Snapshot 142750
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Version 3.2 · Issued 9 October 2026 Data Processing Agreement This page reproduces Eden AI’s Data Processing Agreement, version 3.2. Eden AI has already signed it. To complete it for your organization’s records, go to Settings → Compliance in your Eden AI account and click Get the DPA. In the same settings, an admin can turn on rules that every call from the organization follows, such as Zero Data Retention or region restrictions. Once enabled, Eden AI enforces them as described in Section 5. Need a customised DPA? We are open to tailored data protection terms as part of our Advanced Enterprise offer. Learn more about Advanced Enterprise. Eden AI SAS is a French company operating under European Union data protection law, including the GDPR. Questions about this DPA: [email protected]. 1. Introduction 1.1 This Data Processing Agreement (“DPA”) forms part of the Terms of Service, Master Services Agreement, Order Form or other agreement governing the Customer’s use of the Service (the “Agreement”) and applies whenever Eden AI Processes Customer Personal Data on the Customer’s behalf. 1.2 This DPA becomes effective on the date on which both Parties have affixed their signatures to it (the “Effective Date”). 1.3 Nothing in this DPA limits either Party’s obligations under mandatory Applicable Data Protection Law. In the event of conflict, this DPA prevails over the Agreement only with respect to the Processing of Customer Personal Data. If this DPA conflicts with applicable SCCs or the UK Addendum, those transfer terms prevail. 2. Definitions “Account Data” means business contact, account, authentication, billing, tax, fraud-prevention, sales, support and communication data Processed by Eden AI for account management, security, legal compliance or customer relationship purposes. “AI Provider” means a third party providing an AI model, inference service or related capability made available through the Service. “Applicable Data Protection Law” means the privacy and data protection laws applicable to the Processing, including where relevant the EU GDPR, the French Data Protection Act, UK GDPR, Swiss data protection law and applicable US State Privacy Laws. “Customer Data” means inputs, prompts, files, media, outputs and related metadata submitted to, generated through or otherwise Processed by the Service for the Customer. “Customer Personal Data” means Personal Data contained in Customer Data that Eden AI Processes on the Customer’s behalf. “EU Endpoint” means the Eden AI endpoint intended for eligible request content to be routed and Processed within the European Union, currently https://api.eu.edenai.run/v3/. “Log Retention” means an optional setting or feature that stores request or response content for monitoring, debugging or support. “Operational Subprocessor” means a third party engaged by Eden AI to Process Customer Personal Data in support of the Service, as identified in Annex 2. A supplier processing Account Data solely for Eden AI’s independent Controller purposes is not a Subprocessor for that activity. “Restricted Transfer” means a transfer of Personal Data subject to the restrictions of Chapter V of the EU GDPR, the UK GDPR or equivalent Applicable Data Protection Law. “SCCs” means the European Commission standard contractual clauses adopted by Decision (EU) 2021/914, using the applicable module. “Service” means Eden AI’s AI gateway, APIs, routing, fallback, monitoring, governance, regionalisation and related services. “ZDR” means a provider or configuration under which request and response content is not retained after the Processing necessary to provide the requested result. The terms “Controller”, “Processor”, “Subprocessor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in Applicable Data Protection Law. 3. Roles and allocation of responsibilities 3.1 For Customer Personal Data, Eden AI acts as a Processor and the Customer acts as a Controller or, where applicable, as a Processor acting for another Controller. This allocation reflects the Parties’ statutory roles only and does not create any agency, fiduciary, supervisory or exclusivity relationship. 3.2 Each Party is responsible for compliance with the obligations applicable to its own role. The Customer is responsible for the lawfulness of its use case, instructions and disclosure of Customer Personal Data to the Service. 3.3 Eden AI provides an orchestration and routing layer. AI Providers and models are made available by Eden AI, while the Customer authorises their use through API calls, project settings, routing rules or other Service configuration. 3.4 An AI Provider may act as a Subprocessor when Processing Customer Personal Data to fulfil a Customer request. Account Data is generally Processed by Eden AI as an independent Controller under its Privacy Policy. 4. Service scope and evolution 4.1 The Service may evolve through the addition, replacement or retirement of providers, models, endpoints, controls and features. Eden AI will Process Customer Personal Data only on the Customer’s documented instructions, including this DPA and the Service configuration, unless required by applicable law, in which case Section 5.2 applies. Service changes do not authorise new purposes or override enabled restrictions. 5. Service configuration and instructions 5.1 By using smart routing, fallback or a pool of candidate models, the Customer instructs Eden AI to select among the enabled candidates in accordance with the chosen configuration. EU Endpoint requests will not be routed to models unavailable through eligible infrastructure in the European Union, and eligible request and response content will be Processed in accordance with the regional routing described in Annex 3 and the current Documentation. 5.2 Where applicable law requires Processing outside the Customer’s configuration, Eden AI may perform that Processing and will provide notice where legally permitted. 5.3 Administrative data-governance restrictions. Where the Customer enables an administrative control made available through the Service restricting the AI Providers, models or endpoints that may process Customer Data, Eden AI shall enforce that control for all requests within its stated scope. Such controls may include Zero Data Retention (ZDR); regional processing restrictions, including Europe-only or EU-only processing; no use of Customer Data for model training; no reuse for provider product improvement or other secondary purposes; restrictions based on provider, hosting or processing location; restrictions on specific AI Providers, models or endpoints; provider security or compliance standards; data-retention practices; human review or access; and any other data-governance, privacy, security or compliance restriction made available through the Service from time to time. The scope of each control, including any applicable definition of a region, is the scope displayed to the Customer when the control is enabled. 5.4 Enforcement and precedence. Eden AI warrants that it will enforce each enabled administrative restriction at the Service level and will route requests subject to that restriction only to AI Providers, models and endpoints that satisfy it. Where multiple restrictions are enabled, each must be satisfied. Administrative restrictions take precedence over provider selection, smart routing, fallback, and cost or performance optimisation. Where no eligible option is available, Eden AI shall reject or fail the request rather than route it outside the enabled restrictions. Eden AI shall not silently disable, relax or bypass an enabled restriction, including following a change to a provider, model, endpoint or Service architecture. 5.5 Provider eligibility. Eden AI shall maintain and update the information used to determine whether an AI Provider, model or endpoint is eligible under an enabled restriction. Eden AI shall assess eligibility against the provider terms, commitments and technical configuration relevant to that restriction. Where Eden AI becomes aware that an option no longer satisfies an enabled restriction, it shall remove that option from the eligible routing pool without undue delay. Eden AI shall maintain the contractual arrangements with relevant AI Providers necessary to support the restrictions for which it makes those providers eligible. 5.6 Transparency and non-compliance. On reasonable request, Eden AI shall provide the Customer with reasonably available information needed to verify application of its enabled restrictions, including the AI Provider, model and endpoint used and the relevant location, retention, training and data-use characteristics, subject to security, confidentiality and third-party restrictions. If Eden AI becomes aware that Customer Data was routed in breach of an enabled restriction, it shall notify the Customer without undue delay, identify the affected requests to the extent reasonably possible, and take reasonable containment and corrective measures. Where the event is also a Personal Data Breach, Section 14 applies in addition. 6. Data minimisation, retention and provider practices 6.1 Eden AI does not persist request or response content from synchronous API calls by default. Such content is normally Processed only for the time required to route the request and return the result. 6.2 Eden AI may retain limited operational metadata for billing, security, reliability, analytics and administration only for the period stated in the Documentation, an applicable retention schedule or the Agreement, and no longer than reasonably necessary for those purposes. Supported asynchronous job results may be retained for up to seven (7) days to permit retrieval, unless a different period is expressly stated in the Documentation or an Order Form. 6.3 Request or response content is retained only where a selected feature requires it, the Customer enables Log Retention, or the content is submitted in a support interaction. Log Retention content is kept for the Customer-selected period displayed in the Service or specified in an Order Form; if no period is selected or agreed, Log Retention is disabled. Support content, security records, billing records, operational metadata and backup copies follow the applicable documented, statutory or system retention cycle and are deleted or anonymised when that period expires, unless continued retention is required by law, a legal hold or the defence of legal claims. Changes to retention settings apply prospectively. Retention and deletion of Customer Personal Data following termination remain subject to Section 16. 6.4 AI Provider retention, training and ZDR conditions vary by provider, model, endpoint and configuration. The current provider-level information is maintained in the documentation referenced in Annex 3. Where the Customer enables an administrative restriction, Eden AI shall apply Sections 5.3 through 5.6 notwithstanding those differences or changes. ZDR applies to the content and processing stages covered by the enabled control. Features that require content retention, including asynchronous result storage and Log Retention, are not covered by end-to-end ZDR unless expressly configured to avoid such retention. A request subject to a restriction must fail if a required feature is incompatible with that restriction. Limited operational metadata remains subject to Sections 6.2 and 6.3. Provider eligibility is assessed from relevant contractual commitments and technical configuration; it is not an independent certification of every provider operation. This does not limit Eden AI’s routing obligations or responsibility under Section 10.1. 6.5 Eden AI does not use Customer Data to train AI models and does not sell Customer Data. 7. Customer responsibilities The Customer shall: (a) ensure a lawful basis and required notices for Customer Personal Data; (b) limit submitted data to what is necessary and apply appropriate safeguards to sensitive or regulated data; (c) protect credentials and configure access, providers, routing, retention and regions appropriately; and (d) use the Service and model outputs in compliance with applicable law and the Agreement. 8. Eden AI obligations Eden AI shall, to the extent required by Applicable Data Protection Law: (a) Process Customer Personal Data only for the Service and documented configuration; (b) ensure authorised personnel are subject to confidentiality; (c) maintain appropriate technical and organisational measures; (d) impose the data-protection obligations required by Applicable Data Protection Law on Subprocessors and use commercially reasonable efforts to monitor their compliance with those obligations; (e) provide reasonable assistance with Data Subject rights, breaches and regulatory obligations, taking into account the nature of the Processing and information available; (f) delete or return retained Customer Personal Data as described in this DPA; and (g) inform the Customer if, in Eden AI’s reasonable opinion, a documented instruction infringes Applicable Data Protection Law, unless Eden AI is prohibited by law from doing so. 9. Security and confidentiality 9.1 Eden AI maintains a risk-based security programme appropriate to the Service and the Processing. The principal categories of controls are set out in Annex 5. 9.2 Eden AI holds an ISO/IEC 27001:2022 certificate issued on 3 September 2026, certificate number 330AGIE080104, for the scope stated in that certificate. SOC 2 Type II attestation remains in progress as of the issue date of this DPA. No SOC 2 attestation is represented as issued unless Eden AI provides the corresponding final report or confirmation of issuance. 9.3 Eden AI may update its controls to reflect changes in technology, risk and the Service, provided that the overall level of protection is not materially reduced. No security measure eliminates all risk, and the Customer remains responsible for its systems, credentials, integrations and end-user access. 10. Subprocessors 10.1 The Customer grants general authorisation for Eden AI to engage the Operational Subprocessors listed in Annex 2 and the AI Providers selected or enabled through the Service, subject to the Customer’s enabled administrative restrictions under Section 5.3. Eden AI will enter into written terms with each Subprocessor that impose data-protection obligations appropriate to the Processing and materially equivalent to the obligations applicable to Eden AI under this DPA. For AI Providers eligible under an administrative restriction, Eden AI shall maintain the relevant provider commitments necessary to support that restriction. Eden AI remains responsible for the performance of its Subprocessors’ data-protection obligations to the extent required by Applicable Data Protection Law. 10.2 Eden AI will actively notify the Customer through the account email or a designated in-Service notification at least thirty (30) days before adding or replacing a Subprocessor that will Process Customer Personal Data under a general authorisation, including an AI Provider added to an existing routing pool. The notice will identify the Subprocessor and relevant Processing and allow the Customer to object on reasonable, documented data-protection grounds. Publishing a revised list alone is not notice. The Parties will use reasonable efforts to resolve a valid objection. If no reasonable alternative is available, Eden AI may discontinue the affected feature or the Customer may terminate the affected Service or Order Form before the change takes effect. Accrued charges and unaffected Services remain payable and in force. Merely listing a new AI Provider in the catalogue does not authorise its use for existing Customer requests. 10.3 The Customer may specifically authorise a new AI Provider or another Subprocessor before the notice period expires, including by expressly selecting that identified provider through the Service after the relevant information is made available. For an urgent change needed for security, continuity or legal compliance, Eden AI will seek such specific authorisation if prior general-authorisation notice cannot be completed. Until the applicable authorisation requirements are met, Eden AI may suspend the affected feature or use an already authorised eligible alternative; urgency does not permit bypassing enabled restrictions or mandatory notice requirements. 11. AI Providers and routing 11.1 Eden AI determines which AI Providers and models are available through the Service. The Customer may select among available options, and that selection or use constitutes an instruction and authorisation to transmit the relevant Customer Data to the selected provider, subject always to any enabled administrative restriction under Sections 5.3 through 5.6. The Customer remains responsible for identifying its own sectoral, contractual and legal requirements. Eden AI is responsible for enforcing the restrictions that the Customer enables through the Service. 11.2 Eden AI shall maintain and update information on provider retention, training, ZDR, location and other characteristics relevant to the administrative restrictions offered through the Service. Provider terms and technical practices may change independently of Eden AI; such changes do not permit Eden AI to route a restricted request to an option that fails an enabled restriction. Section 5.5 applies where Eden AI becomes aware of a relevant change. 11.3 Where fallback or smart routing is enabled, only candidates satisfying all applicable enabled administrative restrictions may receive the request. For Bring Your Own Key or a direct provider account, the Customer’s agreement with that provider may govern the provider-side Processing; Eden AI remains responsible for enforcing the administrative routing restrictions made available and enabled through its Service. 11.4 Eden AI does not warrant the accuracy, legality or uniqueness of AI-generated outputs. Output use remains governed by the Agreement. 12. International transfers and regional processing 12.1 Customer Personal Data may be Processed outside the EEA depending on the selected provider, model, feature and configuration, subject to the Customer’s enabled administrative restrictions under Section 5.3. Where required, Eden AI relies on an adequacy decision, the SCCs or another legally recognised transfer mechanism. 12.2 For eligible request and response content sent through the EU Endpoint, Eden AI will apply the regional routing described in its current Documentation and will not route such content to AI inference infrastructure located outside the European Union, except where required by applicable law. This commitment does not extend to Account Data, support interactions or Operational Subprocessor activities, which remain subject to the locations in Annex 2. 12.3 The SCC selections are set out in Annex 4. Any cooperation concerning transfer assessments or supplementary measures is limited to what is legally required, reasonably available to Eden AI and proportionate to the Service. 13. Assistance and Data Subject requests 13.1 Eden AI will provide reasonable assistance, primarily through standard Service functionality and available documentation, for Data Subject requests, data protection impact assessments, prior consultations, Personal Data Breaches and information reasonably necessary to demonstrate compliance, to the extent required by Applicable Data Protection Law. Eden AI will provide such assistance without undue delay and within a reasonable period having regard to the Customer’s applicable legal deadlines. Bespoke or materially burdensome assistance may be subject to scope, timing and reasonable fees agreed in advance. 13.2 If Eden AI receives a request relating to Customer Personal Data, it may redirect the requester to the Customer or notify the Customer where the relevant account can reasonably be identified. Eden AI will not respond on the Customer’s behalf unless legally required or expressly agreed. 14. Personal Data Breaches 14.1 Eden AI will notify the Customer without undue delay and, in any event, within seventy-two (72) hours after becoming aware of a confirmed or reasonably suspected Personal Data Breach affecting Customer Personal Data. The initial notification may be based on the information then reasonably available, and Eden AI may provide additional information in phases as the investigation progresses. Notification does not constitute an admission of fault or liability. 14.2 Eden AI will take reasonable containment and remediation measures. The Customer remains responsible for determining and making notifications to Supervisory Authorities, Data Subjects or other third parties unless the law directly assigns that duty to Eden AI. 15. Government and legal requests Eden AI may disclose Customer Personal Data where required by applicable law or binding legal process. Where legally permitted, Eden AI will notify the Customer and limit disclosure to what is legally required. For data subject to the SCCs or another applicable transfer instrument, Eden AI will comply with that instrument’s notification, review, challenge and documentation obligations. Nothing in this Section limits those obligations. 16. Return and deletion 16.1 At the Customer’s choice, Eden AI will return or delete retained Customer Personal Data following termination of the relevant Processing, and delete remaining copies unless applicable law requires retention. Eden AI will complete return or deletion from active systems within thirty (30) days after termination or a valid instruction, subject to Section 16.2 for backups. The Customer should export available data before access ends; expiry of access does not extinguish its right to request return within that period. After return, Eden AI will delete remaining active copies within the same period unless otherwise instructed or legally required. Bespoke migration beyond the return required by Applicable Data Protection Law may be subject to reasonable fees agreed in advance. 16.2 Backup copies may remain for up to ninety (90) days after deletion from active systems, during which they remain protected, isolated from ordinary use and restored only where necessary for recovery. If a backup is restored, the applicable deletion instruction will be reapplied. Customer Personal Data may be retained beyond these periods only where required by applicable law, with Processing restricted to that legal purpose and deletion when the requirement ends. Account Data Processed by Eden AI as an independent Controller follows the applicable Privacy Policy and statutory retention requirements. Any retained Customer Personal Data remains protected under this DPA while held. 17. Compliance information and audits 17.1 Eden AI will make available reasonably available policies, security information, assurance materials and testing summaries sufficient to support reasonable compliance reviews, subject to confidentiality, security and third-party restrictions. 17.2 Where the information provided under Section 17.1 is reasonably insufficient to demonstrate compliance with this DPA, the Customer may request an additional audit. Unless a Supervisory Authority requires otherwise, an audit is limited to once in any twelve-month period, requires at least thirty (30) days’ notice, must avoid disruption and access to other customers’ data or source code, and is conducted at the Customer’s expense by an independent non-competitor bound by confidentiality. Eden AI may satisfy the request through equivalent third-party evidence or a controlled remote review where direct access would create security, confidentiality or operational risk. These arrangements do not prevent additional audits or inspections required by Applicable Data Protection Law, the SCCs, a competent authority, a Personal Data Breach or reasonable evidence of material non-compliance. Alternative evidence must be sufficient to demonstrate compliance; otherwise Eden AI will permit a proportionate audit or inspection with appropriate safeguards. 18. US State Privacy Laws Where applicable, Eden AI acts as a service provider or processor for Customer Personal Data and will not sell it, share it for cross-context behavioural advertising, or use it outside the limited purposes permitted by the Agreement and applicable law. Nothing in this Section creates obligations beyond those required by the applicable US State Privacy Law. 19. Liability The exclusions and limitations of liability in the Agreement apply to this DPA to the fullest extent permitted by law. This DPA does not create any additional indemnity, warranty, service level, audit remedy or termination right except where expressly stated or legally mandatory. Nothing limits rights or liabilities that cannot lawfully be limited, including under the SCCs. 20. Term and updates 20.1 This DPA remains in effect while Eden AI Processes Customer Personal Data under the Agreement and thereafter only for retained data and provisions that necessarily survive. 20.2 Eden AI may update operational annexes and links to reflect changes in providers, law, security or functionality, subject to Section 10, enabled restrictions and no material reduction in protection. Changes to the core contractual terms of this signed DPA require written acceptance by authorised representatives of both Parties, except changes that take effect under a mandatory transfer instrument or applicable law. Updating online Documentation does not override this DPA. 21. General If a provision is invalid, the remainder remains effective. The Agreement otherwise remains unchanged. Its governing law and forum apply except where mandatory law or the SCCs require otherwise. Electronic signatures and counterparts are valid, and the annexes form part of this DPA. 22. Contact Company: Eden AI SAS SIREN: 829 046 473 Registered office: 19 rue Louis Guérin, 69100 Villeurbanne, France Data protection contact:[email protected] Support and data requests:[email protected] Annex 1 – Description of Processing This Annex describes the Processing carried out by Eden AI on the Customer’s behalf for purposes of Article 28 GDPR and equivalent Applicable Data Protection Law. Subject matter and nature: Receipt of Customer requests; routing to authorised AI Providers; transmission of inputs and files; receipt and return of outputs; optional routing, fallback, monitoring, guardrails and Log Retention; billing, security, support and temporary storage of asynchronous results. Purpose: Provision, operation, security, administration, troubleshooting, billing and support of the Service. Duration and frequency: For the Agreement term and limited deletion, legal-retention or backup periods; continuous or on demand according to Customer use. Data Subjects: Customer users, administrators, employees, contractors and representatives; end users of Customer applications; individuals whose information appears in submitted content; and support contacts. Personal Data: Names, identifiers, contact and professional information; free text, documents, images, audio, video, prompts, files and outputs; account and user identifiers; IP addresses, authentication events, device and browser data; provider/model selections, usage metrics, costs, latency, timestamps and technical logs. Sensitive data: Not required by the Service. If the Customer submits special-category or other highly sensitive data, the Customer instructs Eden AI to Process it and remains responsible for the legal basis, safeguards, selected provider, region and configuration. Default retention: Synchronous request and response content: not persisted by Eden AI by default. Supported asynchronous results: up to seven (7) days, unless otherwise stated. Log Retention content: Customer-selected period displayed in the Service or specified in an Order Form; disabled if no period is selected or agreed. Deletion from active systems: within thirty (30) days after termination or a valid deletion request where deletion is selected. Backup copies: up to ninety (90) days after deletion from active systems. Operational metadata and support records containing Customer Personal Data: Sections 6 and 16 apply. Independently controlled Account Data, including billing records: applicable Privacy Policy and statutory retention periods. AI Provider retention: provider-, model-, endpoint- and configuration-specific as described in Annex 3. Annex 2 – Operational Subprocessors These technical suppliers act as Subprocessors when Processing Customer Personal Data on Eden AI’s behalf. Their role depends on the activity and configuration. The locations below are separate from the EU-only inference commitment. Amazon Web Services EMEA SARL and applicable AWS affiliates – Cloud infrastructure and hosting: hosting, storage, networking, security, backup and operation of the Service. Data: account, authentication and Customer Data; prompts, outputs, usage data, logs and technical metadata, depending on the service and region. Hosting: European Union – Paris, France (eu-west-3). Processing: European Union; limited authorised support, security and administration locations subject to safeguards. Cloudflare, Inc. – Edge infrastructure, content delivery, bot mitigation and AI model hosting: website and documentation delivery; TLS termination; Turnstile protection; and Customer-selected Workers AI inference. Data: IP addresses, URLs, User-Agent, referrer, cookies, connection/device and behavioural signals; Workers AI request and response content where selected. Hosting: Cloudflare global network and applicable service locations; persistent storage only where a storage feature is used. Processing: countries in Cloudflare’s global network, subject to configured localisation controls and safeguards. ClickHouse, Inc. – Database and product analytics infrastructure: storage and analysis of usage data, logs, costs and technical events. Data: account and organisation identifiers, API usage, provider/model identifiers, timestamps, costs, request metadata and technical logs; content only if included in configured datasets. Hosting: European Union – Ireland (eu-west-1). Processing: selected EU region; control-plane, support and affiliate operations may involve other listed locations subject to safeguards. Sentry – Application monitoring and error tracking: detection, investigation and resolution of errors, incidents and performance issues. Data: user identifiers, IP addresses, device/browser data, application events, stack traces, errors and diagnostics; Customer content if inadvertently captured. Hosting: European Union – Frankfurt, Germany (eu-central-1). Processing: European Union – Frankfurt, Germany (eu-central-1) and authorised Subprocessor locations for support, security and administration. Metabase, Inc. – Business intelligence and AI-assisted internal analytics: internal dashboards, reporting and AI-assisted analysis of customer activity and usage datasets. Data: account, organisation, billing and usage identifiers; provider/model usage; timestamps, technical metadata, database metadata, field-value samples and derived metrics. Hosting: European Union – Frankfurt, Germany (eu-central-1). Processing: European Union – Frankfurt, Germany; United States and other locations used by Metabase, its authorised subprocessors and the AI Provider supporting enabled AI features. The following account, identity, billing and support suppliers do not receive content through ordinary inference routing, but may receive content submitted to support. They are Subprocessors only for activities on the Customer’s behalf; other activities may involve independent Controller processing. WorkOS, Inc. – Identity and access management: enterprise authentication, SSO, directory synchronisation and organisation management. Data: names, professional emails, user/organisation identifiers, authentication events, identity-provider attributes and group/directory memberships. Hosting: United States, unless otherwise stated in Eden AI’s WorkOS order terms. Processing: United States and locations used by WorkOS and its authorised Subprocessors. Stripe Payments Europe, Limited and applicable affiliates – Payment processing and billing: payments, subscriptions, invoices, fraud prevention and transaction records. Data: billing contacts, payment identifiers, transactions, addresses, invoices and fraud-prevention data; Eden AI does not store full card details. Hosting: European Union, United States and applicable Stripe locations. Processing: European Union, United States and authorised Subprocessor locations. Brevo, Sendinblue SAS – Transactional email and customer communications: transactional emails, authentication messages, account notifications and service communications. Data: names, emails, organisation and account information, email content, delivery status, tracking data where enabled, IP addresses and technical metadata. Hosting: European Union. Processing: European Union and authorised Subprocessor locations for support and administration. Intercom R&D Unlimited Company and applicable affiliates – Customer support and communications: support requests, service communications and customer interactions. Data: names, professional emails, organisation and account information, support messages, attachments, technical metadata and voluntarily submitted information. Hosting: United States – Northern Virginia (us-east-1). Processing: United States, European Union and authorised Subprocessor locations. Annex 3 – AI Provider governance, retention and ZDR AI Providers are authorised when selected or enabled through the Service, subject to the Customer’s enabled administrative restrictions under Section 5.3. Because provider availability, terms, retention, regional deployment and model features change more frequently than Operational Subprocessors, provider-level information is maintained in live Documentation. Eden AI shall enforce enabled restrictions, maintain provider eligibility information, exclude ineligible options and fail requests where no eligible option is available, in accordance with Sections 5.3 through 5.6. Provider data use, training, ZDR and retention:https://www.edenai.co/docs/v3/data-governance Available providers and models:https://app.edenai.run/models EU Endpoint: https://api.eu.edenai.run/v3/ Eden AI default: synchronous request and response content is not stored by default and is not used by Eden AI for model training. AI Provider practices remain provider-, model-, endpoint- and configuration-specific; where the Customer enables an applicable administrative control, the contractual commitments in Sections 5.3 through 5.6 govern routing and enforcement. Annex 4 – Cross-border transfer terms Where a Restricted Transfer between the Parties falls within the scope of the SCCs and is not covered by an adequacy decision or another valid mechanism, the SCCs are incorporated by reference with the following selections. For onward Restricted Transfers to Subprocessors, Eden AI shall put in place the applicable transfer mechanism with the relevant recipient; incorporation between these Parties alone does not bind an AI Provider or Operational Subprocessor. Module 1 for Account Data transferred between the Parties as independent Controllers, where applicable. Module 2 where the Customer is a Controller and Eden AI is a Processor; Module 3 where the Customer is a Processor and Eden AI is a Subprocessor. Clause 7 applies; Clause 9(a), Option 2 applies with the notice process in Section 10; the optional language in Clause 11(a) does not apply. Clause 17, Option 1: French law. Clause 18(b): competent courts of France. Annex I.A: the Parties’ details and contacts in this DPA and the Agreement, with the transferring Party as exporter and the recipient as importer for the relevant transfer; Annex I.B: Annex 1 and the Service configuration; Annex I.C: the supervisory authority determined under Clause 13, including the CNIL where competent; Annex II: Annex 5; Annex III: Annexes 2 and 3. The applicable module follows the actual roles of exporter and importer for the relevant transfer. For UK Restricted Transfers, the UK International Data Transfer Addendum to the EU SCCs, as issued and updated by the UK Information Commissioner’s Office, is incorporated by reference. Table 1 identifies the Parties and their key contacts by reference to this DPA and the Agreement. Table 2 incorporates the Approved EU SCCs, modules and selections specified in this Annex 4. Table 3 is completed by Annexes 1, 2, 3 and 5 and the relevant Service configuration. For Table 4, neither Party may terminate the Addendum solely as a result of an ICO-approved revision. The governing law and courts for the UK Addendum are those of England and Wales. For Swiss transfers, the SCCs apply with references adapted to Swiss law and the Swiss Federal Data Protection and Information Commissioner. Eden AI may rely on another valid transfer mechanism while it remains legally available. Annex 5 – Technical and organisational measures Eden AI maintains a risk-based security programme designed to protect the confidentiality, integrity, availability and resilience of Customer Personal Data. Measures apply as appropriate to the Service and the risks involved. Governance and risk: Documented security and privacy responsibilities, risk assessment, vendor review and control improvement. ISO/IEC 27001:2022 certificate issued on 3 September 2026, for the scope stated in the certificate. SOC 2 Type II attestation remains in progress as of 9 October 2026; no issued attestation is represented by this DPA. Data minimisation: No default persistence of synchronous request/response content; limited operational metadata; seven-day asynchronous result retention; optional retention and provider-level ZDR controls. Access control: Unique accounts, least privilege, role-based access, authentication controls, controlled privileged access and access removal/review. Encryption and secrets: Industry-standard encryption in transit; encryption at rest where supported; controlled secrets and credential management. Network and application security: Cloud isolation, firewalls/WAF, DDoS and bot protection, secure development practices, code review, dependency and vulnerability scanning. Monitoring and incidents: Centralised monitoring, security logging, alerting, incident handling, containment, investigation and Customer notification as required by this DPA. Availability and recovery: Backups where appropriate, continuity and recovery procedures, capacity management and resilient cloud infrastructure. Personnel and suppliers: Confidentiality obligations, security awareness, restricted support access and contractual/security review of relevant Subprocessors.