Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Use between WORKSTORIES, INC. ("SYNPL") and a business customer ("Customer"). It takes effect when Customer affirmatively accepts Terms or an order that incorporates this DPA and SYNPL processes personal data on Customer's behalf. Publication alone is not acceptance. Customer's identity and authorized contact are those in the accepted business account or order; SYNPL's contact appears below.

"Customer Personal Data" means personal data processed by SYNPL on Customer's behalf under this DPA. "Applicable Data Protection Law" means the privacy law applicable to that processing, including the EU or UK GDPR and applicable US state service-provider laws where their conditions apply. Controller, processor, personal-data breach and similar terms have their statutory meanings.

1. Scope and roles

Customer is controller, or a processor with authority from its controller; SYNPL is respectively processor or subprocessor for instructed assistant processing. This covers transit through SYNPL's Germany-hosted API server and processing by its cloud AI provider, not only persistent storage. Receiving and relaying data can be processing even though request/response bodies are not saved.

Local workspace storage is on Customer-controlled Macs; the phone companion uses an end-to-end encrypted relay. These architectural choices reduce access but do not remove duties for the software and processing SYNPL controls. SYNPL separately acts as controller for its own account administration, billing, fraud/security operations, support administration and product analytics as described in the Privacy Policy. Classification follows the actual purpose, not the physical location or a label in this DPA.

Schedules A-C form part of this DPA. An enabled source or cloud function is not permission for unrelated purposes, general-purpose model training or unrestricted storage.

2. Instructions and Customer responsibilities

Customer's documented instructions consist of the accepted agreement, this DPA, authorized source/feature selections, prompts, approved workflows and lawful support instructions. SYNPL processes only on those instructions, including for transfers, unless law requires otherwise. Where legally permitted, SYNPL will inform Customer of a legal requirement before processing. SYNPL will notify Customer if an instruction appears to infringe applicable data-protection law and may suspend the affected processing while it is resolved.

Customer must establish the lawful basis and necessary notices, authorizations and consents for its information, personnel and correspondents. It must have authority for connected accounts and any recording or voice processing, minimize sources and maintain human review of consequential actions. Technical OAuth or device permission is not proof of that authority. Required Google-to-AI disclosure and consent must precede the relevant transfer.

Unless specifically agreed with suitable safeguards, the processing is not intended for regulated medical records, large-scale special-category or criminal-record datasets, biometric identification, children's datasets or payment-card security data. Incidental sensitive content is possible in business communications; Customer must assess it, minimize it and establish any additional lawful basis. Local masking does not eliminate that responsibility or SYNPL's own duties.

3. SYNPL's processing commitments

SYNPL will process Customer Personal Data only to provide instructed functions and necessary support, maintain confidentiality and ensure authorized personnel are bound by confidentiality duties. Personnel access is limited to a legitimate need and the agreement's restrictions; there is no general permission for staff to inspect local workspaces.

SYNPL will not sell Customer Personal Data, use it for targeted advertising, train general-purpose models on it, or persist the personal workspace as a hosted repository. Application-server AI request/response bodies are not retained as stored records. This does not exclude the operational metadata disclosed in the Privacy Policy or information Customer deliberately supplies for support.

Google-derived data, including aggregates and derivatives, remains subject to the Google Limited Use commitments in the Privacy Policy. Human access and onward transfer must fit the permitted exceptions. Customer instructions cannot authorize SYNPL to breach those commitments.

SYNPL will implement measures appropriate to the nature and risk of processing, including Schedule B, and review their effectiveness proportionately. No independent audit certification, zero-retention approval or guarantee of absolute security is represented. Beta status does not lower mandatory legal safeguards.

4. Subprocessors

Customer gives general written authorization for the subprocessors and functions in Schedule C to the extent they process Customer Personal Data. SYNPL will engage them under written data-protection obligations appropriate to the processing and no less protective than those this DPA requires, and remains responsible for their performance to the extent required by law. A provider's own terms do not cancel SYNPL's obligations to Customer.

SYNPL will notify Customer of a proposed new or replacement subprocessor at least 30 days before affected processing, identifying the function and relevant location. Customer may object on reasonable data-protection grounds within that period. The parties will seek a workable alternative. If none is reasonably available, Customer may terminate the affected function before the change takes effect and receive the refund due for the unused prepaid affected service under the Terms. Required consent under Google rules is separate from this general authorization.

If an urgent legal or security need prevents that notice period, SYNPL will provide notice as soon as possible and will not treat urgency as permission to ignore a required authorization or transfer safeguard. It may pause the affected function until a lawful arrangement is available.

5. Locations and international transfers

The SYNPL intermediary and operational records are hosted with Hetzner in Germany. OpenAI processing involves the United States; relevant ancillary providers have their own processing locations. EU hosting of one server is not a promise that every processing step stays in the EU or that a US operator is outside transfer rules.

Where a transfer requires an adequacy basis, standard contractual clauses, a UK transfer instrument or other recognized safeguard, the parties must put the valid mechanism and any required supplementary measures in place before that transfer. SYNPL will provide information and assistance reasonably needed for the applicable assessment and will not proceed with a restricted transfer lacking its required safeguards. Onward transfers remain subject to the same requirement.

This DPA is not itself a completed set of EU Standard Contractual Clauses or a UK transfer addendum, and does not assert that any particular provider has an unverified certification. Where required, the appropriate transfer instrument, parties, modules, annexes and locations must be identified in the applicable contractual record. Valid transfer clauses prevail over inconsistent provisions here, including incompatible limits on rights or liability. SYNPL will notify Customer if it can no longer comply and suspend or otherwise lawfully resolve affected processing.

6. Rights requests and assistance

Taking account of the processing and information available to it, SYNPL will reasonably assist Customer with requests for access, correction, deletion, restriction, portability, objection and other applicable rights. It will notify Customer of a request concerning Customer Personal Data unless law forbids this, and will not independently resolve it contrary to Customer's lawful instructions except where law requires action.

SYNPL will assist, as applicable, with security obligations, breach assessment, data-protection impact assessments and prior regulatory consultation. It is not required to invent information it does not hold or collect an entire local workspace to answer a request. Assistance outside ordinary service can be charged at reasonable agreed rates where lawful, but not for correcting SYNPL's own breach or in a way that prevents mandatory compliance.

7. Personal-data breaches

SYNPL will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data it processes. It will provide available information about the nature of the incident, affected data and people, likely consequences, relevant contact and containment/remediation measures, with phased updates when necessary. It will reasonably cooperate with Customer's legally required notifications and investigation.

A notification is not an admission of liability. Unsuccessful attacks without a breach do not automatically trigger this clause, though they may require appropriate security action. Customer remains responsible for incidents in its own device environment and for controller notifications; this does not excuse a breach caused by SYNPL or a subprocessor. Neither party may conceal an incident or delay a mandatory notice on the basis of beta status or an indemnity dispute.

8. Information and audits

SYNPL will make available information needed to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or its mandated independent auditor where required by law. Ordinarily the parties first use relevant documentation, questionnaires and available independent reports, with reasonable advance notice, confidentiality and safeguards for other customers' data, source code and system security.

Reasonable scope, business-hours arrangements and non-disruption conditions may apply but must not defeat a legally required audit, regulator access or an investigation justified by a material incident. Customer ordinarily bears its own audit costs; reasonable extraordinary assistance may be agreed where lawful, with no charge for remedying SYNPL's established breach. No penetration test or access to another customer's records is authorized merely by this audit clause.

9. Return, deletion and duration

This DPA lasts while SYNPL processes Customer Personal Data under the agreement. On end of service or a lawful instruction, SYNPL will, at Customer's choice, return or delete data it holds and instruct relevant subprocessors accordingly, except legally required retention. Retained exceptions are isolated to their required purposes and protected until deletion; SYNPL will explain them where legally permitted.

Local information remains under Customer's control. The Mac erase function signs out connections, revokes Google tokens and removes the local index and secrets; Customer must address its source accounts, backups and paired devices separately. SYNPL cannot provide a hosted backup of a workspace it never backed up. On request it supplies information it actually holds and required confirmation of its deletion actions.

Ordinary server technical logs have a maximum 30-day retention. Verified requests to remove server-account, usage and device records are completed within 30 days, or any shorter applicable legal deadline, subject to the limited legal exceptions in the Privacy Policy. Account and metering records are not automatically all erased every 30 days. OpenAI can retain abuse-monitoring information for up to 30 days with legal, safety and feature-specific exceptions; no zero-retention agreement is promised. SYNPL will pass lawful deletion instructions within its control and explain provider limits rather than promise impossible immediate erasure.

10. Applicable US service-provider restrictions

Where SYNPL is a service provider or contractor under applicable US state privacy law, it will process covered information only for the specified business purposes in Schedule A. It will not sell or share that information for cross-context behavioral advertising, retain or disclose it outside the direct service relationship, or combine it with unrelated information except as law and the permitted service require.

SYNPL will provide the legally required protection, notify Customer if unable to comply, and permit reasonable steps to verify compliance and stop and remediate unauthorized processing. SYNPL certifies that it understands and will comply with the applicable restrictions. The clause does not reclassify genuinely independent controller purposes or diminish statutory rights.

11. Beta status, liability and precedence

The service remains beta, as is and as available, without absolute security, anonymity, uptime or recovery warranties. Terms Section 12 supplies the applicable business liability cap and its exceptions; this DPA does not add a separate cap or permit duplicate recovery. Its duties do not disappear under a general disclaimer. Terms Section 13 supplies the limited business indemnity, not an unlimited indemnity for SYNPL's own breach.

No provision limits non-waivable data-subject rights, statutory compensation, regulator powers, mandatory processor duties or prevailing transfer clauses. This DPA controls conflicts with general commercial terms concerning processing on Customer's behalf, while mandatory law and valid transfer clauses prevail over it. It does not broaden the Privacy Policy's permitted uses. Material changes follow the notice and acceptance rules and do not retrospectively reduce accepted protections.

Schedule A. Processing description

Parties and purposes. Customer is identified in the accepted business account/order and acts in the role stated in Section 1. SYNPL is WORKSTORIES, INC., contact below. The purpose is delivery of Customer-authorized retrieval, summaries, drafting, task assistance, cloud answers/search/speech/voice, device relay and approved actions, with necessary technical support. The service is not general-purpose training or a central mailbox archive.

Operations and frequency. Selection and local preparation, indexing, minimization, transient receipt and forwarding by the German API server, analysis/generation by OpenAI, encrypted relay, delivery, necessary operational recording and instructed deletion. Processing occurs on requests and authorized recurring workflows for the duration of the service and necessary lawful deletion periods. Server-side knowledge-base embeddings are limited to the enabled function, not general permission to centralize Customer's personal workspace.

Data and people. Selected message and document excerpts, task and calendar information, prompts, relevant working-memory fragments, identifiers remaining after minimization, outputs, search queries, text for speech, real-time audio, encrypted relay payloads and necessary associated technical metadata. People can include Customer's users, personnel, customers, prospects, suppliers and correspondents. Incidental sensitive information is subject to Section 2; no broad sensitive-data processing purpose is authorized.

Locations and retention. Customer's Mac and paired device; Hetzner-hosted SYNPL infrastructure in Germany; OpenAI and the relevant ancillary services in Schedule C. Local history defaults to a seven-day source window, not expiry of all local memory. Section 9 and the Privacy Policy state the separate retention rules. A required international-transfer record is additional to this processing description.

Schedule B. Safeguards and responsibilities

Data flows. Encrypted transport for API traffic; end-to-end encryption for Mac/iPhone relay content; no persistence of cloud AI request/response bodies in SYNPL application-server records; separation of necessary account/metering/device information from personal workspace storage; text-free product-analytics events. No claim of end-to-end secrecy from SYNPL or OpenAI for cloud inference.

Local exposure controls. Source and conversation selection; configurable history window; text pseudonymization and detection of secret categories before indexing; a local model-request record and activity counters; pause/local-mode controls; and local erase and provider revocation functions. These controls must be maintained consistently with the published descriptions, without a promise of perfect detection. Approved communications remain subject to user confirmation, including an expressly approved schedule.

Operational measures. Proportionate access restriction and confidentiality for personnel, protection of credentials, necessary logging without silent workspace capture, appropriate incident response and deletion procedures, provider-contract controls, and risk-based review of vulnerabilities and safeguards. Changes may improve measures but may not materially reduce the agreed protection without the applicable process. An unperformed certification or third-party audit is not represented.

Customer environment. Customer manages device encryption, authentication, updates, physical security, malware protection, backups, sync and source-account access. SYNPL does not provide managed-device security or backup recovery. These responsibilities complement, rather than replace, safeguards SYNPL must provide for the application and its processing.

Schedule C. Current providers and role boundaries

Amplitude receives text-free interface events with device identifier, version and language for SYNPL's product analytics. Stripe handles payment information. Webflow hosts the website. These are recipients for the separate controller purposes disclosed in the Privacy Policy, not automatically subprocessors of Customer's mailbox merely because they are providers. Account-email and support delivery providers are limited to the data needed for those functions; any provider receiving Customer Personal Data on Customer's behalf must be governed and disclosed under Section 4. Customer's independently selected source providers remain governed by Customer's own arrangements unless separately engaged by SYNPL.

The exact contracting entities and any required onward-transfer details are identified in the applicable supplier agreements and made available as necessary for compliance. A functional provider list does not assert that an unidentified transfer mechanism has been completed.

Contact: WORKSTORIES, INC., 2093 Philadelphia Pike #2517, Claymont, DE 19703, United States. Email: support@synpl.com.