Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Terms of Service (the "Terms") between Melaya Labs LLC ("Melaya") and the business customer that accepts the Terms ("Customer"). It sets out the terms that apply when Melaya processes personal data on Customer's behalf in providing the Melaya platform, including the Agentic Framework, the Assistant, connectors, Device Control, Browser Control, Computer Control, and related services (the "Services"). This DPA is incorporated into the Terms by reference and binds Customer and Melaya without a signature. Customer may request a copy countersigned by Melaya by writing to info@melaya.org.

1. Definitions and Interpretation

In this DPA, the following terms have the meanings below. Other capitalised terms have the meanings given in the Terms.

• "Data Protection Laws" means all laws on the protection of personal data that apply to the processing of Customer Personal Data under the Terms, including Regulation (EU) 2016/679 (the "GDPR"), the GDPR as it forms part of the law of the United Kingdom (the "UK GDPR") and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP"), each as amended or replaced.
• "Customer Personal Data" means personal data that Melaya processes on behalf of Customer in providing the Services, as described in Annex I, including personal data in User Content and personal data that Customer's agents, pipelines, and Assistant conversations read from or send to Connected Services.
• "Authorised User" means a person whom Customer permits to use the Services under Customer's account or projects.
• "Connected Service" means a third-party application, account, service, device, or model provider that Customer or its Authorised Users connect to or select for use with the Services, such as Odoo, HubSpot, Google Workspace, Microsoft Teams, Slack, an exchange account, or a language model provider.
• "Subprocessor" means a third party that Melaya engages to process Customer Personal Data on Melaya's behalf. A Connected Service is not a Subprocessor, except as stated in Section 3.5.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Melaya or its Subprocessors. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, or failed log-in attempts.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force from 21 March 2022.
• "Controller", "processor", "data subject", "personal data", "processing", and "supervisory authority" have the meanings given in the GDPR and include the equivalent terms in other Data Protection Laws.

2. Scope and Roles of the Parties

2.1 This DPA applies when Customer uses the Services for business or professional purposes and Melaya processes Customer Personal Data on Customer's behalf. It does not apply to an individual who uses the Services for purely personal or household purposes; the Privacy Policy governs that use.

2.2 For Customer Personal Data, Customer is the controller, or a processor acting on behalf of its own controller, and Melaya is the processor, or a subprocessor where Customer acts as a processor. Where Customer acts as a processor, Customer warrants that its controller has authorised Customer's instructions and the engagement of Melaya, and Customer remains Melaya's sole point of contact.

2.3 Melaya acts as an independent controller, and not under this DPA, for the personal data it processes for its own purposes: creating and administering accounts, authenticating Authorised Users, billing and payments, fraud and abuse prevention, the security and integrity of the Services, support and service communications, aggregated usage analytics, legal compliance, and the establishment or defence of legal claims. The Privacy Policy describes that processing.

2.4 This DPA applies for as long as Melaya processes Customer Personal Data, including after the Terms end, until Melaya has deleted Customer Personal Data under Section 11.

3. Processing on Customer's Instructions

3.1 Melaya will process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless the law to which Melaya is subject requires otherwise. In that case Melaya will inform Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

3.2 Customer's documented instructions consist of the Terms and this DPA; the configuration and use of the Services by Customer and its Authorised Users, including pipelines, agents, prompts, Assistant conversations, schedules, triggers, uploaded documents, retrieval indices, connectors, the selected model and provider, and the selected approval or autonomy mode; and any further written instructions that the parties agree. Customer is responsible for the instructions that its Authorised Users and configured automations give.

3.3 Melaya will inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the processing concerned until Customer confirms or changes the instruction. Melaya is not obliged to carry out a legal review of Customer's instructions.

3.4 When Customer connects a Connected Service, for example an Odoo database through the Melaya module for Odoo, a HubSpot account, a Google account, Microsoft Teams, or a Slack workspace, Melaya processes the data that Customer's agents, pipelines, and Assistant conversations read from or write to that service only to carry out the tasks Customer directs, and only within the access Customer grants to that connection, such as the OAuth scopes Customer approves or, for Odoo, the access rights of the Melaya Agent user. Customer decides which services, accounts, scopes, and records are connected, and can disconnect them at any time.

3.5 Data that Customer directs the Services to send to a Connected Service, including the prompts and context sent to a model provider that Customer selects, is disclosed on Customer's instructions, and the Connected Service processes it under its own terms with Customer. Melaya is not responsible for processing that a Connected Service performs under those terms. Where a provider processes Customer Personal Data under a contract with Melaya rather than with Customer, Melaya treats that provider as a Subprocessor under Section 6.

3.6 Melaya will not sell Customer Personal Data or use it for advertising. Except as set out in this Section 3.6, Melaya will not use Customer Personal Data to train or improve artificial intelligence models. Melaya may use Computer Control and desktop app interaction data, as described in the Privacy Policy, to train, evaluate, and improve its own models and features unless Customer objects by writing to info@melaya.org. After an objection, Melaya stops that use of Customer's data going forward.

3.7 Customer is responsible for having a lawful basis for the processing it instructs, for giving the notices and obtaining the consents that Data Protection Laws require, for having authority over the Connected Services, devices, computers, and accounts it connects, and for the accuracy of Customer Personal Data. Customer will not instruct processing that Data Protection Laws prohibit.

4. Confidentiality

Melaya will ensure that the persons it authorises to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that their access is limited to what is needed to provide, support, and secure the Services. Melaya will not disclose Customer Personal Data to third parties except as permitted by this DPA, on Customer's instructions, or as required by law. If a public authority requests access to Customer Personal Data, Melaya will, where legally permitted, notify Customer and direct the authority to Customer, and will disclose only the minimum data that the request lawfully requires.

5. Security

5.1 Melaya will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against a Personal Data Breach, as required by Article 32 of the GDPR. Those measures are described in Annex II and in the Security Overview at melaya.org/legal/security.

5.2 Customer has reviewed Annex II and the Security Overview, including the controls they describe as in progress or not yet implemented, and agrees that, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, they provide a level of security appropriate to the risk for the Customer Personal Data that Customer chooses to process with the Services.

5.3 Melaya may update its measures over time, provided that an update does not materially reduce the overall security of the Services.

5.4 Security is shared. Customer is responsible for the security of its own accounts, credentials, devices, computers, and Connected Services, for configuring the Services appropriately, including permissions, connected scopes, app allowlists, and approval modes, and for the content it chooses to submit.

6. Subprocessors

6.1 Customer gives Melaya a general written authorisation to engage Subprocessors. The Subprocessors that Melaya uses at a given time are listed at melaya.org/legal/subprocessors, which forms Annex III.

6.2 Before a Subprocessor processes Customer Personal Data, Melaya will enter into a written contract with it that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the service the Subprocessor provides. Melaya remains responsible to Customer for the performance of each Subprocessor's obligations.

6.3 Melaya will give at least fifteen (15) days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and by notifying Customer by email or through the Services. Where Melaya must replace a Subprocessor urgently to comply with law or to address a security or service-continuity risk, it may give a shorter notice and will then give notice as soon as reasonably possible.

6.4 Customer may object to a new Subprocessor on reasonable data protection grounds by writing to info@melaya.org within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it within a reasonable time, Customer may terminate the Services affected by the new Subprocessor by written notice, and Melaya will refund any prepaid fees for the period after termination. Termination and that refund are Customer's exclusive remedy for an unresolved objection.

7. International Transfers

7.1 Melaya Labs LLC is established in the United States, and Melaya's primary production infrastructure, including the primary database and cache, is hosted in Singapore. Customer Personal Data may also be processed in the locations of the Subprocessors listed on the Subprocessors page. Melaya will transfer Customer Personal Data across borders only in accordance with this Section 7 and Data Protection Laws.

7.2 To the extent that Customer's transfer of Customer Personal Data to Melaya is a transfer to a third country that is subject to the GDPR and not covered by an adequacy decision or another valid transfer mechanism, the SCCs are incorporated into this DPA and apply as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor. Customer is the data exporter and Melaya is the data importer.
• Clause 7 (docking clause) applies.
• Under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period set out in Section 6.3.
• The optional wording in Clause 11(a) does not apply.
• Under Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a).
• Under Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. Under Clause 18(b), disputes are resolved by the courts of Ireland.
• Annexes I, II, and III of the SCCs are completed with the information in Annexes I, II, and III of this DPA.
• Audits under Clause 8.9 are carried out in accordance with Section 10, and the certification of deletion referred to in Clause 8.5 is provided on Customer's written request.

7.3 To the extent that the transfer is subject to the UK GDPR, the SCCs apply as amended by the UK Addendum, which is incorporated into this DPA. Table 1 of the UK Addendum is completed with the parties' details in Annex I, Table 2 with the modules and options selected in Section 7.2, and Table 3 with Annexes I to III of this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.

7.4 To the extent that the transfer is subject to the FADP, the SCCs apply with the following changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence in accordance with Clause 18(c); and, where the transfer is subject to both the FADP and the GDPR, the governing law and forum selected in Section 7.2 apply.

7.5 Where Melaya transfers Customer Personal Data to a Subprocessor in a third country, Melaya will ensure that the transfer is covered by a valid transfer mechanism, such as the SCCs, and by the supplementary measures described in Annex II where required.

7.6 If a transfer mechanism relied on in this Section 7 is invalidated or replaced, the parties will cooperate in good faith to put a valid alternative in place.

8. Assistance to Customer

8.1 Taking into account the nature of the processing, Melaya will assist Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights. The Services let Authorised Users export, correct, and delete their own account data and delete conversations, documents, retrieval indices, and connections. If Melaya receives a request from a data subject that relates to Customer Personal Data, it will forward the request to Customer without undue delay where it can identify Customer, and will not respond to the request itself except to direct the data subject to Customer or as Customer instructs.

8.2 Taking into account the nature of the processing and the information available to Melaya, Melaya will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of Customer in relation to the Services, primarily by making available this DPA, the Security Overview, and the information described in Section 10.

8.3 Where Data Protection Laws permit, Melaya may charge a reasonable fee for assistance under this Section 8 that goes beyond the self-service features of the Services and the documentation that Melaya makes generally available.

9. Personal Data Breach

9.1 Melaya will notify Customer of a Personal Data Breach without undue delay, and in any event within seventy-two (72) hours after becoming aware of it. Melaya will send the notice to the email address associated with Customer's account and to any security contact that Customer has given Melaya in writing.

9.2 The notice will describe, to the extent then known, the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and to mitigate its possible adverse effects; and a contact point for more information. Where this information is not available at the same time, Melaya will provide it in phases without undue further delay.

9.3 Melaya will take reasonable steps to contain, investigate, and remediate the Personal Data Breach and will give Customer the reasonable assistance it needs to meet its own obligations to notify supervisory authorities and data subjects. Melaya will not notify Customer's data subjects or supervisory authorities of a Personal Data Breach on Customer's behalf unless Customer instructs it to or the law requires it.

9.4 Melaya's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

10. Audits and Demonstrating Compliance

10.1 Melaya will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA: this DPA and the Security Overview; on written request to info@melaya.org, Melaya's current control matrix and list of remediations in progress; and Melaya's written answers to a reasonable security and privacy questionnaire no more than once in any twelve (12) month period. Melaya does not currently hold a SOC 2 report, an ISO/IEC 27001 certificate, or any equivalent third-party attestation, and will tell Customer if that changes. Non-public information is provided subject to confidentiality obligations.

10.2 If that information is not sufficient to demonstrate compliance, where a supervisory authority requires it, or following a Personal Data Breach, Customer may audit Melaya's compliance with this DPA, itself or through an independent auditor that is bound by confidentiality obligations and is not a competitor of Melaya. Customer must give at least thirty (30) days' written notice with a proposed scope, and the parties will agree the scope, timing, and duration in advance. Audits take place no more than once in any twelve (12) month period, except where a supervisory authority requires otherwise or following a Personal Data Breach, during normal business hours, and in a way that does not unreasonably disrupt Melaya's operations.

10.3 Melaya will first offer to carry out the audit remotely, through document review and interviews. An on-site audit takes place only where a remote audit cannot reasonably achieve its purpose. An audit does not extend to the data of Melaya's other customers, to information protected by legal privilege, or to the facilities of Subprocessors, for which Melaya will make available the relevant information it receives from those Subprocessors.

10.4 Customer bears its own costs of an audit and reimburses Melaya's reasonable costs of supporting an on-site audit, except where the audit reveals a material breach of this DPA by Melaya. Customer will give Melaya a copy of the audit report, which is Melaya's confidential information.

11. Return and Deletion of Customer Personal Data

11.1 During the term of the Terms, Customer can export and delete Customer Personal Data using the Services, including the data export and account deletion features in the account settings and the deletion of conversations, documents, retrieval indices, and connections.

11.2 When Customer's account is closed or the Terms end, Melaya will delete Customer Personal Data from its active systems without undue delay and in any event within thirty (30) days, unless the law to which Melaya is subject requires it to keep the data. Customer must export any Customer Personal Data it wants to keep before closing its account. On Customer's written request made before closure, Melaya will provide reasonable assistance with returning Customer Personal Data in a commonly used, machine-readable format.

11.3 Copies of Customer Personal Data in Melaya's encrypted backups are deleted as the backups expire under the backup retention schedule described in the Security Overview. Until then they remain protected under this DPA and are not used for any other purpose.

11.4 During the term, run logs, traces, and telemetry are deleted according to the plan-dependent retention windows described in the Privacy Policy. Melaya cannot recall data that Customer directed the Services to send to a Connected Service. On Customer's written request, Melaya will confirm deletion in writing.

12. Liability

Each party's liability arising out of or relating to this DPA, including under the SCCs and the UK Addendum to the extent they permit, is subject to the exclusions and limitations of liability in the Terms, and any reference in the Terms to liability under the Terms includes liability under this DPA. Nothing in this DPA limits the rights of data subjects under the SCCs or any liability that cannot be limited under Data Protection Laws.

13. Order of Precedence

If the documents that make up the agreement between Customer and Melaya conflict, the following order applies to the extent of the conflict: first, the SCCs, the UK Addendum, and the Swiss provisions in Section 7, where they apply; second, this DPA; third, the Terms. A data processing agreement or enterprise agreement signed by both parties that expressly replaces this DPA prevails over it.

14. Changes to This DPA

Melaya may update this DPA to reflect changes in Data Protection Laws, guidance from supervisory authorities, new or replaced transfer mechanisms, or changes to the Services. Melaya will give notice of material changes in the same way as for material changes to the Terms. An update will not materially reduce the protection of Customer Personal Data under this DPA, except where the law requires it. The "Last updated" date at the top of this page shows the current version. A signed copy of this DPA can be changed only by written agreement of both parties.

15. Governing Law and Jurisdiction

This DPA is governed by the law that governs the Terms, currently the laws of the State of Delaware, United States, and disputes arising out of or relating to it are resolved as set out in the Terms, except where the SCCs, the UK Addendum, or Data Protection Laws require another governing law or forum.

16. Effective Date, Signature, and Countersigned Copies

This DPA takes effect on the later of the date on which Customer accepts the Terms and the date on which this DPA was first published. No signature is required: Customer's acceptance of the Terms is acceptance of this DPA and of the SCCs and UK Addendum incorporated into it. Customer may request a copy of this DPA countersigned by Melaya by writing to info@melaya.org with Customer's legal entity name, address, and contact details.

Annex I. Details of Processing

• Data exporter: Customer, as identified in its Melaya account or order form. Contact: the email address associated with Customer's account. Activities: use of the Services. Role: controller, or processor on behalf of its own controller. Signature and date: acceptance of the Terms.
• Data importer: Melaya Labs LLC, United States. Contact: Privacy Team, info@melaya.org. Activities: provision of the Services. Role: processor, or subprocessor. Signature and date: publication of this DPA, and countersignature on request.
• Categories of data subjects: Customer's Authorised Users, including employees and contractors; Customer's customers, prospects, contacts, suppliers, and other individuals whose personal data is contained in User Content or in the records, messages, files, and pages that Customer's agents read from Connected Services; individuals shown on the screens, pages, or application windows that Customer's agents observe; and individuals who interact with agents that Customer deploys.
• Categories of personal data: identification and contact data, such as names, email addresses, phone numbers, usernames, job titles, and company names; the content of prompts, conversations, agent outputs, uploaded documents, retrieval indices, emails, chat messages, calendar entries, CRM and ERP records, and files; data read from or written to Connected Services; screen frames, screenshots, accessibility trees, page content, window titles, recognised text, and action records produced by Device Control, Browser Control, and Computer Control; and technical data, such as IP addresses, device and session identifiers, logs, and run traces. The exact data depends on Customer's configuration and use of the Services.
• Special categories of personal data: none intended. Customer will not submit special categories of personal data, or personal data relating to criminal convictions and offences, unless this is necessary, lawful, and appropriately safeguarded. If Customer does so, the measures in Annex II apply.
• Frequency of the transfer: continuous, for as long as Customer uses the Services.
• Nature of the processing: hosting, storage, organisation, retrieval, indexing and embedding, analysis and transformation by language models, transmission to and from Connected Services, execution of agent actions, display, export, and deletion, as directed by Customer through the Services.
• Purpose of the processing: to provide, support, and secure the Services under the Terms, including running the agents, pipelines, Assistant conversations, connectors, triggers, and Device Control, Browser Control, and Computer Control sessions that Customer configures.
• Duration and retention: for the term of the Terms and until deletion under Section 11. Conversations, documents, and retrieval indices are kept until Customer deletes them or closes its account. Run logs, traces, and telemetry follow the plan-dependent retention windows, and integration data follows the integration-specific periods, described in the Privacy Policy. Backups expire under the schedule described in the Security Overview.
• Transfers to Subprocessors: as described in Annex III, for the subject matter, nature, and duration set out in this Annex I.
• Competent supervisory authority: determined in accordance with Clause 13 of the SCCs, or, as applicable, the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner.

Annex II. Technical and Organisational Measures

Melaya applies the following measures to the Services. The Security Overview at melaya.org/legal/security describes them in more detail, including the controls that are in progress or not yet implemented.

• Encryption in transit: TLS 1.2 or higher for traffic between clients and the Services, terminated at Cloudflare, with HSTS and a strict Content Security Policy. Internal service-to-service calls run over loopback or private network links.
• Encryption at rest: sensitive values, including exchange API credentials, connector credentials and OAuth tokens, and MFA secrets and recovery codes, are encrypted with AES-256-GCM envelope encryption in the server process before they are stored, with keys held separately from database and vault credentials and rotated without downtime. Backups are encrypted. Full-disk encryption of the production volumes is not yet enabled and is on the security roadmap.
• Tenant isolation: every request is scoped to the authenticated user at the application layer, PostgreSQL row-level security is enforced as a second layer under a database role that cannot bypass it, and retrieval indices are returned only to the pipeline that owns them.
• Access control: passwords hashed with bcrypt; TOTP multi-factor authentication available to every user and required to add exchange credentials or create platform API keys; signed session tokens with rotating signing keys; role-based and plan-based authorisation enforced on the server; rate limiting on authentication and API endpoints; runner and phone tokens stored only as hashes and revocable.
• Personnel access: access to production systems is granted per engineer under a two-person approval process, limited to what the role needs, reviewed on a documented quarterly cadence, and removed at offboarding, including the revocation of keys and sessions.
• Logging and monitoring: structured application, host, and edge logs shipped off the production host in real time to a log store in the same region, and an append-only, hash-chained security audit log that stores IP addresses only as keyed HMAC digests and is verified daily.
• Secure development and vulnerability management: peer review before merge, static type checks, secret scanning in pre-commit hooks and CI, dependency and container vulnerability scanning on every build, pinned CI actions, a restricted deployment path, and automatic operating-system security updates. Melaya has not yet undergone an external penetration test.
• Incident response: a written incident response procedure with severity levels, defined roles, containment steps that include key rotation, a 72-hour notification matrix, and post-incident reviews.
• Backup and continuity: nightly encrypted backups of the production databases and uploaded documents, retained on a schedule of 7 daily, 4 weekly, and 6 monthly snapshots, with a weekly integrity check and test restore, and a written business continuity plan. Backups are currently stored in the same region as production, and the Services run from a single primary region without automated failover.
• Data minimisation and deletion: automated retention sweeps for run data by plan; self-service export and deletion; erasure through tombstones that preserve the integrity of the audit log; Computer Control does not read or type into secure fields and paints over the windows of applications that are not allowed; the browser extension omits password field values from page snapshots.
• Agent safeguards: app allowlists and permission levels, approval requests for detected consequential actions in Safe mode, stop and kill controls, and server-side policy checks on device and computer commands.
• Subprocessor management: written contracts with data protection obligations, a published list of Subprocessors, and advance notice of changes.
• Certifications: Melaya builds its controls with the SOC 2 Trust Services Criteria and ISO/IEC 27001 in mind but does not currently hold any third-party certification or attestation.

Annex III. Subprocessors

The Subprocessors that Melaya engages, with their location, purpose, and transfer safeguard, are listed at melaya.org/legal/subprocessors. That list, as updated under Section 6, forms this Annex III. As of the date of this DPA, Melaya's primary compute, database, and cache hosting is provided by Alibaba Cloud in Singapore.

Connected Services that Customer chooses, including the model providers that Customer selects for its agents, are engaged at Customer's direction under Section 3 and are not Subprocessors, except as stated in Section 3.5.

Contact

Questions about this DPA, requests for a countersigned copy, and notices under this DPA should be sent to: