Data Processing Addendum

1. Scope, formation and roles

1.1 Automatic application. This DPA forms part of the Agreement and applies automatically to the extent Mnemo processes Customer Personal Data as a processor or subprocessor on Customer's behalf. No signature, click or other action is needed. "Agreement" means the Mnemo Terms of Service (https://www.trymnemo.com/terms) and any Order Form between Customer and Mnemo.

1.2 Definitions. "Customer Personal Data" means personal data in Customer Content that Mnemo processes on Customer's behalf. "Data Protection Laws" means the data protection laws applicable to that processing, including where applicable Regulation (EU) 2016/679 (the "GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP") and U.S. state privacy laws. "Restricted Transfer" means a transfer of Customer Personal Data to Mnemo (or onward from Mnemo) that, under the GDPR, UK data protection law or the FADP, requires a transfer mechanism. "EU SCCs" means the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner. Other terms have the meanings given in the Agreement or the GDPR.

1.3 Roles. For Customer Personal Data, Customer is the controller (or a processor acting for its own controller) and Mnemo is Customer's processor (or subprocessor) and service provider. Mnemo processes Operational Data (account, authentication, billing, payment, Terms-acceptance, security, fraud-prevention, telemetry and support data) as an independent controller under its Privacy Policy; this DPA does not apply to Operational Data. Customer and Mnemo are not joint controllers.

1.4 Accountless access excluded. Accountless (x402) access must not be used to submit personal data subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland. Such processing requires an account. Mnemo cannot identify an accountless user as a data exporter, and the EU SCCs and UK Addendum are not offered for accountless access.

2. Instructions

Mnemo processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the Services (including requests made by Customer's Automated Systems) are Customer's complete instructions. Mnemo may process Customer Personal Data where required by applicable law, and will inform Customer before doing so unless the law prohibits it. Mnemo will inform Customer if it believes an instruction infringes Data Protection Laws. Mnemo does not sell or share Customer Personal Data, does not use it for targeted advertising, and does not combine it with other data or use it outside the direct business relationship with Customer, except as permitted for service providers by applicable law.

3. Details of processing

Set out in Annex I.

4. Customer obligations

Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including notices, consents and other legal bases. Customer will not submit special-category data, protected health information, payment-card data, regulated biometric data, regulated children's data, classified information or similarly regulated sensitive data unless Mnemo has agreed in writing. Mnemo does not scan or inspect every payload.

5. Confidentiality

Mnemo ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations.

6. Security

Mnemo implements the technical and organizational measures in Annex II. Mnemo may update them, provided the update does not materially reduce the overall protection of Customer Personal Data.

7. Subprocessors

7.1 General written authorization. Customer gives Mnemo general written authorization to engage subprocessors. The current list is Annex III and https://www.trymnemo.com/subprocessors.

7.2 Changes and objection. Mnemo will inform Customer of any intended addition or replacement of a subprocessor at least 30 days in advance, by email to the account owner and by updating https://www.trymnemo.com/subprocessors, with the information needed to exercise the right to object. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Services.

7.3 Flow-down and responsibility. Mnemo imposes on each subprocessor, by written contract, data protection obligations that in substance are no less protective than this DPA, and remains responsible to Customer for its subprocessors' performance.

8. Assistance

Taking into account the nature of the processing and the information available to it, Mnemo will provide reasonable assistance to Customer with (a) data-subject requests (Mnemo forwards requests it receives to Customer where it can identify Customer and does not answer them itself unless Customer instructs it to); (b) security of processing; (c) personal-data-breach notifications; and (d) data protection impact assessments and prior consultations, where required.

9. Personal data breach

Mnemo will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, at the account owner's email address, with the information reasonably available to help Customer meet its obligations, and will take reasonable steps to contain, investigate and remediate it. Notification is not an acknowledgement of fault.

10. Deletion and return

Customer Personal Data is deleted under the retention lifecycle in Section 10 of the Terms: accountless namespaces at expiry; Trials 7 days after the Trial ends unless the account moves to a paid plan; terminated or expired paid accounts after a 30-day grace period; and on account deletion. During the Agreement and any grace period, Customer may retrieve Customer Content through the Services. After that, Mnemo deletes Customer Personal Data from active systems, except where retention is required by applicable law. Deleted data may remain in backups until they expire: operator-created backups are kept for no more than 30 days, and scheduled provider backups follow the provider's rotation (daily up to 6 days, weekly up to 27 days). Data that remains in backups stays protected by this DPA and is not actively processed.

11. Audits and information

Mnemo will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire and a summary of its security measures. Where Data Protection Laws or the EU SCCs require it, and that information is not sufficient, Mnemo will allow audits by Customer or an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, no more than once per year (unless required by a supervisory authority or following a personal data breach), at Customer's cost and without access to other customers' data. Nothing in this Section limits Clause 8.9 of the EU SCCs where they apply.

12. Restricted Transfers

12.1 Location. Mnemo processes Customer Personal Data in the United States. Mnemo is not certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework.

12.2 Transfer mechanism required before a Restricted Transfer. Where Customer Personal Data subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland requires a restricted-transfer mechanism, the applicable transfer mechanism (the EU SCCs, Module Two where Customer is a controller and Mnemo its processor, or Module Three where Customer is a processor and Mnemo its subprocessor; the UK Addendum; and, for Switzerland, the EU SCCs with the adaptations required by the FADP, as applicable) must be completed before Customer uses the Services for such a transfer. Customer must contact Mnemo at legal@trymnemo.com before that use. Mnemo will collect the required legal-entity details and complete the applicable transfer mechanism with Customer.

12.3 Accountless access. Accountless (x402) access must not be used for such personal data (Section 1.4).

12.4 Precedence. Where the EU SCCs or the UK Addendum have been completed for a transfer and conflict with this DPA or the Agreement, the EU SCCs or the UK Addendum prevail. Nothing in the Agreement limits or prejudices the rights of data subjects under them.

12.5 Transfer impact assessment. Mnemo provides the information in its Transfer Impact Assessment input document (available on request to privacy@trymnemo.com) to help Customer document its assessment under Clause 14 of the EU SCCs or UK transfer risk assessment.

12.6 Onward transfers. Where the EU SCCs apply, Mnemo will ensure onward transfers to subprocessors comply with Clause 8.7 of the EU SCCs.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except to the extent applicable law or the EU SCCs or UK Addendum do not permit them. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails (subject to Section 12.4).

14. Term

This DPA applies for as long as Mnemo processes Customer Personal Data on Customer's behalf.

Annex I — Details of processing

• Parties and roles: Customer (controller, or processor for its own controller) and Mnemo LLC (processor or subprocessor), as set out in Section 1.3.
• Subject matter: watermarking, provenance, lineage and verification of vectors and related metadata.
• Nature: receipt, hosting, storage, computation (watermark embedding and verification), indexing, retrieval and deletion.
• Purpose: to provide, secure and support the Services under the Agreement.
• Categories of data subjects and personal data: whatever Customer chooses to include in Customer Content (vectors, embeddings, metadata, model identifiers, subject identifiers, provenance and lineage records). Mnemo does not determine these categories.
• Sensitive data: none permitted unless agreed in writing (Section 4).
• Frequency: continuous, for as long as Customer uses the Services.
• Duration and retention: the term of the Agreement plus the lifecycle in Section 10.

Annex II — Technical and organizational measures

These are the measures actually in place. Mnemo holds no SOC 2, ISO 27001 or other certification.

1. Encryption in transit. Public endpoints of the API (api.trymnemo.com) and website (www.trymnemo.com) are served over TLS.
2. Credential protection. API keys are stored only as SHA-256 hashes, not in plain text. Accountless namespaces use capability tokens bounded to the namespace lifetime.
3. Tenant scoping. Every Customer Content record carries a tenant identifier; requests are authenticated to a tenant, and results are filtered to the requesting tenant (the shared search index applies a fail-closed tenant filter).
4. Integrity of billing records. The billing ledger and funding events are append-only: database triggers reject updates and deletes.
5. Least-privilege production access. Production administration (hosting, database, cache and secrets) is restricted to the owner's accounts with the hosting providers.
6. Managed hosting. Production runs on managed infrastructure providers (Annex III); physical and environmental security is provided by those providers.
7. Encryption at rest. Depends on the hosting provider's storage; Mnemo does not add application-level encryption at rest.
8. Data minimization and limited retention. Customer Content is retained under the lifecycle in Section 10; accountless namespaces expire automatically (24 hours by default, at most 72 hours); IP addresses used for rate limiting are kept in hashed form for up to 2 hours; usage telemetry is kept for up to 90 days; operator backups are kept for no more than 30 days.
9. Testing. Code changes run automated test suites in continuous integration before release.
10. Logging. Production services write application and HTTP logs, retained by the hosting provider for up to 30 days.
11. Assistance measures. Requests from data subjects are forwarded to the Customer; tenant-scoped deletion supports deletion requests.

Annex III — Subprocessors

Customer authorizes the following. Current list: https://www.trymnemo.com/subprocessors.

Part A — process Customer Personal Data

Part B — process Operational Data only (listed for transparency; no Customer Content)