For existing Customers, these revised Terms take effect 30 days after we send direct notice, unless the Customer affirmatively accepts them earlier. Until then, its previously applicable agreement continues, subject to mandatory law.
These Terms govern Typenode's business workflow automation service. Your agreement is with Typenode, Inc., a Delaware corporation, referred to as “Typenode,” “we” or “us.”
1. Business customers and agreement
Typenode is offered for business, trade and professional purposes only. This includes freelancers and sole traders purchasing for their professional activities. It is not offered for personal, family or household use. An email address does not determine your status.
“Customer” means the business, organisation or person buying or using the Service for those professional purposes. “Member” means an individual authorised to access a Customer's Workspace. “Workspace” means the Customer's shared service environment. “Service” means the Typenode website applications, hosted workflow tools, managed execution service, APIs and MCP tools supplied under these Terms. “Run” means one instance of executing a workflow.
By accepting these Terms, creating a Workspace or purchasing the Service, you agree to these Terms for the Customer. You must be at least 18 and have authority to bind the Customer. Members must use the Service within the Customer's authorisation and applicable permissions. If you lack that authority or eligibility, do not create or operate its Workspace.
Our Privacy Policy explains personal-data processing. Our Data Processing Agreement, including its schedules, forms part of this agreement when we process personal data on the Customer's behalf. The DPA controls conflicting provisions about that processing. A separate agreement signed by Typenode controls only the matters it expressly changes. Mandatory legal rights remain applicable regardless of a person's stated business status.
2. Accounts, authority and client Workspaces
Provide accurate account, Customer and billing information and keep it current. Each individual must use their own account; do not share login credentials or use someone else's account. Safeguard accounts and Integration Credentials, grant only necessary access, and promptly report suspected unauthorised access to security@typenode.ai.
The Customer is responsible for permissions it grants, instructions it authorises and Members' use within its control. This does not make the Customer responsible for a security failure caused by Typenode or waive rights relating to activity outside its authorisation. Permissions, connected applications and Roles must be reviewed when people or providers leave.
Agencies and other service providers may work for clients through individually authorised memberships. Each client business must own its own Workspace. An agency must not pool multiple separate clients' workflows, data or credentials in one agency-owned Workspace. An agency may maintain a Workspace for its own business operations.
A departing agency's access must be removed without deleting the client's Workspace or content. Maintain an authorised client owner and arrange handover of integration accounts, configuration and operational information. Credentials or third-party accounts controlled by the departing agency may require reconnection or transfer under the third party's rules. Typenode Workspace membership does not transfer ownership of an external account or establish the parties' legal data-processing roles.
You may provide services to your clients through authorised use of their Workspaces. You may not resell accounts, impersonate the client, sublicense the Service as a separate product or offer an agency-owned pooled service contrary to this section without our written agreement.
3. Trials
We display trial eligibility and charges before activation. A verified work email qualifies for a free trial; an address on our public or disposable-provider list receives a $5 one-time paid trial. Both offers remain limited to eligible business use.
Each trial includes 1,000 execution credits shared across the Workspace and lasts seven days; the precise expiry is shown in the Workspace. A free trial starts after verification; a paid trial starts after successful payment. Neither renews or automatically becomes a Pro subscription. An authorised Workspace owner must separately select and confirm Pro.
When a trial expires, existing work remains viewable subject to retention and lawful access restrictions, while editing and new Runs stop until Pro is active. Included trial credits expire with the trial. Starting Pro ends the trial and its unused included credits; the trial fee is not credited toward Pro.
4. Subscriptions, execution credits and payment
Pro costs $20 per Workspace per month and includes 10,000 execution credits shared across that Workspace for each successfully paid billing period. It renews monthly until cancelled. Included monthly credits do not carry into the next period.
An authorised owner of an active trial or Pro Workspace may buy a one-time $5 pack of 2,000 execution credits. Purchased credits remain in that Workspace until used, including across trial expiry, renewal and subscription cancellation. They require an active trial or paid Pro entitlement to start new Runs; a pack alone does not enable editing or execution. Included credits are used before purchased credits. Credits cannot be transferred between Workspaces, redeemed for cash or used outside the Service. Their continued availability is subject to the termination, closure and mandatory-law provisions below.
A billable Run consumes one credit when it is admitted for execution. A started Run may consume a credit even if it fails, is cancelled or produces an unexpected result. Work confirmed never to have started is compensated in the credit ledger; the original included credit's billing-period limits still apply. Successful completion is not the condition for charging a Run. Node count alone does not create additional Run charges. A separately admitted Run, including a newly started replacement or retry, may consume another credit.
Prices are in US dollars, excluding applicable tax. The final charge and applicable tax are displayed before payment. Stripe provides hosted payment, invoices and subscription management. You authorise the agreed recurring charges and must keep a valid payment method. You remain responsible for amounts properly due and applicable taxes, excluding taxes on Typenode's income.
Failed renewal payment does not grant a new allocation of included credits. We may allow a limited payment-retry period, with the applicable entitlement status shown in Billing, and may restrict editing and new Runs when that entitlement expires. Retry permission does not waive payment obligations. Work already admitted may finish subject to technical, legal and security limits.
5. Cancellation, billing errors and refunds
A Workspace owner can cancel Pro in Billing through the hosted billing portal. Ordinary cancellation stops the next renewal and preserves access through the already-paid period, subject to available execution credits, retention and lawful suspension. Cancellation does not itself delete the Workspace, disconnect every integration or refund unused fees or credits.
Purchases, subscription fees and execution credits are non-refundable except where applicable law requires otherwise. We may offer goodwill remedies at our discretion; they are not a standing entitlement. This provision does not eliminate mandatory remedies for unlawful charges, our nonperformance or other matters for which liability or remedies cannot lawfully be excluded.
Report a suspected billing error promptly to legal@typenode.ai, including enough information to identify the Workspace and charge. Do not include full payment-card details or account secrets. We will investigate the charge and correct errors for which we are responsible. Contacting us is not a condition for exercising a mandatory legal remedy.
6. Customer Content and confidentiality
“Customer Content” means information, workflow configuration and code, files, ordinary business data, Run inputs and outputs, and other material supplied by or for the Customer or generated by its use of the Service. “Integration Credentials” means secrets, keys and authorisation grants used to connect the Customer's external services.
The Customer retains its rights in Customer Content. It grants us a limited right to host, copy, transmit, display and otherwise process that content only to provide and secure the Service, follow authorised instructions, provide permitted support and comply with law. This does not authorise advertising use, sale of Customer Content or model training. It does not grant us ownership of the Customer's workflows or results.
We do not use Customer Content to train or fine-tune AI models, and we do not authorise model training on Customer Content by suppliers processing it for us. Independently chosen AI Apps and external services are governed by their own agreements with the Customer; this commitment does not control their separate use of data.
We may use third-party AI tools to assist with authorised support or draft communications, as described in the Privacy Policy. This does not expand our access rights, permit unrelated experiments on Customer Content, or authorise supplier model training on it. Any Customer Personal Data supplied for customer-instructed support remains subject to the DPA, including supplier-contract, confidentiality and transfer requirements. Typenode's internal AI tools and the AI Clients independently chosen by the Customer are separate relationships.
Each party will protect the other's confidential business information with reasonable care, use it only for the agreement's purposes and disclose it only to people or suppliers who need access and are subject to suitable confidentiality duties. Confidential information includes non-public Customer Content and business information even when it is not personal data. It excludes information lawfully public without breach, already lawfully known, independently developed or lawfully received without a confidentiality restriction.
Typenode human access to Customer Content is limited to reasonable access for requested support, necessary security or abuse investigations, legal obligations, and examples voluntarily supplied for feedback or feature requests. Providing an example does not authorise unrelated Workspace browsing, disclosure or training. Any stricter applicable processing or provider restriction remains effective. Where disclosure is legally required, we will give notice when lawful and reasonably practicable and limit disclosure to what is required.
We may use suggestions and feedback about the Service to improve it without compensation. This permission does not transfer ownership of confidential examples or authorise training on Customer Content. The DPA governs personal data in such materials where applicable.
7. External services, AI apps and Plugins
An “AI App” is an independently chosen AI application, such as ChatGPT, Claude or another MCP-compatible host, which accesses Typenode under a Member's authorisation. A “Plugin” is a Typenode listing in an AI App's directory, such as a connector, app or plugin offered in ChatGPT or Claude, which connects that AI App to Typenode. Typenode currently provides workflow tools and MCP access; it does not provide a built-in customer chat service.
Connecting an AI App permits it to request actions and receive information within its granted permissions. Information returned through tools can include authorised workflow configuration, operational metadata and selected historical Run or Step evidence. The AI App may process that information under its own terms and privacy arrangements. Before connecting, the Customer must have authority to share it, review the host's arrangements and choose appropriate permissions. Typenode's authorisation checks still apply to each action; the AI App does not gain independent authority beyond the connected Member's permitted access.
AI-generated instructions, code and explanations can be inaccurate. Review workflows, configuration and consequential actions before authorising them. The Customer controls which workflows it publishes and what third-party operations they perform. External actions can send messages, change records, transfer data or otherwise have effects that cannot be undone. Authorisation to use tools does not replace any confirmation required for the particular action.
Enter secrets only in Typenode's designated secure entry or external-provider consent interfaces. Do not put API keys, passwords, tokens or one-time codes into chat, ordinary Variables, tool arguments, workflow descriptions or returned evidence. Normal secure OAuth authentication and consent are distinct from sharing credentials as content.
A Plugin may access existing authorised account entitlements. Its availability does not imply endorsement by the AI App's provider, a separate entitlement or a subscription purchased through the AI App. Billing and subscription cancellation remain separate from connecting or disconnecting a Plugin.
Disconnecting an AI App or Plugin revokes that connection; it does not cancel Pro or delete the Workspace. Removing a Member revokes that Member's access; cancelling Pro stops renewal; deleting a Workspace removes its resources through the deletion process. These actions have different consequences.
The Customer must use external accounts and integrations with permission and comply with applicable third-party terms. We do not own or control independently selected external services and cannot guarantee their availability, retention, outputs or continued compatibility. This does not excuse our own obligations under this agreement.
8. Supported data and acceptable use
Use the Service lawfully and within authorised business purposes. Do not infringe rights; upload malware; send unlawful spam; deceive or impersonate others; bypass permissions, payment or security controls; access another Customer's data; or interfere with the Service. Do not use the Service to facilitate unlawful surveillance, abuse, discrimination, fraud or other prohibited activity.
Ordinary business information may be processed when the Customer has a lawful basis and appropriate notices and permissions. Integration Credentials are permitted only through supported secure credential-management flows.
The Service is not offered for the following restricted data or purposes:
Personal data concerning children or people under 18. Ordinary age information about adults is not prohibited by this restriction.
Protected or regulated health information requiring specialised health-sector safeguards, including HIPAA-protected health information.
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership; genetic data; biometric data used for unique identification; and data concerning health, sex life or sexual orientation.
Personal data about criminal convictions or offences, government-issued identification numbers, raw payment-card data or bank-account details. Payment information needed for purchases must be provided through the hosted payment provider.
Unsupported uses determining or materially influencing access to employment, education, essential services, credit, insurance, healthcare, law enforcement or other high-risk decisions about people, or safety-critical operation where failure could cause death or serious injury.
Each Plugin must also comply with its host AI App's stricter restrictions. Do not use its tool/chat interfaces to collect or expose restricted credentials, payment-card data, protected health information or government identifiers, including through otherwise generic Run evidence. Ordinary use restrictions do not establish HIPAA, medical, financial or high-risk AI compliance.
If prohibited data is received, that does not remove legal duties concerning it. Notify us through security@typenode.ai without repeating the sensitive material so we can address the exposure. We may restrict affected processing proportionately under section 10.
9. Retention and retrieval during service
Completed Run inputs, outputs and history default to retention for 30 days after completion. Expiry and physical removal are asynchronous; operational settlement, security or legal requirements may affect cleanup. Workflow configurations and Integration Credentials do not expire on that Run schedule. Separate retention criteria for accounts, billing, security records and backups are described in the Privacy Policy and DPA.
Retrieve records you need before their applicable retention period expires. Individual output downloads and authorised data reads are available where supported. Contact legal@typenode.ai for requests requiring assistance or an applicable return or switching process. We do not promise restoration of content already lawfully deleted under the agreed schedule or a complete automated Workspace-export feature. Our contractual and mandatory assistance duties below remain applicable.
10. Restrictions, suspension and termination for cause
We may restrict or suspend the affected part of the Service when reasonably necessary to address a material breach, nonpayment, credible security or abuse risk, unlawful content or use, a legal order or a legal obligation. We will use proportionate measures and avoid unnecessary disruption of unaffected service.
Unless urgent action is necessary or notice is legally prohibited, we will explain the reason and give a reasonable opportunity to resolve a remediable breach. Where law requires a statement of reasons, we will provide the relevant basis, scope and available redress information. You may request review by replying to our notice or contacting legal@typenode.ai. We do not promise uninterrupted access when continuing access would create a serious risk or be unlawful.
We may terminate for a material breach that remains unresolved after a reasonable opportunity to cure, a serious or repeated breach, or where continuation is legally prohibited or presents a serious security risk. The Customer may terminate for our material breach that remains unresolved after a reasonable opportunity to cure, without limiting other mandatory remedies.
Content restrictions may involve manual review and technical controls; we do not undertake general monitoring of all Customer Content. To notify us of suspected illegal content, email legal@typenode.ai with its precise location or Workspace/resource identifier, why you believe it is illegal, supporting information, your contact details and a statement that the notice is accurate and made in good faith. We will acknowledge notices when contact details permit and communicate our decision and reasons as applicable. Do not include unnecessary sensitive information. Authorities may use the same electronic contact. We communicate in English.
11. Ordinary service closure and switching
For ordinary termination by Typenode without cause or discontinuation of the Service, we will give at least 30 days' direct notice and honour the remaining already-paid service period. The ordinary end date will not precede the end of that paid period. We will not accept renewals or new purchases for service we cannot supply. Necessary urgent legal or security restrictions remain subject to section 10 and mandatory remedies; the nonrefund default does not override them.
For exit or switching requests concerning our hosted data-processing service, contact legal@typenode.ai. The Customer may request switching to another provider of the same service type, transfer to its own infrastructure, or erasure on termination. We will provide reasonable assistance, including to third parties the Customer authorises, and information about available methods, formats and known continuity or technical limitations. Assistance may use available interfaces, downloads and secure manual arrangements; no automated full-export capability is promised.
A notice period for initiating a requested switch will not exceed two months. After that period, the transition will normally be completed within 30 calendar days, with due care for continuity of the contracted functions and data security. If completion within 30 days is technically infeasible, we will explain the reasons within 14 working days of the request and specify an alternative period no longer than seven months. The Customer may extend the transitional period once to a period more appropriate for its purposes as provided by applicable law.
Exportable categories include the Customer's still-held workflow definitions and code, configuration and Variables, supplied files and other Customer Content, retained Run inputs, outputs and history, and customer-specific metadata necessary to interpret or use those records. Credentials and authorisation grants require secure handling and may require reconnection with the external provider. Provider-owned access credentials, underlying Typenode software, internal service-security material and internal operational data protected as Typenode trade secrets are excluded; exclusions will not be used to obstruct lawful switching. We will identify available formats and relevant data structures when arranging the transfer. No promise is made to supply records already lawfully expired before the request or to reproduce every Typenode function on another provider.
The switching contract ends on successful completion of the transition; we will notify the Customer. If the Customer instead chooses erasure without switching, it ends at the end of the applicable notice period. Normal service fees remain due until the applicable contract termination; we will not impose a separate switching charge.
The Customer will have at least 30 calendar days after the transitional period to retrieve still-held exportable data and digital assets securely. An ordinary provider closure will likewise include at least 30 days of assisted retrieval after service ends. Necessary security/legal safeguards may limit the mode of retrieval but do not eliminate applicable retrieval rights. We will erase exportable Customer data and assets after the retrieval period or a later agreed period once switching has completed successfully, subject to legally required retention of separate administrative records. Personal-data return/deletion duties under the DPA continue to apply.
The Customer should identify the intended destination, authorised recipient and required records promptly and cooperate in good faith. Ending service does not give continuing execution, editing, support or software-update rights beyond the expressly agreed period. These Terms do not promise continued operation of a hosted Runtime after service ends or a currently available BYOC service.
12. Service changes and changes to these Terms
We may make changes reasonably needed to improve or maintain the Service, address security, legal or technical requirements, reflect changed costs or suppliers, or prevent abuse. We will not use this right to avoid providing already-paid service or statutory remedies.
For materially adverse changes to these Terms or pricing, we will give at least 30 days' advance notice directly to the Customer's designated account or billing contact, describing the change and its effective date. Price changes apply only to future renewals, not the already-paid period. The Customer may cancel before the affected renewal or terminate in accordance with applicable rights without a separate termination penalty. A notified change cannot retroactively remove accrued rights.
Urgent changes required by law, a serious security issue or abuse prevention may take effect sooner; we will explain them as soon as lawful and reasonably practicable. Minor changes with no material adverse effect may take effect when posted. Continued use after a properly notified effective date indicates acceptance to the extent permitted by law. We will make the current Terms available for the Customer to retain.
13. Intellectual property and service licence
Typenode and its licensors retain rights in the Service, its underlying software, documentation, names and marks. Subject to these Terms and applicable entitlements, we grant the Customer and its authorised Members a limited right to access and use the Service for the Customer's business. This does not transfer our software or marks to the Customer or give resale rights. Separately supplied open-source software remains governed by its applicable licence.
14. Service standards and liability
We will provide the Service with reasonable care and skill. We do not guarantee that it will always be uninterrupted, error-free or suitable for every proposed use, or that third-party services or AI-generated work will be accurate. Except for our express commitments and mandatory legal obligations, the Service is supplied as available without additional implied warranties to the extent permitted by law. This disclaimer does not excuse our failure to perform an express duty under this agreement.
To the extent permitted by law, neither party is liable under this agreement for indirect or consequential loss, lost profits, lost business opportunities or loss of anticipated savings. Labels do not exclude recovery that mandatory law requires or turn a direct contractual loss into an excluded loss.
To the extent permitted by law, Typenode's aggregate liability arising from the Service and this agreement is limited to the greater of $100 or the fees the Customer paid to Typenode for the affected Service in the 12 months before the event giving rise to the claim.
These exclusions and limits do not apply to fraud, intentional misconduct, gross negligence, death or personal injury where liability cannot be excluded, or any other liability or remedy that applicable law does not permit us to exclude or limit. They do not limit duties or remedies that must remain available under applicable data-protection or business-data law. They do not excuse the Customer's obligation to pay charges properly due.
15. Law, disputes and general provisions
Delaware law governs this agreement, excluding its conflict-of-laws rules, subject to mandatory applicable law. Courts with jurisdiction in Delaware are the agreed forum for disputes, except where applicable mandatory law requires or preserves another forum. This provision does not displace mandatory EU data-protection, data-processing-service or other applicable rights. There is no agreement to mandatory arbitration or waiver of legally protected redress.
Both parties may contact the other to seek a practical resolution before litigation; doing so is not a compulsory limitation on legal remedies or deadlines. Contract notices to Typenode may be sent to legal@typenode.ai. We will send Customer notices to its designated account/billing contact; maintain an accessible current address.
Neither party may assign this agreement in a way that prejudices applicable mandatory rights. Typenode may assign it in connection with a merger, reorganisation or transfer of the relevant business if the successor assumes its obligations; we will notify affected Customers. The Customer may assign it to a genuine business successor with our consent, which will not be unreasonably withheld. Membership changes do not themselves transfer the Customer's contract.
If a provision is unenforceable, the remaining provisions continue where legally possible; no replacement may remove mandatory rights. A failure to enforce a provision once is not a waiver. Ownership, confidentiality, accrued payment duties, permitted liability provisions and applicable retrieval/deletion duties survive termination as their nature requires.
16. Company and contact information
Typenode, Inc. is incorporated in Delaware, United States, file number 10510359. Its filed registered office is 251 Little Falls Drive, Wilmington, DE 19808, United States; registered agent: Corporation Service Company. Business correspondence may be sent to 1111B S Governors Ave, #82884, Dover, DE 19904, United States. The Dover correspondence address is not described as the registered office or an operating headquarters. Typenode is currently managed and operated by its founder from Barcelona, Spain.
Contact legal@typenode.ai for contract, billing, support, legal-notice and switching matters; privacy@typenode.ai for privacy matters; and security@typenode.ai for security concerns. Our Privacy Policy provides the privacy contact and rights information.
Data Processing Agreement
Version 1.0 · Updated 12 October 2026. This Agreement forms part of Typenode's Terms of Service at Terms of Service. It takes effect when the Customer accepts those Terms and applies while Typenode processes Customer Personal Data, including during return, deletion and legally required retention. The annexes form part of this Agreement.
1. Parties, scope and definitions
Typenode means Typenode, Inc., a Delaware corporation, with business correspondence address 1111B S Governors Ave, #82884, Dover, DE 19904, United States. This correspondence address is not a representation of its operating headquarters. Privacy and processing requests: privacy@typenode.ai; security incidents: security@typenode.ai; contractual notices: legal@typenode.ai.
Customer means the business or professional accepting the Terms, identified by its account and billing records. A person accepting for another business must be authorised to bind it. Services means the Typenode hosted workflow, integration, Workspace and MCP services purchased or used under the Terms. Customer Personal Data means personal data supplied by or for the Customer, or generated through processing on its behalf, in those Services. It includes personal data in workflow definitions, inputs, outputs, retained execution records, authorised integration data and relevant service evidence. Applicable Data Protection Law means privacy and data-protection law applicable to the relevant processing, including the EU GDPR and applicable US state privacy laws. Personal Data Breach has the meaning in GDPR Article 4(12). Controller, processor, personal data, processing and data subject have their meanings under applicable law. Subprocessor means a supplier appointed by Typenode to process Customer Personal Data on its behalf.
This Agreement governs Typenode's processor activities. Typenode's processing for its own account administration, subscriptions, invoices, legal compliance, direct marketing and website preference or measurement purposes is explained separately in the Privacy Policy. A category's name does not decide its role: operational evidence linked to Customer Personal Data remains covered where processed to provide or secure the Customer's service. The Terms' confidentiality obligations also protect non-personal Customer Content.
2. Roles and Customer authority
The Customer determines the purposes and essential means of processing Customer Personal Data and is its controller. Typenode is its processor. If the Customer itself processes particular data for another controller, the Customer is the processor and Typenode is its subprocessor for that data. The Customer must identify that arrangement when requesting assistance or issuing instructions and have authority from the relevant controller, including required subprocessor authorisation. Typenode will provide information reasonably needed to document that chain.
A client business owns its Workspace. An agency or other provider acts through its individually authorised Members in that client's Workspace; membership does not make the agency the contracting Customer or transfer ownership. One agency Workspace must not pool different clients' credentials or workflows. An agency may maintain its own Workspace for its own business. These rules do not override the actual controller/processor roles for particular data.
The Customer is responsible for lawful collection, instructions, required notices and a valid legal basis; for responding to data subjects; and for its own security, Member permissions and independently selected services. These responsibilities do not reduce Typenode's obligations under this Agreement or law.
3. Instructions and permitted processing
Typenode shall process Customer Personal Data only on the Customer's documented instructions, including instructions concerning transfers, except where processing is required by EU or Member State law applicable to Typenode. In that event Typenode shall inform the Customer before processing unless the law prohibits notice on important grounds of public interest. For other jurisdictions, any legally compelled disclosure must also satisfy applicable data-protection and transfer law.
The Terms, this Agreement, Annex 1, and the Customer's authorised workflow, integration, retention, deletion and support requests constitute documented instructions. Further instructions may be sent to privacy@typenode.ai. Typenode shall promptly inform the Customer if, in its opinion, an instruction infringes applicable data-protection law and may suspend the affected processing while the parties resolve it. Instructions requiring a change to the agreed service may require a separate scope agreement; this does not excuse legally required assistance or safeguards.
Typenode shall not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it for its own unrelated profiling or marketing. Typenode shall not use Customer Content, including Customer Personal Data, to train or fine-tune machine-learning models, or authorise its Subprocessors to do so. Typenode shall require content-processing suppliers to accept restrictions consistent with that commitment and shall not submit customer content to voluntary provider-training or feedback programmes. These are Typenode's contractual obligations; customer-selected AI applications and other independent services remain governed by their own arrangements.
Customer-authorised MCP applications can read or act on data within their granted permissions. Workflow connections can send data to the Customer's chosen destinations. Typenode will execute those instructions within the Services; the Customer must ensure those recipients and its instructions are lawful. A chosen recipient is not automatically Typenode's Subprocessor. Disconnecting an application or removing a Member does not by itself erase Workspace data, cancel a subscription or delete the Workspace.
4. Personnel and confidentiality
Typenode shall ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty. Access shall be limited to what is necessary for service operation, requested support, security or abuse investigation, lawful obligations, or an example the Customer voluntarily supplies for a specific feedback request. Such an example does not authorise unrelated browsing, disclosure or model training. Typenode shall apply any stricter restrictions required by applicable law or the relevant integration provider.
5. Security
Typenode shall implement and maintain technical and organisational measures appropriate to the risks under GDPR Article 32, including the measures in Annex 2. It shall assess confidentiality, integrity, availability and resilience; restoration following an incident; and regular testing and evaluation of the effectiveness of relevant measures. Measures may evolve, but Typenode shall not materially reduce the protection of Customer Personal Data during the term.
The Customer must use the designated credential-management flows, protect its own devices and credentials, restrict permissions, and avoid putting secrets or restricted data into prompts, ordinary workflow payloads or public endpoints. These Customer duties do not exclude Typenode's responsibility for its own security. No Typenode SOC or ISO certification is represented by this Agreement.
6. Subprocessors
The Customer generally authorises the Subprocessors identified in the separately titled Subprocessor List at Subprocessor List, for the purposes stated there. Typenode shall impose, by a binding written contract, data-protection obligations on each Subprocessor that are in substance equivalent to the relevant obligations in this Agreement, including security, confidentiality, permitted use, assistance and lawful transfers. Typenode remains fully liable to the Customer for the performance of those obligations by its Subprocessors.
Typenode shall give the Customer at least 30 days' advance written notice of an intended addition or replacement, through the Customer's account contact email, with the supplier's identity, service, data categories and relevant locations. Updating a web page alone is not that notice. The Customer may object during that period on reasonable grounds concerning protection of its personal data. The parties shall work promptly to resolve the objection through an alternative supplier, configuration or other adequate protection. If no resolution is possible, Typenode shall not use the objected-to supplier for that Customer's affected data; either party may terminate the affected service before that processing begins. Paid-service and mandatory-law financial consequences follow the Terms and applicable law. Required written notice and a meaningful opportunity to object will be preserved when urgent continuity or security circumstances require an expedited change.
7. Rights requests and assistance
Taking into account the nature of processing, Typenode shall assist the Customer through appropriate technical and organisational measures, insofar as possible, to fulfil data-subject requests, including access, correction, erasure, restriction and portability. Assistance may be performed manually; this Agreement does not represent that an automated complete-Workspace export or deletion interface exists.
Typenode shall promptly forward a request concerning Customer Personal Data that it can associate with the Customer, and shall not respond on the Customer's behalf except as instructed or required by law. It may tell the requester how to contact the Customer. Customer instructions must respect the rights of other Workspace participants and lawful retention requirements.
Taking into account processing and the information available to it, Typenode shall assist the Customer with security obligations, breach notifications, data-protection impact assessments and prior supervisory-authority consultation. Typenode shall provide relevant information promptly enough to support applicable deadlines. The Customer may contact privacy@typenode.ai for assistance. Any agreed charges for exceptional additional work shall be reasonable and shall not condition or delay Typenode's required legal duties.
8. Personal Data Breaches
Typenode shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, using the Customer's account contact or another agreed security contact. Notice shall describe, as information becomes available, the nature of the breach, affected categories and approximate numbers of data subjects and records, a contact for further information, likely consequences, and measures taken or proposed to address it and mitigate adverse effects. Information may be supplied in phases without undue further delay. Typenode shall investigate, contain and remedy the breach, preserve relevant evidence and cooperate with the Customer. Notice is not an admission of liability. The Customer remains responsible for controller notifications unless the law or documented instructions provide otherwise.
9. Information, audits and regulatory cooperation
Typenode shall make available all information necessary to demonstrate compliance with its processor obligations and allow and contribute to audits, including inspections, by the Customer or an auditor it mandates. The parties will first use relevant documentation and remote review where these meet the need. Audits must protect other customers' information, credentials and service security. Reasonable notice, confidentiality and proportionate scheduling may be agreed; they must not prevent a legally required audit, urgent breach review or supervisory-authority access. Supplier reports are not represented as Typenode's own certification. Typenode shall notify the Customer if it determines it cannot meet its applicable obligations and cooperate with lawful measures to stop and remedy unauthorised processing.
10. Return, retention and deletion
The Customer may request return or deletion of Customer Personal Data during the term, subject to lawful instructions and the effect on the requested service. Completed Run inputs, outputs and history normally become eligible for asynchronous deletion 30 days after completion, unless a different lawful retention instruction has been agreed. Workflow configurations, Credentials, active or waiting Runs and other records are not governed by that completed-Run period. Return requests should be made before the relevant retention period expires.
On cessation of the relevant processing services, Typenode shall, at the Customer's choice, return Customer Personal Data or delete it, and delete existing copies unless EU or Member State law requires storage. The Customer has at least 30 days to request and retrieve data after the relevant service cessation; where applicable switching law or agreed terms provide a later or longer retrieval period, that period applies. Typenode shall not delete exportable data during a required switching or retrieval period. It will provide secure retrieval assistance, including manual assistance where necessary, and state the scope and format of the delivered data. Return does not include another customer's data, Typenode's secrets or lawfully excluded internal material.
After return or expiry of the applicable retrieval period, active copies shall be deleted without undue delay. Security or legally required records shall be limited to the necessary data and duration, protected against other uses, and the Customer shall be informed of the retention basis unless law prohibits it. Residual recovery copies shall remain protected and unavailable for ordinary processing, expire through necessary recovery cycles, and be subject to deletion instructions if restored. Typenode shall provide relevant recovery-retention details on request and shall not use a restore to reintroduce data already required to be deleted. On request it shall confirm completion or explain any lawful exception. Removing an individual Member does not erase the client's Workspace; agency departure shall preserve client ownership and authorised access.
11. Processing locations and international transfers
Typenode is incorporated in Delaware and is currently managed and operated from Barcelona, Spain. Its principal Supabase project storage region and Inth consent runtime region are Frankfurt. This is not an EU-only storage, execution, access or support promise: the service uses global infrastructure and suppliers, including those identified in the Privacy Policy. Inth consent processing is governed separately as explained there.
Typenode shall ensure that any transfer of Customer Personal Data subject to GDPR Chapter V has a lawful mechanism and any necessary supplementary safeguards before the transfer takes place. It shall document the actual exporter, importer, processing roles, destinations and access, and provide relevant safeguards or their details on request, with necessary confidentiality redactions. Adequacy, including a valid certification where a framework requires one, applies only within its actual scope. Where appropriate contractual safeguards are used, Typenode shall assess the destination's law and practices and implement required supplementary measures; it shall suspend an affected transfer if adequate protection cannot be maintained.
This Agreement does not automatically deem Commission Decision 2021/914 transfer SCCs executed between every Customer and Typenode. EU establishment and the recipient's actual GDPR scope must be assessed for the processing concerned; incorporation and database region alone do not decide whether there is a restricted transfer or which clauses can be used. Where those SCCs are legally available for an actual transfer to a recipient outside their GDPR-covered scope, the controller-to-processor relationship uses Module 2 and a processor-to-subprocessor relationship uses Module 3. The applicable text, options, parties, transfer description, supervisory authority, security annex and any required supplier annex must be completed and made binding for that transfer. A general supplier list alone does not execute them. Where those clauses are unavailable, another legally valid safeguard must be established before transferring. Supplier-specific incorporated transfer terms govern covered onward transfers without reducing Typenode's duties here.
For UK or Swiss data, any additional applicable transfer requirements must likewise be satisfied before a restricted transfer; EU SCCs alone are not represented as satisfying every such requirement. Typenode shall handle government access demands consistently with law and the applicable safeguards, minimise disclosure, challenge unlawful demands where available, and notify the Customer unless legally prohibited.
12. Applicable US processor and service-provider obligations
Where applicable US privacy law requires a processor, service-provider or contractor contract, Typenode shall process Customer Personal Data only for the specific service purposes in Annex 1 and the Customer's lawful instructions. It shall not sell or share that data as those terms are defined by applicable law; retain, use or disclose it outside those purposes or the direct business relationship except as legally permitted; or combine it with personal information from other sources except as legally permitted. Typenode shall provide the level of privacy protection required by applicable law, notify the Customer if it can no longer comply, and allow reasonable and appropriate steps to assess compliance and stop or remedy unauthorised use. It certifies that it understands and shall comply with these restrictions. It shall require applicable downstream suppliers to accept corresponding written obligations and assist with rights requests and legally required assessments. These provisions do not assert that every state law applies to every Customer.
13. Priority and survival
This Agreement prevails over inconsistent Terms concerning Customer Personal Data processing. Binding transfer instruments prevail within their applicable scope. No limitation or dispute clause reduces mandatory data-subject rights, statutory regulatory powers or protections that the parties cannot lawfully limit. Obligations concerning confidentiality, retained data, assistance, audit and deletion survive as necessary. Material changes follow the Terms' notice provisions and must preserve legally required protections. Customer-specific processing or transfer arrangements must be documented in writing.
Annex 1 — Processing details and documented instructions
| Item | Agreed processing |
|---|---|
| Parties and contacts | Customer: business/professional identified by the contracting account and billing record; processing contact: its account owner or separately nominated contact. Typenode: entity and contacts in §1. |
| Subject matter | Hosting and operating the Customer's client-owned Workspace, workflow definitions, authorised integration connections, credential management, managed execution and execution evidence, MCP access and requested support. |
| Purpose | Provide, secure, maintain and support those instructed services, including troubleshooting an authorised request, preserving execution integrity and fulfilling return/deletion instructions. No independent marketing, unrelated profiling or model training on Customer Content. |
| Nature | Collection or receipt, transmission, organisation, storage, retrieval, access-controlled display, workflow transformation and execution, disclosure to instructed destinations, credential refresh/use, operational recording, restriction, return and deletion. |
| Frequency and duration | Continuous or on-demand according to authorised Members, workflows, triggers and integrations, for the service term plus return/deletion and limited lawful retention under §10. |
| Data subjects | Customer and client personnel, contractors, business contacts, suppliers, customers and other adults whose ordinary business information is lawfully processed in supported workflows. Workspace Members and authorised agency personnel where data is processed for the Customer. |
| Data categories | Names and business contact details; organisational identifiers and roles; ordinary business communications/documents and records; workflow/configuration and integration metadata; inputs, outputs and execution records; IP/request and correlation identifiers where needed for the instructed service; authorised Credentials and OAuth token material handled through designated secure flows. The Customer chooses specific supported fields. |
| Supported boundaries | Ordinary business data and authorised Integration Credentials. No GDPR Article 9 special categories; Article 10 criminal-conviction/offence data; protected medical records or regulated health data; genetic or biometric-identification data; government-issued personal identification numbers or identity-document copies; raw payment-card/bank-account details or payment-authentication credentials; or minors' personal data. Stripe's own payment collection is not permission to put payment data into workflows. Do not use the Services for unsupported high-risk or safety-critical decisions affecting employment, education, credit, essential services, health, legal rights or physical safety. |
| Unexpected restricted data | Notify Typenode promptly and stop the affected use. Typenode will restrict access and cooperate on lawful remediation/deletion; a prohibition does not remove obligations for data actually received. Any exception needs a separate documented agreement and legally sufficient safeguards before processing. |
| Destinations and suppliers | Current Subprocessor List identifies Typenode-appointed suppliers; Customer-authorised integrations and AI/MCP hosts are instructed recipients under the Customer's arrangements, not automatically Typenode-appointed suppliers. |
| Customer rights | Issue lawful documented instructions; choose return/deletion; receive assistance and compliance information; audit as §9; receive breach/change notices; object to supplier changes as §6; exercise contractual and statutory remedies. |
Annex 2 — Technical and organisational measures
Typenode shall maintain the following measures appropriate to the processing risk. Specific organisational duties in this annex are binding commitments; no independent certification is claimed.
Service access and isolation. Authenticate protected service requests and apply Workspace- and resource-scoped authorisation. Limit Member access to authorised client Workspaces. Maintain distinct customer identifiers and scopes in storage and execution access; logical isolation does not imply dedicated physical hardware.
Credential protection. Store managed integration credential material encrypted using AES-256-GCM with HKDF-derived keys and authenticated context binding to tenant or relevant credential/row identity. Restrict decryption and use to authorised service paths and keep infrastructure encryption keys separate from customer-visible configuration. Credentials necessarily become available to authorised execution or refresh operations; encryption is not a promise they are never processed in memory.
Network protection. Use HTTPS/TLS for public service and credential-management connections. Restrict service-to-service and datastore access through authenticated service credentials and scoped interfaces; protect those credentials from public responses and client bundles.
Access and confidentiality. Restrict administrative/customer-data access to authorised persons with a documented operational need and confidentiality duties. Review and remove access when no longer needed; record material privileged actions and protect the evidence. Support access is limited as §4.
Operational evidence and minimisation. Use structured diagnostic events, bounded operational attributes and secret/content redaction in application telemetry. Protect retained identifiers and logs as personal data when linkable. Review provider-generated logs separately; application redaction is not represented as filtering every infrastructure record. Limit telemetry retention and supplier access to the stated operational purposes.
Retention and deletion. Apply completed-Run retention expiry and asynchronous payload/history cleanup; separate Credentials/configurations and other justified record classes. Authenticate and authorise account/Workspace erasure requests and verify cleanup. Protect recovery copies; enforce deletion instructions on restore as §10.
Continuity and recovery. Use managed infrastructure and available recovery copies for service resilience. Restrict and document recovery actions, assess integrity before restoring service, and maintain necessary recovery instructions. Supabase production currently uses daily backups with PITR disabled; this is not a guarantee of a particular recovery time or permanent-erasure deadline for all copies.
Incident and effectiveness review. Maintain a response process that identifies and contains incidents, assesses affected data and meets §8 notification/cooperation duties. Regularly evaluate relevant access, credential, isolation, retention and recovery measures and remedy identified deficiencies. Evidence can include targeted technical testing and documented manual review rather than an asserted external audit programme.
Supplier and transfer controls. Assess actual supplier purpose, data, region/access and legal safeguards; require contractual flow-down; maintain the current inventory and change notices; restrict optional provider features or data reuse incompatible with Customer instructions.