Data Processing
Addendum — effective September 15, 2026.

NextOS DATA PROCESSING ADDENDUM
Kumin Consulting LLC
Effective September 15, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Kumin Consulting LLC ("Processor") and the customer identified in that agreement ("Controller") governing Kumin Consulting LLC's processing of personal data submitted to NextOS.

1. SUBJECT MATTER
Processor provides NextOS, a browser-based operating system, hosting platform and agent runtime. Controller may submit personal data to the Service in the course of using it (account data, files synced through a connected storage provider, site visitor data, team member data).

2. DURATION
This DPA remains in effect for as long as Processor processes personal data on Controller's behalf under the agreement.

3. SUB-PROCESSORS
Processor uses the sub-processors listed below to provide the Service. Processor will provide notice of a new sub-processor by updating this list.

  - Vercel: hosting, serverless functions, and Vercel Blob file storage
  - Upstash: the Redis database behind accounts, sites, teams and background runs
  - Resend: transactional email (invites, notifications, exported-data links)
  - Square: billing and payment processing for paid plans
  - Google, and any other AI provider you connect: model calls you make with your own connected provider key, or through the hosted model plane
  - Twilio: SMS delivery, only if a workflow or automation you configure sends a text message

4. SECURITY MEASURES
Processor maintains the security measures described at /security, including encryption at rest for vaulted secrets, role-based access control, and an audit trail for team/organization activity. See that page for specifics, each traceable to the module implementing it.

5. DATA SUBJECT REQUESTS
Controller may access, export or delete personal data directly through the Service (Settings > Privacy: "Export all my data", "Delete my account") or by contacting support (/support).

6. RETURN OR DELETION OF DATA
On termination, Controller's data is deleted according to the retention and deletion mechanics described at /privacy, including the account-deletion grace period and the key families purged.

7. INTERNATIONAL TRANSFERS
Processor's infrastructure (Vercel, Upstash) may process data in regions Controller does not separately select unless Controller's plan includes data residency controls (see /nextos/security).

Questions about this DPA: use the contact form at /support.