Data Processing Addendum

1. Definitions

• "Data Protection Laws" means all laws applying to the Processing of Personal Data under this DPA, including, as applicable, the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other U.S. state privacy laws.
• "Personal Data" means information relating to an identified or identifiable natural person contained in Customer Content or otherwise Processed by Eternex on Customer's behalf under the Agreement.
• "Processing" (and "Process") means any operation performed on Personal Data.
• "Subprocessor" means a third party engaged by Eternex to Process Personal Data on Customer's behalf.
• "Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by Eternex.
• "SCCs" means the European Commission's Standard Contractual Clauses for controller-to-processor transfers (Decision (EU) 2021/914, Module Two), and, for UK transfers, the UK International Data Transfer Addendum.

2. Roles and Scope

2.1 Roles. For Personal Data in scope: Customer is the controller (or, where Customer acts for a Customer Client, a processor acting on that controller's instructions), and Eternex is the processor (or subprocessor). Each party will comply with its own obligations under Data Protection Laws.

2.2 Instructions. Eternex will Process Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA, and Customer's configuration and use of the Service, unless required to do otherwise by law (in which case Eternex will inform Customer unless legally prohibited). Eternex will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

2.3 Customer Responsibilities. Customer is responsible for the lawfulness of the Personal Data it submits, for providing required notices and obtaining required consents, and for its instructions. Customer must not submit special-category or sensitive Personal Data to the Service (Section 2.4(c) covers a User's Personal Notes); the Service is a software-delivery platform, not designed for such data.

2.4 Notes. The Service keeps short notes so that Customer's chats, agents and runs follow what Customer's Users have told it. (a) Project Notes. Notes for all of Customer's projects or for one project ("Project Notes") are what Customer's owners and admins state in a chat that will still matter later (facts about Customer's business or a project, or a rule such as "always", "never" or "from now on"), which the Service saves during that chat turn and shows in the chat with Undo; text they add themselves; or a suggestion from the Service that they approve. Eternex applies Project Notes only to that Customer's own chats and agents and to runs that Customer's Users start, never to runs requested by visitors or other third parties, and never writes a Project Note from run output or third-party content, including any file, web page, email, document or tool result the Service read. Project Notes are listed in the Service ("What Syndai knows"), where Customer's owners and admins can edit, move or delete them; a replaced note's earlier versions are kept only as its history and are deleted with it. Project Notes are tenant-scoped, never pooled across customers or used to improve the Service for other customers, and not used to train models (Section 4.2). They are deleted with their project or with Customer's workspace and on termination under Section 12 (see also Section 6). (b) Personal Notes. A User may also keep private notes of what that User states in a chat, including a chat in Customer's workspace ("Personal Notes"). Personal Notes are held in that User's own personal workspace, not in Customer's: Customer's owners and admins cannot see them, and they stay with the User when the User leaves Customer's workspace, when Customer's workspace is deleted, and on termination under Section 12. Because they stay with the User, Personal Notes are for facts about that User: the Service does not save a note it recognises as a fact of Customer's business or of a project (one stated for the team, such as what "we" or the company do) as a Personal Note, and keeps such a fact only as a Project Note. Customer remains responsible for instructing its Users not to add Customer's confidential information to Personal Notes they write themselves. The Service uses a User's Personal Notes only in that User's own private chats, only when the chat runs on Eternex's model access or on a credential of that User's own (never on another member's plan or on a model key Customer added), and never in agents' chats or runs, coding runs or anything shared with others. Personal Notes are deleted when the User deletes them or deletes their account, and are not used to train models (Section 4.2). (c) Both. The Service refuses to store secrets and keys, payment card numbers, and passport or ID numbers, and asks for booking and payment details each time instead of storing them. The Service does not, on its own, save a note it recognises as revealing anyone's health, religion or beliefs, sexual orientation or sex life, political opinions, trade-union membership, biometric data, or racial or ethnic origin: it shows the User "Not saved" in the chat instead, and saves such a note only when the User explicitly asks it to remember that about the User, and then only as the User's Personal Note; it never keeps such a note about anyone else. A fact of a business itself, such as what it sells, is not such data about a person. The Service does not keep such data as a Project Note, and Section 2.3 still applies to Project Notes. A Personal Note is the User's own: one about the User that reveals such data is kept on the User's explicit request, which is the User's explicit consent (GDPR Article 9(2)(a)), and the User can delete it at any time. Eternex keeps no other memory derived from runs or chats. Notes are stored on the database Subprocessor listed in Annex 3 and sent, as part of a request, only to the LLM Subprocessors that execute the work.

2.5 Prospect Data the Customer Asks Eternex to Find. When the Customer runs a growth scan or taps Find contact in the Grow tab, Eternex finds people and businesses that fit the Customer's market, and their public contact details, through the prospect-data Subprocessors in Annex 3. This is Processing on the Customer's documented instructions under Section 2.2; Eternex contacts these people only through Send, when the Customer turns it on and launches a campaign the Customer has checked, from mailboxes Eternex sets up for the Customer through the sending Subprocessors in Annex 3. The one exception to Eternex's role as processor: when someone opts out of, or complains about, an email sent through Send, Eternex keeps a one-way hash of their address on a shared list, as an independent controller, so no workspace emails them again. (a) Source. Every record stores the source it came from and the date (for example "Apollo, 14 Oct 2026"), so the Customer can answer an access request. (b) Retention. A found record the Customer never acts on is deleted after 90 days. A record the Customer has logged contact with is deleted 24 months after its last logged activity. The Customer may delete any record at any time. (c) Customer responsibility. As controller, the Customer decides whether and how to contact each person, and is responsible for the lawful basis for doing so and for informing each person where their data came from (GDPR Art. 14). The Service shows the Customer a reminder with a copyable sentence the first time the Customer logs contact with a found person.

2.6 Agents and Paid Lookups. Customer's owners and admins may set up agents that act on their written instruction, on a schedule or on events in Customer's project. Agents Process Customer's project data, connected accounts and tools, and public web content only to carry out that instruction, under the rules Customer sets in the Service. Agents never send Personal Data to a third party on their own: email leaves only from Customer's own mail client, a form on a third-party website is submitted only by Customer's User (Section 2.9), and an act through a tool Customer connected waits for a User's approval unless the tool only reads. A paid lookup sends its provider only the input it needs (search terms, company names or website addresses) through the paid-data Subprocessors in Annex 3. A lookup through another provider in Monid's catalog runs only after Customer's User approves a card naming that provider and showing the exact input; that approval is Customer's documented instruction under Section 2.2 to send that input to that provider. Agents do not look up natural persons' contact details, which remain under Section 2.5. An agent's chat, checks and approval requests are stored with Customer's project; they are deleted with it, and with the agent's creator's account.

2.7 AI Assistant, Drafts and Phone Line for Hosted Projects. Where Customer turns them on for a site or app Syndai hosts: (a) the AI assistant sends a visitor's question, the conversation so far and the project's public page text and help notes to an LLM Subprocessor to produce an answer, and discloses that it is an AI; on a Hosted Project whose privacy notice says so, once the visitor sends a message Eternex stores the conversation for Customer, linked to a random key in a `__Host-syndai_chat` cookie on the visitor's browser, for 90 days after its last message, so the visitor can return and read Customer's replies, and deletes it sooner when the visitor deletes it from the chat; Customer sees a conversation only when the visitor or the assistant passes it to Customer, and may then reply in it, and an LLM Subprocessor may translate the conversation and Customer's replies; on such a project Eternex also keeps each question, with email addresses, phone numbers and links removed, and whether it was answered, for up to 90 days, not linked to the visitor; on other projects Eternex does not store the questions (they stay in the visitor's browser tab until it closes); Eternex keeps the number and cost of answers, and an email address the visitor leaves in a stored conversation is kept with it, used only to email the visitor Customer's replies, never shown to Customer, and deleted with the conversation; (b) the phone line answers calls Customer forwards to a number Eternex provides in the United States or Canada, through Telnyx (Annex 3), whose AI assistant converts the caller's speech to text and answers from the same page text; callers hear that the assistant is an AI and that the call is transcribed; calls are not recorded and no transcript is kept, except the message the caller leaves, which is stored as a form entry, and the call's time and length, kept for billing; (c) when a request, question or paid order arrives, Eternex drafts a reply for Customer through an LLM Subprocessor, never sending the visitor's email address; and (d) after the project changes, Eternex may send open questions visitors left, without their email addresses, to an LLM Subprocessor to check whether the project now answers them, and, on a Hosted Project whose privacy notice says so, may send visitors' conversations and Customer's replies, without names or email addresses, to an LLM Subprocessor for the same check and to write the project's help notes, in which Customer's replies may appear without names. Customer must not remove or obscure the AI disclosure, and is responsible for its project's privacy notice describing these features; the Service adds that wording to the starter notice it generates before either feature goes live.

2.8 Watch Addresses. An agent may receive email from one sender domain Customer names, at a receive-only address Eternex creates on its own domain and receives through Cloudflare (Annex 3). Eternex accepts only messages signed by that domain; stores the sender's domain, the subject and the message text, never attachments; deletes the subject and text 30 days after arrival; and never sends, replies or forwards from the address. Customer is the controller of the Personal Data in that mail and uses the address only for mail it is entitled to receive.

2.9 Fill for Me. When Customer's User chooses Fill for me on a third-party website the User approved, Eternex opens a browser session there through Cloudflare (Annex 3), with no stored cookies and no recording. The User signs in; a program, without an AI model, enters only the values the User approved; the User submits. Eternex keeps one screenshot of the completed form with the approval request, and keeps no credentials, cookies or session.

2.10 Syndai Signals for Apps Hosted Elsewhere. Where Customer approves a change that adds Syndai Signals to an app built from a repository Customer connects and hosted outside the Service (an "External App"), Eternex receives through Cloudflare (Annex 3): (i) from a script on the External App's pages, page views, taps on phone, email, map and outside links, and errors in the Visitor's browser; and (ii) where Customer enables it, error reports from the External App's server in the OpenTelemetry format. (a) Minimization. The script sets no cookie, stores nothing on the Visitor's device, assigns no identifier, and reports no taps when the browser sends Global Privacy Control. Before anything is stored, Eternex discards every field that is not on a fixed list of keys and value shapes. For a page view it keeps the page address without query string or fragment, the country, the time and the referring website's host. For an error it keeps the error's name, its resolved in-app code locations, the route pattern, the release, and its message after removing email addresses, URLs, numbers of six or more digits, long hexadecimal or base64 runs and JWT-shaped tokens, capped at 200 characters. It never stores the raw stack trace, request headers or bodies, or the Visitor's IP address or user agent, which it uses only to derive the country, filter bots and limit abuse. (b) Limits. Errors are grouped by fingerprint (their resolved in-app code locations or, without them, their name and redacted message), and a repeat of a known group only increases its counts. Per External App and UTC day, at most 200 new groups are stored, and errors past that are only counted. (c) Use. Eternex uses this data only to show it to Customer's Users, to alert them when something breaks or drops, and to have the Service's agents investigate and propose fixes and changes to Customer, within the spending Customer has approved. Agents receive counts, error, event and span names, route patterns, durations, code locations and opaque identifiers, never error or log messages, which only Customer's owners and admins see. Data received under the External App's public site key is never used to roll back, promote or otherwise change Customer's app on its own. (d) Customer responsibility. As controller, Customer is responsible for its External App's privacy notice, which must describe this Processing (the Service shows suggested wording when Customer approves the change), and for deciding whether the law that applies to the External App requires Visitors' consent before the script runs, and obtaining it where it does. Eternex makes no representation that the script is exempt from any consent requirement. (e) App records. Where Customer's app sends them through the Service's helper library, an OpenTelemetry exporter or Cloudflare's runtime, Eternex also receives the app's events, its logs, and timing records of its requests and operations ("spans"), and, for each request to a site or app Syndai hosts, its route pattern, status and duration. Paragraph (a)'s fixed lists and redaction apply: attributes are kept only as short scalar values, and request bodies and headers are never kept. Events, errors, logs at warning level and above, and failed or slow spans are stored; other records are kept only as counts. Where Customer's app evaluates feature flags through the Service, Eternex records which variant each request received, keeping the identifier the app supplies only as a one-way hash. Where Customer connects them, Eternex receives totals per period from Customer's own database (such as sign-ups, active accounts and revenue), never records of individual people, and, for apps Syndai hosts, the last day each app member was active. Eternex checks that Customer's sites respond by requesting them, which processes no Visitor data. (f) Archive and sharing. So Customer can query its history, Eternex keeps an archive of the records in paragraph (e) and the totals derived from them; the copy the Service's agents query has no error or log messages. Where Customer's owners or admins create a share link, it shows a frozen copy of aggregate totals with customer identifiers replaced, until it expires or is revoked; Eternex logs each view's time and country, never the viewer's IP address. Section 2.10 also applies to the sites and apps Syndai hosts for Customer, except that their errors and records are captured server-side, through Cloudflare's runtime, with no cookie or device access, and only pages that already run scripts get an errors-only script.

3. Confidentiality; Personnel

Eternex will ensure that personnel authorized to Process Personal Data are bound by confidentiality obligations and Process it only as needed to provide the Service.

4. Security

4.1 Eternex will implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in Annex 2, taking into account the state of the art, costs, and the nature and risks of the Processing.

4.2 No Training. Consistent with the Agreement, Eternex will not use Personal Data in Customer Content or Output to train or improve AI models, and requires the same of its LLM Subprocessors.

5. Subprocessors

5.1 Authorization. Customer generally authorizes Eternex to engage the Subprocessors listed in Annex 3. Eternex will impose data-protection obligations on Subprocessors no less protective than this DPA and remains liable for their performance.

5.2 Updates and Objection. Eternex will maintain a current Subprocessor list (Annex 3, as updated by notice under this Section) and will give Customer at least 30 days' notice (email to Customer's Notice Address or in-product notice) before adding or replacing a Subprocessor. Customer may object in writing on reasonable data-protection grounds within that period; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected Order Form (or, under the Terms of Service, close its account) on notice with a prorated refund of prepaid, unused Fees as its exclusive remedy. Eternex will have a data-processing agreement with Unipile in place before any Customer mailbox is connected through it.

6. Data Subject Requests

Taking into account the nature of the Processing, Eternex will provide reasonable assistance (including appropriate technical and organizational measures) for Customer to respond to data-subject requests under Data Protection Laws (access, deletion, correction, portability, objection). This includes deletion of Project Notes (Section 2.4), which Customer's owners and admins can delete themselves at any time as a permanent hard deletion that also deletes the note's earlier versions; a User deletes their own Personal Notes the same way. If Eternex receives such a request directly, it will redirect the data subject to Customer and not respond substantively except as legally required.

7. Security Incidents

Eternex will notify Customer without undue delay and in any event within 72 hours after becoming aware of a Security Incident, providing information reasonably available about its nature, the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. Eternex will take reasonable steps to contain and remediate the incident. Eternex's notification is not an admission of fault.

8. Assistance

Eternex will provide reasonable assistance with Customer's data-protection impact assessments and consultations with supervisory authorities, to the extent required by Data Protection Laws and related to Eternex's Processing.

9. Audits (Reports-Based)

On written request no more than once per 12 months (or following a Security Incident), Eternex will make available information reasonably necessary to demonstrate compliance with this DPA, consisting of summaries of third-party audit reports, certifications, and security documentation and written responses to reasonable security questionnaires. If this information is insufficient to satisfy a requirement of Data Protection Laws, Customer may request an audit by an independent third-party auditor bound by confidentiality, at Customer's expense, during business hours, with reasonable notice, no more than once per 12 months, and without access to other customers' data.

10. International Transfers

10.1 To the extent Eternex Processes Personal Data subject to the EU/UK GDPR that is transferred to a country without an adequacy decision, the SCCs are incorporated by reference into this DPA, with Customer as data exporter and Eternex as data importer, and:

• Module Two (controller-to-processor) applies (Module Three where Customer is a processor);
• Clause 7 (docking) is included; Clause 9(a) Option 2 (general authorization) with the 30-day notice period in Section 5.2; Clause 11 optional language is not included;
• Clause 17: the SCCs are governed by the law of Ireland; Clause 18: the courts of Ireland;
• Annexes I, II, and III of the SCCs are populated by Annexes 1, 2, and 3 of this DPA (Annex I.A by Annex 1 Part A, Annex I.B by Annex 1 Part B, Annex I.C by Annex 1 Part C); Clause 13: the competent supervisory authority is identified in Annex 1 Part C;
• For UK transfers, the UK Addendum applies with the tables completed as set out in Annex 1 Part D; for Swiss transfers, the SCCs apply as adapted for the FADP.

10.2 If the SCCs or another transfer mechanism is invalidated, the parties will cooperate in good faith to implement a lawful replacement.

10.3 Transfer assessment. The parties have assessed that the transfer mechanism in this Section provides an essentially equivalent level of protection, taking into account the supplementary measures in Annex 2 (including encryption in transit and at rest and per-run sandbox isolation) and the warranties in Clauses 14 and 15 of the SCCs. Eternex will promptly notify Customer if it becomes unable to comply with the SCCs, including because of a change in applicable law or a binding government request for access to Personal Data, and where legally permitted will provide reasonable information about any such request; the parties will then proceed under Section 10.2.

11. CCPA / U.S. State Privacy Terms

To the extent Personal Data includes personal information governed by the CCPA or similar U.S. state laws, Eternex acts as a "service provider"/"processor": Eternex (a) will not sell or share the personal information; (b) will not retain, use, or disclose it for any purpose other than performing the Service under the Agreement or as permitted by the CCPA, including not outside the direct business relationship with Customer; (c) will not combine it with personal information from other sources except as permitted for service providers; (d) certifies that it understands and will comply with these restrictions; and (e) will notify Customer if it can no longer meet its obligations, in which case Customer may take reasonable steps to stop and remediate unauthorized use.

12. Deletion and Return

Upon termination or expiration of the Agreement, or earlier on Customer's written request, Eternex will delete Personal Data Processed on Customer's behalf (or return it, at Customer's option, in a commonly used format), and delete existing copies, within 60 days, except where retention is required by law, in which case Eternex will protect the retained data under this DPA and isolate it from further Processing. Sandbox environments are provisioned per run and destroyed on completion; workspace snapshots and encrypted archives of repository content are retained while the repository remains connected and are deleted per the retention schedule in Annex 1 and, on termination or disconnection, under this Section 12. Project Notes (Section 2.4) are hard-deleted when Customer deletes them or their project, and on termination under this Section 12. Personal Notes are held in each User's own personal workspace and are deleted as Section 2.4(b) provides.

13. Liability; Order of Precedence

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in the Agreement (including, under a Master Services Agreement, the Increased Cap Amount applicable to DPA breaches). This DPA controls over the Agreement as to Personal Data; the SCCs control over this DPA where they apply and conflict.

Annex 1, Part A: List of Parties (SCC Annex I.A)

• Data exporter: Customer, as identified on the applicable Order Form or, absent one, in Customer's Syndai account (name, address, contact person). Activities: use of the Syndai Service under the Agreement. Role: controller (or processor, where Customer acts for a Customer Client).
• Data importer: Eternex, Inc. (dba Syndai), 2261 Market Street STE 24499, San Francisco, CA 94114, USA. Contact person: Eternex Privacy Team, privacy@syndai.ai. Activities: provision of the Syndai Service as described in this DPA. Role: processor (or subprocessor). Signature/date: on the Order Form, or by Customer's acceptance of the Agreement.

Each party's contact name, position, address, and signature/date complete SCC Annex I.A from the Order Form or, absent one, from Customer's account details and its acceptance of the Agreement.

Annex 1, Part B: Description of Processing (SCC Annex I.B)

• Subject matter: Provision of the Syndai AI software-delivery Service under the Agreement
• Duration: The term of the Agreement plus the deletion period in Section 12
• Nature and purpose: Hosting, transmission, and automated analysis and transformation of Customer-connected repository and account content in isolated environments to perform the work the Customer directs across the functions of a one-person company: generating code changes and pull requests, and, using accounts the Customer connects and with each result sent to the Customer to approve before it publishes or sends, producing documentation, posts, media, and outreach drafts; for 30 days after a delivery, checking whether its commits landed on the connected repository's default branch outside the pull request (adoption check, by commit-fingerprint match); keeping the Project Notes Customer's owners and admins state or save and applying them to that Customer's chats, agents and the runs its Users start, and using each User's own Personal Notes in that User's private chats (Section 2.4); account management; billing; support; service analytics; hosting and serving the Customer's sites and apps on Syndai-hosted domains, storing what visitors submit to them (form entries such as signups, requests and orders, and feature requests), emailing the Customer's owners and admins a notice of each new form entry (and, when the Customer connects a Slack channel, posting the same notice to that channel: a delivery on the Customer's instruction to a recipient the Customer chose, so Slack is not an Eternex Subprocessor), drafting a reply to each request, question and paid order when it arrives (Section 2.7), and sending sign-in emails and the app's notification emails to app members (from apps@mail.syndai.ai through Resend, with one-click unsubscribe); where the Customer's app uses them, storing files and videos members upload (removing the metadata embedded in still images, such as location, and making smaller copies of them), passing what the app sends to its AI features to an AI model provider through OpenRouter to produce a response, and counting visits and link taps without cookies (for a visit: the page address, country, time, the network operator (an organisation's network, not the visitor) and the referring website's host, used to see how many visits a site gets and where they come from and, only when the Customer turns on "Spot companies that visit" for an app, which organisations visited, by matching the network operator to businesses already in the Customer's CRM (through IPinfo Lite data Eternex downloads; no personal data is sent to IPinfo); for a tap on a phone, email, map or outside link, unless the Customer turns tap counts off: the kind of link, the outside website's host, country and time; never the IP address or an identifier; a visitor's taps are never counted when their browser sends Global Privacy Control or after the visitor asks not to be counted, a choice kept in a strictly necessary cookie); and, for sites the Customer adds to the SEO tab, reading Google Search Console data through a Google identity created for the Customer's workspace, reading those sites' public pages, and, when the Customer asks, confirming the Customer's ownership of a site with Google; and, when the Customer runs a growth scan or taps Find contact, finding people and businesses that fit the Customer's market and their public contact details, and storing them with their source and the activity the Customer logs (Section 2.5); running the agents Customer's owners and admins set up and the paid lookups they make (Section 2.6); answering visitors' questions and forwarded calls for Customer's Hosted Projects, keeping visitors' conversations so Customer can reply where the project's privacy notice says so, and re-checking open questions after a change (Section 2.7); receiving mail at agents' watch addresses (Section 2.8); opening browser sessions for Fill for me (Section 2.9); recording errors in the Customer's hosted sites and apps, and page views, taps and errors from its External Apps (Section 2.10); and, for sales and memberships on Customer's apps, recording orders and membership status from Customer's own Stripe account, and metering each app member's AI use so Customer can limit it
• Categories of data subjects: Customer's Users (employees, contractors); individuals whose personal data is incidentally contained in repository content, commit history, or prompts, or is displayed on pages of the Customer's web application rendered during validation; recipients of outreach the Customer directs through the Service; visitors to sites and apps Syndai hosts for the Customer, including people who join a waitlist or send a request through them, and members who sign in to the Customer's apps; people and businesses the Customer asks Eternex to find as prospects (Section 2.5); visitors who ask a Hosted Project's AI assistant a question and callers to its phone line (Section 2.7); buyers on Customer's apps; senders of mail to agents' watch addresses (Section 2.8); people named in public posts or business listings an agent's lookup returns (Section 2.6); visitors to the Customer's External Apps (Section 2.10); Customer Client personnel where Agency Use applies
• Categories of Personal Data: Account and contact data (name, business email, authentication identifiers); billing data (purchases are sold by Polar, Eternex's merchant of record, which processes payment and tax data as an independent controller; Eternex does not store full card numbers); usage and device data (logs, telemetry, IP addresses); repository and prompt content, which may incidentally contain personal data (e.g., names and emails in commit metadata); screenshots and page-derived text of the Customer's web application rendered during validation (which can show signed-in pages), sent to an LLM Subprocessor for visual design review; all of the above is processed in isolated sandboxes, with workspace snapshots, encrypted archives, and run artifacts/evidence retained per the Retention row below; Project Notes and Personal Notes, short notes of what Users state in chats, which the Customer's chats, agents and runs follow (Section 2.4); for the Customer's hosted sites and apps: what visitors submit (email, name, phone, request details, and when a visitor ticked a box to get news), app member accounts (email, display name), content members save in the Customer's app, files and videos members upload (which can show people), text the app sends to its AI features, feature-request text, and IP addresses used for rate limiting and security; for sites in the SEO tab: search terms people used (which can contain personal data) and the Google account email the Customer enters to be listed as a site owner; for prospects (Section 2.5): name, job title, company, website, location and country, public profile URLs, the public post or event that surfaced them, work or personal email and phone when the Customer taps Find contact, the source and date, and the status, follow-up date and activity notes the Customer logs; for agents (Section 2.6): instructions, chats and approval requests, and paid-lookup inputs and results (business listings, public posts, company facts); for the AI assistant and phone line (Section 2.7): visitors' questions and their conversations with Customer (stored only where the project's privacy notice says so; see Retention), callers' speech (processed during the call, not recorded), the caller's phone number (processed by Telnyx), and the message a caller leaves with the name and callback number they give; for watch addresses (Section 2.8): the sender's domain and the mail's subject and text; for Fill for me (Section 2.9): the values the User approved and one screenshot of the completed form; for sales on Customer's apps: the buyer's email, what they bought, the amount, and the order and membership status (card details are processed by Stripe for Customer under Stripe's own terms, not as Eternex's Subprocessor), and each app member's AI use; for Syndai Signals (Section 2.10): page address, country, time and referring host of a page view, taps as for hosted sites, and for an error its name, code locations, route pattern, release and redacted message (which can still contain personal data a visitor typed)
• Special categories: None intended; Customer must not submit special-category data (Section 2.3), and the Service saves a note revealing it only when a User explicitly asks (Section 2.4(c))
• Frequency: Continuous during the term, per Customer-initiated runs
• Retention: Sandboxes are provisioned per run and destroyed on completion. Workspace snapshots and encrypted archives of repository content are retained while the repository remains connected (to make runs fast and recoverable) and are deleted per Eternex's documented retention schedule and, on termination of the Agreement or disconnection of the repository, per Section 12 (within 60 days). Project Notes (Section 2.4) are retained until Customer deletes them or their project, with a replaced note's earlier versions kept as its history until the note is deleted; they are never pooled across customers, and are deleted on termination per Section 12. Personal Notes are retained until the User deletes them or their account. Account/usage data retained for the term plus the Section 12 deletion window. Data visitors submit to the Customer's hosted sites and apps is kept as the Customer directs (form entries (signups, requests, orders), at most 24 months; uploaded files until the app or the Customer deletes them) and deleted when the Customer's project is deleted. Each recorded page view or tap is kept for three months; daily totals (counts per day, with no page, country or time of day, identifying no visitor) are kept with the site's project. Search Console data is kept for 16 months. Prospect data (Section 2.5): a found record the Customer never acts on, 90 days; a record with logged contact, 24 months after its last activity. Agents' chats, checks and approval requests (Section 2.6): with Customer's project, deleted with it or with the agent's creator's account. Visitors' conversations with the AI assistant: on a Hosted Project whose privacy notice says so, kept 90 days after the conversation's last message or until the visitor deletes it, and each redacted question kept up to 90 days, not linked to the visitor; otherwise not stored by Eternex; calls to the phone line: not recorded, no transcript, a caller's message kept as a form entry (Section 2.7). Watch-address mail (Section 2.8): subject and text deleted 30 days after arrival; the sender's domain and arrival time kept with the agent. Fill for me (Section 2.9): the session ends when the User finishes; the screenshot is kept with the approval request. Syndai Signals (Section 2.10): an error group is kept 90 days after it last occurs, with only its latest redacted message; daily error counts, 35 days; External Apps' page views and taps, as for hosted sites

Annex 1, Part C: Competent Supervisory Authority (SCC Annex I.C)

The competent supervisory authority (SCC Clause 13) is the supervisory authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the supervisory authority of the member state of its EU representative or in which the relevant data subjects are located, as identified on the Order Form or, absent one, as determined under SCC Clause 13.

Annex 1, Part D: UK International Data Transfer Addendum Tables

For transfers subject to the UK GDPR, the UK Addendum applies with its tables completed as follows:

• Table 1 (Parties): Exporter: Customer, per the Order Form (details as in Part A). Importer: Eternex, Inc. (dba Syndai), 2261 Market Street STE 24499, San Francisco, CA 94114, USA; privacy@syndai.ai. Start date: the DPA effective date. Key contacts: per the Order Form (exporter) and privacy@syndai.ai (importer).
• Table 2 (Selected SCCs, Modules and Selected Clauses): The EU SCCs (Decision (EU) 2021/914), Module Two (controller-to-processor) (Module Three where Customer is a processor), as incorporated and completed in Section 10.1 of this DPA.
• Table 3 (Appendix Information): Annex 1A: Part A above. Annex 1B: Part B above. Annex II: Annex 2 of this DPA. Annex III: Annex 3 of this DPA.
• Table 4 (Ending this Addendum when the Approved Addendum Changes): The importer (Eternex) may end the UK Addendum as set out in its Section 19.

Annex 2: Technical and Organizational Security Measures

• Isolation: each run executes in a dedicated, ephemeral sandbox destroyed on completion; no cross-customer sandbox reuse.
• Encryption: TLS 1.2+ in transit; encryption at rest for stored account, usage, and artifact data.
• Access control: role-based access, least privilege, SSO/MFA for Eternex personnel; customer secrets stored in a managed secrets system, never in code.
• Credential handling: repository access via scoped, revocable tokens; Customer can revoke integration access at any time.
• Logging and monitoring: centralized logging, error and anomaly monitoring, audit trails for administrative access.
• Vulnerability management: dependency and vulnerability scanning, timely patching, and security review of changes.
• Personnel: confidentiality obligations, security awareness onboarding, offboarding access revocation.
• Resilience: managed-infrastructure backups and recovery procedures for account/metadata stores; workspace snapshots and encrypted archives of repository content are retained per Annex 1's retention schedule and encrypted at rest.
• Incident response: documented incident-response process supporting the 72-hour notice in Section 7.
• Vendor management: Subprocessors assessed for security posture and bound to written data-protection terms.

Annex 3: Subprocessors

The current list of Subprocessors is published at https://syndai.ai/legal/subprocessors and forms Annex 3 of this DPA, as updated by notice under Section 5.2.

Execution

This DPA takes effect automatically when Customer accepts the Agreement; no separate signature is required. Customers who need a countersigned copy can request one from legal@syndai.ai.