Ekaya Cloud Data Processing Agreement

Version 1.3, effective 2026-10-18.

This Ekaya Cloud Data Processing Agreement (the "DPA") is between Ekaya Inc, a Delaware corporation ("Ekaya" or "Provider"), whose address is 1112 Montana Ave #414, Santa Monica, CA 90403, and the Customer that has accepted the Ekaya Cloud Terms of Service (the "Agreement"). For each Customer, this DPA takes effect when the Customer accepts the Agreement. It governs Ekaya's processing of personal data in Customer Content for Ekaya Cloud, the hosted service Ekaya operates. This DPA covers Ekaya Cloud only. It does not apply to Ekaya Enterprise or to any Ekaya software that a customer runs in its own environment.

Cover Page

Standard Terms

1. Processor and subprocessor relationships

1.1 Roles. For Customer Personal Data, the Customer is a controller, or a processor acting for its own controller, and Ekaya is the Customer's processor, or subprocessor. Ekaya is a controller only for the account, billing and usage data that the Ekaya Cloud Privacy Policy describes, which this DPA does not cover.

1.2 Instructions. Ekaya processes Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA, and the Customer's configuration and use of the Service (including the Requests it approves and the agents and Data Access Points it authorizes) are those instructions. Ekaya tells the Customer if, in its opinion, an instruction infringes data protection law, and is not required to follow it.

1.3 Subprocessors. The Customer authorizes Ekaya to engage the Approved Subprocessors. Ekaya imposes data protection obligations on each subprocessor that are no less protective than this DPA in substance, and remains responsible for its subprocessors' performance.

1.4 Changes to subprocessors. Ekaya gives at least 30 days' notice before a new subprocessor processes Customer Personal Data, by updating the list at https://ekaya.ai/cloud/subprocessors and emailing the Administrators of active Projects. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected Projects and paid plans and receive a refund of fees prepaid for the remaining period.

2. Processing

2.1 Confidentiality of personnel. Ekaya ensures that the people it authorizes to process Customer Personal Data are bound by confidentiality.

2.2 Access to Customer Content. Ekaya maintains administrative access to the Service and the systems that hold Customer Content, because it needs that access to operate, secure and support the Service. Ekaya personnel access Customer Content in a Project only as needed to operate, secure or support the Service, to respond to a Security Incident as Section 11 defines it, to investigate a reported violation of the Acceptable Use Policy, or as law requires.

2.3 Security. Ekaya implements the technical and organizational measures in Annex II.

2.4 Assistance. Taking into account the nature of the processing, Ekaya assists the Customer, through the Service's features where possible, in responding to data subjects' requests, and with data protection impact assessments and prior consultations that concern the Service. If a data subject contacts Ekaya about Customer Personal Data, Ekaya forwards the request to the Customer where it can identify the Customer, and does not respond itself except to direct the data subject to the Customer.

2.5 Ekaya-side model providers. Ekaya does not send Customer Personal Data to a model provider that Ekaya operates or engages. If Ekaya proposes to add one, it follows Section 1.4 first, and the Service sends row-level values from a Project to it only if an Administrator of the Project opts in for that Project. The model provider that the Customer's own agent uses is chosen by the Customer and is not Ekaya's subprocessor.

2.6 CCPA. To the extent Customer Personal Data is personal information under the California Consumer Privacy Act, Ekaya is a service provider. Ekaya will not sell or share it, will not retain, use or disclose it outside the direct business relationship or for any purpose other than performing the Service, will not combine it with personal information from other sources except as the CCPA permits, and will tell the Customer if it can no longer meet these obligations.

3. Restricted Transfers

3.1 Ekaya processes Customer Personal Data in the Region of the Customer's Project, as the Data Residency Statement describes, and its subprocessors process it where the Ekaya Cloud Subprocessors list states. The only Region is in the United States.

3.2 EEA. For a Restricted Transfer from the EEA, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, completed with the information in the Cover Page and Annexes I and II, with the optional docking clause omitted, Option 2 (general written authorization) in Clause 9 with the notice period in Section 1.4, and the optional language in Clause 11 omitted.

3.3 UK and Switzerland. For a Restricted Transfer from the United Kingdom, the parties enter into the UK International Data Transfer Addendum to the Standard Contractual Clauses; for a transfer from Switzerland, the Standard Contractual Clauses apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires.

3.4 Requests from public authorities. If a public authority requests access to Customer Personal Data, Ekaya notifies the Customer unless law prohibits it, challenges a request it reasonably considers unlawful, and discloses only the minimum the request requires.

4. Security Incident response

4.1 Ekaya notifies the Customer of a Security Incident without undue delay and within 72 hours after Ekaya confirms it, by email from an ekaya.ai address to the Project's Administrators and to the account email addresses Ekaya holds for the Project's Members, with the security contact on the Cover Page for follow-up. Ekaya confirms a Security Incident when it has reasonable evidence that one has occurred. Where Ekaya cannot reach an affected member by email, it will try another channel and record who it reached, how and when.

4.2 The notice describes, as far as then known, the nature of the incident, the data and data subjects affected, the likely consequences, and the measures Ekaya has taken or proposes. Ekaya supplements the notice as it learns more, takes reasonable steps to contain and remedy the incident, and cooperates with the Customer's own notifications. A notice is not an admission of fault.

5. Audit and reports

5.1 Ekaya holds no third-party certification or audit report. On the Customer's written request, no more than once a year unless a regulator requires or a Security Incident occurred, Ekaya answers a reasonable security questionnaire and provides the information reasonably necessary to demonstrate compliance with this DPA.

5.2 If that information is not enough to meet a requirement of data protection law or a regulator, the Customer may audit Ekaya's compliance with this DPA, on at least 30 days' notice, during business hours, at the Customer's cost, through an auditor bound by confidentiality, without access to other customers' data, and no more than once a year.

6. Coordination and cooperation

6.1 Ekaya provides the cooperation in Sections 2.4, 3.4 and 4. Where the Service's features let the Customer do something itself (for example delete records or Projects), Ekaya's assistance is to point the Customer to those features.

7. Deletion of Customer Personal Data

7.1 Project databases. When a Project or its Managed Project Database is deleted, the database is dropped at once; Ekaya keeps no backup of it.

7.2 Project configuration and metadata. When a Project is deleted, Ekaya deletes the Project's datasource configuration and credentials, Requests, ontology and other Project metadata from its live systems. Copies in the backups of Ekaya's platform metadata database and of the Request Service database, both kept in the Project's Region, expire on those databases' backup rotation (seven retained daily backups and seven days of transaction logs each). The control plane's Firestore database has point-in-time recovery enabled, and its recovery copies expire at the end of that recovery window. The Data Residency Statement's "Backups" row describes the same copies.

7.3 Audit records. Ekaya keeps audit records about a Project for as long as it needs them to operate and secure the Service and to meet its legal obligations.

7.4 Snapshots. Ekaya does not keep snapshots of a Project's database. If it begins to, they will stay in the Project's Region and be purged within 30 days after the Project is deleted.

7.5 On termination. When the Agreement ends, Ekaya deletes Customer Personal Data as Sections 7.1 to 7.4 provide, unless law requires Ekaya to keep it, in which case this DPA continues to protect it. Ekaya provides no export of Project databases, except that Section 7.7 of the Terms provides an export if Ekaya discontinues Ekaya Cloud; the Customer should retrieve data it needs before deleting a Project (Terms Sections 5.5 and 7.6).

8. Limitation of liability

8.1 Each party's liability arising out of this DPA is subject to the exclusions and limits in Section 9 of the Agreement, and counts toward them, except to the extent data protection law does not allow liability to data subjects to be limited.

9. Conflicts

9.1 If this DPA conflicts with the Agreement, this DPA prevails on the processing of Customer Personal Data. If the Standard Contractual Clauses or the UK Addendum conflict with this DPA, they prevail.

10. Term

10.1 This DPA lasts as long as Ekaya processes Customer Personal Data for the Customer.

11. Definitions

• Approved Subprocessors: the subprocessors listed in Part A of the Ekaya Cloud Subprocessors list and in Annex III — third parties Ekaya engages to process Customer Personal Data. Providers of sign-in, hosting, billing, email and analytics services that process data for which Ekaya is a controller are listed in Part B of that page for information and are not Approved Subprocessors.
• Customer Personal Data: personal data in Customer Content that Ekaya processes for the Customer.
• Customer Content, Project, Region, Request, Data Access Point: as defined in the Agreement.
• Data Residency Statement: the statement for the Project's Region.
• Restricted Transfer: a transfer of Customer Personal Data that, without the measures in Section 3, would be prohibited by the data protection law of the EEA, the United Kingdom or Switzerland.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Content that Ekaya processes. The scope is the Customer Content of the Project, whether or not the data affected is personal data: the same event triggers the notice in Section 4, the access exception in Section 2.2 and the notice and access exception in Terms Section 5.6, and the exception in each of those clauses is this defined Security Incident. Where a Security Incident affects Customer Personal Data it is also a personal-data breach under this DPA and the data protection law it implements.
• Standard Contractual Clauses: the clauses referred to in Section 3.2.

Annex I — Description of processing

I(A) List of parties

I(B) Description of transfer and processing

I(C) Competent supervisory authority

Data Protection Commission (Ireland) (Cover Page).

Annex II — Technical and organizational security measures

Each measure carries its status. Ekaya does not represent a measure marked "planned" as in place.

Annex III — Approved Subprocessors

The subprocessors listed in Part A of the Ekaya Cloud Subprocessors list, published at https://ekaya.ai/cloud/subprocessors. Parts B to D of that page are informational and do not form part of this Annex.

Signature (optional)

Attribution

Structure based on the Common Paper Data Processing Agreement (Version 1.1), free to use under CC BY 4.0.