Data Processing Addendum

Last Updated: July 19, 2026

This DPA describes how Run Wild processes Customer Personal Data on behalf of Customers using the Service, including roles, sub-processors, international transfers, and security.

At a Glance

Processor Role — Run Wild acts as a data processor for customer-controlled personal data, processing it only on documented instructions.
Sub-processors — We engage a limited set of sub-processors (e.g. Anthropic, Vercel, Neon, Stripe, Telnyx) and maintain an up-to-date list customers can review; the current list is in our Privacy Policy.
Security & SCCs — Industry-standard technical and organizational measures, with EU Standard Contractual Clauses for international transfers where applicable.

1. Definitions and scope

This Data Processing Addendum ("DPA") forms part of the agreement between Run Wild and the Customer, governing the processing of Personal Data by Run Wild on the Customer's behalf in connection with the Run Wild Services.

Capitalized terms not defined here have the meanings given in the GDPR, the UK GDPR, the CCPA/CPRA, and other applicable data protection laws, as relevant to the Customer's use of the Service.

2. Roles of the parties

For Customer Personal Data processed in connection with the Service, Customer is the Controller (or, where applicable, Business) and Run Wild is the Processor (or Service Provider).

Run Wild processes Customer Personal Data solely on the documented instructions of the Customer, including with regard to international transfers, except as required by applicable law.

3. Sub-processors

The Customer authorizes Run Wild to engage Sub-processors to assist in providing the Service. Run Wild maintains a current list of Sub-processors and provides reasonable prior notice of any new Sub-processor, allowing the Customer to object on reasonable grounds.

Run Wild remains responsible for the acts and omissions of its Sub-processors and ensures each Sub-processor is bound by data protection obligations no less protective than this DPA.

4. International data transfers

Where Personal Data of EEA, UK, or Swiss data subjects is transferred outside the relevant jurisdiction, the parties rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable) incorporated by reference into this DPA.

Run Wild applies supplementary measures (encryption in transit and at rest, access controls, transfer impact assessments) consistent with EDPB guidance.

5. Security measures

Run Wild implements and maintains appropriate technical and organizational measures, including encryption, access controls, audit logging, vulnerability management, secure software development practices, and incident response procedures.

The Customer acknowledges that the Service's security configuration described in Run Wild's public documentation is appropriate, having regard to the nature, scope, context, and purposes of processing.

6. Personal data breaches

Run Wild notifies the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing the information reasonably necessary for the Customer to meet its own notification obligations under applicable law.

7. Data subject rights

Taking into account the nature of the processing, Run Wild assists the Customer by appropriate technical and organizational measures, so far as possible, in fulfilling its obligation to respond to data subject requests for access, rectification, erasure, portability, restriction, and objection.

8. Audit rights

Upon the Customer's reasonable written request, Run Wild makes available information reasonably necessary to demonstrate compliance with this DPA, such as descriptions of our security measures and sub-processor arrangements. We do not currently hold third-party audit certifications (such as SOC 2) and do not offer on-site audits.

9. Return and deletion

On termination or expiry of the Service, Run Wild deletes or returns Customer Personal Data in accordance with the Customer's instructions and applicable retention requirements, except where retention is required by law.

10. Contact

For DPA-related inquiries, contact support@runwild.ai. A signed DPA is available on request for customers in regulated jurisdictions.