Open ExecutiveLegal

Data Processing Addendum

Effective 30 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between ForeAct Labs, LLC ("Processor", "we") and the Customer ("Controller", "you"). It applies when we process Customer Personal Data on your behalf in providing the Service, and it applies automatically: you accept it when you accept the Terms. If this DPA conflicts with the Terms, this DPA wins for Customer Personal Data.

1. Definitions

"Data Protection Laws" means all laws on the processing of personal data that apply to a party's processing under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").

"Customer Personal Data" means personal data in Customer Content that we process on your behalf. "Personal data", "controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR; "personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. "Subprocessor" means a third party we engage to process Customer Personal Data.

2. Roles and instructions

You are the controller (or a processor acting for your own controller) and we are your processor. We process Customer Personal Data only on your documented instructions. Those instructions are the Terms, this DPA, and what you and your seats do in the Service — including connecting tools and asking your instance to act in them. We will tell you if we believe an instruction breaks Data Protection Laws. If the law requires us to process Customer Personal Data otherwise, we will tell you first unless the law forbids it.

You are responsible for the lawfulness of the Customer Personal Data you put into the Service and of your instructions, including giving notices and obtaining consents.

3. Our personnel

We ensure that everyone we authorize to process Customer Personal Data is bound by confidentiality and gets access only as needed to provide, secure or support the Service.

4. Security

We implement and maintain the technical and organizational measures in Annex II, appropriate to the risk. We may update them as long as the overall level of security is not reduced.

5. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach, at the email address on your account. We will give you the information you reasonably need to meet your own notification obligations as it becomes available, and take reasonable steps to contain and remedy the breach. Notifying you is not an admission of fault.

6. Subprocessors

You give us general authorization to engage subprocessors. The current list is at /subprocessors, which forms Annex III. We impose on each subprocessor, by written contract, data-protection obligations that are no less protective than this DPA, and we remain liable to you for their performance.

We will notify you by email at least 30 days before engaging a new subprocessor. You may object on reasonable data-protection grounds by writing to support@openexecutive.ai before the change takes effect. We will then try to resolve the objection in good faith; if we cannot, you may terminate the affected Service, and we will refund prepaid fees for the unused part of the period.

7. Assistance

Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures and at your reasonable request:

  • respond to requests from data subjects exercising their rights (much of the data is directly accessible to you in your instance, and your seats' own data can be removed there); we will pass on to you any request we receive directly about Customer Personal Data and not answer it ourselves except to redirect it;
  • carry out data protection impact assessments and prior consultations with supervisory authorities about the Service.

8. Deletion and return

While your subscription is active you can export Customer Content by downloading backups of your instance. When the Service ends (including when your subscription ends or your account is closed), or earlier on your written request to support@openexecutive.ai, we delete Customer Personal Data, including backups, within 30 days, unless the law requires us to keep it (in which case we keep it confidential and process it only for that purpose).

9. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering reasonable security questionnaires once a year. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you (or an independent auditor bound by confidentiality) may audit our compliance once a year, on at least 30 days' written notice, during business hours, at your cost, and without access to other customers' data.

10. International transfers

We and our subprocessors process Customer Personal Data in the United States, except that when you choose an AI model from a vendor other than Anthropic, its provider may process prompts in another country (Annex III). To the extent a transfer of Customer Personal Data from the EEA, the UK or Switzerland to us is a restricted transfer, the parties enter into, and this DPA incorporates by reference:

  • EEA: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor, with: clause 7 (docking) included; clause 9(a) option 2 (general written authorization), with the notice period in section 6 of this DPA; the optional wording in clause 11 omitted; clause 13 as applicable to your establishment; clauses 17 and 18 governed by the law and courts of Ireland; Annex I as set out below; Annex II as set out below; Annex III as the subprocessor list.
  • UK: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0), with the information in its tables taken from the SCCs as completed above and from this DPA; either party may end it as described in its section 19.
  • Switzerland: the SCCs as completed above, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the Swiss Federal Act on Data Protection, and "member state" including Switzerland for clause 18(c).

If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

11. US state privacy laws

To the extent the CCPA or a similar US state law applies, we are your service provider (or processor) and we will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Terms, or outside our direct business relationship with you; or combine it with personal data we receive from others, except as those laws permit. We will comply with the obligations that apply to us under those laws, provide the same level of privacy protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data. We certify that we understand these restrictions.

12. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow it to be limited. This DPA lasts as long as we process Customer Personal Data for you.

Annex I — Details of processing

Data exporter: the Customer, as identified by its account; contact is the email address on the account. Role: controller (or processor).

Data importer: ForeAct Labs, LLC, support@openexecutive.ai. Role: processor.

Categories of data subjects: the Customer's principal and seats; and people whose personal data the Customer puts into the Service or its connected tools, such as the Customer's employees, contractors, customers, suppliers and other business contacts.

Categories of personal data: names, contact details, job and organizational details; the content of messages, emails, calendar entries, documents and chats the Customer processes through the Service; notes and memory the Service keeps about the Customer's organization and people; usage data.

Special categories of data: none are intended. The Customer should not put special-category data into the Service unless it has a lawful basis and has assessed that it is appropriate; any that it does is protected by the measures in Annex II.

Frequency of transfer: continuous, for as long as the Service is used.

Nature and purpose of processing: hosting, storage, retrieval and indexing of Customer Content; generating responses, summaries, drafts and scheduled briefings with AI models; running code and hosting apps the Service builds for the Customer; acting in connected tools on the Customer's instructions; sending notifications to the Customer's phones; backups; support.

Retention: for the duration of the Terms, then deleted as described in section 8.

Subprocessors: as listed in Annex III, for the purposes and in the locations stated there.

Competent supervisory authority: as determined by clause 13 of the SCCs.

Annex II — Technical and organizational security measures

  • Isolation. Each customer's instance runs on its own virtual machine with its own storage volume. Instances have no public network address; they are reached only over the hosting provider's private network, authenticated with a secret unique to each instance. Code the Service runs for a customer, and apps it builds, run in separate isolated environments of that customer's own, with no outbound network access; code runs on a clean copy that is reset after use. An app can be opened by people outside the Customer's team only if the Customer shares it by public link, or with people it names by email, who sign in with a one-time code sent to that address.
  • Encryption. All traffic to the Service uses TLS. Storage volumes and backup storage are encrypted at rest by the providers. Credentials for connected services and customers' own API keys are additionally encrypted at the application level before they are stored. Access tokens for business apps are kept only on our platform, which makes the calls for the instance, and are never sent to the instance.
  • Authentication. Passwords are stored only as Argon2 hashes; email addresses are verified before an account can sign in; sign-in and sign-up are rate-limited. Sign in with Google or Microsoft is supported.
  • Access control. Within an instance, seats see only their own chats and cannot change setup, integrations, people or documents; the principal controls seats and can remove them. Our own access to production systems is limited to personnel who need it, through our hosting provider's authenticated access.
  • Logging. Each instance keeps an audit log of the actions the Service takes, visible to the principal.
  • Backups and recovery. Principals can take backups on demand or on a schedule, download and restore them. Each archive carries a checksum of its contents, and secrets for connected services are removed from archives.
  • AI providers. Our model gateway is set to exclude providers that may train on prompts. Claude models are the default; a model from another vendor is used only when the Customer chooses it.
  • Connected tools. In business apps, the Service reads straight away but any change waits for approval in the Service, and tools that delete are not offered.
  • Change management. Updates are rolled out to one instance at a time, starting with our own, and an update that fails its health check is rolled back.
  • Incident response. We investigate suspected incidents and notify customers as set out in section 5.

Annex III — Subprocessors

See /subprocessors.

Open Executive is operated by ForeAct Labs, LLC