Effective Date: October 16, 2026
This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, (a) the Subquadratic API Services Agreement entered into between Subquadratic and Customer, including any Order Form thereunder; or (b) the Subquadratic Terms of Service available at https://subq.ai/terms (the “Self-Serve Terms”), as applicable (each, the “Agreement”), and governs the Processing of Personal Data by Subquadratic on behalf of Customer in connection with the Services. This DPA is effective as of the effective date of the Agreement and does not require a separate signature. By entering into the Agreement, including by accepting the Self-Serve Terms, Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Laws, its Affiliates.
The following terms used herein have the following meanings for the purposes of this DPA. Capitalized terms not defined herein have the meaning set forth in the Agreement.
“Applicable Data Protection Laws” means any applicable laws, rules, or regulations relating to data privacy, data security, data protection, data transfer, breach notifications, or marketing, as applicable from time to time, including without limitation, the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., including as amended by the California Privacy Rights Act of 2020 (“CCPA”); the General Data Protection Regulation (EU) 2016/679 (“GDPR”); the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”); and the Swiss Federal Act on Data Protection (“FADP”); and all amendments, equivalent, comparable, or applicable privacy, security and data breach notification laws.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where “control” means ownership of more than fifty percent (50%) of the voting interests of such entity.
“Aggregate Data” means data that has been aggregated or de-identified so that it does not identify Customer or any natural person.
“Controller” means the Person who, alone or jointly with other Persons, determines the purposes and means of the Processing of Personal Data. The term Controller includes “Business” as defined under the CCPA.
“Data Subject” means a consumer or an identified or identifiable natural person.
“Enterprise Customer” means a Customer that has entered into the Subquadratic API Services Agreement or an Order Form with Subquadratic. “Self-Serve Customer” means a Customer that accesses the Services under the Self-Serve Terms and is not an Enterprise Customer.
“Person” means an individual, entity, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
“Personal Data” means any information relating to an identified or identifiable natural person that is submitted by or on behalf of Customer to Subquadratic, and any other data that constitutes “personal data,” “personal information” or “personally identifiable information” under Applicable Data Protection Laws. For the avoidance of doubt, Usage Data and Aggregate Data are not Personal Data subject to this DPA.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
“Process” or “Processing” means any operation or set of operations performed on Personal Data, whether by manual or automated means, including the collection, use, sale, storage, disclosure, analysis, deletion, or modification of Personal Data.
“Processor” means the Person that Processes Personal Data on behalf of a Controller. The term Processor includes “Service Provider” as defined under the CCPA.
“Prohibited Data” means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; health data; data concerning a natural person's sex life or sexual orientation; government-issued identification numbers (such as Social Security, passport, or driver’s license numbers); financial account information (including credit or debit card numbers, bank account information, or other financial data); information relating to children under the age of sixteen (16), unless Customer has obtained verifiable parental consent in accordance with Applicable Data Protection Laws; any other category of data designated in writing by Subquadratic as prohibited; and data that otherwise constitutes “special categories of data,” “sensitive personal information,” “sensitive personal data,” or “sensitive data” under Applicable Data Protection Laws.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
“Sub-processor” means a Person engaged by Subquadratic to Process Personal Data on Subquadratic’s behalf.
“Usage Data” means information reflecting Customer’s access, interaction, or use of the Services, including but not limited to data relating to access frequency, session duration, feature and functionality usage.
With respect to Personal Data, Customer acts as a Controller and Subquadratic acts as a Processor. Where Customer acts as a Processor on behalf of a third-party Controller, Subquadratic acts as Customer’s Sub-processor, and Customer is responsible for obtaining any authorizations from such Controller necessary for Subquadratic to Process Personal Data under this DPA. Customer will serve as the sole point of contact for Subquadratic with respect to any such third-party Controller. Each party agrees to comply with its respective obligations under Applicable Data Protection Laws and shall provide the level of privacy protection as required by Applicable Data Protection Laws in connection with Personal Data. For the avoidance of doubt, Customer shall not provide to Subquadratic either monetary or other valuable consideration in exchange for Personal Data.
3.1 General. Subquadratic will Process Personal Data solely in accordance with Customer's documented instructions as set forth in this DPA and the Agreement, as necessary to provide the Services described in the Agreement, and as required by applicable law, provided that Subquadratic notifies Customer of such legal requirement unless prohibited by law.
3.2 Scope of Processing. Customer's instructions for Processing Personal Data are to Process data and content submitted by or on behalf of Customer to the Services under the Agreement; detect, investigate, and prevent violations of the Agreement and Subquadratic’s Usage Policy, including through automated systems and limited human review; store and maintain such Personal Data as necessary to provide the Services; and delete or return Personal Data as specified in Section 7 below. Additional details of Processing are set forth in Schedule 1 to this DPA. Subquadratic will not use Personal Data to train or improve its foundational models.
3.3 Prohibited Data. Customer acknowledges and agrees that the Services are not designed to Process Prohibited Data, and Customer shall not, and shall not permit any third party to, submit or cause to be submitted to the Services any Prohibited Data, unless expressly agreed in writing by Subquadratic.
3.4 Customer Obligations. Customer is responsible for the accuracy, quality, and legality of (i) any Personal Data; (ii) the means by which Customer acquired Personal Data; and (iii) the instructions it provides to Subquadratic regarding the processing of Personal Data. Customer represents and warrants to Subquadratic that it has obtained and will maintain all necessary rights, consents, licenses, and permissions, and has provided all necessary notices and opt-out mechanisms required by Applicable Data Protection Laws to make available Personal Data to Subquadratic as contemplated in the Agreement, without violation or infringement of any third-party intellectual property, publicity, privacy, or other rights; Applicable Data Protection Laws; or any terms of service, privacy policies, or other agreement. Customer shall not provide or make available to Subquadratic any Personal Data in violation of, or outside the scope of, the Agreement or otherwise inappropriate for the nature of the Agreement, and shall indemnify Subquadratic from all claims and losses in connection therewith.
Customer acknowledges and agrees that Subquadratic may engage Sub-processors to assist in providing the Services. Subquadratic’s current Sub-processors are listed at https://trust.subq.ai/subprocessors, as referenced in Schedule 3. When engaging Sub-processors, Subquadratic will ensure Sub-processors are bound by data protection obligations equivalent to those in this DPA and remain responsible to Customer for Sub-processors' performance.
Subquadratic will provide at least thirty (30) days' advance notice of new Sub-processors by updating the Sub-processor list at https://trust.subq.ai/subprocessors (and, where Customer has subscribed to updates through that page, by email) or by otherwise notifying Customer in writing. Customer may object to new Sub-processors by providing written notice within fifteen (15) days, provided such objection is based on reasonable and documented data protection concerns. If Customer reasonably objects to the engagement of a new Sub-processor, then the parties shall work in good faith to achieve a reasonable resolution. If none can be reached, then Subquadratic shall, at its option: (i) not engage the new Sub-processor; or (ii) permit Customer to suspend or terminate the portion of the Agreement that requires the engagement of said Sub-processor. For Self-Serve Customers, termination under clause (ii) will be effected by closing Customer’s account, and any refund of prepaid, unused fees will be governed by the Self-Serve Terms. If Customer does not object within the fifteen (15) day period, Customer will be deemed to have authorized the new Sub-processor.
Consistent with Applicable Data Protection Laws, Subquadratic implements and maintains appropriate technical and organizational security measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, as further detailed in Schedule 2.
The parties agree that the measures set out in Schedule 2 provide a level of security appropriate for Customer Content (including Personal Data), taking into account the risks of Processing data as outlined in the Agreement and this DPA.
Customer is responsible for responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws concerning Personal Data, including requests for access to Personal Data, rectification of inaccurate Personal Data, erasure of Personal Data, restriction of Processing, data portability, and objections to Processing. Consistent with and to the extent required by Applicable Data Protection Laws, and taking into account the nature of Processing and information available to Subquadratic, Subquadratic will assist Customer in fulfilling Customer's obligations to respond to Data Subject requests. If Subquadratic receives a Data Subject request pertaining to Personal Data directly, it will promptly notify Customer and will not respond to the request without Customer's authorization, except as required by applicable law.
Personal Data will be retained as set forth in Schedule 1 of this DPA. Within sixty (60) days after termination of the Agreement or closure of Customer's account, Subquadratic will securely delete all Personal Data from Subquadratic's systems. Before such deletion, an Enterprise Customer may request, within thirty (30) days after termination, that Subquadratic return Customer's Personal Data, to the extent it remains in Subquadratic's possession, in a commonly used electronic format. Notwithstanding the above, Subquadratic may retain Personal Data to the extent required by applicable law, legal hold, or pending litigation, and will notify Customer of any such retention requirements.
Consistent with and to the extent required by Applicable Data Protection Laws, upon Customer’s reasonable request, and at Customer’s cost, Subquadratic will: (a) provide reasonable assistance to Customer in conducting any required data protection impact assessments related to Personal Data, taking into account the nature of Processing and information available to Subquadratic; (b) make available to Customer all information in its possession, custody, or control necessary to demonstrate Subquadratic’s compliance with this DPA and Applicable Data Protection Laws; and (c) allow for and contribute to reasonable audits and inspections by Customer or Customer’s designated auditor. Subquadratic will satisfy its obligations under clauses (b) and (c) by making available, upon request, its most recent third-party audit reports or certifications, security documentation, and responses to reasonable security questionnaires. Customer may conduct an on-site or other direct audit only where (i) such information is insufficient to demonstrate Subquadratic’s compliance, (ii) such audit is required by a supervisory authority or Applicable Data Protection Laws, or (iii) Customer is an Enterprise Customer and such audit right is expressly set forth in an Order Form. Customer may use the results of an audit only for the purposes of complying with Applicable Data Protection Laws and/or confirming Subquadratic’s compliance with requirements of the DPA and Applicable Data Protection Laws. Any such audit shall occur no more than once per calendar year under a confidentiality agreement, with no less than sixty (60) days’ prior written notice and based on a mutually agreed-upon scope and procedures. Customer assessments or audits of Subquadratic’s security measures shall be governed by the provisions of Schedule 2.
Customer acknowledges that Subquadratic and its Sub-processors Process Personal Data in the United States. To the extent Customer transfers Personal Data subject to European Privacy Laws (as defined in Section 13) to Subquadratic in a country that has not been deemed to provide an adequate level of protection, the parties agree that such transfer will be governed by the Standard Contractual Clauses, which are incorporated into this DPA by reference, as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Customer is the “data exporter” and Subquadratic is the “data importer”; (c) the optional docking clause in Clause 7 does not apply; (d) Option 2 (general written authorization) applies under Clause 9, with the notice period set forth in Section 4 of this DPA; (e) the optional language in Clause 11 does not apply; (f) the audits described in Clause 8.9 will be carried out in accordance with Section 8 of this DPA; (g) under Clauses 17 and 18, the governing law and forum will be Ireland; and (h) Annexes I and II are completed by Schedules 1 and 2 of this DPA, respectively, and the competent supervisory authority is determined in accordance with Clause 13. For transfers of Personal Data subject to the UK GDPR, the SCCs apply as amended by the International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”), with Table 1 completed by the parties’ information in the Agreement, Table 2 completed as set forth in this Section 9, Table 3 completed by Schedules 1 through 3, and either party may end the UK Addendum as set out in Section 19 thereof. For transfers of Personal Data subject to the FADP, the SCCs apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and the term “member state” not interpreted to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence. Subquadratic may adopt an alternative transfer mechanism recognized under European Privacy Laws (including any successor version of the SCCs or a recognized certification framework) by notice to Customer. In the event of a conflict between this DPA and the SCCs, the SCCs will prevail.
Subquadratic will notify Customer without undue delay and in any case within 72 hours of becoming aware of any Personal Data Breach, using the contact information set forth in the Order Form or, if none, the email address associated with Customer’s account, and reasonably cooperate with Customer for the purposes of responding to a Personal Data Breach. Subquadratic’s notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement by Subquadratic of any fault or liability with respect to the Personal Data Breach. Customer is responsible for determining whether to notify supervisory authorities and data subjects as required by Applicable Data Protection Laws.
Consistent with and to the extent required by Applicable Data Protection Laws, in the event of an investigation, proceeding, formal request for information or documentation, or any similar event in connection with a government authority in relation to Personal Data, each party will promptly and adequately address requests from the other party related to the Processing of Personal Data under this DPA.
With respect to Personal Data that is subject to the CCPA, the parties further agree that: (a) all Personal Data made available to Subquadratic pursuant to the Agreement is done so only for the limited and specified business purposes (as defined under the CCPA, “Business Purposes”) of providing and maintaining the Services under the Agreement; (b) Customer has the right to take reasonable and appropriate steps to help ensure that Subquadratic uses Personal Data in a manner consistent with Customer’s obligations under the CCPA; (c) Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data; (d) Subquadratic will notify Customer if Subquadratic determines that it can no longer meet its obligations under the CCPA; and (e) except as otherwise permitted by the CCPA, Subquadratic will not: (i) “Sell” or “Share” Personal Data (as such terms are defined under the CCPA); (ii) collect, retain, use, or disclose Personal Data outside of the direct business relationship between Subquadratic and Customer, or for any purpose other than the Business Purposes; or (iii) combine Personal Data that Subquadratic receives from or on behalf of Customer with personal information that Subquadratic receives from or on behalf of another Person(s), or collects from its own interaction with the Data Subject.
With respect to Personal Data that is subject to the GDPR, UK GDPR, or FADP (collectively, “European Privacy Laws”), Subquadratic will, consistent with and to the extent required by European Privacy Laws: (a) assist Customer through appropriate technical and organizational measures to comply with European Privacy Laws requirements, considering the nature of the Processing; (b) provide reasonable assistance to Customer in its cooperation or prior consultation with supervisory authorities in the performance of its tasks relating to Section 8 of this DPA; and (c) cooperate with Customer for the purposes of Personal Data Breach response, including, where reasonably requested by Customer, assisting Customer with providing notice to the appropriate supervisory authority or to Data Subjects whose Personal Data was or may have been affected. Subquadratic may require Customer to bear the actual costs incurred because of the assistance provided in accordance with this Section 13.
Subquadratic’s liability under this DPA, including any liability arising from or related to the Processing of Personal Data, Personal Data Breaches, Sub-processors, security measures outlined in Schedule 2, or any other matter arising under this DPA, is subject to and shall not exceed the limitations on liability, exclusions, caps, and disclaimers contained in the Agreement.
This DPA will remain in effect for as long as Subquadratic Processes Personal Data on behalf of Customer under the Agreement. Upon termination of this DPA or the Agreement, the provisions regarding data return and deletion, confidentiality, limitation of liability, and dispute resolution will survive.
This DPA supplements the Agreement and does not replace it. In case of conflict between this DPA and the Agreement regarding Personal Data Processing, this DPA will prevail. For Enterprise Customers, this DPA may only be modified by written agreement of both parties, except that Subquadratic may update this DPA to comply with changes in Applicable Data Protection Laws by providing thirty (30) days' notice to Customer. For Self-Serve Customers, Subquadratic may update this DPA from time to time by posting an updated version at https://subq.ai/data-processing-agreement, in accordance with the modification provisions of the Self-Serve Terms, provided that no such update will materially diminish the protections afforded to Personal Data under this DPA, except as required by Applicable Data Protection Laws. If any provision of this DPA is found invalid or unenforceable, the remainder will remain in effect. This DPA will be governed by the same law as the Agreement, except where Applicable Data Protection Laws require otherwise.
Subquadratic Contact Information for Data Protection Matters:
Subquadratic Data Protection Officer: dpo@subq.ai
Customer Data Protection Contact: As specified in the Order Form or, if none, the email address associated with Customer’s account
Subquadratic’s provision of Services under the Agreement.
The term of the Agreement.
Data Subjects whose Personal Data is included in data or content submitted by or on behalf of Customer to the Services, which, as determined by Customer, may include Customer’s end users, Customer’s customers, Customer’s employees and contractors, and other individuals, together with Customer’s authorized users of the Services. An Enterprise Customer may further specify the categories of Data Subjects in an Order Form.
Any Personal Data included in data or content submitted by or on behalf of Customer to the Services, as determined by Customer, which may include contact information (e.g., name, phone number, email address, physical address); technical identifiers and metadata (e.g., username, device identifier, IP address, session times); and user interaction data (e.g., prompts, inputs, and outputs). An Enterprise Customer may further specify the categories of Personal Data in an Order Form.
Special Categories of Data. None. Customer will not submit Prohibited Data to the Services, as set forth in Section 3.3 of the DPA.
Continuous.
Performing Services on behalf of Customer under the Agreement, including Processing data and content submitted by or on behalf of Customer to the Services; storing and maintaining Personal Data as necessary to provide the Services; and deleting or returning Personal Data as specified in the DPA and this Schedule 1.
Inputs and outputs submitted through the Services, including related safety classification results, are deleted within sixty (60) days after processing, except that content flagged for a potential violation of the Agreement or Subquadratic’s Usage Policy may be retained for as long as reasonably necessary to investigate and address the violation, and except where longer retention is required by law. Where zero data retention is enabled for Customer’s account, inputs and outputs are not retained after processing, except for content flagged for a potential violation of the Agreement or Subquadratic’s Usage Policy, or as required by law. All other Personal Data will be deleted within sixty (60) days after termination of the Agreement or closure of Customer’s account, consistent with Section 7 of the DPA.
See Schedule 3.
This Security Schedule forms part of the DPA and the Agreement and establishes the security controls and measures governing the Services.
Subquadratic maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of data or content submitted by or on behalf of Customer to the Services, including inputs, outputs, and any derivatives thereof (“Customer Content”). Subquadratic’s information security program takes into account the state of current technology, costs of implementation, and the nature, scope, context, and purposes of processing. Subquadratic’s program is aligned with one or more industry-recognized frameworks (e.g., NIST CSF, CIS CSC, AICPA SOC 2, ISO 27001).
2.1 Data Encryption. Subquadratic follows industry standard encryption measures to protect Customer Content, including by applying TLS 1.2 or higher (or successor protocols providing equivalent or greater protection) to Customer Content in transit.
2.2 Access Controls. Subquadratic requires multi-factor authentication for administrative access to systems processing Customer Content. Subquadratic implements role-based access control (RBAC) consistent with the principle of least privilege. Consistent with a risk-based approach, Subquadratic conducts periodic access reviews and promptly deprovisions terminated users. Subquadratic also restricts privileged access to administrative functions, enforces length and complexity rules for user passwords, and times out inactive user sessions.
2.3 Network Security. Services are hosted on cloud services with industry-standard security certifications, and Subquadratic implements commercially reasonable network security measures designed to detect and prevent unauthorized access to Customer Content and network assets. These measures include network segmentation, secure configuration of network devices and firewalls, network traffic logging and monitoring, and regular vulnerability scanning and penetration testing.
2.4 Application Security. Subquadratic implements commercially reasonable application security controls designed to protect the Services. These include secure software development lifecycle (SDLC) practices with regular security code reviews.
Subquadratic conducts vulnerability assessments on a risk-based schedule, with remediation timelines based on severity and exploitability. Subquadratic promptly addresses critical vulnerabilities and remediates other vulnerabilities on a risk-based schedule.
Subquadratic maintains security incident response procedures consistent with industry cybersecurity frameworks, including incident identification, escalation, containment, and remediation. Subquadratic will notify Customer promptly upon becoming aware of a security incident that has a material impact on the confidentiality, integrity, or availability of Customer Content. To the extent a security incident constitutes a Personal Data Breach, notification shall be governed by Section 10 of the DPA.
Subquadratic maintains backup and recovery procedures consistent with industry standards, including regular automated backups with appropriate retention periods, secure storage with encryption and access controls, and testing of recovery procedures. Subquadratic also maintains business continuity and disaster recovery plans, consistent with industry standards, that are designed to promote redundancy and availability of network resources and business services.
Subquadratic monitors its systems and procedures for resilience and compliance on an ongoing basis. It subjects itself to third-party security assessments, and Customer may request, no more than once per calendar year, a copy of Subquadratic’s most recent and available third-party certification(s).
Customer acknowledges that: (a) Customer is solely responsible for the security of its own systems, networks, and environments, including any integration with the Services; (b) Customer is responsible for implementing appropriate access controls and credential management for its authorized users; (c) the security of Customer Content while in transit to Subquadratic is a shared responsibility, and Customer must use the secure transmission methods specified in Subquadratic’s documentation; and (d) Customer will promptly notify Subquadratic of any known or suspected security incident originating from Customer’s environment that may affect the Services.
This Security Schedule describes Subquadratic’s security program and does not constitute a guarantee against cyber threats or harm. Subquadratic's liability for security matters shall not exceed the limitations on liability, exclusions, caps, and disclaimers contained in the Agreement.
Subquadratic’s current Sub-processors are listed at https://trust.subq.ai/subprocessors, as updated from time to time in accordance with Section 4 of the DPA.
