Data Processing Agreement

Effective 2026-11-15

This Data Processing Agreement ("DPA") is between Arthur Katcher, doing business as Kubi ("Kubi" or "Provider") and each customer of Kubi ("Customer"). It is this Cover Page with its Annexes, plus the Common Paper DPA Standard Terms Version 1.1 ("Standard Terms") at commonpaper.com/standards/data-processing-agreement/1.1, which are incorporated by reference. If they conflict, this Cover Page controls. Words the Standard Terms define have their meaning there; Account, Agent, End User, Screen, Service and Your Content mean what the Kubi Terms of Service ("Terms") say.

The short version

• When your Screens hold personal data, you are the controller (or a processor for your own customers) and Kubi is your processor.
• This DPA applies automatically when you accept the Terms. We countersign a copy if you need one.
• We process the data only to run the Service as you instruct, never train AI on it and never sell it.
• We tell you about a personal data breach without undue delay, and within 72 hours of becoming aware of it.
• We give 30 days' notice before a new subprocessor starts, and you can object.
• The EU Standard Contractual Clauses and the UK Addendum are built in.

1. Key Terms

1.1 Agreement. The Terms between Kubi and Customer, in the version Customer accepted online, as later updated under Terms 16. Kubi is for business use only, so this DPA applies whenever Your Content includes personal data.

1.2 Acceptance. Customer accepts this DPA by accepting the Terms, and Kubi records the version and the date. No signature is needed; on request to legal@trykubi.com, Kubi countersigns this Cover Page without changing its terms.

1.3 Approved Subprocessors. The subprocessors listed at trykubi.com/legal/subprocessors on the date Customer accepts the Terms, as later changed under section 2.3.

1.4 Provider Security Contact. security@trykubi.com.

1.5 Security Policy. The measures in Annex II.

1.6 Service Provider Relationship. Where the California Consumer Privacy Act applies, Kubi is Customer's service provider: it receives Customer Personal Data only to provide the Service, does not sell or share it, does not retain, use or disclose it for any other purpose or combine it with other data except as that law allows, and tells Customer if it can no longer meet these duties.

1.7 Credit. The Standard Terms are by Common Paper, used under CC BY 4.0. Kubi adapted the Cover Page and changed the Standard Terms only as this Cover Page says.

2. Changes to the Standard Terms

2.1 Liability and law. The exclusions and the cap in Terms 15 apply to this DPA, subject to section 8.3 of the Standard Terms. Terms 17 governs disputes about this DPA, except disputes under the EEA SCCs or the UK Addendum, which go where section 3 says. This DPA adds no indemnity.

2.2 Breach notice. Kubi notifies Customer of a Security Incident without undue delay and within 72 hours after becoming aware of it, with what GDPR Article 33(3) asks for as far as Kubi knows it, and adds what it learns later. Kubi helps Customer with the notices Customer must give. A breach caused by software, Agents, keys or settings that Customer controls is Customer's to handle, but Kubi tells Customer if it learns of one.

2.3 Subprocessors. Kubi gives at least 30 days' notice, by email to the Account owners and on the subprocessors page, before a new or replacement subprocessor starts processing Customer Personal Data. Customer may object to privacy@trykubi.com before then, with reasons relating to data protection. If the parties can't resolve it, Customer may close the affected Screens or its Account and get back prepaid Fees for the unused time. If a subprocessor fails or must be replaced quickly for security, Kubi may give shorter notice, never less than 10 business days for transfers under the EEA SCCs or the UK Addendum.

2.4 Reports and audits. Kubi has no independent audit report yet. Until it publishes one, Kubi shows its compliance through this DPA, its security page and its answers to security questionnaires, and the first sentence of section 5.2 of the Standard Terms does not apply. Where the law, the EEA SCCs or a supervisory authority requires an audit that this does not satisfy, Kubi allows it: on 30 days' notice, remotely where possible, at most once a year unless a regulator requires more or a Security Incident has affected Customer Personal Data, by Customer or an independent auditor under confidentiality, at Customer's cost, and with no access to other customers' data. For data centers, Kubi provides its providers' own reports where they make them available.

2.5 Return and deletion. Customer exports Customer Personal Data itself through the dashboard, API or SDK at any time, including during the 30-day Retrieval Period after the Agreement ends (Terms 12). Kubi then deletes it; recovery copies of Screen disks expire within 7 days and database backups within 14 days after that. A deleted persistent Screen can be restored for 7 days, then its disk, history and saved screenshots are erased; a deleted disposable Screen is erased at once. Kubi keeps data longer only where the law requires, and certifies deletion on request.

2.6 Kubi's own data. Kubi processes Account details, billing data, Service Data, sign-in records and network and admin logs as an independent controller under its Privacy Policy, not under this DPA.

2.7 Authorities. Instead of the words "and Provider will not respond to the request without Customer's prior consent" in section 6.1 of the Standard Terms: Kubi checks that each request from a public authority is valid, discloses only the minimum the law requires, and tells Customer unless the law forbids it or it would put someone at risk (Terms 7.5). For transfers under the EEA SCCs, Clause 15 applies too. Kubi has built no special access for authorities.

2.8 Instructions and help. Kubi tells Customer at once if it believes an instruction breaks data protection law. Kubi helps with data subject requests and assessments first through the Service's own tools and this DPA, free; for more work it may charge a reasonable fee, quoted in advance, but never for breach notices, deletion or help needed because Kubi breached this DPA.

2.9 Notices. Kubi sends notices under this DPA by email to the Account owners and to any privacy contact Customer names at privacy@trykubi.com. Customer sends notices to privacy@trykubi.com, or to security@trykubi.com for security matters.

3. Restricted transfers

3.1 EEA SCCs. Section 3.2 of the Standard Terms applies: Module Two when Customer is a controller, Module Three when Customer is a processor. Governing law and courts: Ireland.

3.2 UK Addendum. Section 3.3 of the Standard Terms applies, with England and Wales as governing law. In Table 1 the parties are those in Annex I(A) and the start date is the date Customer accepted the Terms.

3.3 Switzerland. Section 3.4 of the Standard Terms applies. "Member state" in the EEA SCCs does not stop data subjects who live in Switzerland from suing there, and Swiss courts are an alternative venue under Clause 18(c).

3.4 Why the SCCs apply. Customer Personal Data stays in the EU location of each Screen, but the seller is not established in the EU and the people who run Kubi work from Serbia and reach its systems remotely, so Kubi relies on the clauses above. Kubi keeps a transfer impact assessment and shares a summary on request.

4. Annex I(A): Parties

Data exporter: Customer, as named in its Account, at the billing address in its Account; contact: its privacy contact or an Account owner; role: controller, or processor for its own customers; signed by accepting the Terms online.

Data importer: Arthur Katcher, doing business as Kubi, legal@trykubi.com; contact: privacy@trykubi.com; role: processor, or subprocessor when Customer is a processor; signed by providing the Service from the date Customer accepted the Terms.

5. Annex I(B): Processing

5.1 Service. Cloud computers with a Linux desktop (Screens) that Customer, its members, its Agents and its End Users control through Kubi's dashboard, API, SDK and MCP server.

5.2 Data subjects. Chosen by Customer. They may include Customer's members, employees and contractors; its End Users and customers; and people whose data appears in the websites, accounts, emails, files and screenshots that Customer's Agents open, collect or create.

5.3 Personal data. Chosen by Customer: anything on its Screens and in its templates, such as files, browser data and saved logins, the keys Customer gives its Agents, Agents' inputs and outputs, the live view (streamed, never stored), and each Screen's history with its typed text and screenshots.

5.4 Special categories. Possible, at Customer's choice; Kubi does not need or ask for them. Safeguards: Annex II, with human access limited and logged. Regulated data such as HIPAA health records or full card numbers needs Kubi's written agreement first (Terms 8.6).

5.5 Frequency, nature and purpose. Continuous while Customer uses the Service. Kubi stores, runs, carries, protects, exports and erases the data only to provide the Service as Customer instructs. It never trains AI on it, never sells it, does not routinely scan it, and looks inside a Screen only if Customer asks, for abuse or security, or when the law requires it, logging each look (Terms 8.3).

5.6 Retention.

5.7 Location. Screens at Ikoula, the database with each Screen's history at Hetzner, and encrypted backups, saved screenshots and disk exports at Scaleway, all in France and Germany. Kubi does not move Customer Personal Data to another country without telling Customer first, except as Terms 4.1 allows.

6. Annex I(C): Supervisory authority

The supervisory authority of the data exporter, under Clause 13 of the EEA SCCs; for the UK, the Information Commissioner's Office (ico.org.uk); for Switzerland, the Federal Data Protection and Information Commissioner.

7. Annex II: Security measures

• Isolation: each Screen runs in its own virtual machine and cannot reach other customers' Screens or Kubi's management systems. Outgoing email ports are closed by default.
• Encryption: TLS on every connection to the dashboard, API, SDK, MCP server and live view. Screen disks, recovery copies, database backups, saved screenshots and disk exports are encrypted at rest. API keys are stored only as hashes, and typed text matching a saved secret is blanked in history.
• Access: customers sign in with an email link, GitHub, Google or a passkey, and Account owners control members and keys. Every administrative account Kubi uses requires two-factor sign-in, each person has a named account, and access is removed when no longer needed.
• Logging: every look inside a Screen by a person is logged with who, when, which Screen and why, and kept 1 year. Operational logs exclude Screen contents and keys and are kept 14 days.
• Availability: encrypted recovery copies of Screen disks for 7 days; the database can be restored to any minute of the last 14 days, from storage separate from the main server, and a restore is tested at least once a year.
• Secrets and change: Kubi's own secrets are never kept in plain text in code, version control or Screen images. Server and image configuration is in version control, security updates are applied promptly, critical ones first, and dependencies are checked automatically for known vulnerabilities.
• Testing and incidents: weekly automated vulnerability scans of internet-facing systems and Screen images; a written incident response plan, reviewed yearly; vulnerability reports to security@trykubi.com.
• People: anyone given access to Customer Personal Data signs a confidentiality agreement and acts only on Kubi's instructions. Laptops used to run Kubi have full-disk encryption.
• Certifications: Kubi holds no SOC 2 or ISO 27001 yet and has had no outside penetration test. Its data center providers' certifications cover their facilities, not Kubi.

8. Annex III: Subprocessors

The Approved Subprocessors, with what each does, the data it handles, where and on what transfer basis, are at trykubi.com/legal/subprocessors. Those processing Customer Personal Data are Ikoula (servers for Screens), Hetzner (main server and database) and Scaleway (encrypted object storage), all in France and Germany. Providers that handle only Kubi's own data, such as Stripe, are listed on the same page and are not subprocessors under this DPA. GitHub and Google as sign-in providers, and the models, websites and services Customer's Agents use, are not subprocessors.

9. Signatures

For a signed copy under section 1.2: