Data Processing Addendum

• "Data Protection Laws" means the laws on the processing of personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA").
• "Customer Personal Data" means personal data in the content that Customer and its users put into or generate in Customer's workspaces (scripts, prompts, uploads, generations, comments, Agent conversations and similar), which we process on Customer's behalf.
• "Sub-processor" means a third party we engage that processes Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

"Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR; under the CCPA, "business" and "service provider" apply in their place.

For Customer Personal Data, Customer is the controller (or a processor acting for its own customers) and we are the processor (or sub-processor).

For account, billing, security and website data about Customer's users, we are a controller, and our Privacy Policy applies instead of this DPA.

Customer is responsible for having a lawful basis for the Customer Personal Data it puts into the Service and for the instructions it gives us. The Service is not designed for special categories of personal data or for protected health information, and Customer should not put such data into it.

The details of the processing are:

• Subject matter and purpose: providing the Service as described in the Terms, including storing content, running the generations and Agent tasks users request, real-time collaboration, review links, support and security.
• Duration: for as long as we provide the Service to Customer, and afterwards until deletion under section 11.
• Categories of data subjects: Customer's users and collaborators, and any people who appear in or are described in Customer's content.
• Categories of personal data: whatever Customer chooses to put into its content, which may include names, likenesses, voices and descriptions of people, and comments and messages written by users.

We process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's use and configuration of the Service (for example, which model a user runs and with which references) are Customer's complete instructions. If we believe an instruction breaks Data Protection Laws, we will tell Customer, unless the law forbids it.

We do not use Customer Personal Data to train AI models, do not sell it, and do not use it for any purpose other than providing the Service, unless the law requires it, in which case we will tell Customer first where the law allows.

We ensure that the people we authorize to process Customer Personal Data are bound by confidentiality obligations, and that only staff who need access to provide, support or secure the Service have it.

We maintain technical and organizational measures appropriate to the risk, including encryption in transit with TLS, encryption at rest by our storage provider, role-based access to workspaces and projects checked on the server for every request, restricted and audited operator access, and monitoring and alerting of our systems. Our Trust Center describes the current measures. We may update them as long as the overall level of protection does not decrease.

Customer gives us general authorization to engage Sub-processors. The current list, with each one's purpose and location, is published at our Trust Center. AI model vendors on that list receive a prompt and its references only when a user (or the Agent on a user's instruction) runs one of their models.

We will update the list before a new Sub-processor starts processing Customer Personal Data, and will notify Customers who ask to be notified, by email, at least 30 days in advance, except where a change is needed urgently to keep the Service running or secure, in which case we will notify as soon as we can.

Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. We will then work with Customer in good faith to find an alternative, such as not using the affected feature or model. If we cannot, Customer may terminate the affected part of the Service, and we will refund any prepaid fees for it that are unused, to the extent the Terms allow.

We impose data protection obligations on each Sub-processor that are no less protective than this DPA, to the extent applicable to the service it provides, and we remain responsible to Customer for its performance. Some AI model vendors offer only their standard API terms; for those, our obligation is to choose vendors whose terms limit the use of API data, including for training.

We and our Sub-processors may process Customer Personal Data outside the country where Customer is located, mainly in the United States, as the Sub-processor list shows. Workspace files can be kept in an EU-jurisdiction storage location where agreed; that location covers files, not all Customer Personal Data.

Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs"; Module Two, controller to processor, or Module Three, processor to processor, as applicable) are incorporated into this DPA by reference, with Customer as data exporter and us as data importer. For the EU SCCs: the optional docking clause in Clause 7 applies; under Clause 9, the general authorization in section 7 of this DPA applies; the competent supervisory authority under Clause 13 is the one competent for Customer as data exporter; the law governing the Clauses under Clause 17 is the law of Ireland, and the courts chosen under Clause 18 are the courts of Ireland; and Annexes I to III are completed by sections 3, 6 and 7 of this DPA.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, governed by the law of England and Wales with disputes heard by the courts of England and Wales. For transfers subject to Swiss law, the EU SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as competent authority.

Taking into account the nature of the processing, we will help Customer respond to requests from data subjects exercising their rights, mainly through the Service's own features (deleting content, removing members, deleting projects). If we receive such a request directly for Customer Personal Data, we will refer the person to Customer and not respond ourselves, unless the law requires it.

We will give Customer reasonable information it needs for data protection impact assessments and prior consultations with supervisory authorities, to the extent that information is not otherwise available to it.

We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as we know at the time, the nature of the incident, the data and data subjects concerned, the likely consequences, and the measures taken or proposed; we will add information as it becomes available. We send notices to the workspace's owners and, if Customer gives us one, a designated security contact. Report suspected incidents to [email protected].

Notifying or responding to a Security Incident is not an admission of fault or liability.

Before the Service ends, Customer can download its files through the Service; on request we will help Customer retrieve other Customer Personal Data in a commonly used format.

When Customer deletes a project or workspace, or the Service ends, we delete the Customer Personal Data in it under our retention policy: it leaves the Service at once, is kept for 30 days in case Customer asks us to restore it, and is then permanently deleted from our active systems. Copies in backups expire on their normal schedule, typically within a further 30 days. We may keep data the law requires us to keep, protected under this DPA, for as long as that law requires.

We will make available the information reasonably necessary to demonstrate compliance with this DPA. Customer agrees to exercise its audit rights by asking us, no more than once a year, to answer a reasonable written security questionnaire, and by reviewing the summaries of any third-party audit reports we hold, which we share under confidentiality. We do not currently hold a SOC 2 report or an ISO 27001 certificate.

If a supervisory authority requires more, or after a Security Incident affecting Customer Personal Data, the parties will agree in good faith on the scope, timing and cost of any further audit. Any audit must not give access to other customers' data.

Where the CCPA applies, we are Customer's service provider. We will not sell or share Customer Personal Data, retain, use or disclose it outside our direct business relationship with Customer or for any purpose other than providing the Service, or combine it with personal data we receive from others except as the CCPA permits. We will tell Customer if we can no longer meet our obligations under the CCPA.

This DPA lasts as long as we process Customer Personal Data for Customer. If it conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if it conflicts with the EU SCCs or the UK Addendum, those prevail. Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent Data Protection Laws allow.

Like the Terms, this DPA is governed by the laws of the State of Wyoming, United States, and disputes under it are heard by the state and federal courts located in Wyoming, except where the EU SCCs or the UK Addendum set their own governing law and courts as described in section 8.

We may update this DPA to reflect changes in Data Protection Laws or in the Service, as long as the update does not materially reduce the protection of Customer Personal Data. We will post updates here and change the date above.

Questions about this DPA: [email protected]. Signed copies: [email protected]. Security incidents: [email protected].