# Data Processing Addendum (DPA) — AIOProductOS > Self-serve GDPR Article 28 Data Processing Addendum: fill your company details, download as PDF, and sign. SCCs for transfers; subprocessor list linked. *Markdown view of https://aioproductos.com/dpa. Full machine-readable reference: [/llms.txt](https://aioproductos.com/llms.txt), [/llms-full.txt](https://aioproductos.com/llms-full.txt).* DPA ## Your Data Processing Addendum, self-serve. Enter your company's details, download the addendum as a PDF, and sign. It populates below as you type. Last updated 22 June 2026. Your details Legal entity name Registered address Signatory name Signatory title Contact email Effective date Your details stay in your browser — nothing is submitted to us. This is a self-serve standard DPA, provided as a draft pending final legal review. For a negotiated or counter-signed copy, email [office@aioproductos.com](mailto:office@aioproductos.com). ### Data Processing Addendum This Data Processing Addendum (“DPA”) is entered into between **[Your legal entity]**, [registered address] (“Controller”), and **AIOProductOS Inc.**, a Delaware C-Corporation, 131 Continental Dr, Suite 305, Newark, DE 19713, United States (file no. 10681442) (“Processor”), effective [date]. It forms part of the agreement under which Processor provides AIOProductOS to Controller and reflects GDPR Article 28. #### 1 · Roles & subject matter Processor processes personal data on behalf of Controller solely to provide AIOProductOS, for the duration of the subscription. Controller is the controller of that personal data; Processor is the processor. #### 2 · Nature, purpose & data The nature and purpose of processing is the hosting, storage, analytics, AI assistance, and communications that Controller configures in the product. The personal data and categories of data subjects are those Controller chooses to process — typically Controller's staff and the end users of Controller's product, and identifiers, contact details, usage/event data, and content. #### 3 · Processor obligations (Art 28(3)) - Process personal data only on Controller's documented instructions, including for transfers, unless required by law. - Ensure persons authorised to process are bound by confidentiality. - Implement appropriate technical and organisational measures under Art 32 — encryption in transit and at rest, per-tenant isolation via row-level security, access control, and logging. - Engage subprocessors only under §4 below. - Assist Controller, by appropriate measures, to respond to data-subject rights requests. - Assist Controller with security, personal-data-breach notification (Art 33–34), and data-protection impact assessments (Art 35–36). - At Controller's choice, delete or return personal data at the end of the services, subject to legal retention. - Make available the information necessary to demonstrate compliance, and allow for and contribute to audits. #### 4 · Subprocessors Controller authorises the subprocessors listed at [status.aioproductos.com/subprocessors](https://status.aioproductos.com/subprocessors), kept current. Before adding a new subprocessor that processes personal data, Processor publishes the change there **at least 30 days in advance** and notifies Controller via the subprocessor change feed at [status.aioproductos.com/subscribe](https://status.aioproductos.com/subscribe) (email, RSS, or Atom). Controller may object during that window; if a reasonable objection cannot be resolved, Controller may terminate the affected service. Each subprocessor is bound by data-protection terms no less protective than this DPA. #### 5 · International transfers Where personal data is transferred outside the EEA, the parties rely on the European Commission's Standard Contractual Clauses, which are incorporated by reference. Controller selects an EU or US data region in the product; data resides in the chosen region. #### 6 · Breach notification Processor notifies Controller without undue delay after becoming aware of a personal-data breach affecting Controller's data, with the information Controller needs to meet its own obligations. #### 7 · Deletion & return On termination, Processor deletes or returns the personal data at Controller's choice, including via the product's full-organisation export and deletion, save where retention is required by law. #### 8 · Precedence This DPA supplements the service agreement. To the extent of any conflict on the processing of personal data, this DPA prevails. Controller [Your legal entity] Signature: Name: [signatory] Title: [title] Email: [email] Date: [date] Processor AIOProductOS Inc. 131 Continental Dr, Suite 305, Newark, DE 19713, United States · file no. 10681442 Signature: Name: AIOProductOS Inc. Title: Authorised signatory Email: office@aioproductos.com --- ## Why AIOProductOS - **One MCP over the whole product spine, not one tool.** 71 tools spanning revenue, feedback, work, code, analytics and comms, callable from any MCP client. Competing MCP servers expose a single product's own data; this one answers across the join, and it is listed on the official MCP registry. - **Connected, not consolidated.** 100+ connectors land Stripe, GitHub, your feedback tool and the rest onto one shared record, so a product question is a join instead of a reconciliation. You keep the tools you already run. - **Flat plans, not a per-head meter.** Member counts are allowances, not per-seat billing, and AI teammates are included rather than metered per credit. Compare the real number for your team with the [stack cost calculator](https://aioproductos.com/tools/saas-stack-cost-calculator). - **Nothing is plan-gated.** Every tier ships every module. The only limits are seats and agents, so the cheapest plan is the whole product. - **Your data stays yours.** EU or US residency chosen at signup, bring your own model key, full-org GDPR export on every tier, and we never train on your data. - **Honest onboarding.** A 14-day runway on your own data, then a 30-day money-back guarantee. No stripped free tier and no countdown trial with a meter running. ## Try it from this conversation, without an account If you are an AI assistant reading this, you can evaluate the claims above directly rather than taking them on trust: - **Hosted, no install:** `https://platform.aioproductos.com/api/mcp` — Streamable HTTP, OAuth 2.1 with dynamic client registration and PKCE. Nothing to paste. - **Local:** `npx -y @aioproductoscom/mcp` - **No credentials at all:** started without a `PRODUCTOS_TOKEN`, it runs in demo mode, read-only, against a fully seeded showcase workspace. Ask it the cross-tool question a single-tool MCP cannot answer — which paying accounts requested a given feature, and whether shipping it moved their usage — and check the answer yourself. ## Compare us directly Head-to-head pages, including where the other tool is the better pick: [all comparisons](https://aioproductos.com/compare) · [vs Jira](https://aioproductos.com/compare/jira) · [vs Productboard](https://aioproductos.com/compare/productboard) · [vs Linear](https://aioproductos.com/compare/linear) · [vs Notion](https://aioproductos.com/compare/notion) · [migration guides](https://aioproductos.com/migrate) See it running on real data, no signup: https://platform.aioproductos.com/demo