1. Scope and roles
In short: For tests our team runs for you, you are the controller and we are your processor.
These terms apply when you order a test of an A2A agent on /early-testing or of an MCP server on /early-testing/mcp, and our team runs it. For the personal data described in section 3, you are the controller and Suncly OÜ ("Suncly", "we") is your processor. They form part of the Terms of Service (section 8). They do not cover the command-line tool you run yourself, which sends Suncly nothing, or the order, contact and payment data Suncly handles as a controller, which the Privacy Policy covers.
2. Subject, duration, nature and purpose
In short: We store what you give us, run the test, and write and send the report, for as long as the order needs.
The subject of the processing is the personal data, if any, contained in what you give us for an order and in what the test produces. It lasts from your order until the data is deleted under section 10. Its nature is storing that data, running the test against the sandbox endpoint you name, recording the transcripts, writing the report and sending it to you. Its only purpose is delivering the order.
3. Types of data and data subjects
In short: Whatever personal data is in your card or tools list, your brief, the transcripts and the test credential.
The personal data is whatever appears in the Agent Card or the tools list, the brief and, for an MCP server, the scope you give us; in the transcripts of the answers your agent or server returns; and in the test credential you send us through a one-time 1Password or Bitwarden Send link, which we set for one run only. The data subjects are the people that data concerns. You decide what you give us, and you can keep personal data out of a sandbox.
4. Documented instructions
In short: We do what your order and brief say, and nothing else.
We process the data only on your documented instructions: the order and its brief, including the skills or tools you mark Skip and what you say must not be touched. If Union or Member State law requires other processing, we tell you before it happens, unless that law forbids telling you. If we think an instruction infringes the GDPR or other data protection law, we tell you at once.
5. Confidentiality
In short: Everyone who handles the data is bound to keep it confidential.
Everyone who processes the data for Suncly is bound to keep it confidential, by contract or by a statutory duty.
6. Security
In short: The measures on our security page.
We take the measures Article 32 of the GDPR requires. The measures for running a test are described on /security: the agent credential is read only by an isolated Runner process; the model key, where the optional model judge is used, only by a separate judge subprocess that calls one endpoint; credentials are redacted from every transcript, and a transcript is withheld if redaction fails; and the evidence the tool writes is append-only.
7. Sub-processors
In short: These providers handle order data for us. We tell you before we change them, and you may object.
You authorise Suncly to use these sub-processors for the data in section 3:
| Sub-processor | What it does for us |
|---|---|
| Amazon Web Services (AWS), Frankfurt region | The concierge order system: quotes, orders and invites (Amazon DynamoDB), Agent Card and tools-list snapshots and report files (Amazon S3), and order e-mail (Amazon SES). |
| Anthropic | The cloud environment in which our team runs concierge evaluations, and the model behind the optional model judge when such a run uses it. |
| Google Workspace | Our mailbox, where pilot requests, new-order notices and correspondence arrive. |
We tell you by e-mail, at the address on your order, before we add or replace a sub-processor, and you may object to the change. We bind each sub-processor by contract to the same data protection obligations as these terms, and we remain responsible to you for it. Transfers outside the European Economic Area follow section 5 of the Privacy Policy.
8. Assistance
In short: We help you answer people who use their rights, and with your security and breach duties.
Taking into account the nature of the processing and the information available to us, we help you answer requests from data subjects who exercise their rights, and help you meet your obligations under Articles 32 to 36 of the GDPR: security, breach notification, data protection impact assessments and prior consultation.
9. Personal data breaches
In short: We tell you without undue delay.
If we become aware of a personal data breach affecting the data, we tell you without undue delay, with the information we have.
10. Deletion at the end
In short: The data is deleted on the schedule in the Privacy Policy, or returned if you ask first.
When the order is delivered, the data is deleted on the schedule in section 6 of the Privacy Policy, unless you ask us before then to return it, and unless Union or Member State law requires us to keep it:
- the test credential: removed right after the run;
- Agent Card and tools-list snapshots, and report PDFs: deleted after 365 days;
- transcripts and evidence kept by our team: as long as needed to deliver the order and answer questions about it;
- the order record, including the brief and the MCP scope: seven years from the end of the financial year (Accounting Act), then deleted.
11. Information and audits
In short: We show you how we comply, and we allow and contribute to audits.
We make available to you all information needed to show that we meet these terms and Article 28 of the GDPR, and we allow for and contribute to audits, including inspections, by you or an auditor you mandate.
12. Contact
In short: One address.
Write to us about these terms at privacy@suncly.com.