DUDE.AI AGENTIC EXIT BUILDER · FOR HEADS OF GROWTH

DATA PROCESSING.

// SUB-PROCESSORS & DPA

NOTE TO COUNSEL: This page describes how DUDE.AI processes data on behalf of operators in the venture studio program (and, where applicable, their customers). A full Data Processing Agreement (DPA) should be signed alongside the term sheet for each engagement. This page is the public disclosure summary required under GDPR Art. 28.

Data controller

For data submitted to headofgrowth.net and the application gate, TechFunder World AG is the controller.

Data processor

For data processed inside the agents running on the operator's behalf during Build / Validate / Scale phases, TechFunder World AG operates as a processor under the operator's instructions.

Categories of data processed

Operator profile data (name, role, market, runway).
Application content (MVP description, hours-in-market, full-time intent).
Workspace / repository / Stripe-derived signals required for agent loops.
Agent outputs (content variants, copy A/Bs, evals, scoring).

Sub-processors

The following sub-processors may be engaged. [Final list to be confirmed by counsel.]

Hosting / infrastructure — [TBD]
AI model providers — [TBD — list per provider, region]
Vector / memory stores — Mem0, Graphiti, Chroma
Eval & tracing — Phoenix (Arize), Ragas, PromptFoo
Email delivery — [TBD]
Analytics — [TBD]
Payments — Stripe (operator-controlled), PayPal, PLAID

International transfers

Some sub-processors operate outside the EU/EEA. Where this is the case, transfers are governed by Standard Contractual Clauses (SCCs) under GDPR Art. 46, supplemented by transfer impact assessments where applicable.

Security measures

Technical and organizational measures include: encryption at rest and in transit, role-based access control, audit logging on the platform (immutable), token rotation (per-agent bearer tokens, hashed with HMAC-SHA256 + server pepper), frozen-on-first-use metric definitions enforced at the database level via PG triggers, automated rollback on eval-gate failure.

Operator instructions

The operator (acting as controller for their downstream customer data) provides written instructions in the engagement contract. The processor will not process data for any purpose other than to deliver the contracted service.

Data subject rights

For data we hold as controller (application data, contact data, marketing list), contact [email protected] to exercise GDPR rights. For data processed under an operator's instructions, contact the operator directly; we will support them in fulfilling rights requests.

Changes to sub-processors

Material changes to the sub-processor list will be communicated to active operators with at least 30 days' notice, where commercially reasonable.

Last updated: [DATE TO BE SET ON PUBLICATION]