which case we will either remove the subprocessor or, at our option, terminate the affected service for a pro-rata refund of prepaid fees.

Each subprocessor is bound by a written contract imposing substantially the same data-protection obligations as those in this DPA.

5. Security measures

We implement at minimum:

• encryption in transit (TLS) for all external traffic;
• encryption at rest for billing metadata and credentials;
• least-privilege access control and multi-factor authentication for production systems;
• audit logging of access to personal data;
• incident-response and change-management procedures;
• regular review of the above.

These measures reflect the risk of the processing, which is limited in scope as described in Section 1.

6. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your personal data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we have taken or propose to take to address the breach and mitigate its effects.

7. International transfers

Where personal data is transferred outside the European Economic Area, United Kingdom, or Switzerland to a country not recognized as providing adequate protection, the transfer is made under the European Commission’s Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, or the Swiss equivalent, as applicable, which are incorporated into this DPA by reference.

8. Audit

On written notice of at least 30 days (or less if required by a supervisory authority), and no more than once per calendar year, you may audit our compliance with this DPA by reviewing written responses to a reasonable questionnaire and, if still needed, by an on-site visit during business hours conducted by an independent auditor mutually acceptable to the parties. Audits will not unreasonably interfere with our operations, and the auditor must sign a reasonable non-disclosure agreement. You will bear the cost unless the audit reveals material non-compliance, in which case we will bear the cost.

9. Liability

The limitations of liability in the Terms of Service apply to claims arising out of or relating to this DPA.

10. Term and termination

This DPA is effective from the start of your Subscription and ends when we have completed the deletion or return of personal data following termination of the Subscription.

11. Governing law

This DPA is governed by the law of the Terms of Service, except that where mandatory data-protection law of your jurisdiction applies, that law applies to the extent required.

Contact

[email protected]