Data Processing Agreement

EFUPAL LLC, a Limited Liability Company of perpetual duration registered in the United States, EIN 37-2165821, with its registered office at 1001 S. Main St. #7973, Kalispell, MT 59901, United States, acts as processor under this DPA. Our designated contact for all matters arising under it is the Managing Member of EFUPAL LLC, reachable at the addresses below.

• Data protection and DPA requests: privacy@efupal.ai
• Security incidents and vulnerability reports: security@efupal.ai (answered within 24 hours)
• Support: support@efupal.ai or the in-app support portal, which also notifies you by email when we reply
• Voice contact is arranged on request for Sovereign customers; all other support is handled in writing so every exchange stays on an auditable record.

You are the controller of the personal data you submit to the platform. EFUPAL acts as processor and processes that data only on your documented instructions, which the Terms of Service, this DPA and your use of the platform constitute. Where we process account and billing data for our own compliance, security and invoicing purposes, we act as an independent controller under our Privacy Policy.

Subject matter: provision of the EFUPAL.AI trust infrastructure platform — issuing identities, minting and verifying proofs, maintaining an evidence trail, agent trust scoring and related support. Duration: for as long as your subscription is active, plus the deletion window in section 10.

Storage, hashing, cryptographic signing, verification, correlation, transmission and deletion of the data you submit, strictly for the purpose of delivering the platform, providing support you request, preventing abuse and meeting legal obligations. We do not use your data to train models and we do not sell it.

Data subjects: your personnel and administrators, your end users or customers where you enrol them as subjects, and named contacts inside proof payloads you submit.

Personal data: account identifiers and email addresses; subject types and subject references; identity hashes and key metadata; proof types, proof hashes and any personal data you place inside a proof payload; verification and evidence records; technical logs including IP address, timestamps and user agent.

You control payload content. Do not submit special-category data under Article 9 GDPR, government identifiers or payment card data inside proof payloads unless we have agreed that use case in writing.

Access to your data is limited to personnel who need it to operate or support the platform. Those personnel are bound by written confidentiality obligations that survive the end of their engagement, and access is logged.

We implement technical and organisational measures appropriate to the risk, including: post-quantum key encapsulation (ML-KEM-1024) for identity material with scheduled rotation; encryption in transit (TLS 1.2 or higher) and at rest; row-level access control so tenants can only reach their own records; least-privilege service credentials with write access to billing records restricted to a verified server process; hash-chained, append-only evidence storage that makes tampering detectable; continuous automated monitoring with bounded autonomous response; segregated production access with audit logging; and documented backup and restore procedures.

You authorise the following sub-processors. Each is bound by data protection terms no less protective than this DPA.

• Supabase — managed database, authentication and storage (United States / EU regions).
• Cloudflare — application hosting, edge delivery and DDoS protection (global).
• Stripe — payment processing, invoicing and tax calculation (United States / Ireland). Stripe acts as an independent controller for payment data.
• Resend — transactional and authentication email delivery from notify.efupal.ai (United States / EU).

We will give at least 30 days' notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if we cannot accommodate the objection you may terminate the affected subscription and receive a pro-rated refund for the unused period.

Personal data may be transferred to and processed in the United States and other countries where we or our sub-processors operate. Such transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum where applicable, and supplementary measures including encryption in transit and at rest and minimisation of personal data in proof payloads. The SCCs are incorporated into this DPA by reference, with EFUPAL as data importer and you as data exporter; Module Two applies where you are a controller.

The platform lets you access, export, correct and delete the records you submit, so you can respond to data subject requests directly. Where you cannot, we will assist within a reasonable time. If a data subject contacts us directly about your data, we will refer them to you rather than act on the request ourselves.

We will notify you without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting your data, including the nature of the incident, the categories and approximate volume of affected records, the likely consequences and the measures taken. We will also assist with your obligations under Articles 32 to 36 GDPR, including impact assessments and prior consultations.

You may export your identities, proofs and evidence at any time in a self-verifying format. On termination we delete your customer data within 30 days, except where retention is required by law (for example invoices and tax records, retained for the statutory period) or where evidence records must be preserved to keep previously issued proofs verifiable — in which case those records are retained in minimised, hashed form only. Backups age out within a further 30 days.

On request, no more than once per twelve-month period, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation and, where available, third-party assessments. Where that is insufficient for your regulator, we will cooperate on a mutually agreed on-site or remote audit conducted under confidentiality and without disrupting the platform.

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

Data protection enquiries, SCC signature requests and sub-processor objections: privacy@efupal.ai. Security incidents: security@efupal.ai. Company details are in our imprint.