NeuroAI Data Processing Agreement

Plain-language summary (does not replace the text of the agreement)

• Your contacts' data (your customers, leads and visitors) belongs to you. You decide what data you collect and why; NeuroAI processes it only to provide the service and on your instructions.
• NeuroAI does not sell that data, does not use it for its own marketing, and does not share mobile numbers or SMS consent with third parties for marketing purposes.
• NeuroAI uses providers (cloud, messaging and telephony, AI models, support) bound by protection obligations similar to this agreement, and notifies you at least 30 days before adding or replacing any of them.
• If a security breach affects your data, we notify you without undue delay (no later than 72 hours after we confirm it).
• You are responsible for having your contacts' permission (consent) to message, call, text, WhatsApp or email them, and for complying with the laws that apply to you.
• When you leave, you have 30 days to reactivate your account or request an export of your data (free of charge, once); the data is deleted no later than 90 days after the end date.

1.Parties and acceptance

1.1This Data Processing Agreement (the "Agreement" or "DPA") is entered into between NeuroAI Inc., a Delaware corporation (United States), with its address at 254 Chapman Rd, Ste 208 #24811, Newark, DE 19702, United States ("NeuroAI", "we" or "us"), owner of the NeuroAI brand and the NeuroAI Studio service (https://neuroaistudio.com and app.neuroaistudio.com), and the person or company that purchases a NeuroAI subscription for its business (the "Customer" or "you").

1.2This Agreement is part of NeuroAI's Terms of Service (the "Terms", published at https://neuroaistudio.com/legal/terms) and is published at https://neuroaistudio.com/legal/dpa. The Customer accepts it by checking the mandatory acceptance box at checkout or by using the Service. Anyone accepting on behalf of a company represents that they have authority to bind it.

1.3If the Customer needs a signed copy of this Agreement (for example, for its own audits or regulators), it may request one at legal@neuroaistudio.com (Section 19), and NeuroAI will send it a signed copy.

2.Definitions

Capitalized terms not defined here have the meaning given to them in the Terms.

• "Data Protection Laws": all privacy and data protection laws that apply to the processing of Customer Data, including, where applicable: the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and its regulations; other U.S. state privacy laws (for example, those of Virginia, Colorado, Connecticut, Utah and Texas); the EU General Data Protection Regulation (GDPR) and its UK and Swiss equivalents; Lebanon's Law No. 81 of 2018 on Electronic Transactions and Personal Data; and the applicable Latin American data protection laws (for example, Brazil's LGPD, Colombia's Law 1581 of 2012, Argentina's Law 25,326 and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties).
• "Communications Laws": the U.S. Telephone Consumer Protection Act (TCPA) and the rules of the Federal Communications Commission (FCC); the CAN-SPAM Act; state telemarketing laws (for example, the Florida Telephone Solicitation Act); the National Do Not Call Registry; the CTIA Messaging Principles and Best Practices and mobile carriers' A2P 10DLC rules; the WhatsApp Business Policy and other Meta terms and policies; and equivalent laws in other countries.
• "Customer Data": personal data of the Customer's Contacts and Users that the Customer, its Users or its Contacts enter, upload, send or generate in the Service, or that the Service receives from channels the Customer connects.
• "Contacts": the people the Customer's business deals with: customers, leads, visitors to its pages, people who fill out its forms, message or call its channels, book appointments, buy, or receive its communications.
• "Users": members of the Customer's team who have access to its account.
• "Processing" or "process": any operation performed on personal data, such as collecting, storing, organizing, accessing, using, sending, transcribing, analyzing, modifying or deleting it.
• "Controller": the party that decides why and how personal data is processed (under other laws: "business" or "data controller"). In this Agreement, the Customer.
• "Processor": the party that processes personal data on behalf of the Controller (under other laws: "service provider", "contractor" or "data processor"). In this Agreement, NeuroAI.
• "Sub-processor": a provider engaged by NeuroAI that processes Customer Data to help provide the Service.
• "Security Breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data. It does not include unsuccessful attempts that do not compromise the data (for example, network scans or failed login attempts).
• "Service": NeuroAI's software (CRM, website, scheduling, messaging by WhatsApp, SMS and email, NEO and other features) under the purchased plan.
• "NEO": NeuroAI's AI-powered virtual assistant, which the Customer can configure to respond to its Contacts.

3.Subject matter, scope and roles

3.1Subject matter. This Agreement governs how NeuroAI processes Customer Data on the Customer's behalf when providing the Service. The description of the processing (data subjects, types of data, nature, purpose and duration) is set out in Annex 1.

3.2Roles. With respect to Customer Data, the Customer is the Controller and NeuroAI is the Processor. If the Customer itself processes that data on behalf of another party (for example, an agency managing its own clients' data, which is permitted only under a separate contract signed with NeuroAI), the Customer warrants that it has that controller's authorization, and NeuroAI will act as a sub-processor.

3.3What this Agreement does not cover. This Agreement does not apply to data that NeuroAI processes as a controller to manage its own relationship with the Customer: account, billing, payments, support, security, fraud prevention, legal compliance, NeuroAI's communications with the Customer and Service usage metrics. That data is governed by NeuroAI's Privacy Policy.

3.4Limited purpose. NeuroAI processes Customer Data only to:

• (a)provide, maintain, protect and support the Service;
• (b)follow the Customer's instructions (Section 4);
• (c)measure usage (messages, minutes, AI usage and Meta fees) in order to charge it to the Customer's wallet and apply spending limits and alerts;
• (d)prevent fraud, abuse, spam and security threats; and
• (e)comply with the law.

4.Customer instructions

4.1NeuroAI processes Customer Data only on the Customer's documented instructions, unless the law requires otherwise. In that case, NeuroAI will inform the Customer before processing, unless the law prohibits it.

4.2The Customer's instructions are:

• (a)this Agreement and the Terms;
• (b)the configuration the Customer and its Users set up in the Service (for example, forms, automations, campaigns, calendars, NEO settings, the integrations they connect and the import or deletion of contacts); and
• (c)other reasonable written instructions the Customer sends through the support channels that are compatible with the Service.

4.3If NeuroAI believes an instruction violates Data Protection Laws or Communications Laws, it will tell the Customer and may decline to carry it out, or suspend the affected processing, until the Customer confirms or changes it. NeuroAI is not required to review whether the Customer's instructions are lawful, and such a notice is not legal advice.

4.4Instructions that require new features or work outside the standard Service are not included in the plan. If NeuroAI can accommodate them, it will quote them separately and will carry them out only after the Customer accepts the quote in writing.

5.NeuroAI's commitments as a service provider (CCPA/CPRA and state laws)

5.1NeuroAI:

• (a)does not sell or "share" Customer Data ("share" as defined in the CCPA/CPRA, meaning for cross-context behavioral advertising);
• (b)does not retain, use or disclose Customer Data for any purpose other than those in Section 3.4, or outside its direct business relationship with the Customer, including for its own marketing;
• (c)does not combine Customer Data with personal data it receives from others or collects on its own, except as permitted by the CCPA/CPRA and its regulations (for example, for security and fraud prevention);
• (d)does not share Contacts' mobile phone numbers or text-messaging opt-in records with third parties or affiliates for marketing or promotional purposes; that information is used only to provide the Service and reaches only the Sub-processors that need it to deliver messages or provide support;
• (e)complies with the obligations that Data Protection Laws impose on processors and gives Customer Data the level of protection those laws require;
• (f)will notify the Customer if it determines that it can no longer meet its obligations under Data Protection Laws; and
• (g)allows the Customer, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Data (for example, exporting it, deleting it or disconnecting integrations).

NeuroAI certifies that it understands these restrictions and will comply with them.

5.2Aggregated or de-identified data. NeuroAI may create aggregated statistics or de-identified data from use of the Service (for example, the number of messages sent or the average response time) to operate, bill for and improve the Service, provided that such data cannot identify the Customer or any individual, that NeuroAI does not attempt to re-identify it, and that any third party receiving it commits to the same. WhatsApp data is never used, even in aggregated or de-identified form, to build, train or improve AI models.

6.Confidentiality

6.1NeuroAI treats Customer Data as confidential information.

6.2NeuroAI gives access to Customer Data only to the staff, contractors and Sub-processors who need it to provide the Service or support, and only to the extent necessary. All of them are bound by written confidentiality obligations or a legal duty of confidentiality.

6.3Support staff of NeuroAI or its Sub-processors access the Customer's account only when needed to handle a Customer request, resolve an issue, protect security or comply with the law.

6.4Government requests. If an authority requests Customer Data from NeuroAI, NeuroAI will try to redirect it to the Customer and, where legally permitted, will promptly notify the Customer so it can object. NeuroAI will disclose only the data it is legally required to disclose.

7.Security

7.1NeuroAI implements, directly or through its Sub-processors, reasonable technical and organizational measures appropriate to the risk to protect Customer Data. Those measures are described in Annex 2. NeuroAI may update them as long as the overall level of protection is not reduced.

7.2Security is shared. The Customer is responsible for: managing its Users and their permissions; using strong passwords and enabling two-step verification; not sharing credentials; removing access for anyone who leaves its team; protecting its devices and the third-party accounts it connects (for example, its Meta or Google account); and configuring the Service securely.

7.3Prohibited data. The Service is not designed for sensitive data. Unless NeuroAI agrees in writing, the Customer must not upload or collect through the Service: payment card or bank account numbers; Social Security numbers, passports or other government-issued identification numbers; biometric or genetic data; third-party passwords; or data of children under 13 (or under 16 where local law requires). Health information (including protected health information under HIPAA or other health laws) is always prohibited, without exception. NeuroAI does not provide the Service to healthcare businesses of any kind, whether or not they handle protected health information (as described in the Acceptable Use, Messaging and AI Policy), and does not sign HIPAA Business Associate Agreements. Payments that Contacts make to the Customer are handled by payment processors (for example, Stripe), and NeuroAI does not store full card numbers.

8.Sub-processors

8.1General authorization. The Customer authorizes NeuroAI to engage Sub-processors in the categories listed in Annex 3 to provide the Service.

8.2Conditions. NeuroAI:

• (a)reasonably evaluates each Sub-processor's security and privacy practices before using it;
• (b)imposes on it, by contract, data protection obligations substantially equivalent to those in this Agreement, as relevant to the service it provides; and
• (c)remains responsible to the Customer for its Sub-processors' compliance, under the terms and within the limits of this Agreement and the Terms.

8.3Information. NeuroAI publishes, and keeps up to date, the list of Sub-processor categories, with their function and the region where they process data, at https://neuroaistudio.com/legal/subprocessors. NeuroAI will disclose the identity of the Sub-processors only to a Customer that an applicable law requires to know it, upon written request to legal@neuroaistudio.com stating that obligation, and as confidential information that the Customer may not disclose except to its authorities or to advisers bound by confidentiality.

8.4Notice of changes. NeuroAI will notify the Customer at least 30 days before adding or replacing a Sub-processor that processes Customer Data, by email to the account owner or through a notice within the Service, and will update the list. If the change is urgent to protect the security or continuity of the Service (for example, because a provider ceases operations), NeuroAI may make it sooner and will give notice as soon as possible.

8.5Objection. The Customer may object in writing to a new Sub-processor, on reasonable data protection grounds, within 15 days after the notice. The parties will work in good faith to find a solution (for example, not using that Sub-processor for the Customer or changing the configuration). If the Customer objects on reasonable data protection grounds and no solution is found, the Customer may cancel the affected Service, and NeuroAI will refund the unused, pro-rated portion of fees prepaid for the current period (item 10.5 of the Terms and item 7.4 d) of the Billing, Renewal, Cancellation and No-Refund Policy). This is one of the exceptions to the "no refunds" rule.

9.Assistance to the Customer

9.1Data subject rights. The Service includes tools that let the Customer respond to its Contacts' rights (to access, correct, export, delete, object, opt out of messages, limit the use of sensitive data, or opt out of the sale or sharing of their data), for example: editing, exporting or deleting contacts, marking "do not disturb" per channel and handling opt-outs (STOP). The Customer is the one who responds to its Contacts.

9.2Requests received by NeuroAI. If a Contact contacts NeuroAI about data that NeuroAI processes for the Customer, NeuroAI will not respond on the Customer's behalf (except to direct the Contact to the Customer) and will forward the request to the Customer within 5 business days, provided it can identify the Customer.

9.3Additional assistance. If the tools are not enough, NeuroAI will reasonably assist the Customer, taking into account the nature of the processing and the information available to it. The self-service tools and this reasonable assistance are free of charge. NeuroAI may charge a reasonable fee, communicated to the Customer before the work begins, only for audits under Section 13.2 and for out-of-the-ordinary work.

9.4Other obligations. Upon the Customer's reasonable request, NeuroAI will provide the information available to it so the Customer can carry out impact or risk assessments, respond to its data protection authorities, or meet its own security obligations.

10.Security breach notification

10.1Timing. NeuroAI will notify the Customer without undue delay and, in any event, within 72 hours after confirming a Security Breach affecting Customer Data.

10.2Content. The notice will include, to the extent known: what happened and when; the types of data and the approximate number of Contacts affected; the likely consequences; the measures taken or proposed; and a contact point for more information. If not everything is known at first, NeuroAI will provide the information in phases.

10.3Delivery. The notice will be sent to the email of the Customer's account owner and to the privacy contact the Customer has registered and, if needed, by phone or within the Service. The Customer must keep that information up to date and may report any suspected breach to NeuroAI at seguridad@neuroaistudio.com.

10.4Measures. NeuroAI will take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with the Customer.

10.5Notices to authorities and individuals. As Controller, the Customer decides on and makes any notifications the law requires to authorities and to its Contacts (for example, the GDPR's 72-hour notice to the supervisory authority or U.S. state data breach laws), with NeuroAI's reasonable assistance. NeuroAI will not notify the Customer's Contacts on its behalf unless the Customer asks it to or the law requires it.

10.6NeuroAI's notice is not an admission of fault or liability.

11.International transfers

11.1Location. NeuroAI is a U.S. company. Customer Data is hosted primarily in the United States and may be processed in other countries where NeuroAI or its Sub-processors operate (Annex 3). The Customer understands and authorizes these transfers and is responsible for informing its Contacts, in its own privacy notice, that their data may be processed in the United States and other countries.

11.2Safeguards. NeuroAI will transfer Customer Data outside its country of origin only in compliance with Data Protection Laws.

11.3Europe and standard contractual clauses (fallback only). The Service is not offered to businesses established in the European Economic Area (EEA), the United Kingdom or Switzerland. If, and only if, NeuroAI agrees in writing to an exceptional case in which the GDPR or its equivalents apply to Customer Data and the transfer to NeuroAI requires safeguards, the parties incorporate by reference the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (Module 2, controller to processor; or Module 3, processor to processor, if the Customer acts as a processor), with the details in Annex 4. For the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner's Office (ICO) applies, and for Switzerland, the adaptations required by Swiss law. NeuroAI requires equivalent safeguards from the Sub-processors that receive that data.

11.4Other countries. If another law applicable to the Customer requires specific clauses or safeguards for data transfers (for example, the standard clauses of the Brazilian data protection authority under the LGPD), the Customer may request them in writing at legal@neuroaistudio.com and the parties will agree on them in good faith.

11.5Sanctions and export controls. Neither party will transfer Customer Data in a way that violates U.S. sanctions or export control laws, including those administered by the Office of Foreign Assets Control (OFAC). The Customer represents that neither it nor its Users appear on any sanctioned-party list, including OFAC's SDN List. The other sanctions rules (including the countries where the Service is not provided) are set out in the Terms. NeuroAI may suspend processing when those laws require it.

12.Return and deletion upon termination

12.1While the subscription is active, the Customer can export its Customer Data with the Service's tools (for example, contacts, conversations and consent records).

12.2After cancelling, the Customer keeps using the Service until the end of the paid period (on the annual plan, until the end of the contracted year). We recommend exporting the data before that date.

12.3Export period. Until the end date, the Customer can export its data from the application. For the following 30 days the account is locked, but the Customer can reactivate it or ask soporte@neuroaistudio.com for an export (for example, in CSV format) of all the data the application allows to be exported. NeuroAI will provide that export free of charge once.

12.4Deletion. After that, NeuroAI deletes or anonymizes the Customer Data in the Service, or has its Sub-processors delete it, no later than 90 days after the end date, unless the law requires it to be retained or it falls under Section 12.5. Backups are deleted in their normal rotation cycle and, while they exist, remain protected by this Agreement and are not used for anything else. Upon the Customer's request, NeuroAI will confirm in writing that the deletion has been completed.

12.5NeuroAI may retain, protected by this Agreement: information it is legally required to keep; proof of acceptance of the Terms and this Agreement; billing records; technical logs, which are deleted in their normal cycles; and Contacts' opt-out records and do-not-contact list (number or email, date and channel), only to honor those opt-outs, comply with the law and carrier and Meta rules, and defend against claims, for the period in section 14 of the Privacy Policy (at least 5 years from the last message, because TCPA claims can be filed years later).

12.6Important note on consent records. Contacts' consent and opt-out records may be the Customer's evidence if a claim is made (for example, under the TCPA). The Customer is responsible for exporting and keeping them for as long as it needs before they are deleted.

12.7Earlier deletion. The Customer can delete Customer Data at any time with the Service's tools. Some deleted items may remain in a recycle bin for a limited time (for example, up to 30 days) before being permanently erased.

13.Reasonable audits and documentation

13.1Documentation. Upon the Customer's written request, and no more than once every 12 months (except as provided in 13.3), NeuroAI will provide the information reasonably necessary to demonstrate compliance with this Agreement, for example: a summary of its security measures; answers to a reasonable security questionnaire; and, where its providers allow them to be shared, summaries of their independent security reports or certifications (for example, SOC 2 or ISO/IEC 27001).

13.2Audit. If that documentation is not enough for the Customer to meet a specific legal obligation, the Customer may request an audit, carried out by the Customer or by an independent auditor bound by confidentiality who is not a competitor of NeuroAI, on these conditions:

• (a)written notice at least 30 days in advance;
• (b)a plan and scope agreed beforehand;
• (c)during business hours and without disrupting the Service;
• (d)no access to other customers' data or to confidential information of NeuroAI or its Sub-processors that is not necessary;
• (e)at the Customer's expense, including, if requested, the reasonable time of NeuroAI's staff, at a reasonable fee that NeuroAI will communicate to the Customer before the work begins; and
• (f)no more than once every 12 months.

13.3Exceptions. The once-a-year limit does not apply if a data protection authority requires the audit or if a Security Breach affected Customer Data.

13.4Sub-processors. Sub-processors' facilities and systems are audited under their own programs and contracts. NeuroAI fulfills this Section by providing the reports or certifications those providers make available to it.

13.5The Customer will share the results of any audit with NeuroAI and treat them as confidential. If non-compliance is found, NeuroAI will remedy it within a reasonable time.

14.Customer responsibilities: data, consent and content relating to its contacts

14.1Legal basis and notices. The Customer is solely responsible for:

• (a)having a valid legal basis to collect and process Customer Data and to give NeuroAI the instructions in this Agreement;
• (b)publishing and complying with its own privacy notice or policy, informing its Contacts that it uses software providers, including AI assistants, and that their data may be processed in the United States; and
• (c)the accuracy, quality and lawfulness of Customer Data and of the means by which it was obtained.

14.2Consent to communicate. Before sending messages or making calls through the Service, the Customer must obtain, keep and honor the consent the law requires for each channel and each purpose. In particular:

• (a)SMS and calls in the U.S.: comply with the TCPA and FCC rules, including prior express written consent for marketing messages or calls that require it; bear in mind that the FCC treats AI-generated voices as "artificial" voices under the TCPA; respect the National Do Not Call Registry, permitted calling hours and state telemarketing laws; and honor opt-outs (STOP or any other reasonable means) within the legal deadlines.
• (b)A2P 10DLC registration and carrier rules: provide truthful information in brand and campaign registration; send only the type of messages registered; identify the business and include opt-out instructions; comply with the CTIA Messaging Principles and Best Practices; and state in its own privacy policy that it does not share its Contacts' mobile numbers or SMS consent with third parties for marketing purposes. A Contact's consent cannot be bought, sold or transferred to another business, and the Customer must not use purchased, rented or third-party lists for SMS, calls or WhatsApp.
• (c)WhatsApp: obtain the Contact's opt-in before sending business-initiated messages; use Meta-approved templates to message outside the customer service window; honor opt-outs and blocks; and comply with the WhatsApp Business Policy, the Commerce Policy and Meta's other terms, including its rules on AI (NEO is used only as an assistant for the Customer's business, never as a general-purpose assistant).
• (d)Email: comply with the CAN-SPAM Act and other applicable laws: identify itself as the sender, not use deceptive subject lines or headers, include a valid postal address and an opt-out method, and honor opt-outs within 10 business days at most.
• (e)Call recording and transcription: give the notices and obtain the consents required by the laws of the place where the call is recorded or transcribed (some states require the consent of all parties).
• (f)Other countries: comply with the commercial communications and data protection rules of the countries where its Contacts are located (for example, in Latin America, Lebanon or the European Union).

14.3Content. The Customer is responsible for the content it sends or publishes through the Service, including content NEO generates based on the Customer's configuration, and for ensuring it is truthful and not deceptive under the Federal Trade Commission Act (FTC Act). The Customer will not publish fake reviews or testimonials, will not gate or condition reviews, and will comply with the FTC rule on consumer reviews and testimonials.

14.4AI with its Contacts. NEO always identifies itself as an AI-powered virtual assistant. The Customer will not configure it to impersonate a human and will comply with laws requiring disclosure of bots or AI (for example, California's bot disclosure law, SB 1001). The Customer reviews the information it gives NEO (prices, hours, policies) and is responsible for the commitments its business makes to its Contacts.

14.5Children. The Customer will not use the Service to target children under 13 or to collect their data (COPPA), or to collect data of minors under 16 where local law requires special consent that the Customer does not have.

14.6Proof. The Customer will keep proof of consent (date, time, source and the text agreed to) and provide it to NeuroAI, carriers or Meta when they request it to handle a complaint, a review or a claim.

14.7Protective measures. To protect the Service, its numbers and its sending reputation, NeuroAI may, with notice where reasonable, pause campaigns, numbers or channels, or block content, if it detects complaints, high opt-out or report rates, lack of consent, or violations of Communications Laws or carrier or Meta policies. Usage charges already deducted from the wallet are not refunded.

14.8Indemnification. The Customer will defend and indemnify NeuroAI and its officers, employees and Sub-processors against claims, fines, penalties and reasonable expenses (including attorneys' fees) arising from: the lack of a legal basis or of consent from its Contacts; the content it sends; the Customer's violation of Communications Laws or Data Protection Laws; or unlawful instructions from the Customer.

15.Third-party services connected by the Customer

15.1If the Customer connects or enables third-party services (for example, its WhatsApp Business or Meta account, its social media, Google, its own payment processor account, or external apps and integrations), those third parties are not NeuroAI's Sub-processors: the Customer deals with them directly, accepts their terms and is responsible for that relationship. NeuroAI exchanges with them only the data needed for the integration the Customer enabled.

15.2Telecommunications carriers and networks that merely transmit messages or calls are not Sub-processors either.

16.AI and data (NEO)

16.1For NEO to respond, summarize, transcribe or classify, NeuroAI sends the necessary parts of Customer Data (for example, the Contact's message, the conversation history and the business information the Customer uploaded) to AI model providers acting as Sub-processors.

16.2NeuroAI does not use Customer Data to train AI models, its own or third parties', and selects AI model providers whose business terms do not allow them to use that data to train their models.

16.3AI responses may contain errors. AI features, their spending limits, alerts and fair use are governed by the Terms.

17.Liability

17.1Each party's liability arising from this Agreement is subject to the limitations and exclusions of liability in the Terms, including the cap on NeuroAI's liability: the amount the Customer paid NeuroAI in the 12 months before the event giving rise to the claim, calculated as set out in the Terms. This Agreement does not expand that liability or set a different cap for data protection.

17.2Nothing in this Agreement limits liability that cannot be limited under applicable law (for example, for fraud or willful misconduct), or the rights the law grants directly to data subjects.

17.3NeuroAI is not liable for damages caused by the Customer's instructions, the configuration the Customer chooses, the lack of consent from its Contacts, the Customer's failure to meet its security obligations (Section 7.2), or third-party services the Customer connects.

18.Term, order of precedence, changes, governing law and language

18.1Term. This Agreement remains in effect for as long as NeuroAI processes Customer Data, including after the subscription ends, until the return and deletion under Section 12 are complete.

18.2Order of precedence. In case of conflict, the order of precedence in item 29.2 of the Terms applies. In short: first, a written agreement signed by both parties; then the Standard Contractual Clauses, where they apply; and then this Agreement, which comes before the Terms as to the personal data of Contacts.

18.3Changes. NeuroAI may amend this Agreement to reflect changes in the law, the Service or its Sub-processors, with at least 30 days' notice to the Customer. Changes will not materially reduce the protection of Customer Data, unless required by law.

18.4Governing law and disputes. This Agreement is governed by the laws of the State of Delaware, United States. Disputes will be resolved under the dispute resolution clause of the Terms (Section 27): binding arbitration administered by the American Arbitration Association (AAA), seated in Wilmington, Delaware, with a class action waiver. Any claim must be brought within 1 year after the event giving rise to it, unless the law requires a longer period that cannot be shortened. This applies unless the Standard Contractual Clauses (when used by exception under Section 11.3) or a mandatory data protection law provide otherwise.

18.5Language. This Agreement is offered in Spanish and English. In case of any conflict or difference in interpretation, the English version prevails.

18.6Severability. If any part of this Agreement is held invalid, the rest remains in effect.

19.Privacy contact

Annex 1.Description of the processing

A.Parties. Controller (data exporter): the Customer, with its account details. Processor (data importer): NeuroAI Inc. (Section 19).

B.Data subjects. The Customer's Contacts (customers, leads, visitors to the Customer's websites and pages, people who fill out forms, book, buy, message or call the Customer's channels, or leave reviews); the Customer's Users (its team); and other individuals whose data the Customer chooses to include.

C.Types of data.

• Identification and contact: name, phone, email, address, company.
• Communications: content of WhatsApp, SMS, email, web chat and social media messages; call and voice-note recordings and transcripts.
• Business activity: appointments, orders, quotes, invoices and payment status (no full card numbers); form and survey responses; tags, notes, opportunities and interaction history.
• Consent: consent and opt-out records (date, time, source, channel and text agreed to).
• Visitor technical data: IP address, device, browser, cookies and traffic source, as configured by the Customer.
• Social and reputation: social media identifiers and reviews.
• Users: name, email, phone, role and activity logs.

D.Sensitive data. None expected. Prohibited unless agreed in writing (Section 7.3).

E.Nature of the processing. Hosting and storage; organization in the CRM; sending and receiving messages, emails and calls; automations and scheduling; AI responses, summaries, transcriptions and classifications (NEO); web pages and forms; reports and dashboards; usage measurement; backups; technical support; security and abuse prevention.

F.Purpose. Providing the Service to the Customer, as set out in Section 3.4.

G.Frequency. Continuous for the duration of the subscription.

H.Duration and retention. For the term of the subscription and until deletion under Section 12. During the subscription, the Customer decides how long each item of data is kept and may delete it.

I.Sub-processors. See Annex 3.

Annex 2.Technical and organizational measures

• 1.Encryption of data in transit (TLS 1.2 or higher) and at rest (for example, AES-256) on the cloud providers' infrastructure.
• 2.Logical separation of each customer's data, with unique identifiers and authorization rules.
• 3.Role-based, least-privilege access control for NeuroAI staff; mandatory two-step verification for anyone with administrative access; periodic access reviews; immediate removal of access when the relationship with a person or provider ends.
• 4.Two-step verification available to the Customer's Users, with the option to require it for the whole team.
• 5.Activity logs of relevant access and changes, retained according to the providers' cycles.
• 6.Regular backups, redundant infrastructure and disaster recovery plans by the infrastructure providers.
• 7.Network and application security: firewalls, denial-of-service protection, monitoring and alerting, vulnerability management and penetration testing carried out by the cloud infrastructure and software providers.
• 8.Vetted providers, with contracts that include confidentiality and data protection; preference for providers with independent security reports or certifications (for example, SOC 2 or ISO/IEC 27001).
• 9.People: written confidentiality commitments; basic security and privacy training for staff and contractors with access; access to customer accounts for support purposes only.
• 10.NeuroAI staff devices with screen lock, disk encryption and up-to-date software; use of a password manager.
• 11.Incident response: a written procedure to detect, contain, investigate, record and notify breaches (Section 10).
• 12.Minimization and deletion: tools to delete data and deletion upon termination (Section 12).
• 13.Messaging: automatic handling of opt-outs (STOP) and do-not-contact lists; email authentication (SPF, DKIM and DMARC) on NeuroAI's sending domains.

Annex 3.Sub-processor categories

• 1.Cloud infrastructure and software providers.Function: the platform on which the Service runs (CRM, automations, websites, scheduling), hosting, databases and backups.Data: all types in Annex 1.Main region: United States.
• 2.Messaging and telephony providers.Function: sending and receiving SMS and MMS, calls, phone numbers, email delivery and connection to the WhatsApp platform.Data: contact details, message and call content, consent and opt-out records.Main region: United States and other countries depending on the message destination.
• 3.AI model providers.Function: NEO responses, summaries, voice transcription and classification.Data: messages, conversation history, business information and audio.Main region: United States.
• 4.Technical support and implementation providers (our implementation team).Function: account setup (onboarding call), configuration and support, with limited user access.Data: whatever is visible in the account during support.Main region: United States and other countries.
• 5.NeuroAI's email, productivity and support-ticketing providers.Function: handling support requests and communicating with the Customer.Data: whatever the Customer includes in its requests.Main region: United States.
• 6.Web hosting, content delivery network and DNS providers.Function: publishing and protecting pages and forms.Data: visitor technical data (IP, browser) and form submissions in transit.Main region: United States and global network.

Not Sub-processors: third-party services connected by the Customer and carriers that merely transmit messages (Section 15). Stripe, the only payment processor NeuroAI uses to collect subscription fees and wallet top-ups (by card, Apple Pay, Google Pay or Link), processes the Customer's billing data under NeuroAI's Privacy Policy, not its Contacts' data.

Annex 4.Standard contractual clauses (only in an exceptional case agreed in writing under section 11.3)

• 1.Module: 2 (Customer as controller to NeuroAI as processor) or 3 (Customer as processor to NeuroAI as sub-processor).
• 2.Clause 7 (docking clause): not included.
• 3.Clause 9 (use of sub-processors): Option 2, general written authorization, with the notice period in Section 8.4.
• 4.Clause 11 (redress): the independent dispute resolution body option is not included.
• 5.Clause 13 (supervision): the competent supervisory authority as determined under that clause.
• 6.Clause 17 (governing law): the law of Ireland.
• 7.Clause 18 (choice of forum): the courts of Ireland.
• 8.Appendix to the Clauses: Annex I is Annex 1 of this Agreement; Annex II is Annex 2; Annex III is Annex 3, supplemented with the identity of the Sub-processors under Section 8.3.
• 9.United Kingdom: the ICO International Data Transfer Addendum, completed with the information in this Agreement.
• 10.Switzerland: references to the GDPR are to be read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Federal Data Protection and Information Commissioner, to the extent required by that law.