Data Processing Addendum

For the personal data you put into your workspace, you are the controller (the data fiduciary under India's Digital Personal Data Protection Act, the controller under the UK GDPR, the UAE and Saudi Arabian data protection laws, and the business under California law) and SelfRun AI is your processor (the processor, or service provider in California).

For the account, billing and website information about you as our customer, we act as a controller. The Privacy Policy describes that.

• We process your personal data only to provide the service to you, and as you instruct us through the product, its settings, its API and your written requests.
• Features you switch on (AI, automations, integrations, your website, push notifications) are instructions to process data in that way.
• If we believe an instruction breaks the law, we will tell you and may pause it until it is clarified.

Only people who need access to operate and support the service have it, and they are bound by confidentiality. What platform staff do in the Platform Console is recorded in a platform audit log. Inside your company, access follows the roles and permissions your administrators set.

• Strict isolation: every record carries its company, and every database query is confined to it.
• Roles and per-action permissions, enforced on the server, with extra permission for payroll, salaries, bank details and stored credentials.
• Two-step sign-in, mandatory for company Super Admins and every Platform Console user; account lock-out after repeated wrong passwords; passwords stored only as salted scrypt hashes.
• Encryption of connection secrets and vault documents at rest, HTTPS with HSTS for all traffic, and a hardened set of security headers.
• Uploaded files are checked by type and size and scanned before they are accepted.
• Sign-ins, changes, exports and administrative actions are recorded in audit logs; sign-in records are kept for 180 days.
• Backups of your workspace, with restore and deletion controls for your Super Admin. The Security & Trust page describes these in full.

You authorise us to use the sub-processors listed on the Sub-processors page. We bind each one to data protection terms no less protective than these. We update that page before a new sub-processor starts handling your personal data; if you object on reasonable data protection grounds, write to privacy@selfrunbusiness.com and we will work with you on an alternative, or you may end the service.

Where personal data is transferred across borders, we rely on the safeguard the applicable law requires (such as an adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or the consent or contractual mechanisms the UAE, India and Saudi Arabia permit) and we record each transfer in a register. The Sub-processors page lists the providers and what they receive.

People can ask you to access, correct, export or delete their personal data. Your workspace has export and deletion tools. If someone writes to us about data in your workspace, we send them to you and do not answer on your behalf. If you need our help to find or remove data, write to privacy@selfrunbusiness.com.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of your personal data, we tell you without undue delay, with what we know: what happened, the data and people affected, the likely consequences, and what we have done and will do. Open incidents are shown on the System status page. We help you meet your own duty to notify regulators and people within the time the law gives you.

You can export your data at any time while your plan is active. If you cancel, your workspace stays readable for a period so you can export it. A Super Admin can delete the company: it is scheduled for deletion after a 30-day grace period during which it can be restored, then deleted for good. Safety copies made before a restore or wipe are kept for 30 days.

Backups roll off on their stated schedule after deletion. We keep information beyond that only where the law requires it, such as tax and accounting records.

We make available the information needed to show we meet this addendum, including the Security & Trust page and the description of our controls. If you need more, or an audit that your regulator requires, write to security@selfrunbusiness.com; we will agree reasonable scope, timing and confidentiality so it does not put other customers at risk.

If this addendum and the Terms of Service conflict about the processing of personal data, this addendum applies. Liability is as set out in the Terms of Service.