Data Processing Addendum

Version 2.0, effective September 26, 2026

This Data Processing Addendum (“DPA”) governs the processing of Customer Personal Data by Anygraph Inc. and its subsidiaries and group affiliates (collectively, “Anygraph”) on behalf of a customer (“Customer”) in connection with the Anygraph desktop application and related services (the “Service”). This DPA forms part of the agreement between Anygraph and Customer that incorporates or references it (the “Agreement”). If this DPA and the Agreement conflict on the processing of Customer Personal Data, this DPA controls to the extent of the conflict.

Version 2.0 updates version 1.0 for the current architecture: the Subprocessor list and its retention terms, the zero data retention and ephemeral processing commitment, and network protection.

1. Definitions

Customer Content means documents, files, prompts, data, instructions, messages, outputs, and other content that Customer or its authorized users submit to, make available to, or process through the Service, or that the Service generates for Customer.

Customer Personal Data means Personal Data contained in Customer Content that Anygraph processes on behalf of Customer in providing the Service.

Data Protection Laws means all privacy, data protection, and data security laws applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and the Personal Data Protection Act 2010 of Malaysia, as amended, replaced, or superseded from time to time.

GDPR means Regulation (EU) 2016/679.

Personal Data has the meaning given under applicable Data Protection Laws and includes equivalent terms such as “personal information.”

Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Anygraph or its Subprocessors.

Subprocessor means a third party engaged by Anygraph to process Customer Personal Data on behalf of Anygraph in connection with the Service.

UK GDPR means the UK General Data Protection Regulation and the UK Data Protection Act 2018.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

2. Roles of the parties

For Customer Personal Data, Customer is the controller and Anygraph is the processor, or the equivalent terms under Data Protection Laws. Customer decides the purpose. The instruction for each processing event is the request an authorized user submits in the desktop application.

Anygraph acts as a controller for Personal Data it processes for its own business purposes, such as account administration, billing, support communications, product telemetry attributable to identified users, legal compliance, and security operations. That processing is described in Anygraph’s Privacy Policy and is not governed by this DPA except where expressly stated.

3. Where Customer Content is processed

Customer files are not stored on Anygraph infrastructure. The desktop application keeps each user’s threads in a local database on the user’s workstation. Customer Content leaves the workstation only for the operation the user runs, and only to the Subprocessor that performs that operation, as listed in Annex 3. Every Subprocessor that receives Customer Content processes it under zero data retention or ephemerally, and none uses it to train models.

The Anygraph gateway routes requests and holds account, workspace, usage, billing, configuration, and library-access records. It does not store Customer files or conversation transcripts.

4. Processing instructions

Customer instructs Anygraph to process Customer Personal Data only as necessary to provide, operate, support, and secure the Service in accordance with the Agreement, this DPA, Customer’s use of the Service, Customer’s account settings, and other documented instructions from Customer.

Anygraph will process Customer Personal Data only:

1. to provide the Service and perform the Agreement;
2. in accordance with Customer’s documented instructions;
3. as permitted by this DPA, the Agreement, or Customer’s account settings; or
4. as required by applicable law.

If Anygraph is required by law to process Customer Personal Data outside Customer’s instructions, Anygraph will notify Customer before processing unless legally prohibited. If Anygraph reasonably believes an instruction violates Data Protection Laws, Anygraph will notify Customer unless legally prohibited.

5. No secondary use and no model training

Anygraph does not use Customer Content or Customer Personal Data to evaluate, test, benchmark, analyze, or improve the Service. Anygraph will not use Customer Content or Customer Personal Data to train, fine-tune, or improve foundation models or any other AI models, and will not permit a model provider or other Subprocessor to do so. Anygraph will not make any of these uses without Customer’s prior written agreement.

6. Customer obligations

Customer is responsible for:

1. complying with Data Protection Laws that apply to Customer’s collection, use, and disclosure of Customer Personal Data;
2. providing all required notices and obtaining all required rights, permissions, and consents for Customer Personal Data processed through the Service;
3. ensuring that Customer has a lawful basis to disclose Customer Personal Data to Anygraph and to instruct Anygraph to process it;
4. using the Service in accordance with the Agreement and applicable law;
5. securing Customer’s own devices, files, systems, credentials, and backups; and
6. not submitting Customer Personal Data that would require Anygraph to comply with law-specific or industry-specific obligations unless Anygraph has agreed to those obligations in writing.

This Section does not restrict ordinary audit, accounting, tax, payroll, financial, compliance, or business records that Customer is authorized to process through the Service.

7. Anygraph obligations

Anygraph will:

1. process Customer Personal Data in accordance with this DPA and Customer’s documented instructions;
2. ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations;
3. implement and maintain the technical and organizational measures described in Annex 2;
4. assist Customer with privacy compliance obligations as described in Section 10;
5. use Subprocessors only as described in Section 8;
6. notify Customer of Security Incidents as described in Section 11; and
7. delete or return Customer Personal Data under Anygraph’s control as described in Section 12.

8. Subprocessors

Customer gives Anygraph general written authorization to engage the Subprocessors listed in Annex 3 to process Customer Personal Data as necessary to provide, support, secure, and operate the Service. Anygraph maintains the current list on trust.anygraph.ai.

Before a new Subprocessor processes Customer Personal Data, Anygraph will give notice by updating the list or by another reasonable method. For an enterprise customer, Anygraph notifies the customer’s IT contact before the change is put into production, including the purpose of the change. An emergency security change is communicated promptly. Customer may object on reasonable data protection grounds within the notice period. If the parties cannot resolve the objection through commercially reasonable measures, Customer may stop using the affected portion of the Service or terminate the affected Service as permitted by the Agreement.

Anygraph binds each Subprocessor to written terms that protect Customer Personal Data at least as well as this DPA, and remains responsible for each Subprocessor’s performance of those terms.

9. Security measures

Anygraph will implement and maintain technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and accidental loss, destruction, alteration, disclosure, or access. Those measures are described in Annex 2. Anygraph may update them from time to time, provided the update does not materially reduce the overall level of protection.

The Service is a desktop application that runs close to Customer’s local files. Customer remains responsible for the security, configuration, access control, and backup of Customer’s own devices, files, and local application data.

10. Assistance with privacy compliance

Taking into account the nature of the processing and the information available to Anygraph, Anygraph will provide reasonable assistance to Customer as required by Data Protection Laws, including with:

1. responding to requests from individuals exercising privacy rights;
2. securing Customer Personal Data processed by Anygraph;
3. investigating and responding to Security Incidents;
4. conducting data protection impact assessments and consulting supervisory authorities where required; and
5. making information available to demonstrate Anygraph’s compliance with this DPA.

If Anygraph receives a request from an individual relating to Customer Personal Data, Anygraph will direct the individual to Customer unless legally required to respond directly. Anygraph may charge reasonable fees for assistance not required by Data Protection Laws, unless the assistance is needed because of Anygraph’s breach of this DPA.

11. Security Incident notice

Anygraph will notify Customer without undue delay, and no later than 48 hours, after confirming a Security Incident affecting Customer Personal Data. The notice will include the information reasonably available to Anygraph, which may include:

1. the nature of the Security Incident;
2. the categories and approximate volume of Customer Personal Data affected, if known;
3. the likely consequences, if known;
4. the measures taken or proposed to address the Security Incident; and
5. contact information for follow-up.

Anygraph may provide this information in phases as it becomes available. Where Anygraph is the controller, it notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and it notifies affected individuals when a high risk is likely. A signed agreement that sets a shorter notice period controls.

12. Retention, deletion, and return

Retention of records under Anygraph’s control:

On Customer’s written request, Anygraph will delete or return Customer Personal Data under its control within 30 days, unless retention is required by law. On request, Anygraph will confirm deletion in writing. Anygraph holds no physical media with Customer Personal Data, so it does not issue certificates of physical destruction.

13. Audits and information rights

On reasonable written request, Anygraph will make available the information reasonably necessary to demonstrate compliance with this DPA, including its SOC 2 Type II report, the zero-data-retention evidence for its Subprocessors, Subprocessor terms, and its current security policies.

Customer may request an audit of Anygraph’s compliance with this DPA no more than once in any 12-month period, unless a Security Incident or regulatory request gives Customer a reasonable basis for an additional audit. An audit must be conducted on reasonable advance notice, during normal business hours, without unreasonable disruption, by Customer or an independent auditor bound by confidentiality, and at Customer’s expense unless it identifies a material breach of this DPA by Anygraph. Anygraph may satisfy an audit request with documentation, third-party reports, certifications, or questionnaire responses where they reasonably address the request. Anygraph is not required to give access that would compromise security, breach confidentiality obligations, expose another customer’s data, or violate law.

14. International transfers

Customer Personal Data may be processed in the locations listed in Annex 3. Where Data Protection Laws require a transfer mechanism, the parties will use an appropriate one, which may include:

1. the EU Standard Contractual Clauses, Module 2 (controller to processor), adopted by Commission Implementing Decision (EU) 2021/914;
2. the UK International Data Transfer Addendum or another UK-approved mechanism;
3. the Swiss amendments to the EU Standard Contractual Clauses;
4. an adequacy decision, including the EU-US Data Privacy Framework, UK Extension, or Swiss-US Data Privacy Framework where applicable; or
5. another lawful transfer mechanism available under Data Protection Laws.

If the EU Standard Contractual Clauses apply, they are incorporated by reference. Customer is the data exporter and controller; Anygraph is the data importer and processor; the processing details are in Annex 1; the technical and organizational measures are in Annex 2; the Subprocessors are in Annex 3; and the competent supervisory authority is determined under Clause 13. If this DPA and the Clauses conflict for a restricted transfer, the Clauses control.

Where a Data Protection Law of another jurisdiction restricts the transfer of Customer Personal Data outside that jurisdiction, the parties rely on this DPA, including Sections 7 to 12 and Annexes 2 and 3, as the contractual safeguard for the transfer, unless that law requires a different mechanism. Anygraph will give Customer the information it reasonably needs to assess each transfer to a location in Annex 3, and will update that information when a Subprocessor location changes.

15. Changes to this DPA

Anygraph may update this DPA to reflect changes in the Service, Data Protection Laws, Subprocessors, or security measures. An update will not materially reduce Customer’s rights or Anygraph’s obligations during an active paid subscription term. Where an update materially affects the processing of Customer Personal Data, Anygraph will give reasonable notice before it takes effect, unless a shorter period is required by law or for security reasons. A version signed by both parties is not changed without Customer’s written agreement.

16. Order of precedence

If documents conflict on Customer Personal Data, this order applies: the applicable Standard Contractual Clauses or other mandatory transfer terms; this DPA; the Agreement; Anygraph’s Privacy Policy; and any other referenced policy or documentation.

Annex 1: Details of processing

Subject matter. Provision of the Anygraph desktop application and related authentication, model inference, document processing, telemetry, support, security, update, and operational services.

Nature and purpose. Local desktop processing; authentication; request routing; model inference; PDF parsing; web search; document search and retrieval over public reference material; remote agent runs when the workstation cannot take the job; operational telemetry; support; and security monitoring, to provide, operate, support, and secure the Service.

Duration. The term of the Agreement and the deletion periods in Section 12.

Frequency. As initiated by Customer’s authorized users through use of the Service.

Data subjects. Customer’s authorized users and personnel; Customer’s clients and their personnel; vendors, customers, employees, contractors, and other individuals whose Personal Data appears in Customer Content.

Categories of data. Names; email addresses; contact details; user identifiers; account metadata; prompt text; file excerpts; model context and responses; business, financial, transaction, payroll, and tax records; contracts; and other information in Customer Content.

Special category data. Not required by the Service. Customer controls the Customer Content it processes and is responsible for having authority to process any sensitive, special category, regulated, or confidential information.

Processing operations. Access, reading, extraction, transmission, routing, analysis, generation, deletion, and other processing necessary to provide the Service. Customer Content is not stored on Anygraph infrastructure.

Annex 2: Technical and organizational measures

• Data minimization: Customer’s files and threads stay on Customer’s workstations; content leaves only for the operation the user runs.
• Encryption in transit: all connections use TLS 1.2 or later. gateway.anygraph.ai is served over HTTPS only, with TLS terminated by Railway.
• Network protection: the gateway is protected by Layer 4 DDoS protection and a Layer 7 edge route allowlist.
• Encryption at rest: the production database and its backups are encrypted at rest with AES by PlanetScale.
• Access control: users sign in through WorkOS; every gateway request needs a valid token and an active organization membership. Customer organizations have two roles, Admin and User; only an Admin can add, change, or remove members, and a removed member fails the membership check on the next request.
• Privileged access: production access is limited to named personnel, protected by multi-factor authentication, and reviewed quarterly.
• Subprocessor retention: model inference runs under zero data retention, so prompts and responses are not written to provider storage after the request and are not used to train provider models. Every other Subprocessor that receives Customer Content processes it under zero data retention or ephemerally, as stated in Annex 3.
• Change management: changes are tracked, reviewed before merge, and deployed to production through a separate confirmed step with a health check.
• Monitoring and incident response: application telemetry and alerting, and a documented incident response plan tested annually.
• Business continuity: managed database with one primary, two replicas, and managed backups; recovery targets of 4 hours (RTO) and 1 hour (RPO).
• Personnel: confidentiality obligations and security awareness activities for all personnel.
• Vendor oversight: each production vendor has a system owner and is reviewed under Anygraph’s Third-Party Management Policy.

Annex 3: Subprocessors

Every Subprocessor that receives Customer Content processes it under zero data retention or ephemerally, and none uses it to train models.

Service providers that do not receive Customer Content: Cloudflare (DNS and website hosting for anygraph.ai).