DraftAria Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the DraftAria Terms of Service or any other written agreement for the Service between DraftAria ("DraftAria") and the Customer (together, the "Agreement"). It applies whenever DraftAria processes Customer Personal Data on the Customer's behalf, and takes effect when the Customer accepts the Agreement. No separate signature is needed; a firm that wants a countersigned copy can request one at support@draftaria.com.

If this DPA conflicts with the rest of the Agreement, this DPA controls with respect to Customer Personal Data. Capitalized terms not defined here have the meanings given in the Terms of Service.

• Customer Personal Data means personal information contained in Customer Content that DraftAria processes on behalf of the Customer in providing the Service.
• Data Protection Laws means U.S. federal and state privacy and data protection laws that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended (the "CCPA").
• Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Content.
• Subprocessor means a third party that DraftAria engages to process Customer Personal Data.
• Personnel means DraftAria's employees, contractors and founder.

The Customer is the controller (or "business") of Customer Personal Data, and DraftAria is its processor (or "service provider" or "contractor" under the CCPA). The Customer decides what data to submit and why; DraftAria processes it only to provide the Service.

The Customer is responsible for the lawfulness of the Customer Personal Data it submits, for having any notices, consents and authority needed to submit it (including under its professional duties of confidentiality to its clients), and for the instructions it gives. Annex 1 describes the processing.

DraftAria will:

• follow instructions: process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, the Customer's use and configuration of the Service, and other reasonable written instructions from a firm admin, unless the law requires otherwise (in which case it will tell the Customer first, unless the law prohibits that);
• flag unlawful instructions: tell the Customer promptly if it believes an instruction violates Data Protection Laws;
• not sell or share: not sell Customer Personal Data or share it for cross-context behavioral advertising, and not retain, use or disclose it for any purpose (including any commercial purpose) other than providing the Service under the Agreement, or outside the direct business relationship with the Customer;
• not combine: not combine Customer Personal Data with personal information it receives from other sources or collects from its own interactions, except as Data Protection Laws allow for a service provider;
• not train AI models: not use Customer Content, or allow its Subprocessors to use it, to train AI models;
• comply: comply with the Data Protection Laws that apply to it as a processor, give Customer Personal Data the level of privacy protection those laws require, and tell the Customer if it can no longer meet its obligations under them; and
• allow remediation: allow the Customer, on notice, to take reasonable steps to stop and remediate any unauthorized use of Customer Personal Data.

Today, only DraftAria's founder can access Customer Content, and only when the Customer asks for help that requires it (for example, an export or deletion request, or a support issue a firm admin has asked us to look into). DraftAria will:

• limit access to Customer Personal Data to Personnel who need it to provide the Service and act on the Customer’s request;
• ensure everyone with access is bound by written confidentiality obligations, or by a professional or statutory duty of confidentiality;
• access Customer Content only for as long, and only as much, as the request requires; and
• tell the Customer before giving any additional Personnel access to Customer Content.

The Customer may submit material protected by the attorney-client privilege, the work-product doctrine or similar protections. DraftAria acts as the Customer's agent and service provider in processing that material, accesses it only to provide the Service as described in this DPA, and treats all of it as the Customer's Confidential Information. The parties do not intend the Customer's use of the Service, or DraftAria's processing, to waive any privilege or protection.

If DraftAria receives a subpoena, court order, government request or other legal demand for Customer Content, it will (unless the law prohibits it) promptly notify the Customer and give it a reasonable opportunity to object or seek a protective order, try to redirect the requester to the Customer, and disclose only what it is legally required to disclose.

DraftAria will maintain appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, at least as protective as those described in Annex 2. DraftAria may update those measures, but will not materially reduce the overall protection they provide.

The Customer authorizes DraftAria to use the Subprocessors listed in Annex 3 and on our Trust Center. DraftAria will:

• have a written agreement with each Subprocessor that requires it to protect Customer Personal Data in a manner consistent with this DPA, and that limits its use of the data to providing its services to us;
• give the Customer at least 30 days' notice before adding or replacing a Subprocessor, by updating the Trust Center list and emailing the Customer's firm admins;
• remain responsible to the Customer for each Subprocessor’s performance of these obligations.

Objections. The Customer may object to a new Subprocessor on reasonable data-protection grounds by emailing support@draftaria.com during the notice period. The parties will discuss the objection in good faith. If they can't resolve it, the Customer may terminate the affected part of the Service by written notice, and DraftAria will refund any prepaid fees for the period after termination.

If DraftAria receives a request from an individual to exercise privacy rights over Customer Personal Data, it will promptly forward it to the Customer and will not respond to it directly except to tell the individual to contact the Customer, unless the Customer authorizes otherwise.

Taking into account the nature of the processing, DraftAria will help the Customer respond to such requests, for example by exporting, correcting or deleting data when a firm admin asks at support@draftaria.com. It will also give the Customer reasonable information and help with any data protection assessment or consultation with a regulator that the Customer is required to carry out about its use of the Service.

DraftAria will notify the Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting the Customer's Customer Content. Notice goes to the Customer's firm admins by email.

The notice will describe, as far as then known, the nature of the incident, the data and individuals affected, the likely consequences, and the steps taken or proposed to contain it and reduce its effects, with updates as more becomes known. DraftAria will take reasonable steps to contain and investigate the incident and will reasonably cooperate with the Customer's own investigation and any notifications the Customer must make. Notifying or responding to an incident is not an admission of fault.

While the Agreement is in effect, a firm admin can ask at any time for an export of the Customer's data or for its deletion. DraftAria confirms the request with the firm admin, then sends the export (a structured data file of the firm's workspace, with any uploaded files on request) or deletes the data, and confirms in writing.

When the Agreement ends, DraftAria will keep Customer Content available for export for at least 30 days and will then delete it, or delete it earlier if the Customer asks. Deleted data may remain in automatic database backups until those backups expire on their own schedule; until then it stays protected by this DPA and is not used for any purpose. DraftAria may keep data longer only where the law requires it, and then only as required.

DraftAria has not yet completed a SOC 2 or ISO 27001 audit; it plans to complete a SOC 2 Type II audit within the next 6–12 months. Until then, the Customer's audit rights are met as follows:

• once a year, or after a Security Incident or at a regulator’s request, the Customer may send a written security questionnaire, which we will answer accurately and in reasonable detail;
• we will provide other written information reasonably needed to show compliance with this DPA; and
• once a SOC 2 report is available, we will provide it on request under confidentiality terms.

If the law requires an audit beyond this, the Customer may arrange one, at its own cost, with at least 30 days' notice, during business hours, under confidentiality terms, and in a way that does not compromise other customers' data.

Customer Content is stored in the United States, in the AWS US West (Oregon) region through Supabase. DraftAria will not move the storage of Customer Content outside the United States without giving notice under the Subprocessors section.

This DPA lasts as long as DraftAria processes Customer Personal Data under the Agreement. Each party's liability under this DPA is subject to the limitations of liability in the Agreement.