Data Processing Addendum

Version 1.0 — effective 15 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Neosphyr Ltd ("Processor", "we") and the Customer ("Controller", "you"). It applies to personal data contained in Customer Data that we process on your behalf ("Customer Personal Data"). Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where applicable to you, the EU GDPR.

1. Roles and instructions

1.1 You are the controller and we are the processor of Customer Personal Data.

1.2 We will process Customer Personal Data only on your documented instructions, which are the Agreement and your use and configuration of the Service, unless required to do otherwise by UK law; in that case we will tell you before processing unless the law prohibits it. We will tell you if, in our opinion, an instruction infringes Data Protection Law.

1.3 You are responsible for the lawfulness of the Customer Personal Data and of your instructions, including having a lawful basis and giving any required information to data subjects. You will not instruct us to process special category or criminal offence data.

2. Details of processing

3. Our obligations

3.1 Confidentiality. We ensure that anyone authorised to process Customer Personal Data is bound by a duty of confidentiality.

3.2 Security. We implement the technical and organisational measures described in the Annex, appropriate to the risk. We may update them provided the overall level of protection is not reduced.

3.3 Assistance. Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to data subject requests and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO. If a data subject contacts us directly, we will refer them to you. We may charge reasonable costs for assistance beyond what the Service's standard features provide.

3.4 Personal data breaches. We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to us, and will update you as more becomes available. Our notification is not an acknowledgement of fault or liability.

4. Sub-processors

4.1 You give us general authorisation to engage the sub-processors listed at Sub-processors.

4.2 We will give at least 14 days' notice of a new sub-processor by updating that page and emailing account owners. If you object on reasonable data protection grounds, we will discuss the objection in good faith; if we cannot resolve it, you may terminate the affected subscription before the change takes effect and receive a pro-rata refund of prepaid Fees, as your sole remedy.

4.3 We impose data protection obligations on each sub-processor that are substantially no less protective than this DPA, and remain responsible for their performance as required by Data Protection Law.

5. International transfers

You authorise transfers of Customer Personal Data to the countries where our sub-processors operate, as listed on the Sub-processors page. Where a transfer outside the UK is not covered by UK adequacy regulations, we will ensure it is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU–US Data Privacy Framework, or another lawful transfer mechanism.

6. Audits and information

6.1 We will make available the information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, primarily by answering written questionnaires and providing summaries of our security measures and our sub-processors' certifications.

6.2 If that information is insufficient to show compliance, or a regulator requires it, you may carry out an audit no more than once in any 12-month period, on at least 30 days' written notice, during business hours, at your cost, by an auditor bound by confidentiality who is not our competitor, and without access to other customers' data or to sub-processors' facilities.

7. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions in clause 15 of the Terms of Service, and the cap in that clause applies to all claims under the Agreement and this DPA together.

8. Deletion and return

On termination of the Agreement, you may export Customer Data using the Service for 30 days. After that we will delete Customer Personal Data from the live Service, and from backups as they are overwritten in the ordinary course, unless UK law requires us to keep it. Trial accounts are deleted as described in the Terms of Service.

9. Precedence

If this DPA conflicts with the Terms of Service on data protection matters, this DPA prevails.

Annex — Security measures

• Encryption of data in transit (HTTPS/TLS) between browsers and the Service and between the Service and its providers.
• Encryption at rest of the database and of the file store, provided by the hosting and storage providers.
• Database and API not reachable from the internet; only the web application can reach the API, over the hosting provider's private network.
• Uploaded files kept in a private object store, never publicly accessible, downloadable only through the Service after an access check.
• Tenant isolation: access to every organisation, project and document checked on the server for each request.
• Passwords stored with Argon2 hashing; session and email tokens stored as hashes; secure, HTTP-only session cookies; CSRF protection; rate limiting of sign-in and sign-up.
• Uploaded files validated by type and size and treated as untrusted input; instructions inside documents are never executed.
• Security-relevant events (sign-in, uploads, downloads, deletions, permission changes) recorded in an audit log.
• Administrative access to hosting, storage, email, payment, AI and source code accounts limited to authorised personnel and protected by multi-factor authentication: on the provider account itself or, where a provider signs users in through their email account or another identity provider, on that account.
• Secrets held only in the hosting provider's encrypted environment settings, never in source code.
• The Service refuses to start in production with insecure configuration.
• Automated deletion of trial data and of AI conversation content in line with the retention periods in the Privacy Notice.