---
title: "Data Processing Addendum | ZeroClick"
url: https://zeroclick.ai/legal/data-processing-addendum
fetched_at: 2026-10-02T11:59:23.528Z
---

# ZeroClick API catalog and pricing

## API reference, endpoint lookup and prices

**[ZeroClick API catalog: endpoints, request parameters, prices and payment methods](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/zeroclick/agent/guide).** Tell the seller advisor what you want to accomplish. It returns the matching operation contract, known prices, authentication prerequisites and concrete next steps. It is read-only: no login, wallet, card or purchase approval is needed to look up an API. It never executes a sale.

Available API services: Agent readiness report, Demo booking.

**Suggested next request:** GET [task guide](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/zeroclick/agent/guide?goal=URL_ENCODED_TASK). Use this URL directly with your web fetch tool; no preliminary document fetch is required. Include known inputs and desired output in the goal. Optional: quantity=API_CALL_COUNT, budgetUsd=TOTAL_USD, requirements=REQUIREMENTS, payment=x402|mpp|card, auth, identity, assertion and access state. Omit unknowns. Do not equate output items with API calls or guess a call count.

For private task details or known request arguments, POST https://agents.zeroclick.ai/zcj/4fgrwj7fijns/zeroclick/agent/guide with Content-Type: application/json. Example: {"intent":"quote","goal":"YOUR_TASK","purchase":{"budgetUsd":"5.00"}}. Replace the task and budget with known facts; budgetUsd is a string. Include known buyerState, paymentCapabilities and arguments. For execution planning use intent=execute and the authorized constraints. Exact fields: [request schema](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/zeroclick/agent/schema). GET and POST are alternatives, not mandatory stages.

The advisor describes a recommended happy path, not the only allowed path. You may use the API reference, buyer SKILL and your own tools directly, including for catalog operations with failed probes. Missing guidance or an unverified probe is not a policy refusal. Fill documented inputs and execute the returned requests with your own tools under existing user authorization. Check usage cost AND minimum cash required against the budget. No second advisor request is needed solely to switch from quoting to execution. For needs_input, supply only missing facts. Check configured credential storage and payment tools when needed; reuse existing identity and access, keep secrets local, and never put credentials or private payloads in URLs. Unknown does not mean absent.

Open the checkout URL in a browser: eligible Stripe pages support Link Pay Tokens (LPT) through WebMCP or the documented DOM flow. Follow this storefront's /payment/card.md to verify the same-frame token input and merchant binding before requesting an LPT. Token submission requires payment authorization. If unavailable, privately send the checkout URL to your human to pay.

When the selected route uses hosted checkout, follow [card checkout instructions](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/payment/card.md) before requesting a token. LPT goes only to Stripe, never to the advisor or ZeroClick API. Poll the returned statusUrl before using credit or retrying delivery.

Verify delivery; a payment or HTTP 202 is not completion. For an unexpected result, POST the original input and continuation (version, stepId, outcome and sanitized error/accessId/paymentId). Reconcile uncertain payments or writes before retrying. Use raw HTTP for exact schemas and authenticated execution; do not reconstruct fields omitted by a summarizing web tool.

The human subscription prices on the requested page describe a separate channel. Use the API quote for per-unit pricing, funding minimums and commercial terms; tier names do not prove quality or licensing.

For an alternative documented path, use the [buyer SKILL](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/SKILL.md) or [full direct workflow reference](https://agents.zeroclick.ai/zcj/4fgrwj7fijns/llms-full.txt). Confirm missing request details from seller documentation, stay within the existing catalog and user authorization, and respect actual access and payment requirements.
Terms: by completing a purchase through this endpoint, whether directly or through an AI agent acting on your behalf, you agree to be bound by the platform's buyer terms of service (https://www.zeroclick.ai/legal/buyer-terms-of-service). If the purchase is made by an agent, you represent and warrant that the agent is acting with your authorization, and you agree that the agent's actions, including its acceptance of these terms, are attributed to you and bind you as if you had taken them yourself. Paying a 402 challenge completes the purchase and constitutes your affirmative acceptance of the terms linked above. The link travels in every payment challenge and receipt as `terms`.

# Data Processing Addendum

Last Updated: September 14, 2026

The seller ("**Seller**") and The People's Internet Experiment Inc. dba ZeroClick ("**Provider**") (each a "Party" and collectively the "Parties") enter into this Data Processing Addendum (including the annexes attached hereto, this "**DPA**"). This DPA is incorporated into and forms part of the Agreement and takes effect on the date Seller enters into the Agreement. No separate signature is required.

## 1. Definitions

For purposes of this DPA, the terms below have the meanings set forth below. Capitalized terms that are used but not defined in this DPA have the meanings given in the Agreement.

1. **Affiliate** means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.

2. **Applicable Data Protection Laws** means the privacy, data protection and data security laws and regulations of any jurisdiction within the United States applicable to Provider's Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws.

3. **Buyer Personal Data** has the meaning given in the Agreement.

4. **Data Subject** means the identified or identifiable natural person to whom Personal Data relates.

5. **Information Security Incident** means a breach of Provider's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider's possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

6. **Personal Data** means Seller Processed Data that constitutes "personal data," "personal information," or "personally identifiable information" defined in Applicable Data Protection Laws or information of a similar character regulated thereby, provided that Personal Data does not include Seller Account Data, Buyer Personal Data, Provider Materials, or such information that Provider receives, collects, or generates independently of the Services and not from or on behalf of Seller. Where the Agreement refers to Provider Processing personal information contained in Seller Data on Seller's behalf, that information is Personal Data for purposes of this DPA, and Provider's Processing of that information is governed by this DPA.

7. **Process** or **Processing** means any operation or set of operations which is performed by Provider (or on Provider's behalf) for Seller under the Agreement on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

8. **Provider Materials** means Provider's platform, software, models, model weights, evaluation and testing frameworks, security and fraud-detection systems, and any aggregated, anonymized, or de-identified data derived from Provider's operation of the Services, in each case that does not identify and is not reasonably linkable to any Data Subject or to Seller.

9. **Security Measures** has the meaning given in Section 4(a).

10. **Seller Account Data** means Personal Data relating to Seller's own relationship with Provider, including the names and contact details of individuals authorized to access Seller's account, and Seller's billing contacts and information.

11. **Seller Processed Data** means information provided or otherwise made available by or on behalf of Seller to Provider for Processing on Seller's behalf to perform the Services, including the contents of requests transmitted by or through the Services to Seller's Offerings.

12. **Services** has the meaning given in the Agreement.

13. **State Privacy Laws** means, collectively, the comprehensive state-specific data privacy laws (and any implementing regulations) currently in effect and applicable to Provider's Processing of Personal Data under the Agreement.

14. **Subprocessors** means Provider's Affiliates and third parties that Provider engages to Process Personal Data in relation to the Services.

## 2. Duration, Scope and Roles

1. This DPA will remain in effect so long as Provider Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

2. **Roles for Personal Data.** With respect to Personal Data, Seller is the controller (or, where Seller is itself acting as a processor, the processor) and Provider is the processor (or subprocessor, as applicable). Each Party will comply with the obligations that apply to it under Applicable Data Protection Laws.

3. **Data for which Provider is not a processor.** This DPA does not apply to, and Provider does not act as Seller's processor in respect of:

   1. **Seller Account Data**, for which Seller and Provider are each independent controllers. Provider Processes Seller Account Data to manage the relationship with Seller, operate and bill for the Services, verify identity, detect and prevent fraud, security incidents and other misuse, and comply with law, in each case in accordance with Provider's privacy policy.

   2. **Buyer Personal Data**, for which Provider is an independent controller. Where Seller has enabled an Identity-Protected Plan and Provider discloses a buyer's verified email address to Seller, Seller receives that information as an independent controller and its use of that information is governed by the Buyer Data Sharing Schedule to the Agreement and not by this DPA. Neither Party acts as the other's processor, and the Parties are not joint controllers, in respect of that disclosure.

4. Processing of Personal Data subject to the State Privacy Laws with respect to which Seller is a Business, Controller, Processor, or Service Provider (as such terms are defined in State Privacy Laws) shall be subject to Annex 2 (State Privacy Laws Annex) to this DPA.

## 3. Seller Instructions

Provider will Process Personal Data only in accordance with Seller's documented instructions to Provider, including as set forth in this DPA, the Agreement, any applicable Order Form(s), and any other written instructions provided by Seller from time to time that are consistent with the Agreement and this DPA. To the extent Seller requests instructions that are outside the scope of the Services or that would require Provider to materially change the Services or undertake additional work not contemplated by the Agreement, the Parties will agree to such instructions in a mutually executed amendment to this DPA or other written agreement. By entering into this DPA, Seller instructs Provider to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement. The Parties acknowledge and agree that the details of Provider's Processing of Personal Data (including the respective roles of the Parties relating to such Processing) are as described in Annex 1 (Data Processing Details) to this DPA.

## 4. Security

1. **Provider Security Measures.** Provider will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data as described in Annex 3 (the "**Security Measures**"), taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing and the risks to Data Subjects. Provider may update the Security Measures from time to time, including to maintain or improve security or address changes in Applicable Data Protection Laws, so long as the updated measures do not materially decrease the overall protection of Personal Data.

2. **Security Compliance by Provider Staff.** Provider shall require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.

3. **Information Security Incidents.** Provider will notify Seller without undue delay, and in any event within seventy-two (72) hours, after confirming any Information Security Incident of which Provider becomes aware. That initial notification may be preliminary, and Provider will provide further detail as it becomes available. Such notifications will describe, to the extent then known, available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Provider recommends Seller take to address the Information Security Incident. Provider's notification of or response to an Information Security Incident will not be construed as Provider's acknowledgement of any fault or liability with respect to the Information Security Incident. Provider shall reasonably cooperate with Seller and take such commercially reasonable steps, to the extent within Provider's control, as may be reasonably requested by Seller and mutually agreed in good faith by the Parties to assist in the investigation of any such Information Security Incident. Seller is solely responsible for complying with notification laws applicable to Seller and fulfilling any third-party notification obligations related to any Information Security Incident. Provider will not expressly identify Seller in any notice it provides to a regulator, Data Subject or the public following an Information Security Incident without Seller's prior written consent, unless required by law. If Seller determines that an Information Security Incident must be notified to any regulatory authority, any Data Subject(s), the public or others under Applicable Data Protection Laws, to the extent such notice directly or indirectly refers to or identifies Provider, where permitted by applicable law, Seller agrees to (i) notify Provider in advance, and (ii) in good faith, consult with Provider and consider any clarifications or corrections Provider may reasonably recommend or request to any such notification, which: (a) relate to Provider's involvement in or relevance to such Information Security Incident; and (b) are consistent with applicable law. This Section 4(c) does not apply to incidents caused by Seller, Seller's Offerings, or Seller's own end users.

4. **Seller's Security Responsibilities and Assessment.**

   1. **Seller's Security Responsibilities.** Seller agrees that, without limitation of Provider's obligations under this Section 4, Seller is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (b) securing the account authentication credentials, API keys, signing secrets, systems and devices Seller uses to access or integrate with the Services; (c) securing Seller's systems and devices that Seller provides or makes available for Provider to access in order to provide the Services; and (d) backing up Personal Data, as applicable.

   2. **Seller's Security Assessment.** Seller acknowledges that it has evaluated the Services, the Security Measures and Provider's commitments under this DPA and, based on information made available by Provider, determines that they are adequate to meet Seller's needs, including with respect to any security obligations of Seller under Applicable Data Protection Laws, and provide a level of security appropriate to the risk in respect of the Personal Data.

5. **Government and Legal Process Demands.** If Provider receives a legally binding demand from a public authority, court, or law enforcement body for disclosure of Personal Data, Provider will, to the extent permitted by applicable law, (i) promptly notify Seller of the demand before disclosing, (ii) use commercially reasonable efforts to redirect the requesting authority to Seller, (iii) disclose only the minimum Personal Data necessary to comply, and (iv) use commercially reasonable efforts to challenge any prohibition on notifying Seller. Where Provider is legally prohibited from notifying Seller, Provider will notify Seller as soon as it is permitted to do so.

## 5. Data Subject Rights

1. **Provider's Data Subject Request Assistance.** Provider will (taking into account the nature of the Processing of Personal Data) provide Seller with assistance reasonably necessary and technically feasible for Seller to perform its obligations under Applicable Data Protection Laws to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws ("**Data Subject Requests**") with respect to Personal Data in Provider's possession or control. Seller shall compensate Provider for any such assistance, to the extent such assistance requires work beyond the Services, at Provider's then-current professional services rates, which shall be made available to Seller upon request, and Provider will, upon request, provide Seller with a good-faith estimate of applicable fees.

2. **Seller's Responsibility for Requests.** If Provider receives a Data Subject Request, Provider will (i) promptly notify Seller (unless prohibited by applicable law); and (ii) advise the Data Subject to submit the request to Seller. Seller will be solely responsible for responding to any such request, unless otherwise required by applicable law.

## 6. Seller Responsibilities

1. Seller shall ensure (and is solely responsible for ensuring) that it has provided all notices to, and obtained all consents and permissions from, third parties (including, without limitation, Data Subjects), and has reserved all necessary rights, in each case, as may be required under Applicable Data Protection Laws for Provider to Process Personal Data as contemplated by the Agreement. Seller shall maintain, and provide at Provider's reasonable request, records of the notices provided and consents obtained.

2. Seller represents and warrants to Provider that Seller Processed Data does not and will not contain any social security numbers or other government-issued identification numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords or other credentials for third-party online accounts (other than credentials created for and used solely to access the Services); credentials to any financial accounts; tax return data; any payment card information subject to the Payment Card Industry Data Security Standard; personal data of children under 18 years of age; or any other information that falls within any special categories of data (as defined in Applicable Data Protection Laws) ("**Restricted Data**"). This Section 6(b) supplements, and does not limit, Seller's obligations in respect of Sensitive Personal Data under the Agreement.

## 7. Subprocessors

1. **Consent to Subprocessor Engagement.** Seller specifically authorizes the engagement of Provider's Affiliates as Subprocessors and generally authorizes Provider to engage third parties as Subprocessors in accordance with this Section.

2. **Information about Subprocessors.** Information about Subprocessors, including their functions and locations, is set out in Annex 4 of this DPA and is maintained at [https://zeroclick.ai/legal/subprocessors](https://zeroclick.ai/legal/subprocessors) (the "Subprocessor Site"), where Seller may subscribe to receive notice of updates. Provider may continue to use those Subprocessors already engaged by Provider as of the effective date of this DPA.

3. **Requirements for Subprocessor Engagement.** When engaging any Subprocessor, Provider will enter into a written contract with such Subprocessor containing data protection obligations not less protective than those in this DPA with respect to Personal Data to the extent applicable to the nature of the services provided by such Subprocessor. Provider shall remain responsible for the performance of all obligations subcontracted to the Subprocessor and shall be liable for all acts and omissions of the Subprocessor to the same extent as Provider would have been had it performed the Processing itself.

4. **Opportunity to Object to Subprocessor Changes.** When Provider engages any new Subprocessor after the effective date of this DPA, Provider will notify Seller of the engagement (including the name and location of the relevant Subprocessor and the activities it will perform) by updating the Subprocessor Site, which constitutes notice for purposes of this Section, and by email to those Sellers that have subscribed to notice of updates through the Subprocessor Site. If Seller objects to such engagement in a written notice to Provider within ten (10) days after the Subprocessor Site is updated on reasonable grounds relating to the protection of Personal Data, Seller and Provider will work together in good faith to find a mutually acceptable resolution to address such objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Seller may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Provider and pay Provider for all amounts due and owing under the Agreement as of the date of such termination.

## 8. Demonstrating Compliance; Audits

1. **Information and questionnaires first.** Upon Seller's reasonable written request, and not more than once in any twelve (12) month period (or following an Information Security Incident affecting Seller's Personal Data), Provider will either (i) make available information or documentation reasonably necessary to demonstrate compliance with its obligations under this DPA, including any then-current SOC 2, ISO, NIST or similar third-party audit report, or (ii) respond to a reasonable written security questionnaire prepared by Seller. If any information provided reveals unauthorized use of Personal Data, the Parties will promptly work together in good faith to agree reasonable and appropriate steps to stop and remediate that use.

2. **Audits.** Where the measures described in Section 8(a) are not sufficient to satisfy a requirement of Applicable Data Protection Laws or of a competent regulatory authority with jurisdiction over Seller, Seller may audit Provider's compliance with its obligations under this DPA up to once per year, upon Seller's written request providing reasonable detail and, where available, supporting documentation of the applicable requirement. Provider will contribute to such audits by providing Seller with the information and assistance reasonably necessary to conduct the audit. If a third party is to conduct the audit, Provider may object to the auditor if the auditor is, in Provider's reasonable opinion, not independent, a competitor of Provider, or otherwise manifestly unsuitable, in which case Seller will appoint another auditor or conduct the audit itself. To request an audit, Seller must submit a proposed audit plan to Provider at least two weeks in advance of the proposed audit date, and any third-party auditor must sign a customary non-disclosure agreement mutually acceptable to the Parties (such acceptance not to be unreasonably withheld) providing for the confidential treatment of all information exchanged in connection with the audit and any reports regarding the results or findings thereof. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. Provider will review the proposed audit plan and provide Seller with any concerns or questions (for example, any request for information that could compromise Provider's security, privacy, employment or other relevant policies), and the Parties will work cooperatively to agree a final audit plan. Nothing in this Section 8 shall require Provider to breach any duties of confidentiality. If the controls or measures to be assessed are addressed in an SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third-party auditor within twelve (12) months of Seller's audit request, and Provider has confirmed there have been no known material changes in the controls audited since the date of such report, Seller agrees to accept such report in lieu of requesting an audit of such controls or measures. The audit must be conducted during regular business hours, subject to the agreed final audit plan and Provider's safety, security or other relevant policies, and may not unreasonably interfere with Provider's business activities. Seller will promptly notify Provider of any non-compliance discovered during the course of an audit and provide Provider any audit reports generated in connection with any audit under this Section 8, unless prohibited by Applicable Data Protection Laws. Seller may use the audit reports only for the purposes of meeting Seller's regulatory audit requirements and/or confirming compliance with the requirements of this DPA. Any audits are at Seller's sole expense. Seller shall reimburse Provider for any reasonable, documented costs, including reasonable internal time expended by Provider and any third parties in connection with any audits or inspections under this Section 8, at Provider's then-current professional services rates, which shall be made available to Seller upon request. Seller will be responsible for any fees charged by any auditor appointed by Seller.

## 9. Return and Deletion

1. Subject to Sections 9(b) and 9(c), upon the date of cessation of any Services involving the Processing of Personal Data (the "**Cessation Date**"), Provider shall promptly cease all Processing of Personal Data for any purpose other than for storage and Processing necessary to effect the return, deletion, or anonymization of such Personal Data, or as otherwise permitted or required under this DPA or applicable law.

2. Subject to Section 9(d), to the extent technically possible in the circumstances, on written request to Provider (to be made no later than thirty (30) days after the Cessation Date (the "**Post-cessation Storage Period**")), Provider shall within a commercially reasonable period following receipt of such request (i) return a complete copy of all Personal Data within Provider's possession to Seller by secure file transfer or other commercially reasonable secure method, promptly following which Provider shall delete or anonymize all other copies of such Personal Data, or (ii) (at its option) delete or anonymize all Personal Data within Provider's possession.

3. In the event that during the Post-cessation Storage Period Seller does not instruct Provider in writing to either delete or return Personal Data pursuant to Section 9(b), Provider shall, within a commercially reasonable time after the expiry of the Post-cessation Storage Period, either (at its option) delete or render anonymous all Personal Data then within Provider's possession, custody or control to the fullest extent technically feasible in the circumstances.

4. Provider may retain Personal Data to the extent permitted or required by applicable law, or where retained in anonymized form as transaction and usage records, for no longer than such applicable law requires or, in the case of anonymized records, indefinitely, provided that Provider shall (i) maintain the confidentiality of all such Personal Data and protect it in accordance with the Security Measures, (ii) Process such Personal Data only as necessary for the purpose(s) specified in the applicable law permitting or requiring such retention, and (iii) delete or anonymize such Personal Data once it is no longer permitted or required to be retained under applicable law. Deletion from routine backups will occur on Provider's ordinary backup rotation cycle.

## 10. Artificial Intelligence and Automated Processing

1. Provider shall not use Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether Provider's own or a third party's, unless (a) such use is reasonably necessary to provide the Services in accordance with Seller's documented instructions, or (b) expressly authorized by Seller in writing.

2. Provider will not provide Personal Data to any AI model provider engaged as a Subprocessor unless that provider is bound, by contract or by its applicable terms of service, not to use Personal Data to train, fine-tune, develop or improve its models other than as necessary to provide services to Provider.

3. If the Services involve automated decision-making that produces legal or similarly significant effects on Data Subjects, Provider shall: (a) disclose the existence of such processing to Seller; (b) to the extent reasonably available to Provider, provide meaningful information about the logic involved without requiring disclosure of Provider's trade secrets or confidential information; and (c) reasonably cooperate with Seller, as required by Applicable Data Protection Laws, to enable Data Subjects to exercise applicable rights under such laws relating to automated decision-making.

4. **Provider Materials.** Nothing in this DPA limits Provider's ownership or use of Provider Materials. Provider Materials are not Personal Data or Seller Processed Data and are not subject to the return-and-deletion obligations in Section 9. Provider will not attempt to re-identify any individual from anonymized or de-identified data, will maintain technical and organizational measures prohibiting re-identification, will not release such data in a manner that permits re-identification, and will impose the same restrictions on its Subprocessors.

## 11. Miscellaneous

1. Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. To the extent of any conflict or inconsistency between this DPA and the other terms of the Agreement, this DPA will govern with respect to data protection matters. Notwithstanding anything in the Agreement or any Order Form to the contrary, the Parties acknowledge and agree that Provider's access to Personal Data does not constitute part of the consideration exchanged by the Parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by Provider to Seller under this DPA may be given (a) in accordance with any notice clause of the Agreement; (b) to Seller's contact details for data protection set out in Annex 1; (c) to Provider's primary points of contact with Seller; or (d) to any email address designated by Seller in writing for the purpose of receiving Services-related communications or alerts. Seller is solely responsible for ensuring that such email addresses are valid.

2. Provider agrees to cooperate in good faith with Seller to consider any amendments that may be reasonably necessary to address compliance with Applicable Data Protection Laws.

3. Provider may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws from time to time, provided that any such variation shall not materially reduce the protections afforded to Personal Data or materially increase Seller's obligations under this DPA without Seller's written agreement.

4. The total aggregate liability of either Party to the other Party, however arising, under or in connection with this DPA will under no circumstances exceed any limitations or caps on, and shall be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement. Any indemnification obligations are as set forth exclusively in the Agreement.

---

# Annex 1 - Data Processing Details

**PROVIDER DETAILS**

**Name:** The People's Internet Experiment Inc. dba ZeroClick

**Address:** 13800 Bora Bora Way, Marina Del Rey, CA 90292-6803

**Contact Details for Data Protection:** [privacy@zeroclick.ai](mailto:privacy@zeroclick.ai)

**Provider Activities:** Provider operates an agent payment gateway and agent-commerce platform that makes Seller's products, application programming interfaces and other offerings discoverable by, and purchasable by, automated software agents, and that forwards paid requests to Seller's systems, meters usage, and reports transactions. Provider processes the content of a request in transit in order to hash, sign and forward it, and does not persist request or response bodies in the course of that routing, except as described below in respect of Provider's features for generating or improving service descriptions and integration guidance and Seller's sandbox; Provider retains operational metadata and a SHA-256 digest of the body. Where Seller enables end-to-end body encryption, Provider relays ciphertext and does not hold the decryption key. Where Seller uses Provider's features for generating or improving service descriptions and integration guidance, or Seller's sandbox, Provider transmits the relevant Seller content, which may include request content, to the AI model providers identified in Annex 4 for that purpose, subject to Section 10. Seller's sandbox may operate against live data supplied by Seller, and accordingly any Personal Data that Seller submits to the sandbox may be included in that transmission.

**CUSTOMER DETAILS**

**Name:** The entity or other person who is a counterparty to the Agreement

**Seller's address:** As stated in Seller's account or the applicable Order Form.

**Seller's Contact Details for Data Protection:** As designated by Seller in its account; absent a designation, Seller's primary account contact.

**Seller Activities:** Seller's activities relevant to this DPA are the use and receipt of the Services under and in accordance with, and for the purposes anticipated and permitted in, the Agreement as part of its ongoing business operations.

**Categories of Data Subjects:** Individuals whose personal data is contained in requests transmitted by or through the Services to Seller's Offerings, and individuals who are Seller's own end users or account holders whose personal data Seller causes Provider to Process in connection with the Services. Buyer Personal Data is excluded and is addressed in Section 2(c)(ii).

**Categories of Personal Data:**

- **Request content** - personal data contained in the body, parameters or headers of requests that Seller's buyers or their agents transmit through the Services to Seller's Offerings, the content of which is determined by Seller's Offering. Provider processes this content in transit only and does not persist request or response bodies, except as described in the Provider Activities section of this Annex 1 in respect of Provider's features for generating or improving service descriptions and integration guidance and Seller's sandbox.

- **Technological details** - internet protocol (IP) addresses, request identifiers, pseudonymous agent and buyer identifiers, device and network information, and usage and metering records associated with calls to Seller's Offerings.

- **Seller end-user records** - where Seller elects to use Provider's account, entitlement or analytics features, the account identifiers, entitlement records and usage data relating to Seller's own end users that Seller causes Provider to Process.

**Sensitive Categories of Data, and associated additional restrictions/safeguards:**

**Categories of sensitive data:** None. As set out in Section 6(b) of this DPA and the Agreement, Restricted Data and Sensitive Personal Data must not be submitted to the Services without the Parties' prior written agreement.

**Additional safeguards for sensitive data:** N/A

**Frequency of transfer:** Continuous - as initiated by Seller, its buyers, and their agents in and through use of the Services.

**Nature of the Processing:** Receipt, verification, routing, transmission, storage, metering, and reporting of requests and associated records required in order to provide the Services and perform Provider's obligations in accordance with the Agreement and this DPA.

**Purpose of the Processing:** As necessary to provide the Services as initiated by Seller in its use thereof, and to comply with Seller's documented instructions as permitted under and in accordance with the terms of this DPA and the Agreement.

**Duration of Processing / Retention Period:** For the period determined in accordance with the Agreement and this DPA, including Section 9.

**Transfers to (sub)processors:** Transfers to Subprocessors are as, and for the purposes, described in Annex 4 and on the Subprocessor Site.

---

# Annex 2 - State Privacy Laws Annex

1. For purposes of this Annex 2, the terms "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider" and "contractor" shall have the respective meanings given thereto in the applicable State Privacy Laws, and "personal information" shall mean Personal Data to the extent it constitutes "personal information" or "personal data" (or a similar term) governed by the State Privacy Laws.

2. It is the Parties' intent that with respect to any personal information, Provider is a service provider, contractor and/or processor, as applicable under the State Privacy Laws. Provider (a) acknowledges that personal information is disclosed by Seller only for limited and specified purposes described in the Agreement; (b) shall comply with applicable obligations under the State Privacy Laws and shall provide the same level of privacy protection to personal information as is required by the State Privacy Laws; (c) agrees that Seller has the right to take reasonable and appropriate steps to help to ensure that Provider's Processing of personal information is consistent with Seller's obligations under the State Privacy Laws; (d) shall notify Seller in writing of any determination made by Provider that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Seller has the right, upon reasonable notice, including pursuant to the preceding clause, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

3. Provider shall not (a) sell or share any personal information; (b) retain, use or disclose any personal information for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the personal information for a commercial purpose other than the provision of the Services, or as otherwise permitted by the State Privacy Laws; (c) retain, use or disclose the personal information outside of the direct business relationship between Provider and Seller; or (d) combine personal information received pursuant to the Agreement with personal information (i) received from or on behalf of another person, or (ii) collected from Provider's own interaction with any Data Subject to whom such personal information pertains, except as and to the extent permitted by the State Privacy Laws and necessary as part of Provider's provision of the Services. Provider hereby certifies that it understands its obligations under this Section 3 and will comply with them.

4. Giving Seller notice of Subprocessor engagements in accordance with Section 7 of this DPA shall satisfy Provider's obligation under the State Privacy Laws to give notice of and an opportunity to object to such engagements.

5. Seller may exercise the rights in Section 8 of this DPA to help ensure that Provider's use of personal information is consistent with Provider's obligations under the State Privacy Laws, including cooperating with any assessment required of Seller under State Privacy Laws.

6. Where Provider creates or receives de-identified data, Provider will maintain it in de-identified form in accordance with Section 10(d).

7. The Parties acknowledge that Provider's retention, use and disclosure of personal information authorized by Seller's instructions documented in the Agreement and this DPA are integral to Provider's provision of the Services and the business relationship between the Parties.

---

# Annex 3 - Security Measures

Provider maintains the following technical and organizational measures. Provider may update these measures in accordance with Section 4(a).

1. **Security program and ownership.** Named personnel with assigned responsibility for the development, implementation and maintenance of Provider's information security program, and periodic risk assessment and review.

2. **Encryption.** TLS encryption for Personal Data in transit; encryption at rest for production data stores.

3. **Access control.** Least-privilege, role-based access to production systems, scoped per role, with unique user credentials, multi-factor authentication for administrative access, audit logging of access, and prompt revocation on role change or termination.

4. **Credential and key management.** Controls governing the issuance, storage, rotation and revocation of API keys, signing secrets and other credentials used in connection with the Services.

5. **Logging and monitoring.** Application and infrastructure logging retained and reviewed, with alerting of security events to on-call personnel.

6. **Network security.** Firewalling and network segmentation, and traffic monitoring.

7. **Change management.** Procedures to test, approve and monitor material changes to Provider's technology and information assets that may affect the security of Personal Data.

8. **Incident management.** Documented incident response procedures to investigate, contain, eradicate, recover, remediate and report, including post-incident review.

9. **Personnel.** Confidentiality obligations for personnel with access to Personal Data and security awareness requirements.

10. **Subprocessor vetting.** Review of the Subprocessors on which Provider depends, and maintenance of a current Subprocessor list.

11. **Resilience.** Backup and disaster recovery procedures designed to maintain and restore the Services.

12. **Hosting.** Production infrastructure hosted with reputable cloud providers in the United States, whose facilities maintain physical and environmental controls.

---

# Annex 4 - List of Subprocessors

Seller approves Provider's engagement of the following Subprocessors to provide services pursuant to the Agreement.

| Subprocessor | Country | Function |
|---|---|---|
| Anthropic, PBC | United States | LLM inference |
| Axiom, Inc. | United States | Application logging, distributed tracing, and observability |
| Cloudflare, Inc. | United States | Content delivery, network security, data pipelines, object storage, and browser rendering |
| MotherDuck Corporation | United States | Data warehousing and query processing |
| OpenRouter, Inc. | United States | LLM routing and inference |
| PostHog, Inc. | United States | Product and usage analytics |
| Plus Five Five, Inc. d/b/a Resend | United States | Transactional and verification email delivery |
| Render Services, Inc. | United States | Application hosting, managed databases, caching, and infrastructure |
| Stripe, LLC | United States | Payment processing, settlement, and payout infrastructure |
| WorkOS, Inc. | United States | Authentication, identity, and user management |