Data Processing Addendum.

• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
• "Data Protection Laws" — GDPR (EU 2016/679), UK GDPR, CCPA / CPRA, and equivalent national or state laws as applicable.
• "Sub-processor" — any processor engaged by UnionEleven to assist in processing Personal Data on behalf of Customer.

Customer is the Controller of Personal Data; UnionEleven is the Processor. Both parties will comply with their respective obligations under applicable Data Protection Laws.

UnionEleven will process Personal Data only on documented instructions from Customer, including for the purposes set out in the Order Form. UnionEleven will inform Customer if instructions appear to violate Data Protection Laws.

Customer authorizes UnionEleven to engage the sub-processors listed below, which are also published at /security. UnionEleven will provide 30 days notice of new sub-processors. Customer may object on reasonable grounds; if unresolved, Customer may terminate the affected service.

• Microsoft Azure — hosting, database, file storage (United States).
• Anthropic — AI model inference.
• OpenAI — AI model inference.
• Google — sign-in; image and video generation where used.
• Mailgun — email delivery (United States).
• Ayrshare — social media publishing.
• Firecrawl — crawling public web pages Customer points the service at.
• Cloudflare — bot checks on public forms (Turnstile).
• Supabase — legacy user-account records, still used for some account management; being retired.

Data location: Customer Data is hosted in Microsoft Azure regions in the United States (East US and East US 2). Sub-processors such as AI model providers process the data sent to them in their own infrastructure.

• Encryption in transit (HTTPS / TLS), including connections to the database.
• Encryption at rest for the database and file storage, provided by Microsoft Azure.
• Customer Data separated by business with Postgres row-level security.
• Platform secrets held as Azure Container Apps secrets, not in source code.
• Automated database backups with point-in-time restore.
• Platform-admin access to a customer account recorded in an append-only audit log.

UnionEleven will assist Customer in responding to data subject requests (access, correction, deletion, portability) within 5 business days of receipt.

UnionEleven will notify Customer without undue delay, and in any event within 48 hours of becoming aware of a Personal Data breach affecting Customer's data.

Where Personal Data is transferred outside the EEA / UK, the parties rely on the EU Standard Contractual Clauses (Modules 2 and 3) and the UK International Data Transfer Addendum, incorporated by reference.

UnionEleven will make available to Customer information necessary to demonstrate compliance with this DPA. Customer may, no more than once per 12 months and on 30 days notice, conduct an audit (or commission an independent third-party auditor) at Customer's expense.

On termination of the underlying agreement, UnionEleven will, at Customer's choice, return or delete all Personal Data within 30 days, unless retention is required by law.

A countersigned copy of this DPA is available by request to legal@unioneleven.ai.