← Back to AppDeploy

Data Processing Addendum (DPA)

Last updated: August 16, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer") and FreeBraavos LTD ("AppDeploy", "we", "us") governing your use of AppDeploy (the "Agreement").

This DPA applies where and to the extent AppDeploy processes Personal Data on Customer's behalf as a processor in connection with the Services ("Customer Personal Data").

The standard online DPA forms part of the Agreement and applies automatically, without additional action, when AppDeploy processes Customer Personal Data through the Services, including the Free tier. It applies at the customer and service level, not separately to each deployed app. AppDeploy does not currently offer individually negotiated or countersigned DPAs. Organizations with additional procurement requirements may contact sales@appdeploy.ai regarding the planned Business offering.

Related trust docs: Security overview, Privacy Policy and Subprocessors.

1) Definitions

2) Roles and scope

Customer is the Controller of Customer Personal Data and AppDeploy is the Processor of Customer Personal Data. Each party will comply with Applicable Data Protection Law in its respective role.

Customer is responsible for (a) providing any required notices to, and obtaining any required consents from, end users and visitors of Customer's deployed apps, and (b) ensuring Customer instructions to AppDeploy comply with Applicable Data Protection Law.

For account, security, abuse prevention, service operations, website analytics and data uses under the free-service data license, AppDeploy may act as an independent controller where permitted by applicable law. For Customer Personal Data processed on Customer's behalf through deployed apps, AppDeploy acts as processor as described in this DPA.

3) Details of processing

The subject matter, duration, nature and purpose of the processing, as well as the types of Personal Data and categories of data subjects, are described in Annex 1.

Customer instructs AppDeploy to process Customer Personal Data to provide the Services under the Agreement. Customer may issue additional documented instructions consistent with the Agreement.

If AppDeploy believes an instruction violates Applicable Data Protection Law, AppDeploy will inform Customer, unless prohibited by law.

4) Model improvement and feedback data

The public AppDeploy Terms include a free-service data license for User Content, Deployment Data, Feedback Data and Derived Data, as defined in the public Terms, submitted to or generated by AppDeploy. This DPA does not limit that license except to the extent the data constitutes Customer Personal Data processed by AppDeploy solely as a processor on Customer's behalf.

AppDeploy will not use Customer Personal Data processed solely under this DPA on Customer's behalf, including personal data collected from visitors to Customer's deployed app, to train third-party models, to train or fine-tune AppDeploy models for general service improvement or for unrelated model-training purposes, unless Customer has instructed or agreed in writing.

AppDeploy may use User Content, Deployment Data, Feedback Data and related data under the public Terms where AppDeploy acts as an independent controller or where the data does not constitute Customer Personal Data processed solely on Customer's behalf. AppDeploy may also use data that has been aggregated, de-identified or anonymized so that it no longer constitutes Personal Data under Applicable Data Protection Law to improve, train, evaluate, benchmark, commercialize and secure the Services.

AppDeploy may use listed AI-service Subprocessors, including Google Cloud Platform or Vertex AI where enabled, to process Customer Personal Data on AppDeploy's behalf for service-delivery functions such as automated QA, evaluation, repair, safety, redaction and reliability. Those Subprocessors are not authorized by this DPA to use Customer Personal Data for their independent model training.

QA screenshots, DOM captures, runtime logs and diagnostic outputs are treated as Deployment Data or Feedback Data when captured for deployment, QA, repair, reliability or security purposes. To the extent those artifacts contain Customer Personal Data processed solely by AppDeploy as processor on Customer's behalf, the processor restrictions in this DPA apply to that Customer Personal Data.

AppDeploy will not share visitor personal data or other Customer Personal Data processed solely under this DPA with AI model providers, coding-agent providers, app-generation platforms, QA or evaluation providers, research partners or infrastructure partners for their independent model training.

5) Processor obligations

5.1 Confidentiality

AppDeploy will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

5.2 Security measures

AppDeploy will implement appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.

A summary of our security measures is described in Annex 2. No security measures can guarantee absolute security.

5.3 Personal data breaches

AppDeploy will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. AppDeploy will provide information reasonably required by Customer to meet its breach notification obligations, as available to AppDeploy.

5.4 Assistance with data subject requests

Taking into account the nature of the processing, AppDeploy will provide reasonable assistance to Customer to help respond to requests by data subjects to exercise their rights under Applicable Data Protection Law, to the extent Customer cannot access relevant data through the Services.

If AppDeploy receives a request directly from a data subject relating to Customer Personal Data, AppDeploy will, to the extent legally permitted, direct the data subject to Customer or notify Customer.

5.5 Assistance with compliance

AppDeploy will provide reasonable assistance to Customer, upon request, with Customer's obligations under Applicable Data Protection Law relating to security, breach notification, data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and information available to AppDeploy.

5.6 Records

AppDeploy will maintain records of processing activities as required by Applicable Data Protection Law.

6) Subprocessors

Customer provides a general authorization for AppDeploy to engage Subprocessors to process Customer Personal Data, subject to the terms of this section.

AppDeploy maintains a list of current Subprocessors at appdeploy.ai/subprocessors.

If AppDeploy uses a third party to process Customer Personal Data for model-improvement, evaluation, QA, labeling, redaction or related purposes, that third party will be listed as a subprocessor where required by Applicable Data Protection Law.

6.1 Subprocessor obligations

AppDeploy will impose data protection obligations on Subprocessors that are no less protective than those in this DPA to the extent applicable to the Subprocessor's processing of Customer Personal Data.

AppDeploy remains responsible for the performance of its Subprocessors with respect to their processing of Customer Personal Data.

6.2 Changes to Subprocessors (notice and objection)

If AppDeploy adds or replaces a Subprocessor that processes Customer Personal Data, AppDeploy will provide advance notice by updating the Subprocessors page and, where feasible, by email or in-product notice at least 30 days before the change takes effect.

If Customer objects to a new Subprocessor on reasonable data protection grounds, Customer may contact support@appdeploy.ai within the notice period. AppDeploy will work with Customer in good faith to address the objection, which may include providing an alternative, limiting the affected processing or allowing Customer to terminate the affected Services.

7) International transfers

AppDeploy primarily processes and stores data in the United States (us-east-1). AppDeploy may also use global edge locations for content delivery and security, depending on the infrastructure services used.

Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country not recognized as providing an adequate level of protection, the parties will ensure appropriate safeguards are in place as required by Applicable Data Protection Law, including the European Commission's Standard Contractual Clauses (SCCs), the UK IDTA or UK Addendum to the EU SCCs, as applicable, or other valid transfer mechanisms.

Customer may request more information about the safeguards AppDeploy uses by contacting support@appdeploy.ai.

8) Deletion or return of Customer Personal Data

Upon termination of the Services or upon Customer's request, AppDeploy will delete or return Customer Personal Data, at Customer's choice, unless retention is required by applicable law.

Upon deletion or termination, AppDeploy will delete or return Customer Personal Data as described in the Agreement and this DPA, subject to legal obligations and backup retention. This deletion obligation does not apply to aggregated, de-identified or anonymized data that no longer constitutes Personal Data under Applicable Data Protection Law, or to model weights, technical learnings or derived statistical outputs that do not identify Customer, Customer's users or deployed apps.

Deletion from backups occurs on a rolling basis consistent with AppDeploy's backup retention practices. For more information, see our Privacy Policy.

9) Audits and information

AppDeploy will make available information reasonably necessary to demonstrate compliance with this DPA.

Customer may conduct an audit of AppDeploy's compliance with this DPA no more than once per 12-month period, subject to (a) at least 30 days prior written notice, (b) reasonable confidentiality obligations and (c) restrictions designed to prevent disruption to AppDeploy's operations and to protect other customers' data and security. Audits will be conducted at Customer's expense.

10) Liability and order of precedence

The parties' liability under this DPA is subject to the limitations of liability and exclusions in the Agreement, unless Applicable Data Protection Law requires otherwise.

If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA will control to the extent of the conflict.

11) Contact

FreeBraavos LTD, Menakhem Begin Rd 121, Tel Aviv-Yafo, Azrieli Sarona Tower, Israel.

General DPA questions? Email support@appdeploy.ai.

Annex 1 - Processing details

A. Subject matter

Deployment, hosting, operation and support of Customer-deployed websites and web applications through AppDeploy, including processing necessary to build and deploy Customer code and to serve Customer deployments to end users.

B. Duration

For the term of the Agreement and as long as Customer deployments remain active, plus any retention periods described in the Agreement, this DPA and AppDeploy's Privacy Policy.

C. Nature and purpose of processing

  • Receive Customer project files, configuration and metadata for deployment.
  • Build and deploy Customer apps and host them at a URL.
  • Serve Customer-deployed apps to end users and visitors.
  • Perform automated QA, evaluation, repair, safety, redaction and reliability checks, including through authorized Subprocessors where enabled.
  • Operate, secure, monitor and troubleshoot the deployment infrastructure.

D. Categories of data subjects

  • Customer, including account users, administrators and collaborators.
  • End users and visitors of Customer-deployed apps.

E. Categories of Personal Data

  • Identifiers and account-related information, for example a user identifier and optional email address if provided via social sign-in.
  • Customer content that may contain Personal Data, for example text entered into an app, files uploaded to an app or configuration values.
  • Technical and usage data related to hosting and serving deployments, for example IP address, request headers, access logs, error logs and timestamps.

Customer controls what Personal Data is collected by Customer-deployed apps. Customer should avoid including secrets or restricted data in project files or logs.

F. Special categories of data

AppDeploy does not intentionally process special categories of Personal Data. Customer agrees not to provide such data unless Customer has a lawful basis and appropriate safeguards, and AppDeploy has agreed in writing.

Annex 2 - Technical and organizational measures

The measures below describe AppDeploy's approach to security. They may evolve as our service changes. AppDeploy will maintain measures designed to be appropriate for the risk of processing.

A. Access control

  • Principle of least privilege for internal access to production systems.
  • Access is limited to authorized personnel and protected through authentication controls.
  • Separation of environments, where feasible, and controlled access to administrative interfaces.

B. Encryption and transport security

  • TLS in transit for communications with the Services.
  • Encryption at rest for stored data where supported by underlying infrastructure services.

C. Logging and monitoring

  • Operational logging to detect and investigate reliability and security issues.
  • Efforts to reduce sensitive data in logs, for example redacting obvious secrets and personal data where feasible.
  • Monitoring for service availability and abnormal behavior.

D. Vulnerability and patch management

  • Regular updates of dependencies and infrastructure components as appropriate.
  • Security review and incident response procedures for reported vulnerabilities.

E. Backups and recovery

  • Backups and disaster recovery practices designed to restore service availability.
  • Backup retention and deletion practices aligned with AppDeploy's Privacy Policy.

F. Subprocessor management

  • Use of reputable infrastructure providers for compute, storage and identity services.
  • Contractual flow-down of data protection obligations to Subprocessors where applicable.
  • Maintenance of a public Subprocessors list and a notice process for changes.

Annex 3 - Subprocessors

The current list of Subprocessors is available at appdeploy.ai/subprocessors.