Data Processing Addendum
How Molecule Dev, Inc. processes personal data on your behalf.
Last updated: August 1, 2026
1. Introduction and scope
This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer") and Molecule Dev, Inc., a Delaware corporation ("Molecule"), and applies where Molecule processes personal data on your behalf in providing Molecule.dev — in particular, personal data of the users of applications you build, host, or deploy through the Service, and personal data contained in your projects. It reflects the requirements of applicable data-protection laws, including the EU and UK GDPR and US state privacy laws.
2. Roles of the parties
For personal data covered by this DPA, you are the controller (or, where you act for another controller, a processor) and Molecule is your processor (under US state laws, your service provider). For our own operational data — your account information and the service telemetry described in our Privacy Policy — Molecule is an independent controller, and that data is governed by the Privacy Policy rather than this DPA.
3. Details of processing
Subject matter and nature: hosting, storing, running, and backing up your projects and deployed applications, including their databases and uploaded files, and processing AI requests you initiate. Purpose: providing the Service as described in the Terms of Service. Duration: the term of your agreement, plus the deletion period below. Categories of data and data subjects: determined by you — typically account and usage data of your applications' end users and any personal data you include in your projects. You are responsible for what your applications collect.
4. Customer obligations
You are responsible for the lawfulness of the personal data you and your applications submit for processing: having a lawful basis, providing required notices to your users, honoring their rights, and not submitting special-category or regulated data (such as health or payment-card data) unless the parties have expressly agreed to it in writing. The Service is not intended for protected health information, and Molecule does not currently offer a HIPAA business associate agreement. Your use of the Service and its settings constitutes your documented processing instructions.
5. Processing and confidentiality
Molecule processes personal data covered by this DPA only on your documented instructions and only as needed to provide the Service, unless required otherwise by law (in which case we will inform you unless legally prohibited). Personnel with access to personal data are bound by confidentiality obligations, and internal access is limited to what is needed to operate, support, and secure the Service.
6. No AI training
Molecule does not use personal data covered by this DPA to train, fine-tune, or otherwise develop AI or machine-learning models, and does not permit the third-party AI providers that process your requests to use it for training their models.
7. Sub-processors
You authorize Molecule to engage sub-processors to provide the Service: the AI model providers used to fulfill your project's requests, our payment processor (Stripe), and cloud infrastructure providers for hosting, storage, and email delivery. Each AI model processes requests in the region shown in the model picker: some models use United States providers, while others — including the default DeepSeek models — default to their native China-operated provider (and some, such as the latest Kimi models, are offered only from China), which transfers that request's data to a provider in China. Where a model offers more than one region, the selection is surfaced in the model picker and controlled by the account holder. Each sub-processor is bound by data-protection obligations no less protective than this DPA. We will maintain a current list and provide at least fourteen (14) days' notice before adding a new sub-processor, during which you may object on reasonable data-protection grounds; if an objection cannot be resolved, you may terminate the affected services.
8. Security
Molecule implements appropriate technical and organizational measures, including: encryption of data in transit; isolation of each project's execution environment and database from other customers; network egress controls on project sandboxes; role-limited internal access; and logging and monitoring of the platform. We may improve these measures over time and will not materially reduce the overall level of protection during your term.
9. Personal data breaches
Molecule will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting personal data covered by this DPA. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed, and we will provide reasonable cooperation so you can meet your own notification obligations and remediate.
10. Data subject requests
Taking into account the nature of the processing, Molecule will assist you in responding to data-subject requests (access, deletion, correction, portability, restriction, objection). The Service's export and deletion controls are the primary mechanism; if a request reaches us directly, we will redirect the data subject to you where appropriate.
11. Audits and information
On written request, and no more than once per year unless required by a supervisory authority, Molecule will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable security questionnaires and summaries of relevant assessments.
12. International transfers
Personal data is processed in the United States and in other locations where our infrastructure providers operate. Where processing involves a transfer of EEA, UK, or Swiss personal data to a country without an adequacy decision, the parties rely on appropriate safeguards — including the European Commission's Standard Contractual Clauses (controller-to-processor and processor-to-processor modules, as applicable) and the UK addendum — which are incorporated by reference into this DPA.
13. Deletion and return
You can export and delete your projects and their data through the Service at any time. When your account is deleted or your agreement ends, Molecule deletes the personal data covered by this DPA within a reasonable period, except where retention is required by law; residual copies in backups are removed as backups expire on our standard cycle.
14. Liability and precedence
This DPA is subject to the limitations of liability in the Terms of Service. If this DPA conflicts with the Terms with respect to the processing of personal data, this DPA controls.
15. Contact
Privacy and data-protection inquiries can be sent to Molecule Dev, Inc. through the support options in the app or on our website.