Skip to content

Data Processing Agreement

Last updated: October 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Terms”) between Opscale Group (CVR-nr. 44583216), the company that provides Zentier (“we”, “us”), and the business that has accepted the Terms (“you”, the “Customer”). You accept it by accepting the Terms. It applies whenever, and to the extent that, we process Customer Personal Data on your behalf, and it is our contract with you under Article 28(3) of the General Data Protection Regulation (“GDPR”).

1. Definitions

Terms defined in the GDPR, such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach”, have the meaning the GDPR gives them. In addition:

  • Customer Content means everything you and the people you give access to put into, create in, or collect through a workspace: projects, code and files, messages with the AI agents, workspace drive files and memory notes, records and other data your apps, websites, agents and automations store or receive, email sent to their addresses, and data they read from services you connect.
  • Customer Personal Data means the personal data in Customer Content that we process on your behalf.
  • Sub-processor means a processor we engage to process Customer Personal Data.

2. Roles

For Customer Personal Data, you are the controller and we are your processor. If you process Customer Personal Data as a processor for someone else, we are your sub-processor, you confirm that your controller has authorised your instructions and our engagement, and you remain our only point of contact.

We are an independent controller, not your processor, for personal data we process for our own purposes, as described in our Privacy Policy: the accounts of the people who use Zentier, sign-in and security records, billing, usage and service records, and our communications with you. We also act as a controller when we process Customer Content where necessary to detect, prevent and respond to abuse, fraud and security incidents, to enforce the Terms, and to comply with Union or Member State law, including notices and orders about content we host.

3. Your instructions

We process Customer Personal Data only on your documented instructions. You give them through the Terms and this DPA, and through your use and configuration of the service: what you and your members ask the AI agents to do, and what you build, deploy, publish, connect and delete. Other instructions are documented instructions if we agree to them in writing. We will immediately tell you if, in our opinion, an instruction infringes data protection law; we are not required to give you legal advice. Where Union or Member State law requires us to process Customer Personal Data in another way, we will tell you before we do, unless that law prohibits it.

4. Your responsibilities

You are responsible for having a lawful basis for the processing, for the notices you owe your end users and other data subjects (including a privacy policy for each app you make available to others), and for the lawfulness of your instructions.

You must not use the service to process:

  1. special categories of personal data (GDPR Article 9), personal data relating to criminal convictions and offences (Article 10), or full payment card numbers, unless we have agreed to it in writing; or
  2. through the AI features (the agents and the AI that your apps, agents and automations call through Zentier): government identification numbers such as social security, tax or passport numbers; payment card numbers; account passwords; or employment, financial, credit, genetic, biometric or health information about a person.

You are responsible for the security of what you build and how you configure it, for who you give access to your workspace, and for keeping your credentials and your apps' secrets out of code and content that you make public.

5. Confidentiality

We give access to Customer Personal Data only to persons who need it to provide and secure the service, to support you at your request, or to comply with the law, and only to the extent they need it. Each of them is bound by a duty of confidentiality, by written agreement or by law.

6. Security

We implement the technical and organisational measures described in Annex 2. We may change them as the service develops, provided the overall level of security does not decrease.

7. Sub-processors

7.1 Authorisation. You give us a general written authorisation to engage the sub-processors listed in Annex 3. For AI features, the authorisation includes the AI model providers that OpenRouter makes available and selects for each request; OpenRouter choosing between them is not a change of sub-processor.

7.2 Contracts. We engage each sub-processor under a written contract that imposes on it data protection obligations that meet the requirements of Article 28(3) of the GDPR. We remain responsible to you for the performance of a sub-processor's obligations as Article 28(4) provides.

7.3 Changes. Before we add or replace a sub-processor, we update Annex 3 and notify you by email at least 14 days before it starts processing Customer Personal Data. You may object on reasonable data protection grounds by writing to privacy@zentier.ai before the notice period ends. We will then discuss the objection with you in good faith; if we cannot resolve it, you may stop using the affected part of the service or close your workspace before the change takes effect.

7.4 Services you connect. Services you or your apps connect to or call yourself, such as an account you link through a connection, a repository you connect, or an API your code calls, are not our sub-processors. Your use of them is governed by your relationship with their providers.

8. International transfers

Some sub-processors process Customer Personal Data outside the European Economic Area, as Annex 3 shows. You authorise those transfers. Each takes place under an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified recipients) or under the standard contractual clauses adopted by the Commission, as Chapter V of the GDPR requires.

If you are established in a country outside the European Economic Area that does not benefit from an adequacy decision, then to the extent that our processing involves transferring Customer Personal Data to you, Module Four (processor to controller) of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (eur-lex.europa.eu/eli/dec_impl/2021/914/oj) is incorporated into this DPA, with us as data exporter and you as data importer. The optional Clause 7 and the optional wording in Clause 11 do not apply; Clause 17 is governed by the law of Denmark, and the courts of Denmark have jurisdiction under Clause 18. Annex 1 of this DPA completes Annex I of those clauses and Annex 2 completes Annex II. Those clauses prevail over this DPA where they conflict.

9. Assistance

9.1 Data subject requests. Most requests can be handled with the service itself: you can view, export, correct and delete Customer Content. If we receive a request from a data subject that we can identify as relating to Customer Personal Data of yours, we will tell you and will not answer it ourselves, other than to refer the person to you. Taking into account the nature of the processing, we will give you further reasonable assistance on request, and may charge reasonable costs for assistance that takes material effort beyond the service's own features.

9.2 Security, impact assessments and consultation. Taking into account the nature of the processing and the information available to us, we will assist you with your obligations under Articles 32 to 36 of the GDPR, mainly by providing this DPA, its annexes and the other information described in section 11.

10. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the owners and administrators of the affected workspaces. The notification will describe, as far as we then know them, the nature of the breach (including, where possible, the categories and approximate number of data subjects and records concerned), its likely consequences, the measures we have taken or propose to take, including to mitigate its possible adverse effects, and a contact point for more information. Where we cannot give all of this at once, we will give it in phases as it becomes available. We will take reasonable steps to contain and investigate the breach. Notifying you is not an admission of fault. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked log-in attempts or network scans, are not breaches under this section.

11. Information and audits

We will make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR: this DPA, its annexes, and written answers to your reasonable questions about the processing, including a reasonable security questionnaire once a year. Where that information is not enough to demonstrate compliance, or where a supervisory authority requires it or a personal data breach has occurred, we will allow for and contribute to an audit, including an inspection, by you or an independent auditor you mandate who is bound by confidentiality and is not our competitor. You will give us at least 30 days' written notice and agree the scope and timing with us. An audit takes place during normal business hours, causes no more disruption than necessary, and does not extend to other customers' data or to our sub-processors' facilities, for which we will pass on the reports and information our sub-processors give us. Other than at a supervisory authority's request or after a personal data breach, an audit takes place at most once every 12 months. Each party bears its own costs.

12. Duration, return and deletion

This DPA applies for as long as we process Customer Personal Data.

Return. You can export Customer Content at any time with the service's export features: the owner of a workspace can export everything it holds, except the private chats and private memory notes of its members, which each member exports with their own personal data export, secret values, app logs, and the internal state of apps' real-time and coordination components. Before you delete a workspace or close your account, export what you want to keep. If you ask us in writing before the deletion takes effect, we will help you retrieve it.

Deletion. When you delete a workspace or close your account, its apps go offline at once. After a period of 7 days in which you can cancel, its Customer Content is deleted from our systems, except the history of your code, which a 28-day lock protects against tampering and which is deleted when that lock ends, about a month after your request. Copies in our backups and logs expire on their own schedules, within about three months after the deletion. Our sub-processors delete their copies under their own terms. On your written request, we will confirm the deletion in writing.

If we close your account or a workspace, we will provide its export on your written request made within 30 days, unless the law prevents it, and then delete its Customer Content as described above.

We may keep Customer Personal Data where Union or Member State law requires us to, and for as long as it is needed as evidence in an open abuse case, security incident or request from an authority, after which it is deleted as above. We also keep the records we hold as a controller under section 2, such as records of decisions we took on abuse, and the email addresses of people who complained about email sent with the service (and, for 180 days, addresses that bounced), kept so that they are not emailed again.

13. Liability

Each party's liability under this DPA is subject to the limitation of liability in the Terms, which applies to the Terms and this DPA together. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR.

14. Precedence and changes

For the processing of Customer Personal Data, this DPA prevails over the rest of the Terms. We may change this DPA in the same way as the Terms, with the same notice; a change that the law requires may take effect sooner. Notices to us under this DPA go to privacy@zentier.ai; we send ours to the email address of your account. This DPA is governed by the law of Denmark, and the courts of Copenhagen, Denmark have jurisdiction, except where section 8 provides otherwise.

Annex 1: Details of the processing

Parties

  • Controller: the Customer, identified by the business details and the account owner's email address given in its Zentier account.
  • Processor: Opscale Group, CVR-nr. 44583216, Lyngbyvej 83A, 2100 København Ø, Denmark. Contact: privacy@zentier.ai. We have not designated a data protection officer.

Categories of data subjects

Determined by you. Typically: the people you give access to your workspace; the end users and visitors of the apps, websites, agents and automations you deploy; and your customers, contacts and other people whose personal data you put into Customer Content or collect through the service.

Categories of personal data

Determined by you, within section 4. Typically: names, contact details and other identification data; the content of messages, files, records and email; online identifiers and request data of your apps' end users, such as IP addresses and user agents; and account and usage data of the users of your apps.

Sensitive data

None, except as agreed in writing under section 4.

Nature of the processing

Storage, hosting, transmission and backup; building, running and serving the apps, websites, agents and automations you create; processing by AI models on your instructions; extracting and indexing text so the AI can search your files; and export and deletion.

Purpose

Providing the service to you under the Terms and your instructions.

Duration

For as long as the Terms apply, and afterwards until deletion under section 12.

Annex 2: Technical and organisational measures

Encryption

  • Connections to the Zentier web app, its API and the apps we host use HTTPS, with HTTP Strict Transport Security.
  • Stored data is encrypted at rest by the storage providers in Annex 3.
  • Secrets you give your apps and connections are additionally encrypted by us with envelope encryption: a key per app, wrapped by a key held in AWS Key Management Service in the EU. Decrypting a secret needs both that service and a separate platform secret. Secrets are injected into your apps at runtime and are not returned to the browser.

Isolation and access control

  • Each request to our control plane is authorised for the specific workspace and app it concerns; access is denied unless a rule allows it. Automated tests check these rules on every change.
  • Each app's databases, key-value data and files are kept separate from every other app's, and development environments run on separate machines per project.
  • People sign in through our authentication provider and can turn on two-factor authentication. Workspace roles decide what each member can see and change.
  • Access to production systems is limited to the people who operate Zentier. The administration console requires an administrator role and a recent sign-in for sensitive actions, reaches the database only with short-lived credentials limited to the task, and records each administrative action.

Availability and recovery

  • Our main database is backed up every night to storage in the EU, and each project's code history is copied every night to a separate account. The backups expire after 30 and 28 days.
  • You can back up and restore your apps' databases from the dashboard.
  • The service is monitored from outside every 15 minutes and tested in production on a schedule, and errors are reported to us as they happen.

Development and testing

  • Every change must pass automated type checks, tests and policy checks before it can be deployed, including tests that check the authorisation rules above and that requests to AI models are only sent to providers that do not retain them.
  • Security weaknesses can be reported privately through our Trust Center.

Data minimisation and retention

  • Requests to AI models are routed only to providers that do not retain them; a request no such provider can serve fails instead.
  • Scheduled jobs delete data when its retention period ends, as set out in our Privacy Policy, and deletions are recorded.
  • Error reports are scrubbed of secrets, credentials and email addresses before they are sent to our error monitoring.

Records and accountability

  • Your workspace shows you a record of changes to its secrets and of calls to connected services.
  • We keep a documented incident response procedure and a register of personal data breaches.

Physical security

We operate no data centres or servers of our own. Customer Personal Data is stored and processed only in the facilities of the sub-processors in Annex 3, which are responsible for their physical security.

Assistance with your obligations

You can view, export, correct and delete Customer Content with the service itself, which is how we mainly assist with requests from data subjects (section 9), and we notify breaches as section 10 describes.

Annex 3: Sub-processors

The sub-processors that process Customer Personal Data, what each does, and where. Our full list of the services we use, including those that only process our own data, is on our Trust Center.

  • Convex (European Union): Workspace content: projects, chats with the AI agents, workspace drive text and memory notes, and the definitions, run records and inbound email of deployed agents and automations
  • Cloudflare (Global edge network): Running and serving deployed apps, agents and automations, and their databases, key-value data (globally replicated), files and logs; workspace files and media; email sent to their addresses
  • Vercel (Global edge network): Requests to the Zentier web app, including the content sent through it
  • Resend (United States): Sign-in and account emails (verification, password reset, sign-in codes) that deployed apps send to their users
  • Sentry (European Union): Error reports from the service, which can contain fragments of content involved in an error
  • OpenRouter (United States): AI requests made by the agents and by deployed apps, agents and automations, including the content they contain
  • AI model and web search providers (through OpenRouter) (Various): Model inference for those AI requests, chosen per request by OpenRouter from providers that do not retain them; web search queries
  • Brave Search (United States): Web search queries the agents make, which can contain content from your requests
  • Fly.io (Matches workspace region): Development environments for your projects, and the build machines that run your CI and apply database changes to your apps' databases
  • Depot.dev (United States): Compiling deployed apps from their source code and the files committed with it; build cache kept up to 2 days. No database contents or credentials.
  • GitHub (United States): Nightly backups of the platform database and of your projects' code history pass through GitHub-hosted runners
  • Composio (United States): Connections to services you link, and the tool calls and events your agents, automations and apps exchange with them