Data Processing Addendum.

Last updated: 2026-06-25

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer") and Dharta Labs, Inc., a Delaware corporation ("Dharta"), governing Customer's use of the Services. This DPA applies when Dharta processes Customer Personal Data on behalf of Customer.

In the event of a conflict, the following order of precedence applies, to the extent of the conflict: (1) the Standard Contractual Clauses, where they apply; (2) this DPA; and (3) the Agreement. The DPA otherwise supplements the Agreement and does not modify its other terms.

Dharta may amend this DPA on reasonable notice to Customer to the extent the amendment is required to reflect changes in Applicable Data Protection Law, guidance from a supervisory authority, or changes to the Services that do not materially reduce the protections afforded to Customer Personal Data.

1. Definitions

"Applicable Data Protection Law" means privacy, data protection, and data security laws applicable to Dharta's processing of Customer Personal Data, including where applicable the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, and other U.S. state privacy laws.

"Customer Personal Data" means personal data Dharta processes on behalf of Customer through the Services, including End-User Data.

"End-User Data" means prompts, messages, files, transcripts, Outputs, tool inputs/outputs, hosted-chat content, and durable workspace state relating to Customer's end users.

"Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

"Subprocessor" means a third party Dharta engages to process Customer Personal Data.

"SCCs" means the European Commission Standard Contractual Clauses under Implementing Decision (EU) 2021/914, Modules Two and Three as applicable.

Terms such as controller, processor, data subject, personal data, processing, business, service provider, consumer, sell, and share have the meanings given under Applicable Data Protection Law. Capitalized terms used but not defined in this DPA (including "Agreement," "Services," "Customer Content," "Outputs," and "Authorized Users") have the meanings given in the Agreement.

2. Roles

Customer is the controller of Customer Personal Data and Dharta is the processor. If Customer acts as a processor for another controller, Dharta acts as Customer's subprocessor and Customer represents that it has authority to appoint Dharta and instruct the processing.

Dharta is a controller for Customer account, billing, dashboard, website, support, and platform-administration data. That data is governed by Dharta's Privacy Policy, not this DPA.

3. Instructions and Processing

Dharta will process Customer Personal Data only:

• to provide, secure, support, maintain, and improve the Services;
• as documented in the Agreement, this DPA, and Customer's use/configuration of the Services;
• to prevent or address fraud, abuse, security incidents, technical issues, and policy violations;
• to comply with law; and
• as otherwise instructed by Customer in writing.

Customer's documented instructions include Customer's configuration of Agents, model mode, BYOK keys, tools, MCP servers, external integrations, retention/export settings, access controls, spend caps, and embeds.

Where Dharta is required by EU or Member State law, or other Applicable Data Protection Law, to process Customer Personal Data other than on Customer's instructions, Dharta will inform Customer of that legal requirement before processing, unless that law prohibits such notice on important grounds of public interest.

Dharta will inform Customer if, in Dharta's opinion, an instruction violates Applicable Data Protection Law, unless law prohibits that notice. Dharta will also promptly inform Customer if it determines that it can no longer meet its processing obligations under this DPA, in which case Customer may, as its remedy, suspend the affected processing or terminate the affected Services. Customer is responsible for the lawfulness of its instructions and for providing notices, consents, and lawful bases to end users.

Customer will defend, indemnify, and hold harmless Dharta and its affiliates from and against any claim, demand, fine, or proceeding by a third party, data subject, end user, or supervisory authority, and any resulting losses, to the extent arising from Customer's instructions, Customer's configuration or use of the Services, or Customer's failure to obtain or maintain the notices, consents, lawful bases, or rights required under Section 14.

Dharta will not sell or share Customer Personal Data, use it for targeted advertising or cross-context behavioral advertising, or use it to train or fine-tune models unless Customer expressly opts in.

Dharta may create and use aggregated, anonymized, and de-identified data derived from the processing, and operational and telemetry data about the Services (such as usage volumes, error rates, latency, and security signals), to provide, secure, monitor, support, and improve the Services. Dharta will not attempt to re-identify de-identified data, and such data does not identify Customer, any data subject, or any end user. This data is not Customer Personal Data.

4. Personnel and Confidentiality

Dharta will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access data only as needed for their duties.

Dharta operator access to End-User Data is restricted, logged, and limited to support, security, abuse, legal, or service-operation needs. Where product controls support it, transcript access is subject to customer-configurable access settings, dual-audited, and customer-visible.

5. Security Measures

Dharta will maintain technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and accidental loss, destruction, alteration, or disclosure. Current measures include:

• TLS for data in transit;
• encryption at rest for designated stores and provider-managed encryption for cloud storage;
• AES-256-GCM encryption for BYOK provider keys;
• bcrypt hashing for API keys;
• role-based access control and scoped keys;
• MFA/passkey support and step-up checks for sensitive actions;
• per-session isolated runtime environments;
• tenant and workspace partitioning;
• audit logging for account and operator actions;
• vulnerability management and dependency review;
• backup and recovery processes; and
• least-privilege access practices.

Dharta may update measures if the overall protection is not materially reduced. Dharta is not currently SOC 2 certified and has not yet begun a SOC 2 examination; Dharta intends to begin pursuing SOC 2 Type I in Q4 2026.

6. Subprocessors

Customer gives Dharta general authorization to engage Subprocessors. Dharta's current Subprocessor list is published in the Sub-processor List and currently includes Stripe, Anthropic, Hetzner Online GmbH, AWS, Postmark, and Sentry (application error monitoring and performance telemetry; United States).

Dharta will impose written obligations on Subprocessors that are substantially similar to this DPA where applicable. Dharta remains fully liable to Customer for the performance of each Subprocessor's data-protection obligations, subject to the monetary liability limitations in the Agreement.

Dharta will provide at least 30 days' notice before authorizing a new Subprocessor to process Customer Personal Data, unless immediate onboarding is required for security, legal, continuity, or urgent operational reasons, in which case Dharta will provide notice as soon as reasonably practicable thereafter. The objection right below applies in either case. Customer may object within 15 days on reasonable data-protection grounds by emailing privacy@dharta.ai. The parties will work in good faith to resolve objections. If unresolved, Customer's sole remedy is to terminate the affected Services within 30 days after the objection and receive any refund available under the applicable Dharta refund and billing terms; if Customer does not terminate within that window, the new Subprocessor is deemed accepted.

BYOK Model Providers are Customer-selected providers and are not Dharta Subprocessors for BYOK traffic. Customer is responsible for its own provider agreement, DPA, costs, and compliance.

7. Data Subject Requests

Dharta will assist Customer, taking into account the nature of processing, with data subject requests. If Dharta receives a request relating to Customer Personal Data, Dharta may direct the requester to Customer or forward the request to Customer if identifiable. Dharta will not respond directly except as authorized by Customer or required by law.

Customer is responsible for responding to data subject requests relating to Customer Personal Data. Dharta may charge reasonable fees for assistance that exceeds self-service functionality or ordinary support.

8. Security Incident Notice

Dharta will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

Notice will include available information about the nature of the incident, affected data and data subjects, likely consequences, and mitigation steps, and may be provided in phases as information becomes available. Dharta will reasonably cooperate with Customer's investigation and notification obligations. As between the parties, Customer is solely responsible for determining whether, and for fulfilling any obligation to, notify supervisory authorities, affected data subjects, or others; Dharta will not make such notifications on Customer's behalf, or identify Customer in a notification, except as required by law or as Customer directs in writing. Dharta's notification of, or response to, a Security Incident is not an acknowledgment of fault or liability.

9. DPIAs and Regulatory Assistance

Dharta will provide reasonable assistance with data protection impact assessments, transfer impact assessments, and regulator consultations required by Applicable Data Protection Law, taking into account the nature of processing and information available to Dharta. Dharta may charge reasonable fees for such assistance, and for audit-support and similar regulatory assistance, that exceeds Dharta's standard documentation and reports.

10. Return and Deletion

On termination or Customer request, Dharta will delete or return Customer Personal Data as instructed, subject to product functionality, backups, legal holds, security, fraud, abuse, dispute, and statutory retention.

Customer is responsible for exporting or requesting return of Customer Personal Data during the post-termination export window provided in the Agreement or through available self-service functionality. Unless Customer requests return during that window, termination is a standing instruction to delete Customer Personal Data. Dharta will use commercially reasonable efforts to delete active Customer Personal Data within a reasonable period, on Dharta's ordinary deletion cycles, after termination or request, with archival and backup copies aging out on Dharta's ordinary backup cycles and remaining subject to this DPA's confidentiality and security protections until deleted. Dharta is not required to return or delete data in a form, format, or schedule that is technically impracticable or that would require Dharta to compromise the security or integrity of its systems. On request, Dharta will certify deletion in writing.

11. Audits

Dharta will make information reasonably necessary to demonstrate compliance available to Customer. Where Dharta has a current third-party audit report or certification, Dharta may provide it under confidentiality to satisfy audit obligations.

If available information is insufficient, Customer may audit Dharta's relevant controls no more than once per 12 months, on at least 30 days' notice, during business hours, at Customer's expense, under confidentiality, and without unreasonable disruption, except where a more frequent audit is required by a supervisory authority or following a Security Incident affecting Customer Personal Data. The audit scope and duration must be reasonable and mutually agreed in advance, are limited to a reasonable number of business days, and must not require Dharta to disclose information that would compromise the security of other customers or breach Dharta's confidentiality or legal obligations. Inspection of physical data-center controls of Dharta or its Subprocessors is satisfied by the applicable third-party audit reports or certifications; Dharta is not required to provide physical access to data centers except to the extent a supervisory authority requires on-site inspection of Dharta's own controls or such reports are demonstrably insufficient to provide equivalent assurance, in which case the parties will agree reasonable terms for a narrowly scoped on-site inspection of Dharta's own controls. Dharta may reject auditors that are competitors of Dharta or not reasonably qualified, and may require the auditor to execute Dharta's confidentiality agreement directly before the audit. Customer bears its own costs and Dharta's reasonable costs of supporting the audit. Customer may use audit results only to confirm Dharta's compliance with this DPA, to meet Customer's own regulatory requirements, and as required to comply with Applicable Data Protection Law or a supervisory-authority request, and the results are the Confidential Information of both parties.

12. International Transfers

For transfers of Customer Personal Data from the EEA, UK, or Switzerland to a country that does not benefit from an adequacy decision, the SCCs are incorporated into this DPA by reference and deemed executed by the parties, completed as follows. Customer (and any controller on whose behalf Customer acts) is the data exporter; Dharta is the data importer. Where the Customer Personal Data is also transferred onward to a Subprocessor, the relevant transfer terms apply between Dharta and that Subprocessor.

• Module Two applies where Customer is controller and Dharta is processor.
• Module Three applies where Customer is processor and Dharta is subprocessor.
• Clause 7 (docking clause) applies.
• Clause 9 Option 2 (general written authorization) applies, with the Subprocessor notice period set out in Section 6.
• Clause 11 (independent dispute resolution) optional wording does not apply.
• Clause 17 (governing law) is the law of Ireland.
• Clause 18 (choice of forum and jurisdiction) is the courts of Ireland.
• Annex I.A (parties) is completed by the preamble and Schedule 1; Annex I.B (description of transfer) by Schedule 1; Annex I.C (competent supervisory authority) by Schedule 1; Annex II (technical and organizational measures) by Schedule 2; and Annex III (Subprocessors) by Schedule 3.
• For UK transfers, the UK International Data Transfer Addendum (the UK Addendum) applies, the EU SCCs as completed above are the Approved Addendum's incorporated clauses, and Dharta as data importer may end the UK Addendum as permitted by its Table 4.
• For Swiss transfers, the SCCs apply with the FADP adaptations: references to the GDPR are read as references to the FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; and, until the revised FADP is in force, the SCCs also protect the data of legal entities.

The parties acknowledge that the third-party-beneficiary rights of data subjects under Clause 3 of the SCCs apply as set out in the SCCs. To the extent the SCCs conflict with this DPA, the SCCs control. Dharta will, on Customer's reasonable request, provide information reasonably necessary for Customer to complete a transfer impact assessment, and may satisfy its transfer-mechanism and transfer-impact obligations through published documentation. If the SCCs or any other transfer mechanism relied on here is invalidated, superseded, or amended, or an adequacy decision (including any applicable data privacy framework) changes, Dharta may adopt an alternative lawful transfer mechanism or successor clauses, which will apply automatically without re-execution of this DPA. Schedules 1, 2, and 3 below complete the SCC annexes.

13. U.S. State Privacy Terms

For Customer Personal Data subject to U.S. state privacy laws, Dharta acts as service provider/processor and Customer acts as business/controller. Customer's disclosure of Customer Personal Data to Dharta is not a sale or share and is made for the business purposes of providing the Services.

Dharta processes Customer Personal Data only for the business purposes specified in this DPA and the Agreement and to perform the Services. Dharta will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes specified in this DPA, including outside the direct business relationship, except as permitted by Applicable Data Protection Law; (c) combine it with other personal information except as permitted by Applicable Data Protection Law; or (d) use it for targeted advertising or cross-context behavioral advertising. Dharta certifies that it understands and will comply with the restrictions in this Section.

Dharta will notify Customer if it determines that it can no longer meet its obligations under Applicable U.S. state privacy law. Customer may take reasonable and appropriate steps to (i) ensure that Dharta uses Customer Personal Data in a manner consistent with Customer's obligations under Applicable U.S. state privacy law, including by monitoring Dharta's compliance with this Section, and (ii) stop and remediate any unauthorized use of Customer Personal Data. Dharta engages Subprocessors only under a written contract requiring them to provide the same level of protection as required of Dharta under this Section.

14. Customer Obligations

Customer represents that it has all rights, notices, consents, permissions, and lawful bases required for Dharta to process Customer Personal Data under this DPA. Customer is responsible for determining whether the Services are suitable for Customer's data, industry, jurisdictions, and use case.

Customer will not submit protected health information, payment-card data, Social Security numbers, government identifiers, or other regulated data unless Dharta expressly agrees in writing to support it. Dharta has no liability arising from Customer's submission of such data in breach of this Section, Dharta may suspend processing of or delete such data, and Customer will defend, indemnify, and hold harmless Dharta and its affiliates from and against any claim or losses arising from that submission.

15. Government and Third-Party Requests

If Dharta receives a legally binding request for Customer Personal Data, Dharta will, where legally permitted, notify Customer, direct the requester to Customer where appropriate, challenge requests that appear unlawful or overbroad where it has reasonable grounds to do so, and disclose only what Dharta reasonably believes is legally required.

16. Liability

Each party's and its affiliates' total aggregate liability arising out of or related to this DPA and the Standard Contractual Clauses, whether in contract, tort, or any other theory, is subject to the limitations and exclusions of liability (including the aggregate liability cap and the exclusion of indirect, consequential, and similar damages) set out in the Agreement. Any reference in the Agreement's liability provisions to the liability of a party means the aggregate liability of that party and its affiliates under the Agreement, this DPA, and the SCCs taken together. Nothing in this DPA limits liability that cannot be limited under Applicable Data Protection Law or excludes a data subject's rights under the SCCs. The liability limitations and exclusions in the Agreement do not apply to, and do not limit, (a) either party's liability to a data subject under the SCCs; (b) the parties' allocation between themselves of liability for compensation owed to a data subject as required by Clause 12 of the SCCs; or (c) any liability that the SCCs prohibit from being limited. For any claim governed by the SCCs, the liability regime of the SCCs controls over the Agreement's liability provisions to the extent of any conflict.

17. Term and General

This DPA takes effect on the effective date of the Agreement and continues until the Agreement terminates or expires and Dharta has completed its deletion and return obligations under Section 10. This DPA is governed by, and construed in accordance with, the governing law and venue of the Agreement, except where the SCCs or Applicable Data Protection Law require otherwise. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force, and the invalid provision will be modified to the minimum extent necessary to make it valid and enforceable while preserving its intent.

Notices to Dharta under this DPA are given to privacy@dharta.ai or to Dharta Labs, Inc., 600 1st Ave Ste 102, PMB 2132, Seattle, WA 98104, USA; notices to Customer are given to the contact and method specified in the Agreement.

Any provision that by its nature should survive termination survives, including Sections 4 (confidentiality), 10 (return and deletion, and audit of deletion), 11 (audit, as to the surviving obligations), 13, 16 (liability), 17, the Customer indemnities in Sections 3 and 14, and the international-transfer terms in Section 12 for so long as Dharta retains Customer Personal Data.

Schedule 1 - Processing Details

List of parties (SCC Annex I.A). The data importer is Dharta Labs, Inc., 600 1st Ave Ste 102, PMB 2132, Seattle, WA 98104, USA; data-protection contact: privacy@dharta.ai; role: processor (Module Two) or subprocessor (Module Three). The data exporter is the Customer identified in the Agreement (and any controller on whose behalf Customer acts); its contact, and any data protection officer or Article 27 representative, are as set out in the Agreement or provided to Dharta on request; role: controller or processor.

Item	Description
Subject matter	Provision of Dharta's platform for running Customer Agents as durable kartas.
Duration	Term of the Agreement plus deletion/return period and lawful retention.
Nature and purpose	Hosting, executing, routing, storing, securing, supporting, metering, and debugging Customer Agents and end-user sessions.
Data subjects	Customer's end users and individuals whose personal data is included in Customer Content.
Categories of data	Prompts, messages, files, transcripts, Outputs, tool I/O, workspace state, session identifiers, routing metadata, and data determined by Customer.
Special categories	Not intended; prohibited unless Dharta separately agrees in writing. No additional safeguards apply because special-category data is not contemplated.
Frequency of transfer	Continuous, for the duration of the Agreement, as determined by Customer's configuration and use of the Services.
Locations	Control plane (accounts, organizations, billing, audit log, primary Postgres) hosted by Hetzner Online GmbH in the United States (Hillsboro, Oregon); data plane (agent session compute, S3 workspace/merge store, RDS session/transcript database) on AWS in us-east-1, United States.
Competent supervisory authority	Determined under Clause 13 of the SCCs by reference to the data exporter's place of establishment or appointed representative; where the data exporter is established outside the EEA and has no representative, the supervisory authority of Ireland.

Schedule 2 - Technical and Organizational Measures

The measures described in Section 5 are Dharta's binding technical and organizational measures for purposes of GDPR Article 32 and SCC Annex II. Dharta will maintain measures providing a level of protection appropriate to the risk, and any replacement measures will be no less protective overall. Measures include encryption, access control, MFA/passkeys, scoped keys, microVM/session isolation, tenant partitioning, audit logs, vulnerability management, backup/recovery, and subprocessor risk management.

Schedule 3 - Subprocessors

The authoritative, current list is the Sub-processor List published by Dharta. As of the date above it comprises:

Subprocessor	Location	Processing activity	Privacy contact
Stripe	United States	Payments and subscription billing	privacy@stripe.com
Anthropic	United States	LLM inference for Dharta-managed (non-BYOK) requests	privacy@anthropic.com
Hetzner Online GmbH	United States	Control-plane hosting and primary Postgres	data-protection@hetzner.com
AWS	United States (us-east-1)	Data-plane agent session compute, S3 workspace/merge store, and RDS session/transcript database	aws-privacy@amazon.com
Postmark	United States	Transactional email	privacy@postmarkapp.com
Sentry	United States	Application error monitoring and performance telemetry	privacy@sentry.io

BYOK Model Providers selected by Customer are not Dharta Subprocessors for BYOK traffic and are not listed here.