How we handle personal data on your behalf.

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms of Service (the "Agreement") between Speider, a California general partnership ("Speider," "we," "us," or "our"), and the subscriber identified in the Agreement ("Customer," "you," or "your"). It governs the processing of Personal Data by Speider on Customer's behalf in connection with Customer's use of the Service.

Where the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the United Kingdom General Data Protection Regulation (the "UK GDPR"), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), or any other applicable data protection law (collectively, "Data Protection Laws") applies to the processing of Personal Data hereunder, the parties shall comply with this DPA in addition to those laws.

In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA shall prevail.

Capitalized terms not defined in this DPA have the meanings given to them in the Agreement or in applicable Data Protection Laws. For the purposes of this DPA:

• "Controller": the natural or legal person that determines the purposes and means of processing Personal Data. Customer is the Controller of the Personal Data processed under this DPA.
• "Processor": the natural or legal person that processes Personal Data on behalf of the Controller. Speider is the Processor of the Personal Data processed under this DPA.
• "Personal Data": any information relating to an identified or identifiable natural person that Customer submits to the Service or that Speider processes on Customer's behalf, as further described in Annex 1.
• "Processing": any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Subject": the identified or identifiable natural person to whom Personal Data relates.
• "Sub-processor": any third party engaged by Speider to process Personal Data on Customer's behalf. The current list of approved Sub-processors is set out in Annex 3.
• "Personal Data Breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed under this DPA.
• "Standard Contractual Clauses" or "SCCs": the contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (Module Two: Controller to Processor), as updated from time to time, together with the UK International Data Transfer Addendum issued by the UK Information Commissioner's Office, where applicable.

The parties acknowledge and agree that, with respect to the processing of Personal Data under this DPA:

• Customer is the Controller of the Personal Data.
• Speider is the Processor of the Personal Data and acts on Customer's documented instructions.
• Where Customer processes Personal Data relating to its own clients or to natural persons identified in those clients' matters (such as counterparties, named executives, or other individuals referenced in a client profile), Customer is responsible for establishing the lawful basis for that processing, providing required notices to Data Subjects, and responding to Data Subject requests, except to the extent Speider provides assistance under Section 7.

Each party shall comply with its respective obligations under applicable Data Protection Laws.

Speider shall process Personal Data only on Customer's documented instructions, which are set forth in the Agreement, this DPA, and Customer's use of the Service. The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Annex 1.

Speider shall not process Personal Data for any purpose other than as instructed by Customer or as required by applicable law. If Speider is required by applicable law to process Personal Data otherwise than as instructed by Customer, Speider shall notify Customer of that legal requirement before processing, unless prohibited by law on important grounds of public interest.

If Speider becomes aware that an instruction from Customer would violate applicable Data Protection Laws, Speider shall promptly inform Customer.

Speider shall ensure that all personnel authorized to process Personal Data under this DPA have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to Personal Data is limited to personnel who require such access to perform their duties.

Speider shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure. The measures in place as of the Effective Date are described in Annex 2.

Speider may update its technical and organizational measures from time to time, provided that the overall level of security shall not be materially reduced. Customer can request the current list of measures by emailing hello@speider.ai.

Customer grants Speider a general authorization to engage Sub-processors to assist in providing the Service, subject to the following conditions:

• Speider shall maintain a current list of approved Sub-processors in Annex 3.
• Speider shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA, except the public search services listed separately in Annex 3. Those receive search terms only and are used under their own published terms, which Speider can't renegotiate; Annex 3 says what each receives.
• Speider shall remain liable to Customer for the acts and omissions of its Sub-processors with respect to Personal Data processed under this DPA, as if performed by Speider itself.
• Speider shall give Customer at least thirty (30) days' prior notice of any intended addition or replacement of a Sub-processor by updating Annex 3 and notifying Customer by email or in-product notice.
• Customer may object to the addition or replacement of a Sub-processor on reasonable data protection grounds within thirty (30) days of the notice. If the parties cannot resolve the objection in good faith, Customer may terminate the affected portion of the Service without further liability, subject to a prorated refund of any prepaid fees for the unused remainder of the then-current Subscription term.

Speider shall, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as possible, in the fulfillment of Customer's obligations to respond to requests from Data Subjects exercising their rights under applicable Data Protection Laws, including the rights of access, rectification, erasure, restriction of processing, portability, and objection.

If Speider receives a request directly from a Data Subject relating to Personal Data processed on Customer's behalf, Speider shall, unless legally prohibited, promptly forward the request to Customer and shall not respond to the Data Subject directly without Customer's prior written authorization, except to confirm that the request has been forwarded to Customer.

Speider shall, on Customer's reasonable request, provide reasonable cooperation and assistance to Customer with respect to: (a) data protection impact assessments under Article 35 of the GDPR; and (b) prior consultations with supervisory authorities under Article 36 of the GDPR.

Speider shall notify Customer without undue delay and, where feasible, within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

The notification shall include, to the extent then known:

• A description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records affected.
• The likely consequences of the Personal Data Breach.
• The measures taken or proposed to address the Personal Data Breach and to mitigate its possible adverse effects.
• The name and contact details of the Speider point of contact for further information.

Where information is not available at the time of the initial notification, Speider shall provide it in subsequent updates as soon as reasonably practicable. Speider shall provide reasonable cooperation and information to Customer in order for Customer to comply with its own notification obligations under applicable Data Protection Laws.

Speider shall make available to Customer, on Customer's written request, information reasonably necessary to demonstrate compliance with this DPA, and shall permit and contribute to audits, including inspections, conducted by Customer or an independent third-party auditor mandated by Customer, subject to the following:

• Audits shall be limited to once per calendar year, unless a more frequent audit is required by a competent supervisory authority or is reasonably necessary following a Personal Data Breach.
• Audits shall be conducted during normal business hours, on at least thirty (30) days' prior written notice, and in a manner that does not unreasonably interfere with Speider's business operations.
• Where possible, Customer's audit obligations may be satisfied by Speider providing the most recent reports, certifications, or summaries (such as SOC 2 reports from Speider's hosting providers or its own internal security documentation) in lieu of an on-site audit.
• The auditor shall be bound by reasonable confidentiality obligations. Customer shall bear the costs of any audit it requests, except where the audit reveals a material non-compliance by Speider with this DPA, in which case Speider shall bear the reasonable costs.

Speider processes Personal Data on infrastructure located in the United States. If Customer is established in, or transfers Personal Data from, the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction whose Data Protection Laws restrict cross-border transfers, the parties agree that the Standard Contractual Clauses are hereby incorporated by reference and shall apply to such transfers.

For purposes of the Standard Contractual Clauses:

• Customer is the data exporter; Speider is the data importer.
• Module Two (Controller to Processor) applies.
• The optional docking clause is not used.
• The governing law and forum are those of Ireland for EEA transfers and those of England and Wales for UK transfers under the UK International Data Transfer Addendum.
• The information required by the Annexes to the Standard Contractual Clauses is set out in Annex 1, Annex 2, and Annex 3 of this DPA.

The current published version of the Standard Contractual Clauses is available on the European Commission's website. A copy of the executed clauses is available on request at hello@speider.ai.

When Customer's subscription ends, whether Customer cancels it, a payment fails and isn't made good, or a free pilot period runs out, Customer's account stays open and becomes read-only. Speider keeps the Personal Data so Customer can still read it, export it, or delete it, and doesn't delete it on a timer. The Personal Data is kept until the account is deleted.

Return. Customer can export its data at any time from the Account page, in a machine-readable format, including after the subscription has ended.

Deletion. Customer can delete its account at any time from the Account page, and the deletion happens straight away. Where the account is the only member of its workspace, the deletion removes the workspace and all Personal Data in it. Where the account belongs to a shared workspace, the deletion removes that user's account, settings and membership, and the client profiles, lenses, briefings and comments the user created stay with the workspace, because they belong to the Customer's firm rather than to the departing user. Customer should export any data it wishes to keep before deleting. Customer may instead ask Speider in writing to delete the account, and Speider shall do so within thirty (30) days of the request.

Speider shall confirm deletion in writing on Customer's request. Speider may retain Personal Data only to the extent required by applicable law, and only for the period required by that law, after which it shall be deleted.

Uploaded source documents are not retained beyond the document parse call itself (typically under thirty seconds), as described in the Privacy Policy. The deletion obligation in this Section applies to structured Personal Data persisted in Speider's database.

Each party's liability under or in connection with this DPA, whether in contract, tort, or otherwise, is subject to the limitations of liability set out in the Agreement. Nothing in this DPA limits or excludes either party's liability where that liability cannot be limited or excluded under applicable Data Protection Laws.

This DPA shall remain in effect for the term of the Agreement and for as long as Speider continues to process any Personal Data on behalf of Customer. Sections 5 (Confidentiality), 9 (Personal Data Breach Notification, with respect to breaches arising during the term), 12 (Return and Deletion), 13 (Liability), and 15 (General Provisions) shall survive termination.

• Order of precedence.: If there is a conflict between this DPA, the Standard Contractual Clauses, and the Agreement with respect to the processing of Personal Data, the Standard Contractual Clauses shall prevail, then this DPA, then the Agreement.
• Modifications.: Speider may update this DPA from time to time to reflect changes in applicable Data Protection Laws, in the Sub-processor list, or in technical and organizational measures. Material changes will be notified to Customer by email or by an in-product notice before they take effect.
• Severability.: If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
• Notices.: Any notice required or permitted under this DPA shall be given in accordance with the notice provisions of the Agreement, or, if none, to hello@speider.ai.
• Counterparts and electronic signatures.: This DPA may be executed in counterparts and by electronic signature, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

Speider implements and maintains the following technical and organizational measures as of the Effective Date:

• Encryption in transit.: All connections between Customer and the Service, and between the Service and Sub-processors, are protected by Transport Layer Security (TLS).
• Encryption at rest.: Personal Data stored in Speider's database (Supabase) is encrypted at rest by the database provider.
• Per-tenant database isolation.: Speider uses row-level security (RLS) policies scoped to the authenticated user's identifier on every table containing Customer data. No Customer's data is queryable from another Customer's account.
• No raw document storage.: Documents uploaded to the Service are transmitted to the AI processor for a single parse call and discarded from memory at the close of the call. The source documents are never written to Speider's database or to disk on Speider's infrastructure.
• Authentication.: Users sign in with email and password (minimum ten characters) or with Google. A second factor is required on every account: a passkey (Face ID, Touch ID, Windows Hello, or a security key) or an authenticator app (time-based one-time passwords), and a workspace administrator can require one of the two. Password resets require verification through the registered email address. Recovery codes for the authenticator app are hashed using scrypt. Each seat can be signed in on a limited number of devices at once.
• Access controls.: Anthropic API keys and Supabase service-role keys are stored as Vercel environment variables, are restricted to server-side use only, and are never exposed to the browser. Production environment variables are not committed to source control.
• Audit logging.: Sensitive actions (account deletion, data export, history clearing, MFA disable and recovery) are logged to a dedicated audit-log table with the actor, timestamp, and action.
• Vendor security.: Supabase maintains SOC 2 Type II compliance. Vercel maintains SOC 2 compliance. Stripe is PCI-DSS Level 1 compliant and handles payment-card data directly without it touching Speider's infrastructure.
• Security headers.: All HTTP responses include Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, and Permissions-Policy headers.
• Personnel measures.: Access to production systems is limited to the founders. All personnel are bound by confidentiality obligations under Section 5 of this DPA.
• AI processor commitments.: Anthropic processes Personal Data only for the purpose of generating the AI output requested by Speider and does not use Customer Personal Data to train its models, under Speider's agreement with Anthropic.

Speider reserves the right to update these measures from time to time, provided that the overall level of security shall not be materially reduced.

The following Sub-processors are approved as of the Effective Date. Each Sub-processor processes Personal Data only for the purpose described and only to the extent necessary to deliver the Service.

• Anthropic, PBC (United States): AI model inference for company autofill, intake template suggestions, Client Lens generation, document parsing, briefing generation and card summaries, memo and email exports, client notes, and Scout chat. Anthropic does not use Customer Personal Data to train its models under Speider's agreement.
• Supabase Inc. (United States): Managed PostgreSQL database, authentication, and row-level security enforcement. Hosts all persisted Customer data.
• Vercel Inc. (United States): Application hosting and serverless function execution. Processes HTTP requests on Speider's behalf; no Customer Personal Data is persisted on Vercel beyond the duration of a single request or function invocation.
• Stripe, Inc. (United States): Subscription billing and payment processing. Stripe stores cardholder data on its own infrastructure; Speider does not store complete payment card numbers.
• Resend (United States): Transactional email delivery (account confirmations, password resets, billing notifications, team invitations, security alerts, and support responses).
• Voyage AI (United States): Embedding generation for semantic ranking. Receives article text and search terms derived from the Client Lens, and returns numerical vectors only. Voyage AI does not train its models on Customer Personal Data and does not retain it after processing, under Speider's account configuration.
• Upstash, Inc. (United States): Serverless Redis backing per-user API rate limiting. Holds a short-lived request counter keyed to an account identifier; no profile, client or briefing data is transmitted, and entries expire within minutes.
• Functional Software, Inc. d/b/a Sentry (United States): Application error monitoring. Receives diagnostic data when a request fails, reduced to an account identifier. Request bodies, cookies, headers, query strings and any field carrying client content are scrubbed before transmission, and session replay is not enabled.

Better Stack is used to check that speider.ai is reachable from outside Speider's infrastructure. It queries an unauthenticated health endpoint and receives no Personal Data, so it is not listed as a Sub-processor.

Speider may update this list from time to time in accordance with Section 7. The current list is always available at speider.ai/dpa.