Data Processing Addendum

This addendum says how spawnpoint Inc. handles the personal data your apps hold, on your behalf.

Effective: October 30, 2026.

1. What this addendum is

This Data Processing Addendum (the "DPA") is part of the Terms of Service between you and spawnpoint Inc. ("spawnpoint", "we", "us"). It applies whenever we process Customer Personal Data under Data Protection Laws. You accept it when you accept the Terms. If your company needs a signed copy, email support@getspawnpoint.com and we will countersign one.

In this DPA:

• "Customer Personal Data" means personal data in the content you deploy to spawnpoint or that your apps collect and store with us, including their databases, file storage, files, and environment variables, and the email addresses of the people you share a project with.
• "Data Protection Laws" means the laws that apply to that processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended (CCPA).
• "Controller", "processor", "data subject", "personal data breach", and "processing" have the meanings the GDPR gives them, and the CCPA's equivalents where the CCPA applies.
• "Sub-processor" means a provider we engage that processes Customer Personal Data.

Our own account data about you, such as your sign-in email and your plan, is covered by our privacy policy, where spawnpoint Inc. is the controller. This DPA does not cover it.

2. Roles

You are the controller of Customer Personal Data, and we are your processor. If you process that data on behalf of someone else, you are their processor and we are your sub-processor, and you confirm that their instructions to you allow you to use spawnpoint.

You are responsible for having a lawful basis for the data your apps collect, for the privacy notice your apps' users see, and for the sign-in that protects any personal data in a public app.

3. Scope and duration

We process Customer Personal Data only to provide the Service to you: to store it, run your apps, serve them to the people you allow, back up our systems, keep the Service secure, and support you when you ask. Annex 1 describes the processing. This DPA lasts as long as we process Customer Personal Data, which ends when section 11 says it does.

4. Your instructions

We process Customer Personal Data only on your documented instructions. Those instructions are the Terms, this DPA, and what you do with the Service, including what you or an agent you connect sets up through the console or the MCP server. If we believe an instruction breaks Data Protection Laws, we will tell you. If a law requires us to process the data in some other way, we will tell you first, unless that law forbids it.

5. Confidentiality

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality. Today that is our founder alone. We give access only to the people who need it to run the Service.

6. Security

We keep the technical and organisational measures in Annex 2 in place, and we keep our security page up to date with them. We may change these measures as the Service changes, but not in a way that lowers the overall protection of Customer Personal Data.

7. Sub-processors

You authorize us to use the sub-processors listed in section 7 of our privacy policy, which is Annex 3. We will email you at least 30 days before we add or replace one. You can object on reasonable grounds about data protection within those 30 days. If we cannot resolve the objection, you can end the affected part of the Service, and we will refund any fees you paid in advance for the time after it ends.

We bind every sub-processor to data protection terms that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for their work.

8. Requests from data subjects

The console and the MCP server let you find, change, export, and delete the data your apps hold. Where you cannot do something yourself, we will help you answer requests from data subjects, taking into account what the processing is and what we can reach. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you and will not answer it ourselves unless you ask us to or the law requires it.

9. Help with your obligations

We will give you reasonable help with data protection impact assessments and with consulting a supervisory authority, where the law requires them for your use of spawnpoint, taking into account the information available to us.

10. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay and in any case within 72 hours. We will tell you what happened, what data and how many people it affects as far as we know, its likely consequences, and what we have done and will do about it. If we do not know everything at once, we will send what we know and add the rest as we learn it. We will take reasonable steps to contain the breach and reduce its harm. Telling you about a breach is not an admission of fault.

11. Deletion at the end

While you use spawnpoint, you can export Customer Personal Data and delete it. Terminating a project deletes its machine, its database, its file storage, and its environment variables, and deleting your account terminates every project. When the Terms end, we delete the Customer Personal Data that remains within 30 days. Copies in our backups are deleted on the backup schedule in our privacy policy, within 60 days, and are not used in the meantime except to recover the Service. We keep data longer only where a law requires it.

12. Audits

We will give you the information you reasonably need to show that we meet this DPA, including written answers to your security questionnaire. If that is not enough, you, or an independent auditor bound by confidentiality, may audit our compliance once a year. Give us at least 30 days' notice, and we will agree the scope, timing, and length together. Audits take place during business hours, at your cost, and may not reach other customers' data or put the Service at risk. A supervisory authority may audit us whenever the law allows it.

13. Transfers out of Europe and the UK

We store Customer Personal Data in the United States. Where Data Protection Laws require a transfer mechanism for data that comes from the European Economic Area, Switzerland, or the United Kingdom:

• The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 apply and are made part of this DPA: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. Clause 7 (the docking clause) applies. Under Clause 9, option 2 applies, with the 30 days' notice in section 7. The optional wording in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. Annexes 1 to 3 of this DPA complete the Clauses' Annexes I to III, and you are the data exporter and spawnpoint Inc. the data importer.
• For data from the United Kingdom, the UK International Data Transfer Addendum to those Clauses, version B1.0, applies, with its tables completed from this DPA, and either party may end it as its section 19 allows.
• For data from Switzerland, the Clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority, references to member states read to include Switzerland, and the Swiss Federal Act on Data Protection in place of the GDPR where it applies.

If the Clauses and the rest of this DPA conflict, the Clauses win.

14. California

Where the CCPA applies, we are your service provider. We will not sell or share Customer Personal Data, as the CCPA defines those words. We will not keep, use, or disclose it for any purpose other than providing the Service, or outside our direct business relationship with you, and we will not combine it with personal data we get from anyone else except as the CCPA allows. We will give it the level of privacy protection the CCPA requires, and we will tell you if we find we can no longer meet these obligations. You may take reasonable steps to stop any use of it that these terms do not allow.

15. Liability

Each party's liability under this DPA, including under the Standard Contractual Clauses to the extent the law allows, is subject to the limitations in the Terms.

16. Which document wins

For anything about Customer Personal Data, this DPA wins over the Terms where they conflict, and the Standard Contractual Clauses win over both. Otherwise the Terms govern.

17. Changes

We may update this DPA when Data Protection Laws or the Service change, and we will give notice the way the Terms describe. An update will not reduce the protection this DPA gives Customer Personal Data, unless a law requires it.

Annex 1: The processing

• Subject matter and nature: storing and running the apps you deploy, and their data, on the Service.
• Purpose: providing the Service under the Terms.
• Duration: as section 3 and section 11 describe.
• Data subjects: the people your apps collect data about, such as their users and customers; your own staff and contractors who use your apps; and the people you share a project with.
• Categories of data: whatever your apps store, which you decide; and the email addresses of people you share a project with, with when they opened it.
• Special categories of data: spawnpoint is not designed for them. If your apps hold them, you are responsible for deciding that the measures in Annex 2 are enough.
• Frequency: continuous, for as long as you use the Service.
• Supervisory authority: the one that is competent for you under Data Protection Laws.

Annex 2: Security measures

• Encryption in transit: every connection to the console, the MCP server, and your apps' links uses TLS, and your apps' databases accept only encrypted connections.
• Encryption at rest: both database servers, every file storage bucket, and the disk of the server that runs spawnpoint are encrypted. Environment variables are encrypted a second time, with AES-256-GCM, before they are stored.
• Isolation: each project with a server runs in its own virtual machine, and each app database has its own user and password.
• Access: only our founder can reach the systems that hold Customer Personal Data. Sign-in to the console is passwordless. API tokens and OAuth tokens are stored only as hashes and can be revoked at once. Agent access tokens last an hour.
• Backups and recovery: both database servers keep 7 days of point-in-time backups and have deletion protection.
• Logging: changes to our Amazon Web Services resources are recorded in an audit log kept for a year.
• Deletion: deleting a project, its database, or its file storage needs an explicit confirmation.
• Location: Amazon Web Services in the United States, region us-west-2 (Oregon), for everything we run.

The security page describes these measures in more detail.

Annex 3: Sub-processors

The providers listed in section 7 of our privacy policy, with what each one receives.

Contact

Questions about this DPA, a request for a signed copy, or notice of an objection: support@getspawnpoint.com.