Data Processing Addendum.

For the connected source data and the outputs derived from it, you are the controller (or processor for your own customers) and Synchronise AIis the processor (a “service provider” under US law). For account, billing, and product-usage data, Synchronise AI is the controller, governed by the Privacy Policy. Capitalised terms not defined here have the meaning given in the Terms.

• Subject matter & duration: processing of connected customer data for the term of your subscription, until deletion.
• Nature & purpose: reading product signal in memory to generate cited insights, themes, and outputs, including via agents you configure.
• Types of data: the content of the sources you connect (events, tickets, threads, issues, pages, docs, recordings and, where you connect a mailbox, message content and addresses) and the personal data they may contain. Where a provider's consent screen grants broader access than we use, the surplus is not read; see the Privacy Policy.
• Categories of data subjects: your users, customers, and team members as represented in those sources.

We process customer data only on your documented instructions, including those given through the product, unless required by law.

Personnel authorised to process customer data are bound by confidentiality. We maintain the technical and organisational measures set out in Annex A, including per-table row-level isolation, encryption in transit and at rest by our infrastructure providers, and least-privilege access. We do not maintain a parallel datastore mirroring your connected sources; workspace data is held in Tokyo, Japan.

You provide general authorisation for Synchronise AI to engage the sub-processors listed on the Sub-processors page. We impose data-protection obligations on each that are no less protective than this DPA, and we remain responsible for their performance. We will notify workspace admins before a new sub-processor handling customer data takes effect. You may object on reasonable data-protection grounds within 30 days; if we cannot accommodate the objection, you may terminate the affected service.

Where your data actually goes. We do not hold customer data in Australia. Workspace data at rest lives in our database region in Tokyo, Japan. Application hosting, AI inference, transactional email, billing and analytics are performed by sub-processors in the United States, and two prospecting sub-processors operate in the European Union. The current list, with each provider's region, is at Sub-processors. We tell you this plainly because a residency commitment we could not keep would be worth less to you than an accurate description of where your data is.

Australian Privacy Principle 8. Where you are an Australian entity and the personal information you entrust to us is disclosed to an overseas recipient, we take the steps reasonable in the circumstances to ensure that recipient does not breach the Australian Privacy Principles, as APP 8.1 requires. In practice that means each sub-processor is engaged under written terms imposing data-protection obligations no less protective than those in this DPA, is selected in part on its independent security attestation where one exists, and is added only after notice to you under the sub-processor clause above. You should assume that we remain accountable to you for those recipients under section 16C of the Privacy Act 1988 (Cth), and we do not ask you to consent your way out of that accountability under APP 8.2(b).

Contact details and AI providers. As a specific control on the largest of these flows, email addresses and phone numbers are replaced with opaque handles before any prompt is sent to an AI provider, and restored only inside our own systems. The AI provider processes the draft without receiving the contact details of the person it concerns. This is enforced in code at a single chokepoint every model call passes through, not by policy alone. It does not extend to names or to the body of a message you ask us to work on.

UK and EEA data. Where processing involves transferring personal data out of the UK or EEA to a country without an adequacy decision, the EU Standard Contractual Clauses are incorporated into this DPA and apply on their Module Two (controller-to-processor) terms, and Module Three (processor-to-processor) for onward transfers to our sub-processors, with Synchronise AI as data importer. The UK International Data Transfer Addendum applies to UK data and the Swiss addendum to Swiss data.

Taking into account the nature of the processing, we assist you with appropriate measures to fulfil your obligation to respond to data-subject requests, and to meet your security, breach, and impact-assessment obligations under applicable law. Most requests can be actioned directly in-app; for the rest, email gautham.srinivas163@gmail.com.

We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting customer data. Awareness means the point at which we have a reasonable degree of certainty that a security incident has occurred and has compromised personal data, not the moment an alert first fires. Where the full picture is not yet established we still notify inside that window with what we know, and follow up as the investigation develops, rather than delaying the first notice until the facts are complete.

The notice will describe the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed: the information you reasonably need to meet your own obligations, including an eligible data breach assessment under Part IIIC of the Privacy Act 1988 (Cth). We will not make a notification to the OAIC or to your customers on your behalf, or on our own initiative in a way that would pre-empt yours, without telling you first, unless we are independently required to.

Report suspected incidents to gautham.srinivas163@gmail.com with the subject incident. We monitor that address for incident reports and will acknowledge receipt.

On termination, or on your request, we delete or return customer data within a commercially reasonable period and delete existing copies, except where we are required by law to retain it. Live workspace data is removed immediately by cascade; residual copies in routine backups are overwritten on our database provider's standard cycle, consistent with the retention schedule in the Privacy Policy.

We make available the information reasonably necessary to demonstrate compliance with this DPA: principally this document, the sub-processor attestations referenced here, and our responses to a reasonable security questionnaire. If that is insufficient for a regulator or a documented compliance obligation, you may request an on-site audit on reasonable prior notice, no more than once a year, during business hours, subject to confidentiality and at your cost. We may rely on independent third-party reports where available.

Where the California Consumer Privacy Act (as amended by the CPRA) or a comparable US state law applies, Synchronise AIacts as a “service provider” (or processor) and processes customer data only to provide the service under this DPA and the Terms. We do not “sell” or “share” customer data for cross-context behavioural advertising, do not retain, use, or disclose it outside that direct business relationship, and do not combine it with personal information from other sources except as permitted by law.

Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the exclusions and limitations of liability in the Terms of Service. This DPA does not create a separate or additional liability cap.

This DPA is incorporated into and forms part of the Terms of Service. To the extent of any conflict on the subject of personal-data processing, this DPA prevails. For a countersigned copy, or to raise a data-protection question, email gautham.srinivas163@gmail.com.

We maintain the measures below, in part through our infrastructure providers (see Sub-processors). They are appropriate to the risk and evolve as the product matures.

• Access control & tenant isolation: PostgreSQL row-level security on every table, per-workspace policies, least-privilege service access, and OAuth/SSO sign-in.
• Encryption: TLS in transit and AES-256 at rest, provided by our database and hosting providers.
• Credential handling: third-party OAuth tokens held by our connection broker, not by us; application secrets in managed secret stores.
• Application & network security: HMAC-signed internal endpoints, rate limiting, and scoped, short-lived tool sessions for agents.
• Data minimisation: no parallel mirror of connected sources; we persist chat history, working files, outputs, and uploads, not bulk source records.
• Availability & recovery: managed Postgres with routine backups by our database provider.
• Sub-processor management: flow-down obligations and advance notice of changes.
• Personnel: confidentiality obligations for everyone with access.