This Data Processing Agreement ("DPA") forms part of the Terms of Service between ONE ACTOR- SOFTWARE DEVELOPMENT, UNIPESSOAL LDA., Rua dos Barreiros, n.º 26 A, 9060-397 Funchal, Portugal, NIPC 519278267 ("OneActor", the processor), and the customer organization that accepts the Terms ("Customer", the controller). It applies when OneActor processes personal data on the Customer's behalf while providing the OneActor platform (the "Service"). It applies automatically; no signature is needed. On request, OneActor sends the Customer a countersigned copy.
1. Definitions
Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in Regulation (EU) 2016/679 ("GDPR"). "Customer Data" means the personal data in the content the Customer, its users and its agents put into the Service or that the Customer's deployed apps collect: source code and project files, conversations with the agents, tickets and designs, stored variables and keys, and the data held in the Customer's databases, caches, queues and file storage. "Sub-processor" means a processor OneActor engages to process Customer Data.
2. Roles and scope
2.1 The Customer is the controller (or a processor acting for its own controller) of Customer Data, and OneActor is its processor. Details of the processing are in Annex 1.
2.2 OneActor is a controller, not a processor, for the data it needs to run its own business: accounts, sign-in, billing, security and abuse prevention, support, and the aggregated usage it bills from. That processing is described in the Privacy Policy, not in this DPA.
2.3 If the Customer is itself a processor, it warrants that its controller has authorised this DPA, including the Sub-processors in Annex 3.
3. Instructions
3.1 OneActor processes Customer Data only on the Customer's documented instructions, including with regard to transfers outside the EEA, unless Union or Portuguese law requires otherwise; in that case OneActor informs the Customer before processing, unless that law prohibits it.
3.2 The Terms, this DPA, the Customer's configuration of the Service and the Customer's requests to the agents (for example asking them to build a feature, deploy a release, or delete a project) are the Customer's complete instructions. Other instructions need a written agreement.
3.3 OneActor tells the Customer without delay if it believes an instruction infringes the GDPR or other Union or Portuguese data protection law, and may suspend the instruction until it is confirmed or changed.
3.4 The agents act on the Customer's instructions. The Customer decides what the agents build and what its apps do with personal data. The agents' output — code, database schemas, emails an app sends — is the Customer's to review; OneActor does not decide the purposes of the Customer's apps.
4. Confidentiality
OneActor ensures that everyone it authorises to process Customer Data is bound by confidentiality, by contract or by law. At the date of this DPA, that is OneActor's manager and no one else.
5. Security
5.1 OneActor implements the technical and organisational measures in Annex 2, appropriate to the risk as required by GDPR Art. 32, and may change them provided the overall level of protection does not fall.
5.2 Shared responsibility. The Customer is responsible for the security of what its apps do: their code and dependencies (which the agents write on the Customer's instructions), their access control, the keys it stores, the people it invites to its organization, and the sign-in credentials of its own account. OneActor is responsible for the platform underneath.
6. Sub-processors
6.1 The Customer gives OneActor general written authorisation to engage the Sub-processors listed in Annex 3 and on oneactor.com/legal/subprocessors.
6.2 OneActor informs the Customer of any intended addition or replacement at least 30 days before it takes effect, by email to the organization's owners and on the sub-processor page (with a way to subscribe). The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receives a pro-rata refund of prepaid, unused fees for it.
6.3 OneActor imposes on each Sub-processor, by contract, data-protection obligations that give at least the protection of this DPA, in particular sufficient guarantees for Art. 32 measures. OneActor remains liable to the Customer for its Sub-processors' performance of those obligations.
6.4 AI model providers. The Service sends the content an agent is working on (prompts, which can include source code, conversation and data from the Customer's workspace) to the AI model provider serving the model at that moment. The providers are listed in Annex 3. OneActor chooses which provider serves which model and may change it at any time among the listed providers; the product does not show which one served a request. An organization's own AI account is the exception: where the Customer's owners connect an account the Customer holds with an AI model provider (section 5.6 of the Terms), the models they chose are served by that account. That provider acts under the Customer's own contract with it and is not a Sub-processor of OneActor; OneActor sends it the content on the Customer's instruction, and the product shows the Customer that account.
6.5 App stores. Apple and Google, where the Customer publishes its phone apps from its own developer accounts (section 5.7 of the Terms), act under the Customer's own agreements with them and are not Sub-processors of OneActor. OneActor uploads the iPhone versions of the Customer's apps to the Customer's App Store Connect account on the Customer's instruction.
7. International transfers
7.1 OneActor hosts the Service in the European Union (AWS region eu-central-1, Frankfurt). Some Sub-processors, notably AI model providers, process Customer Data in the United States or elsewhere outside the EEA, as Annex 3 states for each.
7.2 OneActor transfers Customer Data outside the EEA only under a mechanism of GDPR Chapter V: an adequacy decision (including the EU-U.S. Data Privacy Framework for a certified recipient), or the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 (Module 3, processor to processor) with a transfer impact assessment and supplementary measures where needed. Where OneActor contracts with a Sub-processor's EEA entity (for example OpenAI Ireland Ltd or Amazon Web Services EMEA SARL), OneActor makes no transfer itself, and the Sub-processor's onward transfers are covered by its own safeguards, which OneActor has checked. The mechanism for each Sub-processor is in Annex 3.
7.3 OneActor does not send Customer Data to providers or endpoints in the People's Republic of China. Models developed by Chinese laboratories are used only when hosted by a listed provider outside China.
7.4 Where the Customer is established outside the EEA, OneActor's return of Customer Data to the Customer is a transfer from a processor to a controller; the parties agree Module 4 of the standard contractual clauses where the Customer's law requires a transfer mechanism.
8. Assistance
8.1 Data subjects. Taking into account the nature of the processing, OneActor helps the Customer by appropriate technical and organisational measures to answer requests to exercise data subjects' rights. Most Customer Data is held in the Customer's own apps and databases, which the Customer controls through the Service. If OneActor receives a request meant for the Customer, it forwards it without answering it itself.
8.2 Security, breaches, assessments. OneActor assists the Customer with its obligations under GDPR Arts. 32 to 36, taking into account the information available to OneActor.
9. Personal data breaches
9.1 OneActor notifies the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting Customer Data, by email to the organization's owners, with the information GDPR Art. 33(3) requires as far as it is available, and further information as it becomes available.
9.2 Notifying a breach is not an admission of fault or liability.
10. Return and deletion
10.1 During the Service, the Customer can delete a project; its cloud resources, databases and stored keys are deleted at once, and its workspace and git repository are kept for 10 days so the project can be restored, then deleted.
10.2 At the end of the Service, OneActor deletes Customer Data within 30 days after the last of: the end of the retrieval period of the Terms, the 10-day restore window, and the 30-day retention of application logs, unless Union or Portuguese law requires storage.
10.3 Before deletion the Customer can retrieve its Customer Data itself, with an export from the dashboard's Settings, as described in the Terms (data location and switching).
11. Demonstrating compliance and audits
11.1 OneActor makes available to the Customer the information necessary to demonstrate compliance with Art. 28: this DPA, Annex 2, the sub-processor list, and answers to reasonable written questionnaires once a year.
11.2 Where that is not sufficient, or a supervisory authority requires it, the Customer may audit OneActor, itself or through an independent auditor bound by confidentiality, with 30 days' notice, during business hours, at the Customer's cost, at most once a year unless a breach justifies more. Audits of Sub-processors are satisfied by their own certifications and reports where available.
12. Liability and precedence
Each party's liability under this DPA is subject to the limits of the Terms, except where the GDPR or other law does not allow a limit. If this DPA conflicts with the Terms on personal data, this DPA prevails.
13. Duration
This DPA lasts as long as OneActor processes Customer Data, and survives the end of the Terms until the deletion in section 10.
Annex 1 — Details of the processing
| Subject matter | Providing the Service: AI agents that plan, build, test and deploy the Customer's software, the workspace, and hosting of the Customer's deployed apps and their data |
|---|---|
| Duration | The term of the Terms, plus the retention in section 10 |
| Nature | Storage, hosting, computation, transmission to AI model providers, retrieval, deletion; automated processing by AI agents on the Customer's instructions |
| Purpose | To provide the Service as the Customer configures and instructs it |
| Data subjects | The Customer's personnel and invited users; the end users of the Customer's deployed apps; any person whose data the Customer puts into a project (for example in requirements, test data, or code) |
| Personal data | Whatever the Customer's projects and apps contain: typically names, emails, account data and content of the Customer's end users, commit author names, data in conversations with the agents. The Customer decides |
| Special categories | Not intended. If the Customer's app processes special categories (GDPR Art. 9) or criminal data (Art. 10), the Customer is responsible for having a basis and must tell OneActor |
| Where | EU (AWS eu-central-1) for storage and hosting; a Mac in the EU (Paris, France) for iPhone builds, per Annex 3; AI model providers per Annex 3, or the provider of an AI account the Customer connected (section 6.4); CDN edge locations worldwide for the Customer's published sites (cached copies only) |
Annex 2 — Technical and organisational measures
Tenant separation
- Each project's workspace runs in its own Kubernetes namespace and pod with its own storage volume.
- Each project's database is a separate PostgreSQL schema with its own login role per environment (development, test, production) on a shared cluster; ownership is checked on every request from the project's workload credential, and no tenant can create objects in the shared
publicschema. - Each project's cache access is a separate ACL user restricted to a key prefix; queues and file storage are per project and reached only by that project's function role.
- The Customer's cloud resources are created and deleted only through the platform, which refuses resource types outside a closed catalog.
Secrets
- Keys and variables are stored in a separate database, encrypted with a key-wrapping (envelope) scheme using AWS KMS keys bound to the project and environment. Values for test and production are never returned to anyone, including OneActor's staff, and are injected directly into the Customer's functions.
- Database passwords are generated by the platform, differ per environment, and are never shown.
- An AI account the Customer connects is reached by workload identity federation, and no key for it is stored: the AI gateway exchanges a short-lived identity token of its own, naming the Customer's organization, for a short-lived access token that it keeps only in memory, never in a workspace, and masks in its logs.
Access control
- Customer organizations have roles (owner, admin, member) and per-project roles (viewer, developer, manager); only an owner may authorise production.
- Every deploy needs a person's action in the dashboard; agents cannot authorise production.
- OneActor's operator tools run separately from the customer-facing API, with their own sign-in, roles and audit log.
Encryption
- In transit: HTTPS for the website, the dashboard, the API and published sites.
- At rest: file storage (Amazon S3) and the platform's tables in Amazon DynamoDB are encrypted by AWS.
Accounts
- Passwords of 8–128 characters checked against common and guessable passwords, hashed with bcrypt; single-use password-reset links valid for one hour; sessions revoked on reset.
- Failed sign-ins are limited per address and per client, and 100 failed attempts in a row lock the password until it is reset; two-factor sign-in is not offered.
- A new account's email address is confirmed with a single-use link valid for 24 hours before the account can create projects, pay or invite anyone. Signing in with a Google account (OpenID Connect, identity, address and name only) is offered; an account without a password confirms its deletion, and a project's with production resources, with a fresh sign-in at Google.
Operations
- Application logs of the Customer's functions are kept 30 days. Traces of AI requests, which contain prompts, are switched off in production.
- Releases are scanned for leaked secrets before deployment (advisory); a read-only security-review agent checks risky changes.
- Personnel: one person, bound by confidentiality.
- Incident response: a personal data breach is notified to the Customer as section 9 describes.
Deletion
- Project deletion as in section 10; application logs expire after 30 days; secrets are deleted with the project.
Annex 3 — Sub-processors
The current list, with each Sub-processor's role, location and transfer mechanism, is kept at Sub-processors and forms part of this Annex.