Unfenced - Data Processing Addendum (DPA)

Last updated: 17 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between the sole trader who operates Unfenced, based in Israel ("Processor", "we"), and the customer identified in the Agreement ("Controller", "you"). It applies where we process personal data on your behalf in providing the Service. If there is a conflict on data protection, this DPA prevails over the Agreement.

1. Roles

• For personal data contained in the pages you fetch and the sessions you direct the Service to drive, you are the Controller and we are the Processor. You determine which sites are accessed, which accounts are used, and what is done.
• For your own account data (your email, your billing), we are the Controller; that processing is governed by the Privacy Policy, not this DPA.
• Where you are yourself a processor for your own customers, we act as a sub-processor, and this DPA applies accordingly.

2. Scope and details of processing

The details required by GDPR Article 28(3) are set out in Annex I:

• Subject matter: provision of the Unfenced web-access and session-automation Service.
• Duration: the term of the Agreement, plus deletion/return per Section 9.
• Nature and purpose: fetching URLs through a real browser and returning clean text; storing and using credentials/sessions you provide to act on third-party sites under your authority; metering and audit.
• Types of personal data: account email and account metadata; the website passwords, TOTP (2FA) seeds, and login session cookies you store (sealed at rest); the URLs and page titles you fetch; and any personal data appearing in the content we retrieve and the logged-in sessions you direct the Service to drive. We do not store end-user IP addresses, and the audit chain is redacted of credentials, cookies, tokens, form values, and response bodies.

This list describes the hosted Service as operated today. A self-hosted operator configures their own stores and is responsible for their own inventory; docs/legal/README.md explains how the published set maps to the code.

• Categories of data subjects: your authorized users and agents; and the people whose personal data appears in the sites and accounts you direct the Service to access.
• Special-category data: not permitted. You must not use the Service to process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation (GDPR Article 9), nor criminal-offence data (Article 10). The Service is not designed, assessed, or operated for that processing, and no data-protection impact assessment has been carried out for it. If you direct it at such data you do so in breach of this DPA and of the Acceptable Use Policy, and Section 12 applies.

3. Our obligations as Processor

We will:

1. Process only on documented instructions from you (the Agreement, this DPA, and your configured use of the Service), including as to international transfers, unless required by law - in which case we will inform you first unless the law prohibits it.
2. Ensure persons authorized to process the data are under confidentiality.
3. Implement the security measures in Section 5 (Annex II).
4. Respect the conditions in Section 6 for engaging sub-processors.
5. Assist you - taking account of the nature of processing and the information available to us - with responses to data-subject requests (Section 7), and with your obligations on security, breach notification, data protection impact assessments, and prior consultation (Articles 32-36).
6. At your choice, delete or return the data at the end of the Agreement (Section 9).
7. Make available information needed to demonstrate compliance and allow for and contribute to audits (Section 8).
8. Inform you if, in our opinion, an instruction infringes data-protection law.

4. Your obligations as Controller

You will:

• have a lawful basis for the processing you instruct, and provide any notices and obtain any consents required from data subjects;
• warrant that you have the right and authority to have the Service access the accounts and sites you authorize (mirroring the delegated-authority warranties in the Terms of Service);
• not instruct processing that violates data-protection law or third-party terms.

5. Security measures (Annex II)

We maintain technical and organizational measures appropriate to the risk, including:

• Encryption at rest of stored credentials, TOTP seeds, and session cookie jars using AES-256-GCM; TLS in transit.
• EU data residency for the primary stores (Supabase, region eu-central-1; Cloudflare R2, EU jurisdiction).
• No storage of user IP addresses.
• A redacted, append-only audit chain that strips credentials, cookies, tokens, form values, and response bodies before writing.
• Secret isolation: persistent secrets are resolved server-side and never exposed to the AI model or through any read route.
• Access controls, per-account isolation, and per-tenant data separation.

• Key management. Credential and session encryption keys are held on the worker and in the operator's environment, never in the database beside the ciphertext they protect, and never in the repository.
• Logging. A signed, hash-chained audit record of every authorization decision, redacted of credentials, cookies, tokens, form values, and response bodies. It is append-only and verifiable offline.
• Backup. Central state is backed up daily to encrypted off-site storage, and the restore path is drilled rather than assumed.
• Personnel. The Service is operated by a single person. There is no support team with standing access, and no third party holds production credentials.
• Incident response. Section 11 sets the notification commitment.

These measures are described accurately and are not independently certified. There is no ISO 27001, SOC 2, or equivalent third-party attestation, and none is claimed. A customer who requires one should not rely on this Annex in its place.

6. Sub-processors

• You provide general authorization for us to engage the sub-processors listed in subprocessors.md.
• We impose data-protection obligations on each sub-processor no less protective than this DPA, and remain responsible for their performance.
• We will give prior notice of any intended addition or replacement of a sub-processor, and you may object on reasonable data-protection grounds. If we cannot resolve the objection, you may terminate the affected Service without penalty.
• Notice period and method: 30 days, by email to your account address and by an update to subprocessors.md, which carries its own "Last updated" date and is the canonical list. Objections go to privacy@unfenced.ai within that period.

7. Data-subject requests

Taking account of the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data-subject rights. If a data subject contacts us directly about data we process for you, we will refer them to you (or forward the request) rather than respond on your behalf, unless legally required.

8. Audit

We will make available information reasonably necessary to demonstrate compliance with Article 28, and allow for audits, including inspections, by you or an auditor you mandate, on the following basis: 30 days' written notice, no more than once in any 12-month period (except where a supervisory authority requires otherwise or following a personal data breach affecting your data), during business hours, without unreasonable disruption, subject to confidentiality, and at your cost. We hold no third-party certification or audit report to offer in place of an inspection, and we do not pretend otherwise.

9. Deletion and return

On termination or expiry of the Agreement, and at your choice, we will delete or return all personal data processed on your behalf and delete existing copies, unless law requires storage. Deletion covers the database records, worker-local profile and cookie-jar data, and session-replay frames in Cloudflare R2.

Deleting an account wipes that account's whole frame prefix in R2 after its database records are gone. If any store cannot be cleared the deletion answers "incomplete" and names what is left, rather than reporting success. See the Privacy Policy, Section 9.

10. International transfers

Where processing personal data outside the EEA, we rely on an approved transfer mechanism, including the European Commission's Standard Contractual Clauses, which are incorporated by reference and completed in Annex III.

Annex III - transfer positions.

Where this DPA operates between you (Controller) and us (Processor) directly and a transfer out of the EEA arises, Module Two (controller to processor) applies. Copies of the clauses relied on are available on request to privacy@unfenced.ai.

11. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, with the information available to help you meet your Article 33/34 obligations, and updates as more is known.

Target window: within 48 hours of becoming aware. Security contact: legal@unfenced.ai, monitored for this purpose. If we cannot yet give full information within that window we will tell you what we know and what we are still establishing, rather than delay the first notification.

12. Liability and general

Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. This DPA is governed by the law stated in the Agreement.

Annexes (to be completed by counsel)

• Annex I - details of processing (Section 2).
• Annex II - technical and organizational security measures (Section 5).
• Annex III - Standard Contractual Clauses and module selections (Section 10).
• Annex IV - list of sub-processors (subprocessors.md).