Data Processing Addendum
Effective Date: July 1, 2026
Last Updated: July 1, 2026
Version: en-US 2026-07-01
Contact: [email protected]
Default Processor Entity: Txaion LLC, a Wyoming limited liability company
This Data Processing Addendum ("DPA") supplements the Terms of Service, order form, or other agreement between Txaion ("Txaion," "Processor," "Service Provider," "we," "us," or "our") and the customer using the Services ("Customer," "Controller," "Business," "you," or "your"). This DPA applies when Txaion processes personal data on behalf of Customer in connection with the Services.
1. Definitions
Terms such as "personal data," "personal information," "processing," "controller," "processor," "business," "service provider," "consumer," "data subject," "sell," "share," and "sensitive personal data" have the meanings given under applicable Data Protection Laws.
"Data Protection Laws" means all privacy, data protection, security, breach notification, biometric, and consumer privacy laws applicable to the processing of Customer Personal Data, including where applicable the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, Delaware Personal Data Privacy Act, Delaware Online Privacy and Protection Act, and other U.S. state privacy laws.
"Customer Personal Data" means personal data contained in Customer Content that Txaion processes on behalf of Customer through the Services.
"SCCs" means the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914, as updated or replaced.
2. Roles and Scope
2.1 Roles
For Customer Personal Data, Customer is the controller or business, and Txaion is the processor or service provider, unless the parties expressly agree otherwise in writing. If Customer is a processor acting for a third-party controller, Customer represents that its instructions to Txaion are authorized by that controller.
2.2 Scope
This DPA applies only to Customer Personal Data processed by Txaion on behalf of Customer. Txaion may separately process account, billing, usage, security, and business contact data as a controller as described in the Privacy Policy.
2.3 Details of Processing
The subject matter, duration, nature, purpose, categories of data, and categories of data subjects are described in Annex A.
3. Customer Instructions
Txaion will process Customer Personal Data only:
- To provide, secure, support, maintain, and improve the Services as permitted by the Agreement, product settings, this DPA, and Data Protection Laws
- According to Customer's documented instructions, including the Terms, order forms, product settings, API calls, and support requests
- As required by applicable law, in which case Txaion will inform Customer unless legally prohibited
- As otherwise permitted by this DPA
For Customer Personal Data processed by Txaion as a processor or service provider, "improve the Services" is limited to security, reliability, quality, abuse prevention, debugging, support, performance, accessibility, and similar operational improvements. Txaion will not use Customer Personal Data to train, fine-tune, or improve third-party foundation models or Txaion general-purpose AI models unless Customer expressly instructs or authorizes that use in writing or through a product setting made available for that purpose.
Customer is responsible for ensuring that its instructions comply with Data Protection Laws. Txaion will notify Customer if Txaion believes an instruction violates Data Protection Laws, unless legally prohibited.
4. Customer Obligations
Customer represents and warrants that:
- Customer has all required rights, notices, consents, and lawful bases to provide Customer Personal Data to Txaion
- Customer will not submit prohibited or unsupported sensitive data unless the Services and written agreement expressly allow it
- Customer will comply with Data Protection Laws in its use of the Services
- Customer is responsible for responding to data subject or consumer requests where Customer controls the data
- Customer will configure the Services in a secure and lawful manner
- Customer will maintain legally required consent, authorization, retention, withdrawal, and deletion records for biometric-related data, voice data, likeness materials, children's data, sensitive personal data, digital twin materials, and regulated use cases
5. Txaion Processor Obligations
Txaion will:
- Process Customer Personal Data according to Customer's documented instructions
- Ensure personnel authorized to process Customer Personal Data are subject to confidentiality obligations
- Implement and maintain appropriate technical and organizational measures described in Annex B
- Assist Customer with data subject requests, consumer requests, security, breach response, data protection assessments, DPIAs, and regulatory consultations as required by Data Protection Laws and reasonably possible through the Services
- Make available information reasonably necessary to demonstrate compliance with this DPA
- Return or delete Customer Personal Data as described in Section 12
6. Confidentiality
Txaion will ensure that personnel with access to Customer Personal Data are bound by confidentiality obligations or professional duties of confidentiality. Access will be limited to personnel with a business need to provide, secure, support, or improve the Services.
7. Security Measures
Txaion will implement and maintain appropriate administrative, technical, and organizational security measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures are described in Annex B and the Security Policy.
Customer acknowledges that security is a shared responsibility and that Customer is responsible for account configuration, user permissions, endpoint security, credential protection, API key management, and lawful use.
8. Subprocessors
8.1 General Authorization
Customer gives Txaion general authorization to engage subprocessors to process Customer Personal Data. Current subprocessors are listed in the Subprocessor List.
8.2 Subprocessor Obligations
Txaion will enter into written agreements with subprocessors requiring data protection obligations materially equivalent to those in this DPA. Txaion remains responsible for subprocessors' performance of their data protection obligations to the extent required by Data Protection Laws.
8.3 Notice and Objection
Txaion may update the Subprocessor List from time to time.
Where required by applicable Data Protection Laws or a written agreement, Txaion will provide reasonable notice of material new subprocessors, or other subprocessor changes for which notice is legally required, before they are authorized to process Customer Personal Data, unless urgent security, operational, legal, continuity, infrastructure, support, service-delivery, or feature-availability reasons require shorter notice or immediate deployment.
Notice may be provided through any reasonable method, including email, in-product notice, website posting, or updates to the Subprocessor List. Not all notices will be provided individually to every Customer unless required by applicable law or a written agreement.
Updates that do not materially expand the categories of Customer Personal Data processed or materially increase privacy, security, or compliance risk may be reflected in the Subprocessor List without separate advance notice, unless applicable law or a written agreement requires otherwise.
Customer may object on reasonable data protection grounds by contacting [email protected] within the notice period stated in the notice, or if no period is stated, within a reasonable time after notice, and explaining the specific concern. Txaion will use commercially reasonable efforts to address the objection, which may include additional information, safeguards, configuration options, or use of an alternative subprocessor where reasonably available. If the parties cannot resolve the objection, Customer may stop using the affected Service or terminate the affected order as its sole remedy, unless Data Protection Laws or a written agreement require a different remedy.
9. Data Subject and Consumer Requests
Taking into account the nature of the processing, Txaion will reasonably assist Customer with requests to access, correct, delete, port, restrict, object, opt out, limit sensitive data use, or appeal decisions, to the extent Customer cannot fulfill the request through the Services. If Txaion receives a request directly relating to Customer Personal Data, Txaion may refer the requester to Customer unless legally required to respond.
10. Personal Data Breach
Txaion will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. Where GDPR, UK GDPR, or similar law applies, Txaion will use commercially reasonable efforts to provide notice promptly enough to help Customer meet any applicable 72-hour supervisory authority notification deadline. The notice will include information reasonably available to Txaion, which may include the nature of the breach, affected data, affected data subjects, likely consequences, measures taken, and contact information.
Customer is responsible for determining whether regulatory, consumer, data subject, contractual, or other notifications are required. Txaion will reasonably assist Customer with breach investigations and notices as required by Data Protection Laws. A notice or response under this Section is not an admission of fault, liability, or legal obligation.
11. Audits and Compliance Information
Txaion will make available information reasonably necessary to demonstrate compliance with this DPA and to help Customer conduct and document data protection assessments required by Data Protection Laws. Where required by Data Protection Laws, Customer may request an audit or assessment no more than once per year unless a Personal Data Breach, regulator request, or mandatory legal requirement requires more frequent review. Audits must be conducted during normal business hours, with reasonable notice, by an independent auditor subject to confidentiality obligations, and in a manner that does not compromise Txaion security, other customers, or operations.
Txaion may satisfy audit and assessment obligations by providing security summaries, questionnaires, certifications, third-party audit reports, independent assessment reports, or similar materials where available. If Data Protection Laws allow a processor-arranged independent assessment in lieu of a customer audit, Txaion may use that method and provide the resulting report or summary to Customer upon request. Penetration testing, vulnerability scanning, or access to systems requires Txaion's prior written approval.
12. Return and Deletion
Upon termination or expiration of the Services, Txaion will delete or return Customer Personal Data according to the Terms, product functionality, order form, Customer's documented instructions, and applicable law. Customer may export Customer Personal Data through available tools before termination. Where Data Protection Laws require deletion or return at Customer's direction, Txaion will follow Customer's documented instruction through available product controls or a written request, unless retention is required or permitted by law. Txaion may retain Customer Personal Data as required by law, legal holds, security, fraud prevention, dispute resolution, backups, or compliance obligations, provided retained data remains protected and is not used for other purposes. Data retained in backups will be overwritten according to backup cycles unless legal, security, or compliance obligations require longer retention.
13. International Transfers
Customer authorizes Txaion and its subprocessors to process Customer Personal Data in the United States and other countries where Txaion or its subprocessors operate.
Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will use appropriate transfer mechanisms, including the SCCs, UK International Data Transfer Addendum, Swiss adaptations, and supplementary safeguards where required.
Taking into account the nature of processing and information available to Txaion, Txaion will provide reasonable information to help Customer conduct transfer impact assessments or similar assessments required by Data Protection Laws. Customer acknowledges that subprocessors and model providers may process Customer Personal Data in countries identified in the Subprocessor List or in provider documentation for enabled features.
For EEA transfers, the SCCs are incorporated as follows unless a signed agreement states otherwise:
- Module Two applies where Customer is controller and Txaion is processor
- Module Three applies where Customer is processor and Txaion is subprocessor
- Clause 7 docking clause applies
- Clause 9 Option 2 general written authorization applies, with the notice period in Section 8.3
- Clause 11 optional language is omitted
- Clause 17 governing law is the law of Ireland
- Clause 18 forum is the courts of Ireland
- Annexes I, II, and III are completed by Annexes A, B, and C of this DPA
For UK transfers, the SCCs apply with the UK International Data Transfer Addendum or other valid UK transfer mechanism. For Swiss transfers, references to GDPR supervisory authorities and member states will be interpreted to include the Swiss Federal Data Protection and Information Commissioner and Swiss law where required.
14. U.S. State Privacy Terms
Where U.S. state privacy laws apply, Txaion acts as a processor, service provider, or contractor for Customer Personal Data. Txaion will not:
- Sell or share Customer Personal Data
- Retain, use, or disclose Customer Personal Data outside the business purposes of providing the Services
- Retain, use, or disclose Customer Personal Data for commercial purposes other than providing the Services
- Combine Customer Personal Data with personal data from other sources except as permitted by applicable law
- Process Customer Personal Data for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects unless Customer instructs Txaion to do so and the processing is supported by the applicable Service feature and Data Protection Laws
Txaion certifies that it understands and will comply with these restrictions. Customer has the right to take reasonable and appropriate steps to ensure Txaion uses Customer Personal Data consistently with Customer's obligations, as provided in this DPA.
Taking into account the nature of the processing and information available to Txaion, Txaion will reasonably assist Customer with consumer requests, opt-out requests, security obligations, data protection assessments, and other processor obligations required by applicable U.S. state privacy laws. Customer remains responsible for determining whether a particular law applies to Customer and for providing required notices, choices, consents, and instructions to Txaion.
15. AI and Model Training
Txaion will not use Customer Personal Data to train, fine-tune, or improve third-party foundation models or Txaion general-purpose AI models unless Customer expressly instructs or authorizes that use in writing or through a product setting made available for that purpose. Txaion may process Customer Personal Data for inference, retrieval, transcription, speech synthesis, output generation, safety, abuse prevention, support, debugging, logging, security, and operational service improvement as permitted by the Terms, Privacy Policy, this DPA, product settings, and applicable law.
16. Liability
Each party's liability under this DPA is subject to the limitations, exclusions, and remedies in the Terms or applicable agreement, unless prohibited by Data Protection Laws. Nothing in the Agreement limits any rights, obligations, or remedies that cannot be limited under the SCCs or mandatory Data Protection Laws.
17. Conflict
If this DPA conflicts with the Terms, this DPA controls for data protection matters. If the SCCs conflict with this DPA, the SCCs control for restricted transfers.
Annex A: Details of Processing
A.1 Subject Matter
Txaion's processing of Customer Personal Data to provide, secure, maintain, support, and improve SaaS, AI, voice, API, digital twin, and related services.
A.2 Duration
For the term of Customer's use of the Services and any post-termination period required for deletion, backup, legal, security, or compliance purposes.
A.3 Nature and Purpose
Hosting, storage, transmission, retrieval, inference, generation, analysis, indexing, search, transcription, speech synthesis, authentication, support, logging, monitoring, troubleshooting, security, abuse prevention, billing support, analytics, and related processing necessary to provide the Services. Model training, fine-tuning, or general-purpose model improvement using Customer Personal Data occurs only if Customer expressly instructs or authorizes it as described in this DPA.
A.4 Categories of Personal Data
Account data, contact data, identifiers, device data, usage data, Customer Content, prompts, uploaded files, audio, voice samples, transcripts, images, videos, profile data, digital twin materials, communications, metadata, integration data, and any personal data Customer submits to the Services.
A.5 Sensitive Personal Data
Sensitive data may include voice data, biometric-related data, precise location, health-related data, children's data, financial data, government identifiers, or other sensitive information, only to the extent Customer submits it or a supported feature processes it.
A.6 Categories of Data Subjects
Customer personnel, users, administrators, contractors, end users, prospects, customers, support contacts, speakers, content subjects, integration contacts, and any individuals whose data Customer submits to the Services.
A.7 Frequency of Transfer
Continuous or as initiated by Customer through the Services.
Annex B: Technical and Organizational Measures
Txaion's measures include, as applicable to the Services, architecture, size, and risk profile:
- Encryption in transit using TLS or equivalent
- Encryption at rest where supported by infrastructure and product design
- Access controls and least-privilege permissions
- Multi-factor authentication or equivalent strong authentication for administrative access where supported
- Access approval, removal, and periodic access review for personnel with production access
- Logging and monitoring of production systems and privileged activity where feasible
- Network and infrastructure protections through cloud and security providers
- Vulnerability management and patching based on risk
- Backup and recovery processes appropriate to the Services
- Personnel confidentiality obligations
- Security incident response procedures
- Vendor and subprocessor review
- Separation controls for customer environments where commercially reasonable
- Secure software development practices proportionate to risk
- Abuse detection, rate limiting, and anti-fraud controls
- Internal controls for support access to Customer Personal Data, including business-need access and confidentiality obligations
- Controls designed to prevent unauthorized use of Customer Personal Data for model training
Annex C: Subprocessors
Current subprocessors are listed in Subprocessors. The list may be updated according to Section 8.