Data Processing Addendum

1. Scope and incorporation

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement between the customer ("Customer") and Oppulence Inc. ("Eigenn" or "Provider") governing Customer's use of the Service (the "Agreement"). It applies where Eigenn processes Personal Data on Customer's behalf.

This DPA remains in effect for as long as Eigenn processes Personal Data, notwithstanding the expiration or termination of the Agreement. Except as expressly modified here, the Agreement remains in full force. If this DPA conflicts with the rest of the Agreement, this DPA governs with respect to the processing of Personal Data.

Processing of Personal Data subject to State Privacy Laws, where Customer is a business, controller, processor, or service provider, is additionally subject to Section 12 (State privacy laws) below.

This DPA addresses United States data protection laws. If Customer requires terms covering the EU GDPR, UK GDPR, or Swiss data protection law, including standard contractual clauses for international transfers, contact [email protected] to put a GDPR-enhanced addendum in place. The rights described for individuals in the European Economic Area and the United Kingdom in our Privacy Policy apply regardless of whether such an addendum is signed.

2. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

• "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity.
• "Applicable Data Protection Laws" means the privacy, data protection, and data security laws of any United States jurisdiction applicable to Eigenn's processing of Personal Data under the Agreement, including the State Privacy Laws.
• "Customer Data" means information provided or otherwise made available by or on behalf of Customer to Eigenn for processing on Customer's behalf to perform the Service.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Information Security Incident" means a breach of Eigenn's security resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data in Eigenn's possession, custody, or control. It does not include unsuccessful attempts that do not compromise the security of Personal Data, such as failed log-in attempts, pings, port scans, or denial of service attacks.
• "Personal Data" means Customer Data that constitutes personal data, personal information, or personally identifiable information under Applicable Data Protection Laws, excluding information about Customer business contacts and information Eigenn receives or generates independently of the Service.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, alteration, retrieval, use, disclosure, restriction, erasure, or destruction.
• "State Privacy Laws" means the comprehensive state data privacy laws and implementing regulations in effect and applicable to Eigenn's processing of Personal Data under the Agreement.
• "Sub-processor" means an Eigenn Affiliate or third party that Eigenn engages to process Personal Data in relation to the Service.

3. Customer instructions

Eigenn will process Personal Data only in accordance with Customer's documented instructions, including as set out in this DPA, the Agreement, any applicable order form, and any other written instructions consistent with the Agreement. By entering into this DPA, Customer instructs Eigenn to process Personal Data to provide the Service and to perform its other obligations and exercise its rights under the Agreement.

If Customer requests instructions outside the scope of the Service, or that would require Eigenn to materially change the Service or undertake additional work, the parties will agree to those instructions in a mutually executed amendment or other written agreement.

The details of Eigenn's processing, including the categories of Data Subjects and Personal Data, the nature and purpose of processing, and the retention period, are set out in Section 11 (Processing details).

4. Security

Eigenn will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access, taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of processing.

Eigenn may update these measures from time to time to maintain or improve security or to address changes in Applicable Data Protection Laws, so long as the updated measures do not materially decrease the overall protection of Personal Data. Eigenn requires personnel authorized to access Personal Data to be subject to appropriate confidentiality obligations.

5. Data subject rights

Taking into account the nature of the processing, Eigenn will provide Customer with assistance reasonably necessary and technically feasible for Customer to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws.

If Eigenn receives a request directly from a Data Subject, it will promptly notify Customer unless prohibited by law and will advise the Data Subject to submit the request to Customer. Customer is solely responsible for responding to such requests unless otherwise required by law.

Where assistance requires work beyond the Service, Customer will compensate Eigenn at its then-current professional services rates, and Eigenn will provide a good-faith estimate of applicable fees on request.

6. Customer responsibilities and restricted data

Customer is solely responsible for ensuring that it has provided all notices to, and obtained all consents and permissions from, third parties including Data Subjects, and has reserved all necessary rights, as required under Applicable Data Protection Laws for Eigenn to process Personal Data as contemplated by the Agreement.

Customer represents and warrants that Customer Data will not contain any of the following categories of "Restricted Data" without the parties' prior written agreement. These restrictions apply to data Customer chooses to submit into the Service; they do not restrict the bank, invoice, transaction, and business-identity data that the Service is designed to process, as described in the Privacy Policy.

• Social security numbers, driver's license numbers, passport numbers, or other government-issued identification numbers of individuals. This does not restrict business tax identification numbers submitted for invoicing and accounting purposes.
• Protected health information subject to HIPAA, or other information about an individual's medical history, condition, treatment, or diagnosis, or health insurance information.
• Biometric information.
• Passwords or credentials for third-party online accounts, other than credentials created solely to access the Service and credentials supplied through supported bank connections, OAuth authorization, or designated integration settings to operate the integrations you authorize. Do not place credentials in ordinary documents, messages, or AI prompts.
• Tax return data.
• Payment card information subject to the Payment Card Industry Data Security Standard.
• Personal data of children under 16 years of age.
• Any other information falling within special categories of data as defined in Applicable Data Protection Laws.

7. Sub-processors

Customer specifically authorizes the engagement of Eigenn Affiliates as Sub-processors and generally authorizes Eigenn to engage third parties as Sub-processors in accordance with this section. The current list of Sub-processors, including their functions and locations, is published on our Sub-processors page.

When engaging a Sub-processor, Eigenn will enter into a written contract containing data protection obligations no less protective than those in this DPA, to the extent applicable to the nature of the services provided. Eigenn remains responsible for the performance of subcontracted obligations and is liable for the acts and omissions of its Sub-processors to the same extent as if it had performed the processing itself.

When Eigenn engages a new Sub-processor, it will notify Customer by updating the Sub-processors page and providing written notice, including by email, to Customer's designated contact. If Customer objects within 15 days on reasonable grounds relating to the protection of Personal Data, the parties will work together in good faith to find a mutually acceptable resolution. If no resolution is reached within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and pay all amounts due as of the termination date.

8. Audits

Customer may audit Eigenn's compliance with this DPA up to once per year, and on other occasions to the extent Customer is legally required to conduct an additional audit or a competent regulatory authority requires it, in each case on written request providing reasonable detail and supporting documentation.

To request an audit, Customer must submit a proposed audit plan at least two weeks in advance describing the proposed scope, duration, and start date. Any third-party auditor must sign a customary non-disclosure agreement. Eigenn may object to an auditor that is, in its reasonable opinion, not independent, a competitor, or otherwise manifestly unsuitable, in which case Customer will appoint another auditor or conduct the audit itself.

Eigenn will contribute to audits by providing the information and assistance reasonably necessary to conduct them, and will work cooperatively with Customer to agree on a final audit plan. Nothing in this section requires Eigenn to breach any duty of confidentiality. Where available, Eigenn may satisfy an audit request by providing existing third-party reports or certifications.

9. Return and deletion

On the date of cessation of any Service involving the processing of Personal Data (the "Cessation Date"), Eigenn will promptly cease all processing of Personal Data other than storage and processing necessary to effect its return, deletion, or anonymization, or as otherwise permitted or required by law.

On written request made no later than 30 days after the Cessation Date (the "Post-cessation Storage Period"), and to the extent technically possible, Eigenn will within a commercially reasonable period either return a complete copy of the Personal Data in its possession by a secure method and then delete or anonymize all other copies, or at its option delete or anonymize all Personal Data in its possession.

If Customer does not provide instructions during the Post-cessation Storage Period, Eigenn will, within a commercially reasonable time after it expires, delete or anonymize the Personal Data then in its possession to the fullest extent technically feasible.

Eigenn may retain Personal Data to the extent permitted or required by applicable law, for no longer than that law requires, provided it maintains confidentiality, protects the data in accordance with the security measures, processes it only for the purpose requiring retention, and deletes or anonymizes it once retention is no longer required.

10. Artificial intelligence and automated processing

AI features may transmit prompts, conversation history, documents, and relevant business records retrieved by tools to OpenRouter and configured model providers to generate responses, extract information, categorize records, or support enabled automation. Document OCR, classification, and extraction can also use Mistral, and document embeddings can use Google. These processes may run when documents are uploaded or processed in the background. This processing is subject to Customer instructions and the restrictions below.

Eigenn will not use Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless that use is reasonably necessary to provide the Service in accordance with Customer's documented instructions, or is expressly authorized by Customer in writing.

Eigenn prohibits its Sub-processors, including AI model providers, from using Personal Data for their own model training, fine-tuning, development, or improvement purposes, except as expressly authorized by Customer in writing.

If the Service involves automated decision-making that produces legal or similarly significant effects on Data Subjects, Eigenn will disclose the existence of that processing to Customer, provide meaningful information about the logic involved to the extent reasonably available and without disclosing trade secrets, and reasonably cooperate with Customer to enable Data Subjects to exercise applicable rights.

11. Processing details

The following describes the processing of Personal Data under this DPA.

• Provider: Oppulence Inc., 651 N Broad St, Suite 201, Middletown, DE 19709. Data protection contact: [email protected].
• Customer: the entity that is a counterparty to the Agreement. Customer's activities relevant to this DPA are its use and receipt of the Service as permitted by the Agreement.
• Categories of Data Subjects: any Data Subjects whose Personal Data Customer causes Eigenn to process in connection with the Service, including Customer's end users, customers and other business contacts, and Customer's personnel including employees and contractors.
• Categories of Personal Data: personal details such as name and contact information; authentication details such as usernames and access credentials for the Service; technological details such as IP addresses, unique and pseudonymous identifiers, location data, application activity data, and device identifiers; and business records such as invoices, bank account and transaction data, documents, attachments, connected inbox communications, AI prompts and conversation history, and generated outputs processed through features Customer uses or enables.
• Sensitive categories of data: none. As stated in Section 6, Restricted Data must not be submitted to the Service without the parties' prior written agreement.
• Frequency of transfer: ongoing, as initiated by Customer through its use of the Service.
• Nature of processing: the processing operations required to provide the Service and perform Eigenn's obligations under the Agreement and this DPA.
• Purpose of processing: to provide the Service as initiated by Customer and to comply with Customer's documented instructions as permitted by this DPA and the Agreement.
• Duration and retention: for the period determined in accordance with the Agreement and this DPA, including Section 9.
• Transfers to Sub-processors: as described from time to time on our Sub-processors page.

12. State privacy laws

For purposes of this section, the terms "business", "controller", "processor", "commercial purpose", "sell", "share", "service provider", and "contractor" have the meanings given in the applicable State Privacy Laws, and "personal information" means Personal Data to the extent it is governed by those laws.

It is the parties' intent that, with respect to personal information, Eigenn acts as a service provider, contractor, or processor as applicable.

• Eigenn acknowledges that personal information is disclosed by Customer only for the limited and specified purposes described in the Agreement.
• Eigenn will comply with its applicable obligations under the State Privacy Laws and will provide the same level of privacy protection as those laws require.
• Customer has the right to take reasonable and appropriate steps to help ensure that Eigenn's processing of personal information is consistent with Customer's obligations under the State Privacy Laws.
• Eigenn will notify Customer in writing of any determination that it can no longer meet its obligations under the State Privacy Laws, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.
• Eigenn will not sell or share any personal information.
• Eigenn will not retain, use, or disclose personal information for any purpose other than providing the Service, including for any commercial purpose other than the provision of the Service, except as permitted by the State Privacy Laws.
• Eigenn will not retain, use, or disclose personal information outside the direct business relationship between Eigenn and Customer.
• Eigenn will not combine personal information received under the Agreement with personal information received from or on behalf of another person, or collected from its own interaction with a Data Subject, except as permitted by the State Privacy Laws and necessary to provide the Service.
• Eigenn certifies that it understands these restrictions and will comply with them.
• Notice of Sub-processor engagements given under Section 7 satisfies Eigenn's obligation to give notice of and an opportunity to object to those engagements, and audits under Section 8 may be used to verify Eigenn's compliance.

13. General

Eigenn will cooperate in good faith with Customer to consider amendments reasonably necessary to address compliance with Applicable Data Protection Laws. Eigenn may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided the variation does not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations without Customer's written agreement.

The total aggregate liability of either party under or in connection with this DPA is subject to, and will not exceed, the limitations, caps, and exclusions of liability agreed by the parties in the Agreement.

The parties acknowledge that Eigenn's access to Personal Data does not constitute part of the consideration exchanged under the Agreement. Notices under this DPA may be given in accordance with the notice provisions of the Agreement, to the data protection contacts identified in Section 11, or to any email address Customer designates for Service-related communications.

To request a countersigned copy of this DPA, or to raise a question about it, contact [email protected].