Data Processing Addendum

Effective date: October 28, 2026

1. About this Addendum

This Data Processing Addendum ("DPA") is part of the agreement between Zelos, Inc. ("Zelos," "we," "us") and the customer that uses the Services for business ("you") under our Terms of Service or a separate signed agreement (either one, the "Agreement"). It applies when we process personal data inside your content on your behalf. Capitalized words we do not define here have the meaning the Agreement gives them.

"Personal data" means information about an identified or identifiable person that is protected by a data protection law. "Customer personal data" means personal data in your content that we process on your behalf to provide the Services. It does not include information we collect for our own purposes, such as account, billing, support, security, and product-analytics information, which our Privacy Policy covers. Content that appears in session replays or error reports is processed for those purposes under the Privacy Policy; the providers that receive it are listed in Annex 3 so that the list is complete. "Data protection laws" means the laws that apply to our processing of customer personal data, including the EU General Data Protection Regulation (the "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the US state privacy laws that apply to you. "Processing," "controller," "processor," "data subject," and "supervisory authority" have the meanings the GDPR gives them; "business," "service provider," "sell," and "share" have the meanings the US state privacy laws give them.

If this DPA conflicts with the Agreement, this DPA controls for the processing of customer personal data. If the standard contractual clauses described in section 11 conflict with this DPA, the clauses control for the transfers they cover.

2. Roles

You are the controller (or a processor acting for another controller) of customer personal data, and we are your processor (or sub-processor). Where US state privacy laws apply, you are the business or controller and we are your service provider, contractor, or processor. Annex 1 describes the processing.

3. Our instructions

We process customer personal data only on your documented instructions. Your instructions are: the Agreement, this DPA, your use of the Services and their settings, and any other written instruction you give us that is consistent with the Agreement. If we think an instruction breaks a data protection law, we will tell you. If you ask for processing outside the Services, we will agree it with you in writing first. We do not sell or share customer personal data, we do not use it for our own purposes, we do not combine it with personal data we receive from anyone else except as the Services require, and we do not keep, use, or disclose it outside our direct relationship with you except as the Agreement, this DPA, or the law allows.

4. Confidentiality

Only staff and service providers who need access to customer personal data to provide the Services have it. They are bound by confidentiality obligations, and we keep records of administrative changes to customer accounts and of support sessions that view an account as one of its members.

5. Security

We maintain the technical and organizational measures in Annex 2. We may update them from time to time, but never in a way that materially lowers the overall level of protection during the Agreement. You are responsible for your own use of the Services: for keeping your sign-in and devices secure, for the access you give your members, for the content you upload, and for keeping your own backups.

6. Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to customer personal data (a "security incident"), we will notify you without undue delay, and no later than 72 hours after we confirm it. The notice goes to the email addresses of your organization's owners. It will describe what we know about the incident, the data and people likely affected, the steps we have taken, and the steps we recommend. We will cooperate with your investigation. Notifying you is not an admission of fault. Unsuccessful attempts, such as blocked sign-ins, port scans, or denial-of-service attacks that do not compromise customer personal data, are not security incidents. You are responsible for notifying your own regulators and data subjects as the law requires.

7. Sub-processors

You authorize us to use the sub-processors in Annex 3, and to add or replace sub-processors as follows. We will give your organization's owners at least 15 days' notice by email, or by a notice in the console, before a new sub-processor processes customer personal data, naming the sub-processor, where it operates, and what it does. If you object on reasonable data protection grounds within that period, we will work with you in good faith on a solution. If we cannot find one within 30 days, you may end the affected Services and we will refund any prepaid fees for the period after termination. We put each sub-processor under a written contract with data protection obligations no less protective than this DPA, and we remain responsible for its performance.

8. Helping you with your obligations

Taking into account the nature of the processing, we will help you respond to requests from data subjects to exercise their rights, and with data protection impact assessments and prior consultations with supervisory authorities, in each case where the request concerns customer personal data in our possession and you cannot meet it yourself through the Services. If a data subject contacts us directly about customer personal data, we will tell you promptly and, unless the law requires otherwise, direct them to you. If help requires work beyond the Services, we may charge our then-current professional services rates after giving you an estimate.

9. Return and deletion

You can export your traces, notebooks, and layouts from the Services at any time while the Agreement is in force, and for a reasonable period after it ends as the Agreement describes. When you delete content, an organization, or an account, or when the Agreement ends, we delete customer personal data within 90 days, except for copies we must keep under the law, which we keep confidential and delete when the law allows. Copies in backups are deleted within our normal backup rotation. On request, we will confirm deletion in writing.

10. Audits

On request, we will give you the information you reasonably need to show that we meet this DPA, including summaries of third-party audit reports and certifications that we or our hosting providers hold. If that information is not enough to meet a requirement of data protection law, you may audit our relevant systems and records once in any 12 months, or more often if a supervisory authority requires it, on at least 30 days' written notice, during business hours, without disrupting our operations, and under confidentiality. You bear the cost of the audit, and we may charge our reasonable costs of assisting. An auditor you appoint must not be our competitor.

11. International transfers

We are based in the United States, and we and our sub-processors process customer personal data there and in other countries. Where a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision requires a transfer mechanism, the parties agree as follows.

• EEA transfers. The standard contractual clauses in European Commission Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA and deemed signed by both parties. Module Two applies where you are a controller, and Module Three where you are a processor. Clause 7 (docking) is not used. Under Clause 9, Option 2 (general written authorization) applies with the notice period in section 7. The optional language in Clause 11 is not used. Under Clause 13, the competent supervisory authority is the one determined by the SCCs for you. Under Clauses 17 and 18, the law and the courts of Ireland apply. Annex I of the SCCs is completed with Annex 1 of this DPA, Annex II with Annex 2, and Annex III with Annex 3.
• UK transfers. The SCCs apply as varied by the UK International Data Transfer Addendum issued by the Information Commissioner's Office (the "UK Addendum"), which is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information above, and for Table 4 either party may end the UK Addendum as its section 19 allows.
• Swiss transfers. The SCCs apply with these changes: references to the GDPR are to the Swiss Federal Act on Data Protection, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, references to EU member states include Switzerland, and data subjects in Switzerland may bring claims in Switzerland.
• Other mechanisms. Where a sub-processor is certified under the EU-US Data Privacy Framework, or where another lawful transfer mechanism applies, we may rely on it instead. If a mechanism is invalidated, we will adopt a replacement that the law recognizes and tell you.

If a supervisory authority or data subject needs a signed copy of the SCCs, we will provide one on request.

12. US state privacy laws

Where a US state privacy law applies, we act as your service provider, contractor, or processor. We certify that we understand the restrictions in section 3 and will comply with them, and that we will provide the same level of privacy protection the law requires of you. We will notify you if we decide we can no longer meet our obligations under those laws. You may take reasonable and appropriate steps to make sure we use customer personal data consistently with your obligations, and to stop and remediate unauthorized use, including under sections 7, 8, and 10.

13. AI features

We do not use customer personal data to train, fine-tune, or improve AI or machine learning models, our own or anyone else's. Our AI requests tell our AI gateway to route only to providers that do not train on prompts and do not keep them after the request. The Services make no decisions about data subjects by automated means that have legal or similarly significant effects.

14. Liability and changes

Each party's liability under this DPA and the SCCs, taken together with the Agreement, is subject to the limits and exclusions in the Agreement, except where the SCCs or data protection laws do not allow a limit. We may update this DPA where a change in data protection law requires it, without materially reducing your protection; otherwise this DPA changes only as the Agreement allows. This DPA lasts as long as we process customer personal data.

Annex 1. Description of the processing

Parties. Data exporter: you, the customer named in the Agreement, acting as controller or processor. Data importer: Zelos, Inc., 340 Pine St, Suite 100, San Francisco, CA 94104, USA, acting as processor. Contact for data protection matters at Zelos: [email protected]. Your contact is your organization's owners' email addresses.

Data subjects. Your employees, contractors, and other members of your organization; people whose personal data appears in the traces, recordings, notebooks, files, prompts, and other content you put into the Services.

Categories of personal data. Names, email addresses, and roles of your members; identifiers, file paths, and device or hardware identifiers in your content; any other personal data your content contains. The Services are not designed for sensitive personal data, and the Agreement requires you not to upload it unless we have agreed in writing.

Nature and purpose of the processing. Hosting, storing, transmitting, displaying, and analyzing your content to provide the Services you use, including cloud storage of traces, notebooks, and files attached to Zelos AI chats, sharing within your organization, publishing notebooks you choose to publish, and Zelos AI features when you use them.

Duration. For the term of the Agreement and the deletion period in section 9.

Frequency. Continuous, as you use the Services.

Competent supervisory authority. Determined under Clause 13 of the SCCs.

Annex 2. Security measures

• Hosting. The Services run on Cloudflare (application hosting and object storage) and Neon (database), in the United States. Both providers hold SOC 2 Type II reports and operate the physical and environmental security of their data centers.
• Encryption. All traffic between your browser or the desktop app and the Services uses TLS. Stored content and database records are encrypted at rest by our hosting providers. Sign-in tokens for third-party identity providers are encrypted before they are stored.
• Access control. Every request to organization data is authorized against the requester's membership and role in that organization. Members see only the organizations they belong to. Access to cloud storage uses short-lived, scoped credentials. Zelos staff use named accounts; administrative changes to customer accounts, and support sessions that view an account as one of its members, are logged.
• Authentication. Accounts sign in through Google, Microsoft, or GitHub; we store no passwords. Sessions expire after 90 days, and sensitive actions require a recent sign-in.
• Secrets. Production secrets are stored in our hosting providers' secret stores, not in source code, and are rotated when exposed.
• Software development. Changes are reviewed, tested, and deployed through continuous integration. We monitor dependency advisories and apply security updates. The console's error monitoring is configured not to collect user identity, cookies, or request bodies.
• Data separation. Customer content is separated by organization in the database and in object storage keys, and deletion of an organization removes its content and storage.
• Backups and resilience. The database supports point-in-time recovery, and object storage is replicated by the provider. Backups are retained for a limited period and are encrypted.
• Incident response. We investigate alerts and reports, contain incidents, and notify affected customers as section 6 describes.
• Personnel. Staff and contractors with access to customer data are bound by confidentiality obligations and have access only to what their role requires; access ends when their role does.

Annex 3. Sub-processors

We update this list on this page. Section 7 describes how we notify you of changes.