Data Processing Agreement

1. Scope and Parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between LiquidCortex Inc., a corporation incorporated in Ontario, Canada ("LiquidCortex", "Processor"), and the customer that accepted those Terms ("Customer", "Controller"). It applies whenever LiquidCortex processes Personal Data on the Customer's behalf in the course of providing the Service.

For Personal Data subject to the GDPR or UK GDPR, the Customer is the controller and LiquidCortex is the processor. For Personal Data subject to PIPEDA, LiquidCortex acts as a service provider processing on the Customer's behalf. Where the Customer is itself a processor for a third party, the Customer warrants that its instructions to LiquidCortex are authorized by that third party.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that LiquidCortex processes on the Customer's behalf.
• "Customer Content" means the data, documents, messages and connected-tool records the Customer or its users submit to the Service, including any Personal Data they contain.
• "Subprocessor" means a third party engaged by LiquidCortex to process Personal Data in delivering the Service.
• "Data Protection Laws" means the GDPR, the UK GDPR and Data Protection Act 2018, PIPEDA and applicable Canadian provincial privacy statutes, the CCPA/CPRA, and any other law governing the processing of Personal Data that applies to a party.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Service" has the meaning given in the Terms of Service.

3. Details of Processing

• Subject matter: provision of the LiquidCortex Service, in which AI employees perform tasks on Customer Content.
• Duration: the term of the Customer's subscription plus the deletion period in Section 12.
• Nature and purpose: storing Customer Content, retrieving it into task context, sending task content to model providers for inference, executing approved actions in tools the Customer connects, and producing outputs for the Customer's review.
• Categories of data subjects: the Customer's employees and users; the Customer's customers, prospects and contacts; and any other individuals whose data appears in Customer Content.
• Types of Personal Data: names, business contact details, communication content, CRM and support records, account identifiers, and any other Personal Data the Customer chooses to include. The Service is not designed for special-category data or payment card data; the Customer agrees not to submit them.

4. Processing on Instructions

LiquidCortex will process Personal Data only on the Customer's documented instructions, which are: the Terms of Service, this DPA, the Customer's configuration of the Service (including which tools it connects, which employees it enables and which actions it approves), and any further written instructions the parties agree. LiquidCortex will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

As a matter of policy LiquidCortex does not use Customer Content to train machine-learning models, and it contractually requires the same of its model-provider Subprocessors to the extent their terms allow. LiquidCortex may process Personal Data where required by law, in which case it will inform the Customer before processing unless the law prohibits that.

5. Confidentiality

LiquidCortex will ensure that every person it authorizes to process Personal Data is bound by a duty of confidentiality. Access to production data is limited to personnel who need it to operate or support the Service and is logged.

6. Security Measures

LiquidCortex implements the technical and organizational measures described in the Annex and on the Trust page. In summary: TLS for data in transit; per-user envelope encryption of stored credentials and API keys (Fernet, AES-128); tenant isolation enforced at the database layer with row-level security; role-based access control; rate limiting and breached-password screening on sign-in; action logging; and an internal red-team test suite that runs on every code change.

The Customer acknowledges the current limits stated on the Trust page: no SOC 2 report is held, multi-factor authentication and single sign-on are not yet available, and no third-party penetration test has been performed. LiquidCortex will update the Trust page as these change and will not reduce the overall level of protection during the term.

7. Subprocessors

The Customer gives general authorization for LiquidCortex to engage the Subprocessors listed in the Annex. LiquidCortex will impose data-protection obligations on each Subprocessor that are no less protective than this DPA and remains liable for their performance.

LiquidCortex will give the Customer at least 30 days' written notice (by email to the account owner and by updating the Annex) before adding or replacing a Subprocessor. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the remaining term.

8. Data Subject Requests

Taking into account the nature of the processing, LiquidCortex will assist the Customer with requests from data subjects to exercise their rights (access, correction, erasure, restriction, portability, objection). The Service provides self-serve export and deletion; for requests that cannot be completed through the Service, LiquidCortex will act on the Customer's written instruction within 10 business days. If a data subject contacts LiquidCortex directly, LiquidCortex will forward the request to the Customer without responding on the merits, unless the law requires otherwise.

9. Personal Data Breach

LiquidCortex will notify the Customer by email to the account owner without undue delay, and in any case within 72 hours of confirming a Personal Data Breach affecting the Customer's Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases as it becomes available.

LiquidCortex will cooperate with the Customer's own notification obligations and will not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer asks it to or the law requires it.

10. Assistance and Audits

LiquidCortex will provide reasonable assistance with the Customer's data-protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to the Service and the information is available to LiquidCortex.

LiquidCortex will make available the information necessary to demonstrate compliance with this DPA. In practice this means: written answers to the Customer's reasonable security questionnaire once in any 12-month period; copies of third-party audit reports or certifications when LiquidCortex obtains them; and the current Trust page. On-site or remote audits by the Customer or its auditor are available only where a supervisory authority requires one or a Personal Data Breach has affected the Customer, on 30 days' notice, during business hours, at the Customer's cost, and subject to confidentiality.

11. International Transfers

LiquidCortex is established in Canada and hosts the Service with Subprocessors in the United States, as listed in the Annex. Personal Data is therefore stored and processed in the United States and may be accessed from Canada. EU data residency is not yet available.

Where the Customer transfers Personal Data from the EEA, the United Kingdom or Switzerland to LiquidCortex, the parties agree that the European Commission's Standard Contractual Clauses (Module Two, controller to processor), the UK International Data Transfer Addendum and the Swiss supplements as applicable are incorporated into this DPA by reference, with the Customer as data exporter and LiquidCortex as data importer, and with the Annex serving as the description of the transfer and the security measures. Onward transfers to Subprocessors are covered by the obligations in Section 7.

12. Return and Deletion

The Customer may export or delete Customer Content through the Service at any time. On termination or expiry of the subscription, LiquidCortex will delete Customer Content and the Personal Data it contains within 30 days, except that usage logs are retained for up to 90 days for operational purposes and billing records for 7 years as required by law, each as described in the Privacy Policy. On written request LiquidCortex will confirm deletion. Model-provider Subprocessors retain task content only for the period set in their API terms.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, and the aggregate liability of the parties under the Terms and this DPA together will not exceed the cap set out in the Terms. Nothing in this DPA limits a party's liability to data subjects or supervisory authorities where Data Protection Laws do not permit that limitation.

14. Term and Precedence

This DPA takes effect when the Customer accepts the Terms of Service, or on the date of a separately signed copy if later, and continues until LiquidCortex has deleted the Customer's Personal Data under Section 12. If this DPA conflicts with the Terms of Service on the processing of Personal Data, this DPA prevails. If the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

15. Governing Law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and the courts of Toronto, Ontario have jurisdiction, in each case consistent with the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses require otherwise.

Annex — Subprocessors and Measures

A. Subprocessors (as of September 15, 2026)

B. Technical and organizational measures

• Transport: TLS for all connections; HSTS enforced on the site.
• Credentials at rest: per-user envelope encryption of stored credentials and API keys (Fernet, AES-128). Task data at rest relies on the hosting provider's storage encryption.
• Tenant isolation: row-level security policies enforced in Postgres for every tenant-scoped table; the application connects with a role that cannot bypass them.
• Access control: role-based access control; least-privilege access to production; action logging.
• Authentication: password sign-in with rate limiting and breached-password screening. MFA and SSO: not yet available.
• Human approval: consequential actions in connected tools wait for the Customer's approval before execution, per the Service's configuration.
• Testing: internal red-team and regression suites run in continuous integration on every change. No third-party penetration test yet.
• Backups: database backups managed by Supabase; restore procedure not yet independently tested.
• Incident response: 72-hour customer notification commitment (Section 9); vulnerability reports to [email protected] per security.txt.