Data Processing Agreement

1. Definitions

• Data Protection Law means the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law with the UK Data Protection Act 2018 (“UK GDPR”), and the Swiss Federal Act on Data Protection (“FADP”), to the extent each applies to the processing.
• Customer Personal Data means personal data in the content you and your users put into Done (tasks, projects, comments, files, and data from apps you connect) and the account data of your users, which Done processes on your behalf.
• Sub-processor means a third party Done engages to process Customer Personal Data.
• SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 (text).
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR.

2. Roles

For Customer Personal Data, you are the controller (or a processor acting for your own controller) and Done is your processor (or sub-processor). Done is a controller only of the data it uses to run its own business, such as billing, security and website analytics, which its Privacy Policy covers. You are responsible for having a lawful basis for the Customer Personal Data you put into Done and for the instructions you give.

3. Instructions

Done processes Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and what you or your users direct through Done's settings, interface and API, including the actions of AI agents you connect and authorize. Done will tell you if it believes an instruction breaks Data Protection Law, unless the law forbids it. If Done is required by law to process Customer Personal Data otherwise, it will tell you first unless that law prohibits it.

4. Confidentiality

Done limits access to Customer Personal Data to people who need it to provide, secure or support the service, and makes sure they are bound by confidentiality. Done does not read your content except to provide support you ask for, to investigate abuse or a security issue, or where the law requires it.

5. Security

Done implements and maintains the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Done may update them as long as the overall level of protection does not decrease.

6. Personal data breaches

Done will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe what is known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Done will add details as they become available and take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.

7. Sub-processors

You give Done general authorization to use sub-processors. The current list is at trydone.app/legal/subprocessors (Annex III). Done imposes data-protection obligations on each sub-processor by written contract that are at least as protective as this DPA, and remains liable to you for their performance.

Done informs you of an intended new sub-processor by adding it to that page at least 10 days before it starts processing Customer Personal Data. Done does not send separate notices, so check the page if you need to follow changes. If you object to a new sub-processor on reasonable data-protection grounds within that period, your remedy is to stop using Done and delete your account.

8. Assistance

Taking into account the nature of the processing, Done will help you, through the features of the service where possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability and objection). If Done receives such a request directly about Customer Personal Data, it will pass it to you rather than answer it. Done will also give reasonable help with data protection impact assessments and prior consultations with supervisory authorities relating to Done.

9. Deletion and return

You can export your data and delete content or your whole account in Done at any time. When your account is deleted, or within 30 days after the Terms end, Done deletes Customer Personal Data from the live service, except where the law requires it to keep some. Done also deletes accounts that have not been used for 12 months, after emailing the account 30 days before, as its Privacy Policy describes. Deleted data is removed from backups as they expire, within 30 days. On request before deletion, Done will help you obtain a copy of the data.

10. Information and audits

Done will make available the information reasonably needed to demonstrate compliance with this DPA and Article 28 of the GDPR, including written answers to reasonable security questionnaires. Where that is not enough, you, or an independent auditor bound by confidentiality, may audit Done's compliance once a year on at least 30 days' written notice, during business hours, at your cost, and in a way that does not disrupt the service or expose other customers' data. Audits of Done's sub-processors are satisfied by the reports and certifications they make available.

11. International transfers

Done stores and processes Customer Personal Data in the United States. To the extent that providing Done involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the transfer is governed by the SCCs, which are incorporated into this DPA by reference, as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and Done is the data importer.
• The optional docking clause in Clause 7 applies.
• In Clause 9, Option 2 (general written authorization) applies, with the notice period in section 7 of this DPA.
• The optional language in Clause 11 does not apply.
• In Clause 13, the competent supervisory authority is the one determined by your establishment or, if you are not established in the EEA, by your EU representative or the data subjects concerned, as Clause 13 provides.
• In Clause 17, Option 1 applies and the governing law is the law of Ireland. In Clause 18(b), disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by the Annexes of this DPA.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies and is incorporated by reference. Table 1 is completed with the parties' details in Annex I, Tables 2 and 3 with the choices above and the Annexes of this DPA, and in Table 4 either party may end the Addendum as its Section 19 allows.

For transfers from Switzerland, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to the GDPR are read as references to the FADP for those transfers; “Member State” in Clause 18(c) includes Switzerland, so data subjects there can bring claims where they habitually reside.

If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

12. Liability and precedence

Each party's liability under this DPA is subject to any limitations of liability in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. This DPA lasts as long as Done processes Customer Personal Data for you.

Annex I: Description of the processing

Parties

• Data exporter: the Customer, as identified in its Done account. Activities: using Done for task and project management. Role: controller (or processor). Signature and date: given by accepting the Terms.
• Data importer: Pickleland LLC, 21427 Martin Lane, Pflugerville, TX 78660, United States, operating Done. Contact: support [at] trydone.app. Activities: providing the Done service. Role: processor. Signature and date: given by offering the Terms.

Data subjects

Your users and workspace members, and anyone whose personal data you or your users put into Done: for example colleagues, clients, contacts, and attendees of calendar events you connect.

Categories of personal data

Account data (name, email address, sign-in identifiers); content (task titles and descriptions, comments, activity history, attached files, and anything else you enter); data from apps you connect (for example calendar events, attendees and their email addresses); and technical data (device tokens for notifications, and IP addresses in short-lived request logs).

Special categories of data

None are intended. Done is not designed for special categories of personal data or data about criminal convictions, and you should not put them into Done unless you have a lawful basis and have satisfied yourself that the measures in Annex II are adequate.

Frequency, nature and purpose

Continuous, for as long as you use Done. Done stores, organises, displays, transmits and deletes Customer Personal Data in order to provide the service as described in the Terms, including carrying out actions requested by AI agents you connect, sending the notifications and emails you enable, and providing support.

Retention

As set out in section 9.

Transfers to sub-processors

As listed in Annex III, for the purposes stated there, for as long as you use Done.

Annex II: Technical and organisational measures

• Encryption: all traffic uses TLS (HTTPS with HSTS); the database and file storage are encrypted at rest by Cloudflare.
• Authentication: passwords are stored only as argon2id hashes; optional two-step verification and passkeys; sign-in with Google or Microsoft; session cookies are HttpOnly and Secure.
• Agent access: MCP tokens and OAuth grants are per account, stored only as hashes, can be limited to read-only or one project, and can be revoked at any time. An agent cannot mark a task done without a human's approval unless the customer has opted that task in, and every approval is recorded in a history that cannot be deleted.
• Isolation: every query is scoped to the workspaces and projects the user is a member of; accounts cannot see each other's data unless it is shared with them.
• Application security: a strict Content Security Policy with per-response nonces, rate limiting on sign-in and other sensitive endpoints, a bot check on sign-up, and automated tests for access control run on every change.
• Infrastructure: Done runs on Cloudflare's managed platform, which is responsible for physical security, network protection and the availability of the underlying systems.
• Availability and recovery: point-in-time database backups kept for 30 days; deleted files are kept for 30 days before permanent removal so mistakes can be recovered.
• Access by personnel: production access is limited to the people who operate Done, who are bound by confidentiality. An internal dashboard shows aggregate counts only and never task content.
• Data subject rights: users can export their tasks, delete content and delete their account themselves.

Annex III: Sub-processors

The sub-processors listed at trydone.app/legal/subprocessors, as updated under section 7.