This addendum is part of the Terms when you use Any.win as a business. It describes V1 as it ships. It is not a SOC 2 report, HIPAA BAA, or SCCs pack. Email [email protected] if you need a countersigned PDF of this page.
1. Roles
You (the customer) are the controller of workspace content you submit: employee goals, instructions, memory, knowledge, run inputs, drafts, and outcomes you log. GEXC Labs, operating Any.win, is the processor of that content. We are the controller of account, billing, and security data, as described in the Privacy Policy.
2. Subject matter and duration
We process customer content only to operate AI employees you hired: plan runs, call models and skills you enabled, pause for approval, store run steps, and schedule jobs. Processing lasts while the account is open. After deletion we remove or anonymize personal data within 30 days, except billing and abuse records we must keep.
3. Types of data and people
Typical categories: account email and name; workspace and employee configuration; memory and knowledge you upload; run timelines and artifacts; encrypted credentials; usage and plan. Data subjects are your users and, if you put them in knowledge or run input, people you already have a relationship with (candidates, customers, leads). Do not upload special categories of data or children’s data. The service is for people 18 and older.
4. Instructions
Your instructions are what you do in the product and Builder API: hire, connect keys, run, approve, schedule, and delete. We will not use customer content to train our own models. We will not sell it. Model labs you bind process prompts under their terms. On Pro and Builder, our key can be used until that month's included model budget is spent, and that lab processes those prompts too.
5. Security
Measures we take in V1 are listed on Security: encryption of credentials at rest, redaction of secrets from persisted steps, approval before send, SSRF controls, skill allow-lists, and a full run audit. Report incidents to [email protected].
6. Subprocessors
You authorize the processors on the Subprocessors page, including identity (Google or Microsoft when you choose those buttons), hosting (Vercel and/or Azure), billing (Stripe), jobs (Inngest), and the model or tool vendors you enable. We will update that page when a production processor is added.
7. International transfers
Hosting and most subprocessors are in the United States. Where GDPR or UK GDPR requires a transfer tool, we rely on the subprocessors’ standard contractual clauses or equivalent. Using the service from the EEA or UK is your instruction to process in those regions.
8. Assistance, deletion, and audit
You can access, correct, and delete memory and knowledge in the app. For export, deletion of the account, or help with a data-subject request, email [email protected]. V1 does not offer on-site audits or customer pentests against the shared production environment. We will not test other customers’ workspaces; please do not either.
9. Liability and order of documents
Liability, indemnities, and governing law stay as in the Terms. If this addendum and the Terms conflict on processing of customer content, this addendum controls for that topic only.