Data Processing Addendum

1. Definitions

Capitalized words not defined here have the meanings in the Agreement. “Data Protection Laws” means all laws on privacy and the processing of personal data that apply to a party’s processing of Customer Personal Data, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state laws such as the California Consumer Privacy Act as amended (“CCPA”). “Customer Personal Data” means personal data within Customer Data that EnemoAi processes for the Customer. “Controller”, “processor”, “data subject”, “personal data”, “processing”, “business”, “service provider” and “supervisory authority” have the meanings given in Data Protection Laws. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. “Subprocessor” means a third party EnemoAi engages to process Customer Personal Data. “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1For Customer Personal Data, the Customer is the controller (or, where it processes for its own clients, a processor) and EnemoAi is its processor (or subprocessor); under the CCPA, the Customer is a business and EnemoAi is its service provider.

2.2This DPA does not apply to personal data EnemoAi processes as a controller for its own purposes, such as account administration, sign-in through WorkPair, billing, security and compliance, which the Privacy Policy describes; or to public records EnemoAi collects for its source library, for which EnemoAi is the controller.

2.3Annex 1 describes the processing. The Customer is responsible for the lawfulness of the Customer Personal Data it provides, including having a legal basis and giving any notices required, and for its instructions complying with Data Protection Laws.

3. Instructions

3.1EnemoAi processes Customer Personal Data only on the Customer’s documented instructions, unless the law to which EnemoAi is subject requires otherwise, in which case EnemoAi will tell the Customer before processing unless the law forbids it. The Agreement, this DPA, and the Customer’s and its Authorized Users’ use and configuration of the Service are the Customer’s complete instructions. Further instructions must be consistent with the Agreement and agreed in writing.

3.1aDecision dataset. When the Owner or an Admin allows contributions to EnemoAi’s decision dataset and an Authorized User opts in, that is the Customer’s instruction to derive, from each decision the user tags and reviews, an anonymous record holding only the kind of move, the quarter, the review period and the outcome rating, and to use it in totals of at least five for all customers (Terms, Section 15.2a). The records contain no personal data. EnemoAi deletes them, and the link to them kept within the Customer’s records, when the instruction is withdrawn, the user is removed or the Account closes.

3.2EnemoAi will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is changed.

4. EnemoAi’s commitments

4.1Purpose limitation. EnemoAi will not (a) sell or share Customer Personal Data, as “sell” and “share” are defined in the CCPA; (b) retain, use or disclose it for any purpose other than the business purposes of providing, securing and supporting the Service under the Agreement, or outside the direct business relationship with the Customer; (c) combine it with personal data EnemoAi receives from others, except as the CCPA permits for a service provider; or (d) use it to train AI models, or give it to a Subprocessor whose terms with EnemoAi allow that Subprocessor to train AI models on it.

4.2No cross-customer use. Customer Personal Data is never used to answer another customer’s questions. The tables holding each Customer’s content, Business Data, Data API keys, Wallet, watchlist, invitations, reports and security log are isolated in the database by row-level security (Annex 2 lists what runs outside it), and each Authorized User’s questions, quotes, answers, documents and decisions are private to them unless they share them.

4.3Compliance and notice. EnemoAi will comply with the obligations Data Protection Laws impose on it as a processor or service provider, provide the same level of protection they require, and notify the Customer if it determines it can no longer meet its obligations under the CCPA. The Customer may then take reasonable steps to stop and remediate unauthorized use.

4.4Confidentiality of personnel. EnemoAi ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to perform the Agreement (Section 15.4 of the Terms).

4.5Certification. EnemoAi certifies that it understands and will comply with the restrictions in this Section 4.

5. Security

EnemoAi implements and maintains the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches and appropriate to the risk. EnemoAi may update them, provided the update does not materially reduce the overall protection of Customer Personal Data.

6. Subprocessors

6.1General authorization. The Customer gives EnemoAi general authorization to engage Subprocessors. The current Subprocessors are listed at www.enemo.ai/legal/subprocessors, which forms Annex 3.

6.2Contracts. EnemoAi engages each Subprocessor under a written contract imposing data protection obligations no less protective than this DPA, to the extent applicable to the service it provides, and remains liable to the Customer for each Subprocessor’s performance as Data Protection Laws require.

6.3Changes and objections. EnemoAi will update the Subprocessors page and email the Customer’s Owner at least 30 days before a new Subprocessor begins processing Customer Personal Data. If an emergency (for example, replacing a provider that has failed or become insecure) makes 30 days’ notice impossible, EnemoAi will give notice as soon as practicable. The Customer may object on reasonable data protection grounds within that period by emailing hello@enemo.ai. The parties will discuss the objection in good faith; if EnemoAi cannot reasonably avoid using the Subprocessor for the Customer, the Customer may end the Agreement and receive a refund under Section 11.4 of the Terms. This is the Customer’s sole remedy for an objection.

7. Assistance

7.1Data subject requests. EnemoAi will promptly forward to the Customer any request it receives from a data subject about Customer Personal Data, unless the request concerns the requester’s own content (Section 11.5 of the Privacy Policy), and will not otherwise respond except to direct the requester to the Customer. Taking into account the nature of the processing, EnemoAi will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to such requests; the Service’s data download and deletion features are part of that assistance.

7.2Assessments and consultations. EnemoAi will provide information reasonably necessary for the Customer to carry out data protection impact assessments and prior consultations with supervisory authorities about its use of the Service, to the extent the Customer does not otherwise have access to it.

8. Personal Data Breaches

8.1EnemoAi will notify the Customer’s Owner by email without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed; information not available at first may be provided in phases.

8.2EnemoAi will take reasonable steps to contain, investigate and mitigate the breach and will cooperate reasonably with the Customer’s notifications to authorities and data subjects. Notification is not an acknowledgment of fault or liability.

9. Deletion and return

9.1During the Agreement, each Authorized User can download their own data through the Service (their profile, their Answers and those shared with them, their decisions, the watchlist and their legal acceptances), and the Owner and Admins also receive the company profile, the Wallet history, the security log and the Business Data. No download includes a teammate’s private Answers or decisions. Uploaded documents can be deleted at any time and are deleted automatically seven days after upload. The Owner and Admins can delete Business Data at any time: a record, an import with everything it brought in, a data type, or all of it.

9.2When the Owner closes the Account (in the app, after a fresh WorkPair sign-in, or by asking us), EnemoAi at once deletes every Answer, Question, Quote, decision, uploaded document, watchlist entry, alert and invitation, all Business Data (records, documents and imports) with the forecasts and warnings built from it, the knowledge profile and every follow-through draft, and every Data API key, and de-identifies every Authorized User: their name, email address, WorkPair identifiers, photo and preferences are deleted, and the user record that remains says only “former team member”. EnemoAi keeps only (a) the wallet ledger (amounts, dates, kinds of entry and payment references, never question text), for at least seven years for tax and accounting; (b) records of acceptance of the Agreement, for four years after closure as evidence of it; (c) the Account’s security log, which is append-only, contains no question content, and is kept as a permanent security record; (d) the business record’s creation and closing dates, its Monitoring status and Stripe subscription number, and its Stripe customer number (we remove the Owner’s name and email from Stripe’s customer record); (e) the Customer’s WorkPair organization ID with whether it used the Free Month and a Monitoring trial, to prevent repeat promotions; (f) the category and dates of reports made to EnemoAi staff, without their description; (g) for 120 days after closure, and while any refund EnemoAi owes the Customer is unpaid, the Customer’s legal name and the Owner’s name and email address, so the refund reaches the right business (kept with the record of a refund we owed until it is paid or reported as unclaimed property, then for 7 years with our accounting records); (h) copies of emails EnemoAi sent or received, in its mailbox, as Section 9 of the Privacy Policy describes; and (i) data EnemoAi must keep by law. Deleted data remains in EnemoAi’s encrypted database backups until they expire, within 30 days. Retained data remains subject to this DPA and is used only for the purpose for which it is kept. Each Authorized User can download their data before the Account closes (Section 9.1).

9.3The Owner receives an email confirming the closure, what was deleted, what was kept and what was refunded. EnemoAi will also confirm deletion in writing on request.

10. Audits and information

10.1EnemoAi will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, including written responses to reasonable security questionnaires, no more than once a year unless a Personal Data Breach or a supervisory authority requires more.

10.2If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer (or an independent auditor it appoints, bound by confidentiality and not a competitor of EnemoAi) may audit EnemoAi’s processing of Customer Personal Data, on at least 30 days’ written notice, during business hours, no more than once a year, in a manner that does not compromise the security of the Service or other customers’ data. The Customer bears its own costs and reimburses EnemoAi’s reasonable costs for time beyond one business day. The parties will agree the scope in advance. Audits under the SCCs are carried out under this Section to the extent consistent with the SCCs.

10.3EnemoAi does not currently hold third-party security certifications. It will tell customers on its Security page if it obtains one.

11. International transfers

11.1Location. EnemoAi stores Customer Personal Data on servers in Helsinki, Finland, and keeps encrypted backups with Backblaze in the United States. EnemoAi is a U.S. company and accesses it from the United States, and some Subprocessors process it in the United States, as Annex 3 shows. The Service is offered to businesses in the United States and is not directed at the EU or the UK; Sections 11.2 to 11.4 apply where, despite this, Data Protection Laws of those places apply to a transfer.

11.2EU transfers. To the extent Customer Personal Data subject to the GDPR is transferred to EnemoAi in a country without an adequacy decision (or onward), the SCCs are incorporated into this DPA and apply as follows: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor; Modules 1 and 4 do not apply; the Customer is the data exporter and EnemoAi the data importer; the optional Clause 7 (docking) is included; in Clause 9, Option 2 (general authorization) applies with the notice period in Section 6.3; the optional wording in Clause 11 does not apply; in Clause 13, the supervisory authority is the one determined under that Clause for the Customer, and where the Customer is not established in the EU and has not appointed a representative, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located; in Clauses 17 and 18, the governing law and courts are those of Ireland; Annex I is Annex 1 to this DPA, Annex II is Annex 2, and Annex III is Annex 3. Where EnemoAi or a Subprocessor is certified under the EU–U.S. Data Privacy Framework, the parties may also rely on it.

11.3UK transfers. For Customer Personal Data subject to the UK GDPR, the SCCs apply as amended by the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0), whose Tables are completed with the information in Section 11.2 and the Annexes; either party may end the Addendum as its Section 19 allows.

11.4Swiss transfers. For Customer Personal Data subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and “Member State” including Switzerland so that data subjects there may enforce their rights.

11.5Precedence. If the SCCs conflict with this DPA or the Agreement, the SCCs control.

12. Liability, term and changes

12.1Each party’s liability under this DPA is subject to the limitations in Section 21 of the Terms, except where the SCCs or Data Protection Laws do not allow it. Nothing in this DPA limits a data subject’s rights under the SCCs.

12.2This DPA lasts as long as EnemoAi processes Customer Personal Data. EnemoAi may update it under Section 27 of the Terms, and will not make a change that reduces the protection of Customer Personal Data except as Data Protection Laws require.

Annex 1. Description of the processing

Annex 2. Technical and organizational measures

These are the controls in place today. Our Security page may describe further detail.

1. Tenant isolation. The tables holding a Customer’s content (Questions, Quotes, Answers, uploaded documents, decisions), Wallet, watchlist and alerts, invitations, legal acceptances, reports, security log, Business Data, imports, Data API keys and the forecasts and warnings built from Business Data enforce PostgreSQL row-level security keyed to that Customer, forced for the table owner as well. Account and sign-in tables (people, businesses, sessions), read-aloud jobs (an Answer’s text, kept up to a day and reachable only by an unguessable token) and a small number of system operations (sign-in, payment notifications, monitoring, team management, retention jobs) run outside these policies, with the business checked in application code. The application connects with a database role that is not a superuser and cannot bypass these policies; our deployment refuses to proceed if it could.
2. Private by default. A further restrictive database policy limits each Authorized User’s questions, quotes and answers, uploaded documents and logged decisions to their author unless the author shares them, so not even the Customer’s Owner or Admins can read them through the Service.
3. Encryption in transit. The website and API are served only over HTTPS (TLS). Connections from our servers to Anthropic, Stripe, WorkPair and Google’s mail servers use TLS. Session cookies are marked Secure.
4. Authentication. EnemoAi has no passwords; the only way in is WorkPair, using OpenID Connect with pushed authorization requests, PKCE (S256), a nonce, and a single-use state bound to the starting browser. Identity and organization claims are accepted only in proofs signed by WorkPair and checked against its revocation list. WorkPair’s signed notices of withdrawn identity or membership, and its back-channel logout when a person signs out of WorkPair, end the person’s EnemoAi sessions at once. Handing over ownership, closing the Account in the app, top-ups above US$500 and team changes require a WorkPair sign-in from the last 15 minutes.
5. Sessions. Session tokens are 256-bit random values held in HTTP-only, Secure, SameSite cookies sent only to api.enemo.ai; only their SHA-256 hashes are stored; sessions expire after 30 days; “Sign out everywhere” ends every session of a person.
6. Abuse controls. Per-person and per-business limits on questions, uploads, invitations and watchlist changes, counted in the database; in-app reports to EnemoAi staff that never copy question text and whose reporter is never shown to the Customer; bans tied to the WorkPair identity, so a banned person cannot return under a new account.
7. Request protections. Every request that changes data must carry a custom header that only our own pages can send, and cross-origin requests are allowed only from our own origins.
8. Access control. Roles (Owner, Admin, Member) limit who can manage billing, members and settings; per-person spending limits; invitation and sign-in tokens are stored only as hashes and expire.
9. Hosting and administration. Servers are hosted by Hetzner Online in Helsinki, Finland. We administer them over SSH with cryptographic keys.
10. Availability and backups. The customer database is backed up every night. Each backup is encrypted with AES-256 under a key held only by EnemoAi (on our server, with an offline copy in our secured key store) and never given to Backblaze, stored with Backblaze in the United States with a checksum, and permanently deleted after 30 days. A documented procedure restores it into a fresh database if the database server is lost. The Service has no standby server, so an outage lasts until we restore it. Data on our servers’ disks is not separately encrypted at rest; backups are.
11. Data API keys. Keys are 256-bit random values shown once; only their SHA-256 hashes are stored. Each key is limited to the data types it was created for and to a rate per minute and per day, can be revoked at once, and every use is recorded in the security log with a shortened network address. Creating a key requires a WorkPair sign-in from the last 15 minutes. Business Data is read-only to EnemoAi: the Service holds no credentials that could move money or change the Customer’s accounts.
12. Payments. Card and bank details are collected by Link and Stripe and never reach EnemoAi. Payment notifications are accepted only with a valid Stripe signature, and each payment credits the Wallet exactly once.
13. Data minimization. We receive from WorkPair only the claims listed in the Privacy Policy, never identity documents or biometric data. Uploaded documents are deleted after 7 days and read-aloud text after 1 day by an automatic purge. Legal acceptance records and the security log keep only a network prefix, not a full IP address. Our servers’ operational logs, which do include full IP addresses, are deleted after 30 days.
14. AI provider. Questions, documents and excerpts are sent to Anthropic’s API under commercial terms that prohibit training on them. Embeddings for search and read-aloud speech are generated on our own servers; no third party receives that text for those purposes.
15. Logging and accountability. An append-only security log per Customer, which the database refuses to update or delete (no privilege, no row policy and a trigger), records sign-ins and sign-outs, team changes, ownership handovers, WorkPair revocations and back-channel logouts, holds, bans, failed fresh sign-ins, Account closure and that a report was made (never by or about whom), with a shortened network address and never question content; the Owner and Admins can read it. Every wallet charge, credit and top-up is recorded with who ran it, and legal acceptances are recorded.
16. Email. Email is sent over TLS through Google Workspace; unsubscribe links are signed so they cannot be forged.
17. Incident response. Suspected incidents are investigated promptly, contained, and notified as Section 8 requires.

Annex 3. Subprocessors

The list at www.enemo.ai/legal/subprocessors, as updated under Section 6.

Version history

• 2026-11-01: first version.
• 2026-11-01.2: Business Data connected through the Data API or imports (Sections 4.2, 9; Annexes 1 and 2).
• 2026-11-01.3: the decision dataset, by the Customer’s instruction and each user’s consent (Section 3.1a).
• 2026-11-01.4: the knowledge profile, contracts read on EnemoAi’s own servers, and follow-through drafts (Section 9.2; Annex 1).