Data Processing Addendum

How to execute this DPA

This Data Processing Addendum ("DPA") supplements our Terms of Service (or any separately signed Master Services Agreement). This public page provides the review form; authorized representatives of both parties complete and countersign the account-specific version to make it effective.

To request an executable DPA (often required by enterprise procurement teams), email privacy@foundable.com with your company name, signing authority, processing role, and required transfer mechanism. We will confirm the available form and next steps during intake.

1. Definitions

Unless otherwise defined here, capitalised terms have the meaning given in our Terms of Service or in the GDPR.

• "Customer" (also "you") means the entity that has agreed to the Terms of Service.
• "Foundable" (also "we," "us") means Autono Labs, Inc., a Delaware corporation, which operates the Foundable service. ("Foundable" is the product name; the contracting legal entity is Autono Labs, Inc.)
• "Customer Personal Data" means personal data within Customer Content that Foundable processes on Customer's behalf as part of providing the Service.
• "Data Protection Laws" means the EU GDPR, the UK GDPR, the Swiss FADP, the CCPA/CPRA, and any other applicable data-protection or privacy law.
• "SCCs" means the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner.
• "Subprocessor" means any third party engaged by Foundable to process Customer Personal Data, as listed at /subprocessors.

2. Roles and scope

For Customer Personal Data, Customer is the "controller" (or, if Customer is itself acting as a processor for an upstream controller, Customer is a "processor"), and Foundable is a "processor" (or "subprocessor," as applicable).

For account data and product telemetry that Foundable collects to operate, secure, and improve the Service (described in our Privacy Policy), including the agent traces Foundable keeps for quality monitoring, Foundable is a controller in its own right. That controller-side processing is out of scope for this DPA but is governed by our Privacy Policy. This does not change Foundable's processor role when the same Customer Content is otherwise processed to provide the Service on Customer's instructions.

3. Processing on documented instructions

Foundable processes Customer Personal Data only on Customer's documented instructions. The Terms of Service, the Service's feature configuration in Customer's business, and Customer's interactions with the Service constitute Customer's instructions.

If Foundable is required by law to process Customer Personal Data outside those instructions, we will (where legally permitted) inform Customer before processing.

4. Categories of data and data subjects

The categories of data subjects, personal data, and processing activities covered by this DPA are described in Annex I (below). The duration of processing is the term of the Terms of Service plus the retention period described in our Privacy Policy.

5. Confidentiality

Personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive role-appropriate security and privacy guidance.

6. Security measures

Foundable implements appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. The measures are described in Annex II (below) and on our Security page.

7. Subprocessors

Customer authorises Foundable to engage Subprocessors to process Customer Personal Data, subject to the terms of this Section 7. The current list of Subprocessors is at /subprocessors and is incorporated into this DPA.

Foundable will:

• Use written provider terms that include data-protection obligations required for the applicable processing;
• Remain liable to Customer for the acts and omissions of its Subprocessors;
• Keep the public registry current and provide change notice using the method and period stated in the countersigned DPA.

The countersigned copy defines any objection right, cure process, notice period, and termination remedy. The public registry remains the current source for provider changes.

8. Data subject rights

Taking into account the nature of the processing, Foundable will assist Customer (by appropriate technical and organisational measures, where possible) to fulfil Customer's obligations to respond to requests by data subjects exercising their rights under Data Protection Laws. Owners and admins can export foundable data and operators can delete their account through the product. Contact privacy@foundable.com for authenticated assistance with broader or downstream-provider requests.

If a data subject contacts Foundable directly with a rights request, we will (where lawful) forward it to Customer rather than respond ourselves.

9. Data breach notification

Foundable will notify the customer contact identified in an effective DPA without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Available information may be provided in phases. The notice will include, to the extent known at that time:

• The nature and scope of the breach;
• The categories and approximate number of data subjects and records affected;
• The likely consequences and the measures taken or proposed to address the breach.

We will provide material updates as the investigation progresses. A specific contractual outer limit, if required, must be stated in the countersigned copy and supported by the agreed notice method.

10. Data Protection Impact Assessments

Foundable will provide reasonable assistance to Customer in conducting Data Protection Impact Assessments and prior consultations with supervisory authorities, where required by Data Protection Laws and taking into account the information available to Foundable.

11. Audits

Foundable will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. On reasonable request and no more than once per 12-month period (unless required by a regulator or following a material security incident), Foundable will:

• Respond to a security questionnaire reasonable in scope and timing;
• Provide relevant security-assurance materials under NDA, where available;
• Permit a proportionate audit of Foundable-controlled records, systems, and personnel where the information above is insufficient, subject to confidentiality, security, reasonable notice, non-disruption, and reasonable cost terms in the countersigned DPA. Provider facilities are covered through the applicable provider's assurance materials.

12. International transfers

For a restricted transfer from the EEA, UK, or Switzerland, the countersigned DPA completes the applicable mechanism and its required party, contact, role, authority, selection, and signature details:

• EEA transfers: the parties may execute the 2021 Standard Contractual Clauses using the module appropriate to their roles, together with completed SCC annexes and the competent supervisory authority.
• UK transfers: the parties may execute the UK Addendum with all mandatory Part 1 table selections completed and the mandatory clauses incorporated.
• Swiss transfers: an executed SCC arrangement may be adapted for the Swiss FADP and FDPIC where applicable.

13. Return or deletion of data

Subscription termination does not itself delete an account. An operator can delete their account in the product (Settings, or the waitlist portal while on the waitlist) or by an authenticated request, and can ask for a copy of their data by request. Access is disabled immediately and the deletion is final: a deleted account cannot be restored. The account and every foundable it owns are then erased right away, and the copies our Subprocessors hold are deleted or requested for deletion as the erasure runs. Provider-held copies, financial records, legally retained records, and backups follow their applicable schedules. The countersigned DPA can define any additional return or deletion service level.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits liability that cannot be limited under Data Protection Laws.

15. Order of precedence

In the event of any conflict, the order of precedence is: (1) the SCCs (where applicable); (2) this DPA; (3) the Terms of Service or any separately-signed master agreement.

Annex I: Description of processing

• Subject matter: provision of an AI-powered operations platform ("Foundable") that processes messages and connected-service data on Customer's instruction.
• Nature and purpose: hosting, transmitting, displaying, and analysing Customer Content; generating and retrieving AI output; building, previewing and publishing websites and running their backends; rendering videos; creating embeddings so earlier chats can be recalled; carrying out enabled research, email, texting, social and scheduled workflows; and calling third-party integrations Customer has connected.
• Categories of data subjects: Customer's authorised users (operators, admins), Customer's employees and contractors mentioned in Customer Content, third parties whose data Customer chooses to send through the Service.
• Categories of personal data: names, email addresses, phone or messaging identifiers, message and outreach content, files and media, generated website source and backend data, social-account data, connected-service identifiers, and any other personal data Customer chooses to include in Customer Content.
• Special category data: Foundable is designed for general business data and does not request special-category data. Customer must not include it in free-form Customer Content without a separate written agreement that expressly permits the processing.
• Frequency of transfer: continuous, as Customer uses the Service.
• Retention period: for the active account or foundable, followed by the erasure, provider-cleanup, and backup-rotation process described in our Privacy Policy).
• Subprocessors and recipients: see /subprocessors.
• Competent supervisory authority (SCC Clause 13): completed in the executable SCC package based on the parties and transfer before signature.

Annex II: Technical and organisational measures

Foundable maintains the technical and organisational measures described on our Security page, which include (at minimum):

• Encryption: HTTPS with TLS in transit and TLS to the database; encryption at rest in Aurora and Amazon S3; the credentials of connected services held by the providers that manage them.
• Access control: authenticated company routes recheck current ownership on every request; row-level security in the database; operator tooling limited to allowlisted accounts or verified @foundable.com emails.
• Resilience: two database instances in production with 14-day automated backups and point-in-time recovery; project-specific backup and recovery controls for website backends; rolling deployments with readiness checks and rollback to an earlier release.
• Monitoring: error tracking via Sentry (with redaction of headers, request bodies, URL credentials, structured PII, and known secret fields); explicit product events via PostHog; service logs in AWS CloudWatch.
• Personnel: personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive role-appropriate security and privacy guidance.
• Incident response: notice without undue delay under Section 9, with material investigation updates as more information becomes available.

Annex III: Subprocessors

The authorised Subprocessors processing Customer Personal Data on Foundable's behalf as of the date at the top of this page are:

The canonical, continuously-updated list lives at /subprocessors. Changes and any objection right follow Section 7 and the notice method and period completed in the countersigned DPA.

Miscellaneous

Order of precedence. In the event of a conflict between this DPA and the Terms, this DPA controls for the subject matter it covers. Where the SCCs apply, they prevail over both for transfers within their scope.

Assignment. Neither party may assign this DPA without the other's prior written consent, except that either party may assign it to an affiliate or in connection with a merger, acquisition, or sale of substantially all of its assets, in each case on notice to the other party. Any attempted assignment in breach of this section is void.

Severability. If any provision of this DPA is held unenforceable, the remaining provisions remain in effect, and the parties will replace the unenforceable provision with one that achieves, as closely as legally permissible, the original intent.

No third-party beneficiaries. Except for data subjects' rights under the SCCs and GDPR (which the parties acknowledge), this DPA creates no rights in any third party.

Need a counter-signed copy?

Email privacy@foundable.com with your company name, signing authority, and requested transfer mechanism. We will confirm the available form and next steps during intake.