Data Processing Agreement

This Data Processing Agreement ("DPA") applies when Conare, Inc. ("Conare", "Provider") processes personal data on behalf of a customer ("Customer") through the Services. It is this Cover Page plus the Common Paper DPA Standard Terms Version 1.1 ("Standard Terms"), which are incorporated by reference. Capitalized terms not defined here have the meanings in the Standard Terms. If this Cover Page and the Standard Terms conflict, this Cover Page controls.

This DPA forms part of our Terms of Service and takes effect when Customer accepts them. No signature is needed. For a countersigned copy, email support@conare.ai.

1. Agreement

The Conare Terms of Service at conare.ai/terms, or the signed order form or agreement between Conare and Customer where one exists.

2. Roles

Customer is the Controller and Conare is the Processor. Where Customer processes the personal data on behalf of its own customer, Customer is a Processor and Conare is its Subprocessor.

3. Details of processing (Annex I)

• Data exporter: Customer, as set out in the Agreement. Contact: Customer's account owner.
• Data importer: Conare, Inc., United States. Contact: support@conare.ai.
• Categories of data subjects: people whose personal data appears in the content Customer sends to the Services, such as Customer's employees, customers and contacts, and Customer's users of the Services.
• Categories of personal data: any personal data in the documents, files and app data Customer sends, and users' names, email addresses and organization.
• Special category data: none intended. Customer will not send special category data unless both parties agree in writing.
• Frequency of transfer: continuous, for as long as Customer uses the Services.
• Nature and purpose of processing: hosting, indexing, searching and returning Customer's content, and the support and security of the Services, only to provide the Services to Customer.
• Duration of processing: the term of the Agreement, then until deletion, which happens within 30 days after the Agreement ends or Customer asks for it.

4. Approved Subprocessors (Annex III)

The subprocessors listed on our subprocessors page, with their locations and processing tasks. Conare gives notice of a new subprocessor by updating that page at least 10 business days before it starts processing Customer Personal Data.

5. Security Policy (Annex II)

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Customer data separated by organization, with access checked on every request.
• Production access limited to authorized personnel, with multi-factor authentication.
• API keys stored only as hashes; connector credentials stored encrypted.
• Logging, monitoring and alerting on the Services.
• Backups, including an immutable copy, that expire on a fixed schedule.
• Vulnerability scanning, penetration testing and a documented incident response process.
• Written security policies, reviewed at least once a year.

Conare answers reasonable security questionnaires and, once issued, shares its independent audit reports (such as SOC 2) under confidentiality.

6. Provider Security Contact

support@conare.ai

7. International transfers

• EEA: the Standard Contractual Clauses apply as set out in the Standard Terms. The Governing Member State is Ireland.
• UK: the UK Addendum applies as set out in the Standard Terms, with the details in sections 3 to 5 above.
• Switzerland: the Standard Contractual Clauses apply, with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

8. US state privacy laws

Where the CCPA or a similar US state law applies, Conare is Customer's service provider. Conare will not sell or share Customer Personal Data, or keep, use or disclose it for any purpose other than providing the Services.