Data Processing Addendum

aityx, a product of Aletyx, Inc.

Last updated October 7, 2026.

This Data Processing Addendum (“DPA”) supplements the Terms of Service at aletyx.ai/legal/aityx-terms/ (the “Terms”) between Aletyx, Inc. (“Aletyx,” “we,” or “us”) and the customer agreeing to the Terms (“Customer”). This DPA applies whenever Aletyx processes personal data contained in Customer’s Content, as defined in the Terms, in the course of providing the Service. Capitalized terms not defined here have the meaning given in the Terms.

1. Roles of the Parties

Customer is the controller of personal data contained in its Content. Aletyx is the processor, acting solely on Customer’s documented instructions as set out in this DPA and the Terms.

2. Subject Matter, Nature, and Purpose of Processing

Aletyx processes personal data contained in States, Questions, and Documents, as those terms are defined in the Terms, solely to generate and execute Models and to return Receipts, consistent with Section 4 of the Terms. Aletyx does not process personal data within Content for any purpose other than providing the Service, except as this DPA or the Terms separately permit.

3. Duration of Processing

Aletyx processes personal data for the duration of the Terms, and for any period afterward during which Aletyx retains Content consistent with Section 16 of the Terms.

4. Categories of Data Subjects and Personal Data

The categories of data subjects and personal data processed are determined by Customer through the Content it submits. Customer is responsible for ensuring it has a lawful basis to submit any personal data to the Service and for not submitting special categories of personal data unless the nature of the decision genuinely requires it.

5. Subprocessors

5.1 Authorization

Customer authorizes Aletyx to engage subprocessors to process personal data in connection with the Service, including infrastructure hosting providers and third-party model providers used in Model generation.

5.2 Current Subprocessors

Aletyx maintains a current list of subprocessors at aletyx.ai/legal/aityx-subprocessors/, including the identity of each subprocessor, its function, and, where applicable, its data retention commitment for Content it processes. Aletyx will keep this list current rather than restate it in this DPA, so that an operational change in Aletyx’s infrastructure or model providers does not require an amendment to this DPA.

5.3 Notice of New Subprocessors

Aletyx will provide notice of a new subprocessor by updating the list in Section 5.2 and, if Customer has provided a notification email for this purpose, by email. Customer may object to a new subprocessor on reasonable data protection grounds within 15 days of notice by contacting [email protected]. If the parties cannot resolve the objection, Customer’s sole remedy is to terminate the Terms for the affected Service without penalty.

5.4 Subprocessor Obligations

Aletyx will impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for each subprocessor’s performance of those obligations.

6. Aletyx’s Obligations

Aletyx will:

(a) process personal data only on Customer’s documented instructions, as reflected in the Terms and this DPA, unless required to do otherwise by law, in which case Aletyx will inform Customer before processing unless the law prohibits doing so;

(b) ensure persons authorized to process personal data are bound by an obligation of confidentiality;

(c) implement the security measures described in Section 9 of the Terms;

(d) taking into account the nature of the processing, assist Customer with its obligation to respond to data subject requests to the extent such a request concerns personal data within Content, by providing reasonably requested information or access;

(e) notify Customer without undue delay upon confirming a breach affecting personal data within Content, consistent with Section 9 of the Terms;

(f) make available the information reasonably necessary to demonstrate compliance with this DPA, including by responding to reasonable security questionnaires; and

(g) at Customer’s choice, delete or return personal data within Content upon termination of the Terms, consistent with Section 16 of the Terms, unless applicable law requires continued storage.

7. International Data Transfers

If personal data processed under this DPA is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection, the transfer is made subject to the Standard Contractual Clauses adopted by the European Commission, incorporated into this DPA by reference, with Aletyx as data importer and Customer as data exporter, and with the appropriate module selected based on the parties’ roles under Section 1.

8. Audits

Aletyx will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including Aletyx’s current SOC 2 report upon request. If a further audit is reasonably necessary, it will be conducted at Customer’s expense, during business hours, on at least 30 days’ notice, no more than once per 12-month period absent a confirmed security incident, and subject to confidentiality obligations no less protective than Section 12 of the Terms.

9. Liability

Liability arising under this DPA is subject to the limitations set out in Section 15 of the Terms, except to the extent applicable law prohibits such a limitation.

10. Order of Precedence

If there is a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls. For all other matters, the Terms control.

Last modified: October 7, 2026