Data Processing Agreement

Version 22 October 2026

This agreement applies when a business uses the Samlify app under the Pilot Terms. It sets out how Samlify processes personal data for the business, as article 28 of the GDPR requires.

1. Roles

1.1 The business that accepts the Pilot Terms (the “Customer”) is the controller. William Jannert, a sole trader, Smedgatan 10, 243 34 Höör, Sweden (“Samlify”) is the processor.

1.2 The Customer’s documented instructions are this agreement, the Pilot Terms and what the Customer’s users choose in the app (for example which sites to observe, what to build and what to approve).

1.3 Data that the app keeps on the Customer’s Mac is processed by software under the Customer’s control. Samlify has no access to it.

2. Samlify’s obligations

Samlify will:

• process the personal data only on the Customer’s documented instructions, unless the law requires otherwise, and tell the Customer if it believes an instruction breaks data protection law;
• ensure that everyone who processes the data for Samlify is bound to confidentiality;
• take the security measures in Annex 2;
• help the Customer, as far as it reasonably can, to answer requests from data subjects and to meet its obligations under articles 32 to 36 of the GDPR;
• tell the Customer without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach that concerns the Customer’s data, with the information it then has;
• when the agreement ends, delete the personal data it holds for the Customer, unless the law requires it to keep them;
• make available the information needed to show that it meets this agreement, and allow and contribute to audits. An audit is first done through written questions; an inspection on site is agreed in advance, at the Customer’s cost, and respects Samlify’s confidentiality.

3. Sub-processors

3.1 The Customer gives Samlify general permission to use sub-processors. The kinds in use today are in Annex 3. Samlify gives the Customer the names of its current sub-processors in writing when the pilot starts and whenever the Customer asks.

3.2 Samlify tells the Customer at least 30 days before it adds or replaces a sub-processor. The Customer may object on reasonable grounds and, if no solution is found, end the agreement.

3.3 Samlify binds every sub-processor to data protection obligations that match this agreement and remains responsible to the Customer for them.

4. Transfers outside the EU and the EEA

Personal data are transferred outside the EU and the EEA only to a country the EU considers adequate, or with the EU standard contractual clauses or another safeguard the GDPR allows.

5. The Customer’s obligations

The Customer is responsible for having a legal basis for the processing, for informing the data subjects, including employees whose work the app observes, and for not letting the app process special categories of personal data without Samlify’s written agreement.

6. Term, liability and law

This agreement applies for as long as Samlify processes personal data for the Customer. Liability, changes, law and disputes follow the Pilot Terms.

Annex 1. The processing

Purpose

To provide the Samlify app to the Customer: to notice tasks users repeat, suggest automations, build them when a user asks, and run them after the user approves.

Data subjects

The Customer’s users of the app, and people whose details appear in the work the users do, such as the Customer’s customers, suppliers and colleagues.

What Samlify processes

• When the app looks for repetition: what kind of actions a user took and when, and which well known apps were involved. No page addresses, field names or the values the user works with.
• When a user builds an automation: a description of the task without the user’s own names, and any note the user writes. The user sees exactly what is sent first.
• When a user chats with the app or asks it to adapt a document: what the user types, and the section the user chooses.

Samlify’s service passes this to an AI model provider to get an answer and does not store it.

What stays on the Customer’s Mac

What the app observes, the automations, chat messages, the values an approved automation reads and writes, and the connection to the Customer’s own services. Samlify has no access to it.

Duration

While the Customer uses the app. Samlify’s service does not keep the processed content after it has answered.

Annex 2. Security measures

• No screenshots or screen recording.
• Data that leaves the Mac is reduced to what each task needs, and the user sees what will be sent before an automation is built.
• Password, card number and one time code fields are not read.
• Data the app keeps on the Mac is stored encrypted, with the key in the macOS Keychain.
• The connection to Samlify’s service is encrypted, and each installation has its own revocable access key.
• Samlify’s service has limits per account and per day, and refuses requests when it cannot check them.
• The key to the AI model provider is held only on Samlify’s server, never on the Customer’s Mac.
• No automation runs without a user’s approval of the version shown.

Not in place, and not claimed: end to end encryption. Samlify’s service and the AI model provider can read what is sent to them. An export a user makes is readable.

Annex 3. Sub-processors