Data Processing Agreement

Last updated: July 13, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Model Pipeline AI Inc. ("nocode.expert", "we", "us") and the client ("Client", "you") governing our automation, workflow, tracking, and AI-agent services (the "Services"). It applies where, in the course of providing the Services, we process Personal Data on your behalf, for example when we build or configure automations and tracking inside your accounts and handle data that flows through them.

This page is provided for transparency. Clients who require a countersigned DPA for their records may request one at hello@nocode.expert.

1. Definitions

"Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings given in applicable data protection law, including the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). "Subprocessor" means any third party engaged by us to process Personal Data.

2. Roles of the Parties

For Personal Data processed in connection with the Services, you act as the Controller and we act as the Processor. Where you are yourself a Processor acting on behalf of a third-party Controller, we act as a sub-processor. We process Personal Data only on your documented instructions, including as set out in this DPA and the applicable proposal or statement of work.

3. Scope and Purpose of Processing

We process Personal Data only to provide and support the Services: building, configuring, testing, and maintaining automations, workflows, tracking, and AI agents within your systems, and supporting you in their operation. The subject matter, duration, nature, and purpose of processing, the categories of Data Subjects, and the types of Personal Data are determined by the systems you engage us to build and are described in the applicable proposal.

4. Confidentiality

We ensure that anyone we authorise to process Personal Data is bound by appropriate confidentiality obligations and accesses Personal Data only on a need-to-know basis under least-privilege controls.

5. Security Measures

We implement appropriate technical and organisational measures to protect Personal Data, as described on our Security page. Because deliverables are built inside your own accounts, much of the underlying data remains in your infrastructure under your platforms' native controls; we apply least-privilege access, time-boxed credentials, multi-factor authentication, encrypted connections, and data minimisation to the access we are granted.

6. Subprocessors

You provide general authorisation for us to engage Subprocessors to process Personal Data in connection with our own operations. A current list of the Subprocessors that support this website and our contact and scheduling flows is maintained at nocode.expert/legal/subprocessors. Where the Services are delivered inside your accounts, the third-party platforms involved are engaged by you and under your own agreements with them. We impose data-protection obligations on our Subprocessors that are no less protective than those in this DPA and remain responsible for their performance, and we will provide a mechanism to notify you of changes to our Subprocessor list, to which you may raise reasonable objections.

7. Data Subject Requests

Taking into account the nature of the processing, we provide reasonable assistance to enable you to respond to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, and objection) under applicable law. Where a Data Subject contacts us directly about data we process on your behalf, we will, where lawful, refer the request to you.

8. Personal Data Breach

We notify you without undue delay after becoming aware of a Personal Data breach affecting your Personal Data, and provide information reasonably available to assist you in meeting your breach-notification obligations.

9. International Transfers

Where processing involves the transfer of Personal Data outside the European Economic Area, the United Kingdom, or Switzerland, such transfers are made under an appropriate transfer mechanism, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable.

10. Audit

We make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior request and subject to confidentiality, respond to your reasonable audit and questionnaire requests, including by providing relevant security documentation where available.

11. Return and Deletion

Because deliverables are built inside your own accounts, the operational data typically remains with you on termination. For any Personal Data we hold on your behalf on our own systems, we delete or return it on termination of the Services, save where retention is required by applicable law.

12. Liability and Precedence

This DPA is subject to the limitations and exclusions of liability set out in the main agreement between the parties. In the event of a conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails.

13. Contact

For questions about this DPA or to request a countersigned copy, contact hello@nocode.expert (Model Pipeline AI Inc., Delaware, United States).