Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Kingly Intelligence Systems LLC (“Processor”, “we”) and the customer that accepted the Agreement (“Customer”, “you”). It applies when we process Customer Personal Data on your behalf and Data Protection Laws apply to that processing. If you need a countersigned copy, email us. If this DPA conflicts with the Agreement on data protection, this DPA controls.

#1. Definitions

• “Data Protection Laws” means all laws on privacy and personal data that apply to the processing. These include the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and other U.S. state privacy laws.
• “Customer Personal Data” means personal data within Customer Content that we process on your behalf when we provide the Service.
• “Subprocessor” means a third party we engage that processes Customer Personal Data.
• “Security Incident” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• “SCCs” means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). “UK Addendum” means the UK International Data Transfer Addendum issued by the ICO.
• Controller, processor, data subject, processing, business, service provider and similar terms have the meanings given in the Data Protection Laws.

#2. Roles and instructions

2.1 For Customer Personal Data, you are the controller (or a processor acting for your own controller), and we are your processor. Under the CCPA, we are your service provider.

2.2 Instructions. We process Customer Personal Data only on your documented instructions. Those instructions are:

• the Agreement and this DPA;
• your configuration and use of the Service, including the AI providers, channels, plugins and agents you enable;
• any other written instruction we agree to.

We will tell you if we believe an instruction infringes Data Protection Laws.

2.3 Our own purposes. We act as an independent controller only for:

• account, billing, security and fraud-prevention data;
• Usage Data and Aggregated Data, as described in Section 7.4 of the Terms;
• legal compliance.

For those purposes, the Privacy Policy applies.

2.4 CCPA. We will not do any of the following with Customer Personal Data, except as the CCPA permits for a service provider:

• sell or share it;
• keep, use or disclose it for any purpose other than the business purposes in the Agreement, or outside our direct business relationship with you;
• combine it with personal data we get from other sources.

We will comply with the CCPA and tell you if we can no longer meet its obligations.

2.5 No training. We do not use Customer Personal Data to train AI models unless you opt in under Section 7.3 of the Terms.

#3. Details of processing

#4. Confidentiality and personnel

Anyone we authorize to process Customer Personal Data is bound by confidentiality. Access is limited to what is needed to provide, support and secure the Service.

#5. Security

We implement the technical and organizational measures in Annex 2. We may update them, but we will not materially reduce the overall level of protection.

#6. Subprocessors

6.1 Authorization. You give general authorization for us to use the Subprocessors on our Subprocessors page. We will put written terms in place with each Subprocessor that protect data at least as much as this DPA does. We remain responsible for their performance.

6.2 Changes. We will give at least 30 days’ notice before a new Subprocessor processes Customer Personal Data. We do this by updating the Subprocessors page and notifying you by email or in the Service. If you have reasonable data-protection grounds to object, tell us within that period. We will then work with you in good faith on an alternative. If we cannot find one, you may terminate the affected Service and receive a refund of prepaid fees for the unused period.

6.3 Providers you choose. Third-party services that you choose and connect act under their own terms, either directly with you or as your vendors. They are not our Subprocessors. Examples are AI model providers reached through your own keys or subscriptions, messaging channels, brokers and third-party plugins. We transmit data to them only on your instruction.

#7. International transfers

7.1 We are based in the United States, and our Subprocessors may process data in the United States and other countries.

7.2 EEA. Where Customer Personal Data is transferred from the EEA to a country without an adequacy decision, the SCCs are incorporated by reference as follows:

• Module Two (controller to processor) or Module Three (processor to processor) applies, as appropriate;
• Clause 7 (docking) applies;
• under Clause 9, option 2 (general authorization) applies, with the notice period in Section 6.2;
• the optional wording in Clause 11 does not apply;
• under Clauses 17 and 18, the law and courts of Ireland apply;
• Annex I is completed by Section 3 of this DPA, and Annex II by Annex 2.

Where a transfer qualifies for the EU-U.S. Data Privacy Framework, we may rely on it instead.

7.3 UK and Switzerland. For UK transfers, the UK Addendum applies, with Table 1 to 3 information taken from this DPA. In Table 4, either party may end it. For Swiss transfers, the SCCs apply with the FDPIC as the competent authority and references to the GDPR read as the FADP.

#8. Data subject requests and assistance

We will pass to you any request from a data subject about Customer Personal Data. We will not respond to it ourselves except on your instructions or as the law requires. Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures, to respond to requests and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation. We may charge reasonable fees for assistance that goes beyond the Service’s self-service tools.

#9. Security Incidents

We will notify you without undue delay, and within 72 hours, after we become aware of a Security Incident affecting Customer Personal Data. Where available, the notice will include:

• the nature of the incident;
• the categories and approximate number of records and data subjects affected;
• the likely consequences;
• the steps taken or proposed.

We will take reasonable steps to contain and fix it. Notifying you is not an admission of fault.

#10. Deletion and return

When the Service ends, you can export Customer Personal Data during the 30-day window in Terms, Section 14. After that, we will delete it from active systems within 30 days, and from backups on their normal cycle, normally within a further 35 days. We may keep data if the law requires us to, and it stays protected by this DPA for as long as we keep it. When you ask, we will confirm the deletion in writing.

#11. Audits

11.1 When you ask in writing, no more than once every 12 months, we will give you the information you reasonably need to show compliance with this DPA. That includes completed security questionnaires, and any third-party audit reports or certifications we or our Subprocessors hold.

11.2 If that information is not enough to meet a legal requirement, or a regulator requires it, you may carry out an audit, at your own cost:

• with 30 days’ notice;
• during business hours;
• in a way that does not unreasonably disrupt operations;
• under confidentiality;
• through an independent auditor who is not our competitor.

For audits of Subprocessors, their own audit reports satisfy this right.

#12. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitation of liability in the Agreement, to the extent Data Protection Laws allow. Where the SCCs apply, they control if they conflict with this DPA.

#Annex 1: Subprocessors

See the current list at /subprocessors.

#Annex 2: Security measures

• Isolation: each workspace runs on its own Fly.io Machine with its own encrypted volume. Database rows are scoped by tenant ID in every query.
• Encryption: TLS for data in transit. API keys you save (BYOK) are encrypted at rest with AES-256-GCM, using a key held outside the database, and each ciphertext is bound to your tenant and provider. Hosting providers encrypt storage at rest.
• Access control: sign-in through Clerk (with multi-factor options). Session tokens are verified on every request. Owner and admin access is restricted, and administrative actions are logged.
• Least privilege: narrow, purpose-specific service tokens. Production secrets are kept in provider secret stores, not in source code.
• Logging and monitoring: request and event logs (saas_events), health checks, idle detection, and fair-use and abuse monitoring.
• Resilience: managed Postgres (Neon) with provider backups, and machine restart and rollback procedures.
• Development: code review, automated tests, and staged releases with recorded rollback points.
• Incident response: a documented process for triage, containment and notification.
• Personnel: access only on a need-to-know basis, with confidentiality obligations.