Data Processing Agreement

Table of Contents

1. Definitions
2. Scope and roles
3. Processing on documented instructions
4. Zero-retention of submitted text
5. Confidentiality
6. Security measures
7. Sub-processors
8. Data-subject requests
9. Personal-data breaches
10. Audit and information rights
11. International data transfers
12. Return and deletion of personal data
13. Liability
14. Term and termination
15. Governing law and miscellaneous
16. Annex A — Parties
17. Annex B — Description of processing
18. Annex C — Sub-processors
19. Annex D — Technical and organizational measures
20. Signature
21. Companion: EU SCCs (Module 2) →
22. Companion: UK Addendum →

This Data Processing Agreement (the “DPA”) is entered into between:

• Komplexity AI LLC, a California limited liability company doing business as “Komplex AI,” with its principal place of business at 7514 Girard Ave, Ste 1 #935, San Diego, California 92037, United States (the “Processor” or “Komplexity”); and
• the customer identified in Annex A who has accepted the Komplex AI Terms of Use or otherwise entered into an agreement for the Services (the “Customer” or “Controller”).

The Controller and the Processor are referred to individually as a “Party” and collectively as the “Parties.”

This DPA forms part of, and is incorporated by reference into, the Komplex AI Terms of Use (the “Agreement”) between the Parties. In the event of any conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Personal Data.

1. Definitions

Capitalized terms not otherwise defined in this DPA have the meanings given to them in the Agreement, or, where applicable, in Regulation (EU) 2016/679 (the “GDPR”) or the United Kingdom General Data Protection Regulation (the “UK GDPR”).

• “Applicable Data Protection Law” means all laws and regulations applicable to the Parties' processing of Personal Data under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act and the California Privacy Rights Act (together, the “CCPA”), and any other applicable U.S. state privacy law.
• “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” and “processing” have the meanings given to those terms under the GDPR.
• “Customer Personal Data” means Personal Data that the Processor processes on behalf of the Controller in connection with the Services, as further described in Annex B.
• “EU SCCs” means the Standard Contractual Clauses approved by European Commission Decision 2021/914 of 4 June 2021, as set out at Decision 2021/914.
• “Services” means the Komplex AI hallucination detection products described in the Agreement, including the web interface and the API.
• “Sub-processor” means any third party engaged by the Processor to process Customer Personal Data on its behalf.
• “UK Addendum” means the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018.

2. Scope and roles

This DPA applies to the processing of Customer Personal Data by the Processor under the Agreement. The subject matter, duration, nature, purpose, categories of Data Subjects, and categories of Personal Data are described in Annex B.

With respect to Customer Personal Data, the Customer is the Controller and Komplexity is the Processor. Each Party will comply with its obligations under Applicable Data Protection Law.

For Personal Data that Komplexity processes for its own purposes (for example, billing records, account-administration data, and aggregated service analytics), Komplexity acts as an independent Controller; that processing is governed by the Privacy Policy and falls outside the scope of this DPA.

3. Processing on documented instructions

The Processor will process Customer Personal Data only on documented instructions from the Controller. The Controller's documented instructions are:

• the Agreement and this DPA;
• the Customer's configuration of the Services (including API calls); and
• any further written instructions agreed between the Parties (which the Processor may decline if compliance would be technically infeasible or would conflict with Applicable Data Protection Law).

The Processor will inform the Controller without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law. The Processor will not be required to act on an instruction it reasonably believes to be unlawful.

4. Zero-retention of submitted text

The Processor processes the text the Controller submits for hallucination analysis (the “Submitted Text”) only transiently, in memory, for the time strictly necessary to compute a result and return it to the Controller. The Processor:

• does not persist Submitted Text to disk, object storage, database, log file, message queue, or any other durable medium;
• does not use Submitted Text to train, fine-tune, evaluate, or improve any machine-learning model, including its own;
• does not retain hallucination scores derived from Submitted Text on its servers once they have been returned to the Controller; and
• does not share Submitted Text with any third party other than the inference Sub-processor identified in Annex C, which receives it only transiently for the duration of an inference call.

The only data the Processor retains in connection with API requests is the usage-metadata set described in Annex B (timestamp, API-key identifier, token count, response latency). This metadata is held for the period stated in Section 9 of the Privacy Policy.

The Parties acknowledge that the zero-retention model materially reduces the obligations under several clauses of this DPA. Where this DPA references retention, deletion, or return of Submitted Text, those obligations are satisfied by the fact that no Submitted Text persists beyond the response cycle.

5. Confidentiality

The Processor ensures that personnel authorized to process Customer Personal Data are subject to confidentiality obligations, whether by contract or by statutory duty, that survive the termination of their engagement with the Processor.

6. Security measures

The Processor will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to Data Subjects' rights and freedoms. The measures in place at the effective date of this DPA are described in Annex D.

The Processor may update the measures in Annex D from time to time, provided that the overall level of security is not materially decreased.

Certifications. The Processor does not, as of the effective date, hold SOC 2, ISO 27001, or comparable third-party security certifications. The Processor will not represent that it holds such certifications unless and until they are obtained.

7. Sub-processors

The Controller provides a general written authorization for the Processor to engage Sub-processors to process Customer Personal Data, subject to this Section 7. The Sub-processors engaged by the Processor as of the effective date are listed in Annex C.

Before engaging a new Sub-processor or replacing an existing one, the Processor will give the Controller at least thirty (30) days' advance notice, by updating the list at komplexai.io/dpa and, where the Controller has provided a notice address, by email. The Controller may object to the change on reasonable data-protection grounds during the notice period. If the Parties cannot resolve the objection in good faith, the Controller may terminate the affected Services for cause and receive a pro-rata refund of any pre-paid fees for the unused portion of the term.

The Processor will impose on each Sub-processor data-protection obligations no less protective than those in this DPA and will remain liable to the Controller for the acts and omissions of its Sub-processors as for its own.

8. Data-subject requests

Taking into account the nature of the processing, the Processor will assist the Controller, by appropriate technical and organizational measures and insofar as this is possible, in fulfilling the Controller's obligation to respond to requests for the exercise of Data Subject rights under Applicable Data Protection Law.

If the Processor receives a request from a Data Subject relating to Customer Personal Data, it will, without undue delay, forward the request to the Controller and will not respond to the request itself unless authorized by the Controller or required by law.

Practical note. Because the Processor does not retain Submitted Text, most rights requests (access, correction, deletion) related to the content of Submitted Text are automatically satisfied: there is nothing for the Processor to access, correct, or delete beyond the limited usage-metadata set described in Annex B.

9. Personal-data breaches

The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours after becoming aware, of a Personal Data Breach affecting Customer Personal Data. The notification will, to the extent available at the time, include:

• the nature of the breach and the categories of Personal Data affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its possible adverse effects; and
• a contact point at the Processor for further information.

Because the Processor does not retain Submitted Text, the realistic breach surface is limited to (i) account-administration data, (ii) usage metadata, and (iii) transient in-flight inference traffic. The Processor will provide reasonable assistance to the Controller in meeting the Controller's notification obligations under Applicable Data Protection Law.

10. Audit and information rights

The Processor will make available to the Controller, on reasonable written request, information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR and the equivalent provisions of other Applicable Data Protection Law. This will ordinarily take the form of written responses to a standard security questionnaire and copies of any then-current third-party attestations or summaries.

Where reasonably necessary to confirm compliance and where written responses are insufficient, the Controller may conduct, or mandate a qualified independent auditor to conduct, an audit of the Processor's processing activities, at the Controller's expense, subject to: (a) at least thirty (30) days' advance written notice; (b) a maximum frequency of once per twelve (12) months, except where required to investigate a confirmed Personal Data Breach or by a competent supervisory authority; (c) execution of a reasonable non-disclosure agreement; and (d) conduct that does not disrupt the Processor's operations or compromise other customers' data.

11. International data transfers

The Processor processes Customer Personal Data in the United States. To the extent the Processor receives Customer Personal Data from the European Economic Area, Switzerland, or the United Kingdom, the Parties incorporate the following transfer mechanisms by reference:

• EU SCCs (Module 2 — Controller to Processor). The Parties enter into the EU SCCs as set out at komplexai.io/sccs. The Controller is the data exporter and the Processor is the data importer. The clause-option selections, docking clause, governing law, and supervisory authority are set out in that document. Annexes I, II, and III of the EU SCCs are populated by Annexes A, D, and C of this DPA respectively.
• UK Addendum. Transfers of Personal Data subject to the UK GDPR are governed by the UK Addendum, version B1.0, set out at komplexai.io/uk-addendum.
• Swiss FADP. Where Personal Data is subject to the Swiss FADP, the EU SCCs apply, with references to GDPR concepts read as references to the equivalent FADP concepts and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

If a court or supervisory authority of competent jurisdiction determines that the transfer mechanism above does not, or no longer, provides an appropriate level of protection, the Parties will negotiate in good faith to adopt a successor mechanism.

12. Return and deletion of personal data

On termination or expiry of the Agreement, and at the Controller's choice, the Processor will delete or return all Customer Personal Data that it then holds, and will delete existing copies, unless retention is required by law. Given the zero-retention model:

• Submitted Text: nothing to delete — none is retained.
• Usage metadata: deleted within thirty (30) days of termination, except where retention is required for tax, accounting, or other legal compliance.
• Account data: deleted within ninety (90) days of account closure, in line with Section 9 of the Privacy Policy.

On written request, the Processor will provide written confirmation that deletion has occurred.

13. Liability

Each Party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits or excludes liability that cannot be limited or excluded under Applicable Data Protection Law, including liability under Article 82 of the GDPR.

14. Term and termination

This DPA takes effect on the date the Controller accepts the Agreement (or, if later, the date both Parties sign Annex A) and continues for as long as the Processor processes Customer Personal Data on behalf of the Controller. Sections that by their nature should survive termination, including Sections 5, 6, 9, 10, 12, 13, and 15, survive.

15. Governing law and miscellaneous

This DPA is governed by the laws of the State of California, United States, without regard to its conflict-of-laws provisions, except that the EU SCCs and the UK Addendum are governed by the laws specified in those documents. Disputes arising out of or relating to this DPA are subject to the dispute-resolution provisions of the Agreement, except that the dispute-resolution provisions of the EU SCCs and the UK Addendum apply to disputes arising under those instruments.

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions remain in full force and effect. No waiver of any provision of this DPA will be effective unless in writing. This DPA, together with the Agreement, the EU SCCs, and the UK Addendum, constitutes the entire agreement of the Parties with respect to its subject matter and supersedes any prior understandings on that subject.

Annex A — Parties

Data Importer (Processor)

Data Exporter (Controller)

Annex B — Description of processing

Annex C — Sub-processors

As of the effective date of this DPA, the Processor engages the following Sub-processors. The Processor will update this list and notify Customers in accordance with Section 7 before adding or replacing a Sub-processor.

Other operational vendors named in the Privacy Policy (Clerk for authentication, Resend for transactional email, OpenAI's Moderation API for screening correspondence, and Cloudflare for contact-form bot-protection and inbound-mail routing) process limited account, correspondence, or telemetry data; they do not receive Submitted Text. They are disclosed in the Privacy Policy as third-party service providers and are not treated as Sub-processors for the purposes of this DPA.

Annex D — Technical and organizational measures

The Processor implements the following measures, recognizing that the zero-retention model is itself the most consequential security control:

• Data minimization by design. Submitted Text is never written to persistent storage and is held in process memory only for the duration of an inference call. There is no offline copy to encrypt, back up, or rotate keys for, and there is no historical archive to breach.
• Transport encryption. All traffic between the Controller and the Services, and between the Services and Sub-processors, uses TLS 1.2 or higher.
• Access controls. Production access is limited to authorized personnel and is gated by multi-factor authentication. API access is gated by per-customer API keys.
• Authentication. User authentication is performed by Clerk; user passwords are stored as salted hashes by Clerk and are never accessible to the Processor in plaintext.
• Payment-card data. The Processor does not handle or store payment-card data; Stripe is the PCI-DSS-compliant processor for all payment flows.
• Logging. Application logs record usage metadata (timestamp, API key identifier, token counts, latency, status codes) but do not record Submitted Text or model outputs.
• Personnel. Personnel with production access are bound by confidentiality obligations.
• Vendor due diligence. Each Sub-processor in Annex C has a published DPA and either a SOC 2 attestation or an equivalent third-party security review. The Processor does not itself hold a SOC 2 or ISO 27001 certification at this time.
• Incident response. The Processor maintains an internal incident- response procedure and will notify the Controller in accordance with Section 9.
• Business-continuity. Inference compute is provided by Modal under its own redundancy commitments; the web layer is provided by Vercel under its own redundancy commitments. The Processor does not run its own data center.

The Processor will update this list as its security program matures. Any update will preserve at least the level of protection in place on the effective date of this DPA.

Signature

By accepting the Agreement and continuing to use the Services, the Customer is deemed to have entered into this DPA. Where the Customer requires a countersigned copy, the following signature block applies: