Data Processing Addendum

This Data Processing Addendum ("DPA") is made between Nace.AI, Inc., a Delaware corporation with its principal office at 366 Cambridge Ave, Palo Alto, CA 94301, USA ("Nace"), and the customer that has accepted the Nace.AI Terms of Service or signed a Separate Agreement ("Customer"). It forms part of the Terms of Service at console.nace.ai/terms, or of the Separate Agreement that refers to it (each, the "Agreement").

How this DPA takes effect. This DPA applies automatically, from the moment processing begins, whenever Nace processes personal data contained in Customer Content on Customer's behalf. Customer accepts this DPA when it accepts the Agreement; no separate signature is required. If Customer needs a countersigned copy, it may request one at support@nace.ai using the signature block in Schedule 1. If Customer and Nace have signed a different data processing agreement, that signed agreement governs instead of this DPA.

1. Scope, roles and priority

1.1 This DPA applies to Customer Data processed by Nace or its Subprocessors in providing the Services, through every Access Method, including the Console, APIs, CLI, SDKs, MCP Server and interactive playgrounds, and for both Perception and Decision models (including Drex).

1.2 Customer decides what Customer Content to submit and for what purpose. Nace processes Customer Content on Customer's behalf, as Customer's "service provider" or "processor" (as those terms are used in applicable data protection laws), under this DPA and Customer's lawful instructions. Customer is responsible for having the rights, and for giving any notices and obtaining any consents, needed to submit Customer Data to the Services.

1.3 If this DPA conflicts with the Agreement, the Privacy Notice, the Documentation or any product setting, this DPA controls with respect to Customer Data. A product setting, Console option or account configuration cannot reduce the protections in this DPA. Stronger commitments in a Separate Agreement continue to apply.

1.4 Customer must not submit Prohibited Data (as defined in the Terms of Service, for example health information subject to HIPAA, full payment card data, credentials and biometric data) unless a Separate Agreement expressly permits it. This DPA does not authorise the submission of Prohibited Data.

2. Definitions

Capitalised terms not defined here have the meanings given in the Agreement.

"Customer Content" means Inputs (documents, files, images, text, prompts, questions, state information, parameters, schemas and other materials submitted to the Services) and Outputs (results returned by the Services), together with any copy, extract or representation derived from them that could reveal or reconstruct their substance (such as converted documents, page images, parsed text, embeddings and indexes), whether or not they contain personal data.

"Operational Metadata" means content-free records about use of the Services, such as request identifiers, timestamps, model and endpoint identifiers, file type, page and token counts, credits consumed, latency, status and error codes, and partially masked API key identifiers. It excludes Customer Content and any excerpt of Customer Content, including content captured in error logs or traces.

"Customer Data" means Customer Content, Operational Metadata, and Customer's account, contact and billing information processed in connection with the Services.

"Saved Content" means Customer Content that Customer affirmatively chooses to keep using a persistence feature of the Services (for example, saved workspaces, drafts, runs or stored results).

"Zero Retention" means the optional account setting described in Section 4.3.

"Subprocessor" means a third party engaged by Nace that processes Customer Data on Nace's behalf, including hosting, infrastructure, storage, workflow and AI model inference providers.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data in the possession or control of Nace or its Subprocessors. Unsuccessful attempts that do not compromise Customer Data (such as blocked log-in attempts or port scans) are not Security Incidents.

"Applicable Data Protection Law" means all privacy and data protection laws that apply to the processing of personal data in Customer Data, including the California Consumer Privacy Act as amended and other U.S. state comprehensive privacy laws.

3. Permitted processing

3.1 Nace will process Customer Content only (a) to provide, maintain, secure and support the Services for Customer in accordance with the Agreement and Customer's use and configuration of the Services, which together form Customer's instructions; (b) to prevent abuse of the Services; and (c) to comply with a binding legal requirement.

3.2 Nace will not: (a) sell or share Customer Content or personal data in Customer Data, including for cross-context behavioural advertising; (b) use Customer Content for advertising; (c) retain, use or disclose Customer Content for any purpose other than those in Section 3.1, or outside the direct business relationship with Customer; or (d) combine personal data in Customer Content with personal data it receives from other sources, except as permitted by Applicable Data Protection Law. Nace understands and will comply with these restrictions.

3.3 Nace personnel may review specific Customer Content only where necessary to troubleshoot a request Customer reports or to provide support Customer asks for, and only for that purpose.

3.4 Nace will promptly tell Customer if it believes an instruction violates Applicable Data Protection Law, and may pause the affected processing while the parties resolve the issue. Nace will also notify Customer if it can no longer meet its obligations under Applicable Data Protection Law.

4. Retention and deletion

4.1 Default retention. Unless Customer saves it as Saved Content, Nace removes Customer Content from active systems within 48 hours after processing completes for Paid Accounts, and within 7 days after processing completes for Free Tier Accounts. For failed or cancelled requests, the period starts when the request fails or is cancelled. Uploads that never enter processing are removed within 24 hours of upload by default, or within a longer period Customer selects of up to 7 days.

4.2 Saved Content. Before Customer saves Customer Content, the relevant feature will state its retention period. Saved Content is kept until the earliest of: Customer deletes it, Customer's Account is closed, or the disclosed retention date is reached. Some saved configuration, such as classification domains, cannot be deleted through the Services because existing results depend on it. It is kept until Customer's Account or organization is closed, or deleted within 72 hours of a request to support@nace.ai.

4.3 Zero Retention. Account owners and administrators may enable Zero Retention. When it is enabled:

(a) Customer Content is deleted from active systems, including caches, within 1 hour after results are delivered, and is not kept as Saved Content;

(b) Customer Content is not written to backups, previous file versions, logs, traces, databases or training datasets;

(c) Nace sends Customer Content only to Subprocessors that are contractually bound not to retain it beyond the request and not to use it for training (fallback processing through OpenRouter is used only where zero-data-retention routing is enforced); and

(d) Nace is responsible for configuring its systems, processing routes and Subprocessors to meet this Section before Zero Retention requests are processed. An incorrect configuration does not excuse non-compliance.

Operational Metadata needed for billing and security is still retained under Section 4.8.

4.4 What deletion covers. Deletion under this Section covers all Customer Content Nace or its Subprocessors keep to provide the Services, including uploaded files, Outputs, temporary processing files, converted documents, page images, caches, embeddings and indexes, and webhook event payloads that contain Customer Content. Nace applies deletion to pending and running jobs so that they do not restore deleted Customer Content.

4.5 Deletion requests. Customer may delete Customer Content through the deletion controls in the Services or by contacting support@nace.ai. Nace removes the requested Customer Content from active systems within 72 hours. A deletion request never extends an earlier deletion deadline.

4.6 Backups. Residual copies in backups are permanently removed within 35 days after removal from active systems. Until then they remain protected under this DPA, are not used for any other purpose, and, if restored for disaster recovery, are deleted again in line with this Section.

4.7 Deletion means deletion. Where this DPA or the Agreement requires Customer Content to be deleted, Nace will delete it. Removing identifiers from, de-identifying, anonymising, aggregating or re-labelling Customer Content does not satisfy a deletion obligation.

4.8 Records Nace may keep. Nace may keep Operational Metadata and account and billing records only as reasonably necessary to operate, bill, support and secure the Services or as required by law, for the periods stated in the Privacy Notice (currently: API logs and usage metadata up to 13 months; account information up to 24 months after the Account is closed; billing records up to 7 years; a deletion record of a hashed file name, file size and page count, with no document content, up to 7 years; one-way hashes of the email address and payment card fingerprint used at sign-up, to prevent repeated free-tier sign-ups; and a record of Customer's acceptance of the Terms and Privacy Notice, each for as long as needed for that purpose). When the period for account information or API logs and usage metadata ends, Nace deletes the records or irreversibly de-identifies them for billing, audit and security purposes, by erasing names, email addresses, user and key identifiers, IP addresses and free text so that only counts, amounts and timestamps remain. These records must not contain Customer Content. Section 4.7 continues to apply to Customer Content, which is always deleted.

4.9 Legal requirements. If binding law requires Nace to keep specific Customer Data that would otherwise be deleted, Nace will keep only that data, only for the period required, use it only for that requirement, and delete it when the requirement ends. Nace will tell Customer about the requirement unless the law prohibits it. This Section does not permit routine retention of Customer Content for debugging, security monitoring or business convenience.

5. No training on Customer Content

5.1 Nace will not use Customer Content to train, fine-tune, evaluate or improve general-purpose or shared models, or to create training or evaluation datasets, and will require its Subprocessors not to do so. This applies to all Accounts, including Free Tier Accounts, Paid Accounts and playground use.

5.2 This restriction also applies to copies and derivatives of Customer Content, including anonymised, de-identified, aggregated or synthetic material derived from it. Re-labelling Customer Content as metadata, feedback or de-identified data does not remove the restriction. An account setting cannot authorise a use that this Section prohibits.

5.3 The only exception is use that Customer separately and expressly authorises in writing (including through an opt-in control in the Console). Any authorisation must identify the Customer Content covered, the permitted purposes, the retention period and how Customer can withdraw it. Accepting the Agreement, using free credits or submitting Feedback is not authorisation. Customer-specific model development requested under a Separate Agreement is governed by that agreement.

5.4 Nace may use Operational Metadata to operate and improve the Services. Operational Metadata does not include the contents of Inputs or Outputs.

6. Location of processing and confidentiality

6.1 Nace is based in the United States. Customer Data is processed and stored in the United States and in the other countries where the Subprocessors listed in Schedule 2 operate, as stated in that Schedule. Where Applicable Data Protection Law requires safeguards for transfers of personal data between countries, Nace will put them in place.

6.2 Nace will treat Customer Content as Customer's confidential information, limit access to personnel who need it to provide the Services or meet obligations under this DPA, and bind those personnel to confidentiality obligations. If disclosure is legally compelled, Nace will disclose only what is required and, where legally permitted, give Customer advance notice and reasonable cooperation.

7. Subprocessors

7.1 Customer authorises Nace to use the Subprocessors listed in Schedule 2 for the functions stated there. The current list is also published at trust.nace.ai/subprocessors.

7.2 Nace will impose written obligations on each Subprocessor that protect Customer Data at least as effectively as the applicable obligations in this DPA, including confidentiality, security, the no-training restriction, and retention terms compatible with Section 4. Subprocessors may receive only the Customer Data needed for their stated function. Nace remains responsible to Customer for its Subprocessors' performance of those obligations. General third-party disclaimers in the Agreement do not relieve Nace of this responsibility.

7.3 Nace will give notice of any new or replacement Subprocessor by updating the list at trust.nace.ai/subprocessors before the Subprocessor begins processing Customer Data and by email to Account owners who have subscribed to updates. If Customer does not agree to a change, Customer may stop using the affected Services and close its Account.

8. Security and Security Incidents

8.1 Nace will implement and maintain technical and organisational security measures appropriate to the nature of Customer Data and the risks of the processing, including those in Schedule 3. Nace will not materially reduce the overall protection provided by those measures during the term of the Agreement.

8.2 Nace will notify Customer of a Security Incident affecting Customer Data without undue delay, and no later than 48 hours after becoming aware of it, by email to the Account owner's address (or the security contact in Schedule 1, if provided). The first notice may be preliminary. It will include what is known about the incident, the Customer Data affected, containment measures taken and a contact for further information. Nace will provide more information as it becomes available, take reasonable steps to contain and remediate the incident, and reasonably help Customer meet its own notification obligations. Notice will not be delayed while the investigation is completed. Notice of a Security Incident is not an admission of fault.

9. Assistance and verification

9.1 Taking into account the nature of the processing and the information available to it, Nace will reasonably assist Customer (a) in responding to requests from individuals exercising their rights under Applicable Data Protection Law in relation to personal data in Customer Data, and (b) in demonstrating compliance with this DPA. If Nace receives such a request directly, it will refer the individual to Customer where it can identify Customer.

9.2 On request, Nace will provide reasonable documentation of its compliance with this DPA, including security information and reports available through the Trust Center at trust.nace.ai (such as its SOC 2 Type 2 report), subject to confidentiality.

9.3 If that documentation does not reasonably address a substantiated compliance concern, the parties will agree a proportionate review by Customer or an independent reviewer, at Customer's cost, with reasonable notice, under confidentiality obligations and with measures that protect other customers' information and the availability of the Services. Nothing in this DPA requires Nace to restore or recreate Customer Content that was deleted under Section 4.

10. Duration and termination

10.1 This DPA applies from the first processing of Customer Data and continues while Nace or its Subprocessors process Customer Data.

10.2 When Customer's Account is closed or the Agreement ends, Nace will stop processing Customer Content except as needed to close the Account, and will delete Customer Content in accordance with Section 4. Customer Content is not held for a general export or return period after termination; Customer is responsible for keeping copies of Inputs and Outputs it needs. Records kept under Sections 4.8 or 4.9 remain protected by this DPA and are deleted when their permitted purpose ends.

10.3 On reasonable request, Nace will confirm in writing that deletion has taken place, or identify the categories of any data kept and the reason under Section 4.8 or 4.9.

11. General terms

11.1 Except as changed by this DPA, the Agreement remains in effect, including its governing law, dispute resolution and limitation of liability terms. General warranty disclaimers in the Agreement do not cancel the express obligations in this DPA. Nothing in this DPA limits rights or obligations that cannot lawfully be limited.

11.2 Nace may update the published version of this DPA. Updates will not reduce the protection of Customer Data already processed, and material changes will be notified as described in the Terms of Service. A countersigned copy can be amended only in writing signed by authorised representatives of both parties.

11.3 This DPA may be accepted electronically and, where countersigned, signed in counterparts. Nace's contact for notices, privacy requests and security matters is support@nace.ai.

Schedule 1: Details of processing

Signature block (only for a countersigned copy on request)

Schedule 2: Subprocessors

Current list of Subprocessors, also published at trust.nace.ai/subprocessors. Each receives only the data needed for its function. Contracting entities and processing locations are to be confirmed before publication.

Also to confirm: whether Cursor and Microsoft Azure, which appear on the Trust Center, process Customer Data and should be listed.

Schedule 3: Security measures

Nace maintains the following measures for the Services. Items marked as pending are commitments that must be implemented and verified before this DPA is published.