Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Cwiz LLC, a Wyoming limited liability company doing business as Scrape AI ("Scrape AI" or "Processor"), and the customer that has accepted the Terms ("Customer"). It applies automatically, without signature, whenever Scrape AI processes Customer Personal Data in providing the Services to a Customer that uses the Services for business or professional purposes. Capitalized terms not defined here have the meanings given in the Terms or in Data Protection Laws.

1. Definitions

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Terms, including, as applicable, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the EU GDPR as incorporated into UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other U.S. state comprehensive privacy laws.
• "Customer Personal Data" means personal data contained in Customer Content (as defined in the Terms) that Scrape AI processes on behalf of Customer.
• "Subprocessor" means a third party engaged by Scrape AI that processes Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Scrape AI or its Subprocessors.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "Controller," "processor," "data subject," "personal data," "processing," "service provider," and "supervisory authority" have the meanings given in Data Protection Laws.

2. Roles and scope

2.1 Roles. Customer is the controller (or a processor acting on behalf of its own customer, in which case Customer warrants that its instructions are authorized by that controller) and Scrape AI is a processor of Customer Personal Data. For purposes of the CCPA, Scrape AI is Customer's service provider.

2.2 Details of processing. The subject matter, duration, nature and purpose of processing, and the categories of data subjects and personal data are described in Annex I.

2.3 Scrape AI as controller. This DPA does not apply to Account Information (as defined in our Privacy Policy), which Scrape AI processes as a controller under its Privacy Policy.

3. Customer obligations

Customer is responsible for: (a) the lawfulness of the Customer Personal Data it uploads and of its instructions; (b) having a valid legal basis for the processing and providing all notices and obtaining all consents required by Data Protection Laws, including for processing by Scrape AI and its Subprocessors in the United States; (c) not uploading the categories of data prohibited by Section 7.8 of the Terms; and (d) the accuracy and quality of Customer Personal Data.

4. Scrape AI obligations

4.1 Instructions. Scrape AI will process Customer Personal Data only on Customer's documented instructions, unless required to do otherwise by law, in which case Scrape AI will inform Customer of that legal requirement before processing unless the law prohibits it. The Terms, this DPA, and Customer's use and configuration of the Services are Customer's complete instructions. Scrape AI will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.2 CCPA commitments. Scrape AI will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Terms and this DPA, including for any commercial purpose other than providing the Services; (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Customer and Scrape AI; or (d) combine Customer Personal Data with personal information it receives from or on behalf of others, except as permitted by the CCPA. Scrape AI will notify Customer if it can no longer meet its obligations under the CCPA, and Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use.

4.3 No AI training. Scrape AI will not use Customer Personal Data to train or fine-tune artificial intelligence models, and uses AI and text-recognition Subprocessors that do not use Customer Personal Data to train their models.

4.4 Confidentiality. Scrape AI will ensure that any person it authorizes to process Customer Personal Data is bound by an appropriate duty of confidentiality and accesses Customer Personal Data only as described in Section 7.5 of the Terms.

4.5 Security. Scrape AI will implement and maintain the technical and organizational measures described in Annex II, which are designed to protect Customer Personal Data against Security Incidents. Scrape AI may update these measures provided that the update does not materially reduce the overall level of protection.

5. Subprocessors

5.1 Authorization. Customer gives Scrape AI general authorization to engage Subprocessors. The current list is published at getscrape.ai/subprocessors and forms Annex III.

5.2 Changes. Scrape AI will update the Subprocessors page before a new Subprocessor begins processing Customer Personal Data. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing privacy@getscrape.ai within 15 days after the update. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused part of the billing period, which is Customer's sole remedy.

5.3 Flow-down and responsibility. Scrape AI will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, to the extent appropriate to the service it provides, and remains responsible for each Subprocessor's performance of those obligations.

6. Data subject requests and assistance

6.1 Requests. Taking into account the nature of the processing, Scrape AI will provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights. Customer can access, correct, export (on paid plans), and delete Customer Personal Data itself through the Services. If Scrape AI receives a request directly from a data subject concerning Customer Personal Data, it will not respond except to direct the data subject to Customer, unless required by law, and will promptly notify Customer where the request identifies Customer.

6.2 Other assistance. Scrape AI will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and taking into account the information available to Scrape AI.

7. Security Incidents

Scrape AI will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident, by email to the address on Customer's account. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and Scrape AI will provide further information as it becomes available. Scrape AI will take reasonable steps to contain and remediate the incident. Notification is not an acknowledgment of fault or liability.

8. Deletion and return

Customer may delete Customer Personal Data at any time by deleting documents, runs, or its account in the Services, and may export extracted data at any time while on a paid plan. Deletion through the Services is immediate and permanent in Scrape AI's primary storage. Copies held by Subprocessors and in backups are deleted on their normal schedules described in our Privacy Policy. When Customer's account is deleted, Scrape AI will delete remaining Customer Personal Data in its systems, unless retention is required by law, in which case Scrape AI will continue to protect it under this DPA.

9. Audits and information

Scrape AI will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, in the form of written responses to reasonable security and privacy questionnaires no more than once in any 12-month period (or more often if required by a supervisory authority or following a Security Incident). Any on-site audit required by Data Protection Laws must be at Customer's expense, on at least 30 days' notice, during business hours, subject to confidentiality obligations, and limited to what is needed to verify compliance.

10. International transfers

10.1 Location. Scrape AI and its Subprocessors process Customer Personal Data in the United States.

10.2 EU transfers. To the extent the EU GDPR applies to a transfer of Customer Personal Data to Scrape AI in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorization) applies, with the notice period in Section 5.2; the optional wording in Clause 11 does not apply; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18, disputes are resolved before the courts of Ireland; Annex I of the SCCs is completed with Annex I of this DPA, Annex II with Annex II of this DPA, and Annex III with Annex III of this DPA.

10.3 UK transfers. To the extent the UK GDPR applies, the UK Addendum is incorporated by reference and applies to the SCCs as described above; Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes, and in Table 4 neither party may end the UK Addendum as permitted by its Section 19.

10.4 Switzerland. To the extent Swiss data protection law applies, the SCCs apply with references to the EU GDPR read as references to the Swiss Federal Act on Data Protection, the competent supervisory authority being the Swiss Federal Data Protection and Information Commissioner, and "member state" including Switzerland for purposes of Clause 18(c).

10.5 Alternative mechanisms. If Scrape AI adopts another lawful transfer mechanism recognized under Data Protection Laws (such as certification under the EU–U.S. Data Privacy Framework), that mechanism will apply instead to the extent it covers the transfer.

11. Liability and precedence

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs do not permit it. If there is a conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA controls; if there is a conflict between this DPA and the SCCs, the SCCs control.

12. Term

This DPA remains in effect for as long as Scrape AI processes Customer Personal Data on behalf of Customer.

Annex I — Details of processing

Parties. Data exporter: Customer, as identified by its account (contact: the account email). Role: controller or processor. Data importer: Cwiz LLC d/b/a Scrape AI, 30 N Gould St, Ste N, Sheridan, WY 82801, USA; contact privacy@getscrape.ai. Role: processor.

Categories of data subjects. Individuals whose personal data appears in documents Customer uploads, which may include Customer's own customers, vendors, suppliers, contractors, employees, job applicants, and business contacts.

Categories of personal data. Whatever personal data appears in documents Customer chooses to upload, typically including names, job titles, business and postal addresses, email addresses, telephone numbers, signatures, company details, invoice, order, and contract details, and professional history (for example, on resumes).

Sensitive data. None intended. Customer must not upload special categories of data or other prohibited data except as incidental to an ordinary business document (Terms, Section 7.8).

Frequency. Continuous, whenever Customer uses the Services.

Nature of processing. Storage; rendering of page images; optical character recognition; AI-based field suggestion and data extraction; verification of extracted values against document text; display, editing, and export at Customer's direction; deletion.

Purpose. To provide the Services to Customer under the Terms.

Duration and retention. For the term of Customer's use of the Services, until Customer deletes the data or its account, and as described in Section 8.

Subprocessor transfers. As listed in Annex III, for the same nature, purpose, and duration.

Competent supervisory authority. For EU transfers, the supervisory authority of the EU member state where Customer is established or, if Customer is not established in the EU, where its EU representative is located; for UK transfers, the UK Information Commissioner.

Annex II — Technical and organizational measures

• Encryption: all data in transit is encrypted with TLS; data at rest is encrypted by our infrastructure providers.
• Tenant isolation: each customer's records and files are isolated by account; database row-level security limits browser access to a customer's own records; extracted values are readable only through our servers; every server request that reads or changes data checks account ownership first; stored files are kept in a private bucket under per-account paths, and every server-side file access is checked against the owning account.
• Write protection: browsers cannot write to the database directly; all changes go through our servers after authentication and ownership checks.
• Access control: access to production systems is limited to authorized personnel, uses individual accounts with strong authentication, and is granted on a least-privilege basis; personnel access Customer Content only as described in Section 7.5 of the Terms.
• Authentication: passwords are stored only as salted one-way hashes by our authentication provider; email verification codes; optional Google sign-in.
• Abuse protection: rate limits on costly and state-changing operations, configured to refuse requests if the rate limiter cannot be reached.
• Secure development: automated checks run before every deployment, including checks that every database query on customer data is scoped to the requesting account; code changes are reviewed before release.
• Monitoring: error monitoring configured not to collect personal identifiers by default; no session recording.
• Deletion: customers can delete documents, runs, and accounts themselves; deletion removes stored files and derived page images and then database records.
• Vendor management: Subprocessors are selected for their security practices and bound by data protection terms; AI and text-recognition providers do not train on Customer Content.
• Incident response: Security Incidents are investigated and notified as described in Section 7.

Annex III — Subprocessors

The current list of Subprocessors, with each one's purpose and location, is published at getscrape.ai/subprocessors and is incorporated into this DPA.