Data Processing Addendum

How this DPA applies

This Data Processing Addendum ("DPA") forms part of our Terms of Service (or any separately signed Master Services Agreement) and applies to every Foundable account, on every plan, from the moment the Terms are accepted. No signature is needed: the Standard Contractual Clauses and the UK and Swiss terms in Section 12 take effect with it.

1. Definitions

Unless otherwise defined here, capitalised terms have the meaning given in our Terms of Service or in the GDPR.

• "Customer" (also "you") means the entity that has agreed to the Terms of Service.
• "Foundable" (also "we," "us") means Autono Labs, Inc., a Delaware corporation, which operates the Foundable service. ("Foundable" is the product name; the contracting legal entity is Autono Labs, Inc.)
• "Customer Personal Data" means personal data within Customer Content that Foundable processes on Customer's behalf as part of providing the Service.
• "Data Protection Laws" means the EU GDPR, the UK GDPR, the Swiss FADP, the CCPA/CPRA, and any other applicable data-protection or privacy law.
• "SCCs" means the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner.
• "Subprocessor" means any third party engaged by Foundable to process Customer Personal Data, as listed at /subprocessors.

2. Roles and scope

For Customer Personal Data, Customer is the "controller" (or, if Customer is itself acting as a processor for an upstream controller, Customer is a "processor"), and Foundable is a "processor" (or "subprocessor," as applicable).

For account data and product telemetry that Foundable collects to operate, secure, and improve the Service (described in our Privacy Policy), including the agent traces Foundable keeps for quality monitoring, Foundable is a controller in its own right. That controller-side processing is out of scope for this DPA but is governed by our Privacy Policy. This does not change Foundable's processor role when the same Customer Content is otherwise processed to provide the Service on Customer's instructions.

3. Processing on documented instructions

Foundable processes Customer Personal Data only on Customer's documented instructions. The Terms of Service, the Service's feature configuration in Customer's business, and Customer's interactions with the Service constitute Customer's instructions.

If Foundable is required by law to process Customer Personal Data outside those instructions, we will (where legally permitted) inform Customer before processing.

4. Categories of data and data subjects

The categories of data subjects, personal data, and processing activities covered by this DPA are described in Annex I (below). The duration of processing is the term of the Terms of Service plus the retention period described in our Privacy Policy.

5. Confidentiality

Personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive role-appropriate security and privacy guidance.

6. Security measures

Foundable implements appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. The measures are described in Annex II (below) and on our Security page.

7. Subprocessors

Customer authorises Foundable to engage Subprocessors to process Customer Personal Data, subject to the terms of this Section 7. The current list of Subprocessors is at /subprocessors and is incorporated into this DPA.

Foundable will:

• Use written provider terms that include data-protection obligations required for the applicable processing;
• Remain liable to Customer for the acts and omissions of its Subprocessors;
• Post each new Subprocessor on /subprocessors, with the date, at least 15 days before it receives Customer Personal Data.

Customer may object to a new Subprocessor on reasonable data-protection grounds by emailing privacy@foundable.com within those 15 days. We will work with Customer in good faith to resolve the objection; if we cannot, Customer may close its account, and its data is erased as Section 13 describes.

8. Data subject rights

Taking into account the nature of the processing, Foundable will assist Customer (by appropriate technical and organisational measures, where possible) to fulfil Customer's obligations to respond to requests by data subjects exercising their rights under Data Protection Laws. Owners and admins can export a website backend's tables, and operators can delete their account through the product. Contact privacy@foundable.com for authenticated assistance with broader or downstream-provider requests.

If a data subject contacts Foundable directly with a rights request, we will (where lawful) forward it to Customer rather than respond ourselves.

9. Data breach notification

Foundable will notify Customer by email to the account owner's address without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Available information may be provided in phases. The notice will include, to the extent known at that time:

• The nature and scope of the breach;
• The categories and approximate number of data subjects and records affected;
• The likely consequences and the measures taken or proposed to address the breach.

We will provide material updates as the investigation progresses.

10. Data Protection Impact Assessments

Foundable will provide reasonable assistance to Customer in conducting Data Protection Impact Assessments and prior consultations with supervisory authorities, where required by Data Protection Laws and taking into account the information available to Foundable.

11. Audits

Foundable will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. On reasonable request and no more than once per 12-month period (unless required by a regulator or following a material security incident), Foundable will:

• Respond to a security questionnaire reasonable in scope and timing;
• Provide relevant security-assurance materials under NDA, where available;
• Permit a proportionate audit of Foundable-controlled records, systems, and personnel where the information above is insufficient, under confidentiality, with at least 30 days' notice, during business hours, without disrupting the Service, and at Customer's cost. Provider facilities are covered through the applicable provider's assurance materials.

12. International transfers

For a restricted transfer from the EEA, UK or Switzerland, the following apply and are deemed signed by both parties when this DPA takes effect:

• EEA transfers: the 2021 Standard Contractual Clauses, Module Two where Customer is a controller and Module Three where Customer is a processor. Clause 7 (docking) does not apply. Under Clause 9, Option 2 (general written authorization) applies, with the notice in Section 7. Clause 11's optional wording does not apply. Under Clause 13, the competent supervisory authority is that of the EU member state where Customer is established, or Ireland's if Customer is established outside the EU. Under Clauses 17 and 18, the law and courts of Ireland apply. The SCCs' Annexes I, II and III are Annexes I, II and III below.
• UK transfers: the UK Addendum to those clauses. Table 1 takes the parties' details from the Terms and Customer's account, Tables 2 and 3 take the selections above, and under Table 4 neither party may end it.
• Swiss transfers: the clauses above, with the Swiss FDPIC as the competent authority and references to the GDPR read as the Swiss FADP. Data subjects in Switzerland may bring claims where they habitually reside.

13. Return or deletion of data

Subscription termination does not itself delete an account. An operator can delete their account in the product (Settings) or by an authenticated request, and can ask for a copy of their data by request. Access is disabled immediately and the deletion is final: a deleted account cannot be restored. The account and every foundable it owns are then erased right away, and the copies our Subprocessors hold are deleted or requested for deletion as the erasure runs. Provider-held copies, financial records, legally retained records, and backups follow their applicable schedules.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits liability that cannot be limited under Data Protection Laws.

15. Order of precedence

In the event of any conflict, the order of precedence is: (1) the SCCs (where applicable); (2) this DPA; (3) the Terms of Service or any separately-signed master agreement.

Annex I: Description of processing

• Subject matter: provision of an AI-powered operations platform ("Foundable") that processes messages and connected-service data on Customer's instruction.
• Nature and purpose: hosting, transmitting, displaying, and analysing Customer Content; generating and retrieving AI output; building, previewing and publishing websites and running their backends; rendering videos; creating embeddings so earlier chats can be recalled; carrying out enabled research, email, texting, social and scheduled workflows; and calling third-party integrations Customer has connected.
• Categories of data subjects: Customer's authorised users (operators, admins), Customer's employees and contractors mentioned in Customer Content, third parties whose data Customer chooses to send through the Service.
• Categories of personal data: names, email addresses, phone or messaging identifiers, message and outreach content, files and media, generated website source and backend data, social-account data, connected-service identifiers, and any other personal data Customer chooses to include in Customer Content.
• Special category data: Foundable is designed for general business data and does not request special-category data. Customer must not include it in free-form Customer Content without a separate written agreement that expressly permits the processing.
• Frequency of transfer: continuous, as Customer uses the Service.
• Retention period: for the active account or foundable, followed by the erasure, provider-cleanup, and backup-rotation process described in our Privacy Policy.
• Subprocessors and recipients: see /subprocessors.
• Competent supervisory authority (SCC Clause 13): as set out in Section 12.

Annex II: Technical and organisational measures

Foundable maintains the technical and organisational measures described on our Security page, which include (at minimum):

• Encryption: HTTPS with TLS in transit and TLS to the database; encryption at rest in Aurora and Amazon S3; the credentials of connected services held by the providers that manage them.
• Access control: authenticated company routes recheck current ownership or membership on every request; row-level security in the database; the team console limited to allowlisted accounts or verified @foundable.com emails.
• Resilience: two database instances in production with 14-day automated backups and point-in-time recovery; project-specific backup and recovery controls for website backends; rolling deployments with readiness checks and rollback to an earlier release.
• Monitoring: error tracking via Sentry (with redaction of headers, request bodies, URL credentials, structured PII, and known secret fields); product analytics and session recordings via PostHog, of the screens viewed, websites and documents included, with typed field values masked and passwords, sign-in codes and fields for entering secret keys excluded; service logs in AWS CloudWatch.
• Personnel: personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive role-appropriate security and privacy guidance.
• Incident response: notice without undue delay under Section 9, with material investigation updates as more information becomes available.

Annex III: Subprocessors

The authorised Subprocessors processing Customer Personal Data on Foundable's behalf as of the date at the top of this page are:

The canonical, continuously-updated list lives at /subprocessors. Changes and objections follow Section 7.

Miscellaneous

Order of precedence. In the event of a conflict between this DPA and the Terms, this DPA controls for the subject matter it covers. Where the SCCs apply, they prevail over both for transfers within their scope.

Assignment. Neither party may assign this DPA without the other's prior written consent, except that either party may assign it to an affiliate or in connection with a merger, acquisition, or sale of substantially all of its assets, in each case on notice to the other party. Any attempted assignment in breach of this section is void.

Severability. If any provision of this DPA is held unenforceable, the remaining provisions remain in effect, and the parties will replace the unenforceable provision with one that achieves, as closely as legally permissible, the original intent.

No third-party beneficiaries. Except for data subjects' rights under the SCCs and GDPR (which the parties acknowledge), this DPA creates no rights in any third party.

Need a signed copy?

No signature is needed for this DPA to apply. If your organization still wants a signed copy for its records, email privacy@foundable.com and we'll sign this same text.