Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms of service between Wisella AI LLC (“Clousd”, “we”) and the customer that accepted them (“you”). It applies whenever we process personal data on your behalf in the course of providing the service: personal data in the apps, files, accounts, messages and screens of your devices, data that your scripts and AI agents process through the service, credentials and media you store in the dashboard for devices to use, and data of your end users that passes through a device. For that data you are the controller (or a processor acting for your own customer) and we are your processor. The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “supervisory authority” have the meanings given in the GDPR; references to the GDPR include the UK GDPR and the Data Protection Act 2018 where they apply.

This DPA does not cover the data we process as a controller for our own purposes (your account, billing, security and the way you use the service), which is described in the Privacy Policy. It applies automatically to every business customer; if you need a signed copy, or a version with your details filled in, write to legal@clousd.com. If you and we sign a separate data processing agreement, that document prevails.

2. Details of the processing

3. Our obligations as processor

• Instructions only. We process personal data only on your documented instructions, which are the Terms of service, this DPA, the settings and actions you perform in the service, and your written instructions sent to legal@clousd.com, unless the law we are subject to requires otherwise, in which case we tell you before processing unless the law prohibits it. We tell you if we believe an instruction infringes data protection law.
• Confidentiality. Only the people who need access to operate the service have it; they are bound by confidentiality obligations and access to production systems is logged.
• Security. We implement the measures in section 4.
• Sub-processors. We engage sub-processors only as set out in section 5, under written terms that impose data protection obligations at least as protective as this DPA, and we remain responsible for their performance.
• No other use. We do not use personal data processed on your behalf for our own purposes, for advertising, or to train AI models, and we do not sell it.
• Records and cooperation. We keep records of our processing activities as required by Article 30 GDPR and cooperate with supervisory authorities on request.

4. Security measures

Taking into account the state of the art, the costs and the risks, we maintain at least the following measures (Annex II in the sense of the standard contractual clauses):

• Isolation: each device runs in its own container with separate storage and network namespace; devices of different customers cannot reach each other.
• Encryption: all connections to the dashboard, API, relay and client use TLS; stored devices, snapshots and media in object storage are encrypted in transit and at rest; stored credentials are encrypted with AES-256-GCM using a key kept separately from the database; passwords are stored as salted hashes.
• Access control: production access only for named operators with key-based authentication from designated hosts, two-factor sign-in for customer accounts, scoped API keys, ADB access with codes, lockout after repeated failures, and logging of administrative access.
• Integrity monitoring: hosts are checked for unauthorized changes to critical files, open ports and accounts; abuse and security events raise alerts.
• Availability: devices and data are stored on redundant infrastructure; stopped devices and snapshots are copied to object storage in the EU; backups are tested by restoring devices.
• Deletion: deleted devices are removed from active storage immediately and from backups within 30 days.
• Organizational: staff are trained on data protection and security; incidents are handled under a written procedure; sub-processors are reviewed before engagement.

5. Sub-processors

You authorize us to engage sub-processors in the categories below (the same categories as in section 6 of the Privacy Policy). The current list of sub-processors by name, with their locations, is provided on request at legal@clousd.com. Before adding or replacing a sub-processor that processes your personal data, we send notice to the email address of your account at least 30 days in advance. If you have reasonable data protection grounds to object, write to legal@clousd.com within those 30 days; if we cannot resolve the objection, you may terminate the affected part of the service and we refund any prepaid fees for the unused period.

6. Assistance to you

Taking into account the nature of the processing, we help you respond to requests from data subjects (access, correction, deletion, portability, objection) by providing the tools in the service (export through ADB, API and the media library; deletion of devices, snapshots, credentials and media) and, where a request reaches us directly about data you control, by forwarding it to you without undue delay and not answering it ourselves unless you instruct us. We help you with data protection impact assessments and prior consultations by providing the information in this DPA and in the Privacy Policy, and further information on reasonable request.

7. Personal data breaches

If we become aware of a personal data breach affecting personal data processed on your behalf, we notify you without undue delay, and in any case within 72 hours of becoming aware, by email to the address of your account, with the information available to us at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. We supplement the notice as more becomes known and cooperate with you on your own notifications.

8. International transfers

Devices, their data and backups are stored in the European Union (Germany, Finland, the Netherlands). We are a United States company and our operators may access data from the United States and other countries; some sub-processors are located outside the EU and UK. Where this involves a transfer of personal data protected by the GDPR or UK GDPR to a country without an adequacy decision, the transfer is made under the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference with you as data exporter and us as data importer (clause 7 docking not used; clause 9 option 2 with 30 days’ notice; clause 11 optional language not used; clause 13 and 17 governed by the law of Ireland; clause 18 courts of Ireland; Annex I = section 2 of this DPA, Annex II = section 4, Annex III = section 5 and the list of sub-processors provided on request), and for UK transfers under the UK International Data Transfer Addendum to those clauses issued by the Information Commissioner. Where a sub-processor is certified under the EU-US Data Privacy Framework, we may rely on that certification instead. You can ask for a completed copy of the clauses at legal@clousd.com.

9. Deletion and return of data

You can export the data of a device at any time through ADB, the API, the media library and the dashboard, and delete devices, snapshots, stored credentials and media yourself. When you delete a device or your account, or when the service ends, we delete the personal data processed on your behalf: immediately from active storage, and from backups within 30 days. Devices whose plan has lapsed are kept for 7 days so that you can resume or export, then deleted. We keep data longer only where the law requires us to, and then only for as long as it requires, under the confidentiality obligations of this DPA.

10. Audits

We make available the information needed to demonstrate compliance with Article 28 GDPR: this DPA, the Privacy Policy, our security documentation on request, and answers to a reasonable security questionnaire once a year. Where this is not sufficient to meet a legal requirement or a request from a supervisory authority, you may conduct an audit, at your cost, on 30 days’ written notice, during business hours, no more than once a year unless required by an authority or following a breach, by yourself or an independent auditor bound by confidentiality, limited to the systems and records relevant to your data and without access to other customers’ data.

11. Your obligations

You are responsible for the lawfulness of the processing you carry out through the service: for having a legal basis and giving the required information to data subjects, for the accuracy and minimization of the data, for your instructions to us, for the settings and permissions you choose (including which keys your agents hold), for not processing special categories of data or data of children through the service, and for your own security obligations as controller. You confirm that you are authorized to put the data on the devices and to store the credentials you store.

12. Liability and term

The limitations and exclusions of liability in the Terms of service apply to this DPA, to the extent permitted by Article 82 GDPR. This DPA takes effect when you accept the Terms and lasts until all personal data processed on your behalf has been deleted or returned. Where this DPA conflicts with the Terms, this DPA prevails for the processing of personal data on your behalf; where the standard contractual clauses conflict with this DPA, the clauses prevail.

13. Who operates Clousd

Clousd is a product of Wisella AI LLC, a limited liability company organized under the laws of the State of New Mexico, United States, 1209 Mountain Road Pl NE #10198, Albuquerque, NM 87110, USA (wisellai.com), which operates the service and is the merchant for every purchase. Merchant country: United States. Legal notices to us must be sent by email to the legal address below or by post to the address above.

• Support, billing, refunds and privacy requests: support@clousd.com
• Company, partnership and press inquiries: hello@wisellai.com
• Abuse reports and copyright complaints: abuse@clousd.com (see Report abuse)
• Legal notices and requests from authorities: legal@clousd.com

Last updated 18 October 2026. We reserve the right to change this document at any time. The current version is always published on this page with its date, and material changes are announced by email or in the dashboard before they take effect.