Data Processing Agreement

1. Roles

Customers act as Data Controllers. AIEmployee.com acts as a Data Processor.

2. Processing Scope

We process data only to provide and support the Services.

3. Security Measures

We maintain access controls, monitoring, and reasonable safeguards appropriate to the nature of the data.

4. Subprocessors

We may use third-party subprocessors for infrastructure, analytics, communications, and payments.

5. Data Breach Notification

We will notify customers without undue delay upon discovery of a qualifying data breach.

6. Data Deletion

Upon termination, data may be deleted or anonymized unless retention is legally required.

Raw uploads are deleted after finalization succeeds or fails. Normalized sources follow authenticated owned deletion under the lifecycle below. Manual-reference normalized images for unpaid drafts are retained for seven days after binding; replacement, abandonment, cancellation, and completed fulfillment queue authenticated owned deletion. Checkout adds seven-day protection against payment and deletion races. Paid or in-progress requests are not deleted by stale-unpaid cleanup. Failed deletion will retry with exponential backoff starting at five minutes and capped at 24 hours. An assigned avatar that adopts the same image receives ownership by transfer instead of deletion. Limited consent, audit, and deletion-tombstone records may be retained where needed for compliance, security, or replay prevention.