Parties and scope
This DPA is concluded between the customer that holds a Teams workspace on crons.ai (the Controller) and the administrator of the crons.ai service (the Processor). It forms part of the Terms of Service and applies to personal data the Controller places in crons, cron memory, run logs, approvals and connections. Version dpa-2026-10.
Subject and duration of processing
- Subject: running the scheduled AI agents (crons) the Controller configures, storing their memory and run logs, and sending results to the tools the Controller connects.
- Duration: for the term of the subscription and until the data is deleted under the section on return and deletion below.
- Categories of data subjects: the Controller's team members, and people whose data appears in sources and tools the Controller connects, such as leads, customers, candidates or suppliers.
- Categories of personal data: names, business contact details, job titles, company data and any other content the Controller chooses to process in crons. Special categories are not intended.
Processing only on documented instructions
The Processor processes personal data only to provide the service and only on the documented instructions of the Controller. The configuration of crons, schedules, steps, approvals and connections is the Controller's instruction. The Processor tells the Controller if it believes an instruction breaks data protection law.
Confidentiality
People authorised to process the data are bound by confidentiality. Access to customer workspaces is limited to what is needed to run, secure and support the service.
Security measures
- Encryption in transit (TLS) for the website, app, API and webhooks, and encryption of stored connection secrets and SSO settings.
- Access control with roles (owner, editor, viewer), approval rules per team, SSO with SAML and an audit log of workspace changes.
- Secrets for inbound webhooks and API tokens are stored only as hashes. Inbound webhooks can be limited to an IP allowlist.
- Run logs are kept only for the retention period of the plan and then deleted.
- Continuous uptime measurement of the app and the run queue, with incident notices to Teams workspaces.
Sub processors
The Controller gives general authorisation to use sub processors in these categories: hosting in the European Union, a payment operator, an email delivery provider, and an AI model provider under business terms that do not allow training on customer data. Integration providers the Controller connects act on the Controller's own instructions. The Processor binds every sub processor to obligations equivalent to this DPA and tells account owners by email at least 14 days before adding or replacing a sub processor, so the Controller can object.
International transfers
Where a sub processor processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on standard contractual clauses approved by the Commission, with additional safeguards where needed.
Assistance with data subject rights
The Processor helps the Controller answer requests from data subjects. Most requests can be handled in the workspace by editing or deleting crons, clearing cron memory and exporting run history as CSV. Requests that need our help go to support@crons.ai.
Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information available at the time and updates as they become known.
Audits and information
The Processor makes available the information needed to show compliance with this DPA, including answers to security questionnaires sent to support@crons.ai. On reasonable notice, and no more than once a year unless a breach occurred, the Controller may audit compliance through written questions or an independent auditor bound by confidentiality.
Return and deletion
When the subscription ends, the Controller can export run history as CSV until the end of the paid period. Workspace data is then deleted, and backups roll over within 30 days, unless the law requires longer storage.
Signing
The owner of a Teams workspace signs this DPA in the workspace under Security. The signed copy shows the signer, the company, the version and the time of signing, and can be downloaded at any time.