DATA PROCESSING ADDENDUM (DPA)

Last Updated: October 18, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Cybentis Oy (Business ID 3593125-1), doing business as GrainQL ("Processor", "we", "us"), and the customer using the Services ("Controller", "Customer"). It applies to the extent GrainQL processes Personal Data on the Customer's behalf in connection with the Services.

This DPA supplements the GrainQL Terms of Service and Privacy Policy. If there is a conflict between this DPA and the Terms with respect to Customer Personal Data processing, this DPA controls.

1. Roles and Scope

The parties agree that, for Customer Personal Data processed through the Services on the Customer's behalf, the Customer acts as Controller (or Processor, as applicable) and GrainQL acts as Processor (or Subprocessor, as applicable).

GrainQL may separately act as an independent controller for account administration, billing, fraud prevention, security, product communications, and compliance obligations relating to the Customer's own GrainQL account.

2. Subject Matter and Nature of Processing

GrainQL provides privacy-focused analytics, reporting, heatmaps, page snapshots, APIs, data export tooling, support workflows, and AI-assisted analytics features. Processing may include collection, organization, storage, querying, retrieval, analysis, export, deletion, and anonymization of Customer Personal Data.

When the Customer uses Neo, GrainQL's AI assistant, user prompts, the query results needed to answer them and tool results are sent to AI model providers through OpenRouter, by API only. Conversations (messages, tool results and answers) are stored in Supabase in Frankfurt, Germany, so they can be continued, and the Customer can delete them in the dashboard. GrainQL does not use Customer Personal Data to train AI models.

The duration of processing is the term of the parties' agreement plus any time required to complete exports, deletion workflows, backup rotation, or legally required retention.

3. Instructions and Confidentiality

GrainQL will process Customer Personal Data only on the Customer's documented instructions, including as set out in the agreement, the Customer's product configuration, and the Customer's use of the Services, unless otherwise required by applicable law.

GrainQL will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

4. Security Measures

GrainQL maintains technical and organizational measures designed to protect Customer Personal Data, including:

• Encryption in transit: HTTPS with TLS 1.2 or newer on all public endpoints, with HTTP redirected to HTTPS
• Encrypted backups of the analytics event database
• Servers with a default-deny firewall, SSH key-only administrative access, blocking of repeated failed sign-ins and automatic security updates
• Server credentials kept encrypted in deployment tooling, and tenant API secrets stored as salted hashes
• Authentication through Auth0 with OAuth2 and signed JWTs, and per-workspace roles for Customer personnel
• Tenant isolation in the application: every request is checked against the workspace it asks for, and analytics data is partitioned by tenant
• Row-Level Security on the AI conversation data store
• Pseudonymous visitor identifiers that change daily until the visitor consents, and no IP addresses stored with analytics events
• Masking of form inputs in page snapshots, and a class that excludes elements from snapshots
• Backups of the analytics event database every other day, kept 7 days in Helsinki, and of other databases kept 14 days in Cloudflare R2
• Operational logging, monitoring and alerting
• Personnel confidentiality obligations

5. Data Breach Notification

GrainQL will notify the Customer without undue delay, and in any event no later than 48 hours, after becoming aware of a Personal Data breach affecting Customer Personal Data. The notification will include, to the extent reasonably available:

• The nature of the breach, including the categories and approximate number of data subjects and records concerned
• The name and contact details of the point of contact for further information
• The likely consequences of the breach
• The measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

GrainQL will cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of each such breach. GrainQL will provide ongoing updates as additional information becomes available.

6. Audit Rights

GrainQL will make available to the Customer, on request, information necessary to demonstrate compliance with this DPA and applicable data protection law.

The Customer (or a qualified third-party auditor appointed by the Customer and bound by appropriate confidentiality obligations) may conduct an audit of GrainQL's processing activities covered by this DPA, subject to the following conditions:

• The Customer provides at least 30 days' prior written notice of the audit
• Audits are limited to once per 12-month period, unless required by a supervisory authority or following a Personal Data breach
• The audit is conducted during normal business hours and does not unreasonably disrupt GrainQL's operations
• Audit findings and any GrainQL confidential information accessed during the audit are treated as confidential

Where GrainQL has obtained relevant third-party certifications or audit reports (e.g., SOC 2), GrainQL may provide these in lieu of a physical audit, provided they reasonably address the Customer's audit objectives.

7. Assistance with Controller Obligations

Taking into account the nature of processing and the information available to GrainQL, GrainQL will provide reasonable assistance to the Customer in:

• Ensuring compliance with security of processing obligations (GDPR Article 32)
• Data breach notification obligations (GDPR Articles 33 and 34)
• Data protection impact assessments where the Customer's use of the Services is likely to result in a high risk to data subjects (GDPR Article 35)
• Prior consultation with supervisory authorities where required (GDPR Article 36)

8. Subprocessors

The Customer grants GrainQL general authorization to use subprocessors and infrastructure providers to deliver the Services. GrainQL remains responsible for its subprocessors' processing to the extent required by applicable law. GrainQL will impose data protection obligations on each subprocessor that are no less protective than those in this DPA.

GrainQL will provide the Customer with at least 30 days' prior notice before adding or replacing a subprocessor that processes Customer Personal Data. The notice will identify the new subprocessor, its purpose, and its location.

The Customer may object to a new subprocessor by notifying GrainQL in writing within the 30-day notice period, providing reasonable grounds related to data protection. GrainQL will make commercially reasonable efforts to address the objection, which may include offering an alternative configuration. If GrainQL cannot reasonably accommodate the objection, either party may terminate the affected Services upon written notice without penalty.

9. International Transfers

Analytics events are stored on servers in Helsinki, Finland, and their backups stay in Helsinki. Other database backups and page snapshots are stored in Cloudflare R2. AI conversation data is stored in Supabase in Frankfurt, Germany.

Some processing takes place outside the EEA, the UK and Switzerland, as Annex II shows. This includes some dashboard hosting, AI model inference for Neo, website analysis during setup, support chat, logging and error tracking.

Where GrainQL transfers Customer Personal Data to a jurisdiction that does not provide an adequate level of protection, GrainQL will use the European Commission's Standard Contractual Clauses (2021 version):

• Module 2 (Controller-to-Processor) for transfers from the Customer to GrainQL
• Module 3 (Processor-to-Sub-processor) for onward transfers from GrainQL to its subprocessors

Supplementary measures include:

• Encryption in transit (TLS 1.2 or newer) for all Customer Personal Data
• API-only access for AI inference providers, with no model training on Customer Personal Data by GrainQL
• Access controls limiting data exposure to the minimum necessary for processing
• Pseudonymous analytics identifiers, and no IP addresses stored with analytics events
• Where a subprocessor is certified, the EU-US Data Privacy Framework

10. Assistance with Data Subject Requests

Taking into account the nature of the processing, GrainQL will provide reasonable assistance to help the Customer respond to requests relating to access, deletion, correction, restriction, portability, or objection, using the tools and workflows available in the Services.

11. Return and Deletion

Upon termination of the Services or on the Customer's documented instruction, GrainQL will delete, anonymize, or return Customer Personal Data in accordance with the parties' agreement, applicable law, and the configuration of the Services.

Analytics events are kept for up to 2 years. Backups are kept for up to 14 days. Retention limits by plan, and the retention setting in the Customer's workspace, are not yet enforced automatically. Until they are, GrainQL deletes data on the Customer's documented instruction, sent to privacy@grainql.com, within 30 days.

Following account termination, and on the Customer's request:

• Analytics data will be deleted within 30 days
• AI conversation data will be deleted within 30 days
• Backups containing it will expire within a further 14 days

12. Annex I: Categories of Data and Data Subjects

13. Annex II: Current Subprocessors and Providers

Infrastructure and storage

Neo and AI

Accounts, billing and email

Support and operations

14. Governing Law and Venue

This DPA is governed by the laws of Finland. Any dispute arising out of or in connection with this DPA will be subject to the courts of Helsinki, Finland, unless mandatory law requires otherwise.

Cybentis Oy
PL 157, 00101, Helsinki, Finland
legal@grainql.com