Data Processing Addendum
The terms that apply when Fous processes personal data on behalf of its customers, including the EU Standard Contractual Clauses.
Last updated
Table of contents
1. Scope
This Data Processing Addendum (“DPA”) is part of the Fous Terms of Service between Fous Technologies, Inc. (“Fous”) and the customer that accepted them (“Customer”). It applies when Fous processes personal data in Customer Content on Customer’s behalf (“Customer Personal Data”). Capitalized words have their meanings in the Terms, and words such as “controller” and “personal data breach” their GDPR meanings. On data protection, this DPA prevails over the Terms, and the Standard Contractual Clauses prevail over both.
This version is dated November 10, 2026.
2. Roles
Customer is the controller of Customer Personal Data, or a processor for its own customers, in which case Fous is its subprocessor. Fous is Customer’s processor and, under U.S. state privacy laws, its service provider. Customer is responsible for the lawfulness of its instructions and of Customer Personal Data, including data its Methods collect.
Fous is an independent controller of account, billing, and usage data, and of the build requests and run records it uses to secure, debug, and improve the Service and, unless Customer opts out by emailing privacy@fous.com, to train its own models. The Privacy Policy governs that processing.
3. Instructions
Fous processes Customer Personal Data only on Customer’s documented instructions, which are the Terms, this DPA, and Customer’s use and configuration of the Service, unless the law requires otherwise; then Fous tells Customer first, unless the law forbids it. Fous tells Customer if it believes an instruction breaks data protection law.
4. Confidentiality
Everyone Fous authorizes to process Customer Personal Data is bound by confidentiality.
5. Security
Fous maintains the measures in Annex II and may change them if the overall protection is not reduced. Customer is responsible for its own security, including its API keys, its Members, and the accounts it connects.
6. Subprocessors
Customer authorizes Fous’s Subprocessors in the categories in Annex III. Fous emails Customer’s Organization owners at least 10 days before a new Subprocessor starts processing Customer Personal Data. If Customer objects on reasonable data protection grounds within that period and the parties cannot resolve it, Customer may end the Terms. Fous binds each Subprocessor in writing to obligations no less protective than this DPA and remains liable for them. Target Sites are not Subprocessors.
7. Assistance
Taking into account the nature of the processing, Fous helps Customer answer requests from individuals, passing on any it receives, and helps with security, data protection impact assessments, and consultations with supervisory authorities. Customer can delete private Methods, Connections, and its Organization in Studio, and can ask for other help at privacy@fous.com.
8. Personal data breaches
Fous notifies Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, with the information Article 33(3) GDPR requires as it becomes available, and takes reasonable steps to contain it.
9. Deletion and return
When the Terms end, Fous deletes Customer Personal Data, including copies, within 90 days, or returns it first if Customer asks before then, unless the law requires keeping it. Backups are overwritten in their normal cycle. Data that Fous holds as an independent controller under Roles is kept as the Privacy Policy describes.
10. Information and audits
Fous makes available the information needed to show that it complies with this DPA and Article 28 GDPR, including answers to a reasonable security questionnaire. Customer, or an independent auditor bound by confidentiality who is not a Fous competitor, may audit that compliance, including by inspection, once in any 12 months, with 30 days’ written notice, during business hours, and at Customer’s cost. More frequent audits or shorter notice apply where data protection law, a supervisory authority, or a personal data breach requires them.
11. International transfers
Fous and its Subprocessors process Customer Personal Data in the United States and other countries. Where a transfer to Fous needs a safeguard, the following are incorporated by reference, and accepting the Terms counts as signing them:
- EU and EEA: the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, Module 2 where Customer is a controller and Module 3 where it is a processor, with Customer as exporter and Fous as importer. Clause 7 applies; Clause 9 option 2 applies, with the notice period in Subprocessors; Clause 11’s optional wording does not apply; Clauses 17 and 18 choose Irish law and courts. The annexes below complete the clauses’ annexes.
- United Kingdom: the UK Information Commissioner’s International Data Transfer Addendum, with Tables 1 to 3 completed from the above; either party may end it as its section 19 allows.
- Switzerland: the Standard Contractual Clauses as above, with the Swiss Federal Data Protection and Information Commissioner as competent authority and the Swiss Federal Act on Data Protection in place of the GDPR where it applies.
12. U.S. state privacy laws
Where the CCPA or a similar law applies, Fous does not sell or share Customer Personal Data or combine it with other data except as those laws allow; keeps, uses, and discloses it only for the business purposes in the Terms and this DPA and within its direct business relationship with Customer; protects it as those laws require; and tells Customer if it can no longer comply. Customer may take reasonable steps to ensure that Fous uses the data as these laws require and, after notice, to stop and remediate unauthorized use. Fous certifies that it understands and will comply with these restrictions.
13. Liability
Liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or the law do not allow them.
Annex I: Description of the processing
Data exporter: Customer, as identified in its account, acting as controller or processor; contact: its Organization’s owners. Data importer: Fous Technologies, Inc., 2261 Market Street, STE 86843, San Francisco, CA 94114, United States, acting as processor; contact: privacy@fous.com.
| Item | Description |
|---|---|
| Data subjects | Customer’s Members and users, and people whose personal data appears in Customer’s requests, Target Site content, Output, or Connections. |
| Personal data | Whatever Customer chooses to process, such as names, contact details, account details and credentials, and web page content; sensitive data only if Customer chooses, protected by Annex II. |
| Frequency | Continuous, while Customer uses the Service. |
| Nature and purpose | Providing the Service: building, running, and maintaining Methods, Connections, and actions, and support. |
| Duration | The term of the Terms and the deletion period above. |
Competent supervisory authority
The authority determined under Clause 13 of the Standard Contractual Clauses.
Annex II: Security measures
- Encryption in transit, and of stored credentials.
- Access limited to the people who need it, with logging and monitoring.
- Backups that can be restored.
- A process for responding to security incidents.
Annex III: Subprocessors
| Category | Service |
|---|---|
| Hosting and infrastructure | Servers, database, storage, and network |
| Email delivery and support | |
| AI model, web search, and proxy network providers | Building and running Methods |
Fous sends the names of its current Subprocessors on request to privacy@fous.com.