Profusia AI — Data Processing Addendum

Effective date: 12 November 2026

This Data Processing Addendum ("DPA") forms part of the Agreement between Evadaroo & Company, LLC, a Pennsylvania limited liability company trading as Profusia AI ("Profusia", the "Processor"), and the customer that accepted the Terms ("Customer", the "Controller"). It applies where Profusia processes Customer Personal Data on Customer's behalf in providing the Service. How this DPA ranks against the other documents of the Agreement is set out in Section 16.2 of the Terms; within this DPA, the SCCs and the UK Addendum prevail (Section 7.5).

---

1. Definitions

"Terms" means the Profusia AI Terms of Service. "Agreement", "Service", "Workspace", "Customer Content", "User", "Recipient", "Order" and "AUP" have the meanings given in the Terms. Words such as "controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meanings given in the GDPR.

"Data Protection Laws" means, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and the Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations ("CCPA"); and other US state privacy laws.

"Customer Personal Data" means personal data that Profusia processes on Customer's behalf under the Agreement: personal data in Customer Content; in the membership, role, group, invitation and preference records of Customer's Workspace; in the audit, view and AI-usage records attributable to Customer's Workspace; and personal data that Recipients and portal visitors provide through doors Customer opens. It does not include the data described in Section 2.2.

"Personal Data Breach" means a breach of Profusia's security, or of a sub-processor's, leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Customer Personal Data. It does not include (a) unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, blocked sign-in attempts or denial-of-service attacks; (b) access through a link, credential or connected assistant that Customer or its Users created or handed out, where the Service worked as designed; or (c) the acts of a web page, script or file that Customer or its Users published, including a page acting with the permissions of a signed-in member who opens it on Customer's own Workspace address (Annex II), where the Service worked as designed. On request, Profusia will give Customer the records it holds about a case under (b) or (c), as assistance under Section 3.6.

"SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0.

2. Roles and scope

2.1 Controller and processor. Customer is the controller (or a processor acting for a third-party controller) of Customer Personal Data, and Profusia is its processor (or sub-processor). Under the CCPA, Profusia is a service provider, and under other US state privacy laws it is a processor.

2.2 Profusia's own processing. Profusia is an independent controller of: (a) the sign-in account itself (email address, password hash, name, photo, timezone and sign-in sessions), which follows a person across every Workspace they belong to, for authentication, account security and account messages; (b) Customer's billing and contract relationship, including the record of who accepted the Agreement's documents; (c) security, fraud and abuse prevention, including rate limiting, the email do-not-send list, self-serve sign-up records, and its own use, for those purposes, of the Service's audit and delivery records and of the cookies it sets; (d) its own operator log, the notes its operator keeps about a Workspace, and the aggregated, de-identified statistics described in Section 3.2; (e) the product-help assistant described in Section 8.6; and (f) compliance with law. That processing is described in the Privacy Policy and is outside this DPA.

2.3 The Annexes. The details of the processing are in Annex I, the security measures in Annex II, and the sub-processors and other recipients in Annex III.

3. Profusia's obligations

3.1 Instructions. Customer's documented instructions are the Agreement, this DPA, and the configuration and use of the Service by Customer, its Users and the credentials Customer or its Users create. That includes every act of an assistant connected to the Service over the Model Context Protocol. An assistant a person connects with their own sign-in acts as that person, with that person's role and only what they can see. An assistant connected with a Workspace access key acts for the whole Workspace and is not limited by roles. Either way, everything it does, including acts prompted by instructions it read in a document, comment, page or dataset, is the Customer's act under the Terms. What the Service returns to a connected assistant leaves Profusia and is held by that assistant's vendor under Customer's own terms with it. Profusia does not review what a User or a connected assistant publishes or shares before it happens, and carrying out an instruction given through the Service, including publishing a document at a link, is processing on Customer's instructions. By entering into the Agreement, Customer also instructs Profusia to process Customer Personal Data to enforce the Agreement and the AUP, including taking down a document or suspending a Workspace as the Agreement describes; to keep the backups described in Annex II; and to preserve and disclose it as Section 9.6 describes. Profusia processes Customer Personal Data only on these instructions, or where the law requires it, in which case Profusia will tell Customer first unless the law forbids it.

3.2 No sale or sharing; limited purposes. Profusia will not sell or share Customer Personal Data (as the CCPA defines those terms). It will not retain, use or disclose that data outside its direct business relationship with Customer, or for any purpose other than the business purposes in the Agreement and this DPA, and will not combine it with personal data from other sources except as the CCPA permits. Those purposes are: providing, securing, supporting and maintaining the Service; improving the Service and measuring which features are used, only from usage records (what was done, when, by which account and at what AI cost), never from the contents of documents, and never to build a profile of anyone for another business; enforcing the Agreement and the AUP; billing and capacity planning; and complying with law. Profusia may create aggregated, de-identified statistics from usage records, will keep them de-identified, and will not attempt to re-identify them. Profusia will comply with the obligations that apply to it under the CCPA and will give Customer Personal Data the level of privacy protection the CCPA requires. Profusia will tell Customer if it determines that it can no longer meet its obligations under the CCPA, and Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including by ending the affected processing. Profusia certifies that it understands and will comply with these restrictions.

3.3 No training on Customer data. Profusia will not use Customer Personal Data or Customer Content to train, fine-tune or improve any machine-learning model. Profusia will not send Customer Content to an AI provider tier that may use it for training. AI providers process content only as Section 8 and Annex III set out.

3.4 People and access. As of the date of this DPA, Profusia has no employees. It is operated by one person, its principal, who is the only person with administrative access to the production database, storage and backups and can read them; the AI coding tools and the internal operations console described in this Section and in Section 3.11 act under that access. Customer Personal Data is not encrypted from Profusia. Profusia will ensure that everyone it authorizes to process Customer Personal Data is bound by confidentiality. Profusia's operator console shows Workspace-level records — members' names and email addresses, roles, and when each joined and last signed in; plan and billing status, including any refunds and chargebacks; usage and each member's AI spend; the AI usage record, which names the documents asked about; the names of documents Profusia has taken down with the reasons given; the addresses on the Workspace's pending invitations and reset links; and the notes Profusia's operator keeps about the Workspace — but not the content of documents, comments or conversations. Profusia will not open Customer Content except (a) at the request of Customer, or of a User about content that User can already see, to provide support; (b) to investigate a suspected security incident or a reported breach of the AUP, including a document reported to it; (c) where the law requires; (d) to keep the Service running, or to recover the Service or Customer's data after a failure (Section 9.5), where that cannot be done without it; or (e) to preserve or disclose it as Section 9.6 describes; and in each case it will open only what is necessary. The AI coding tools Profusia builds and deploys the Service with (Anthropic's Claude Code) work under a written rule never to read Customer Content. The credential they deploy with can also read production data, so that rule is a policy control, not a technical one. Beyond what this Section and Section 3.11 describe, no screen, listing or export shows Customer Personal Data to anyone at Profusia, and Profusia does not read it. To keep the Service running, Profusia does look at operational records, such as counts, sizes, timestamps, error records and configuration.

3.5 Security. Profusia will implement and maintain the measures in Annex II, which are appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.

3.6 Assistance. Taking account of the nature of the processing and the information available to it, Profusia will assist Customer with data subject requests (Section 6); with Customer's own security obligations and breach notifications (Section 3.7); and with data protection impact assessments and prior consultations with supervisory authorities, chiefly by providing this DPA's Annexes, the descriptions at profusia.ai/trust and profusia.ai/trust/packet, and answers to Customer's reasonable questions. Assistance under this Section 3.6 and Section 6 is subject to the time allowance in Section 6.2.

3.7 Personal Data Breach. Profusia will notify Customer without undue delay after becoming aware of a Personal Data Breach, and where feasible within 72 hours. Profusia becomes aware when it has a reasonable degree of certainty that a Personal Data Breach has occurred; for a breach at a sub-processor, when the sub-processor tells Profusia. The notice goes to the email address on file for the Workspace owner(s) and, where Customer has given Profusia an additional address for this purpose by writing to legal@profusia.ai, to that address as well. Notice to the owner's address on file is sufficient notice under this Section. It describes, so far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to limit its effects; and a contact point. Where Profusia cannot give all of that at once, it will give it in phases as facts emerge. Profusia will take reasonable steps to contain and investigate the breach. A notice is not an acknowledgment of fault or liability. Customer is responsible for any notice it must give to supervisory authorities or data subjects, and Profusia will give the information and help it reasonably can.

3.8 Return and deletion. Profusia will make Customer Personal Data available for export and will delete it as Section 9 describes.

3.9 Demonstrating compliance. Profusia will make available the information needed to demonstrate compliance with this DPA, and allow for audits, as Section 10 describes.

3.10 Unlawful instructions. Profusia will tell Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.11 Operator acts. Under the Agreement, Profusia's operator can: take down a single document (its Workspace's members are shown the reason); suspend a Workspace (it is held, not deleted; Section 9.2(c)); issue a sign-in reset link to restore a person's access (when it is used, the account holder is sent an email notice where the Service can send one, except that an account belonging only to self-serve Workspaces nobody has paid for is sent one only at an address its sign-up proved); issue an owner invitation into a Workspace, to set up its first owner or to restore control to an owner whose identity Profusia has verified; revoke a pending invitation; rotate a Workspace's access key; disconnect connected assistants; remove an address from the do-not-send list, so that the Service may write to it again; place or release a legal hold on a Workspace, which keeps it from Profusia's erasure jobs, holds the trash purges and person erasures asked for inside it, and changes nothing else in it (Section 9.2(c)); mark a suspended Workspace for erasure once the Agreement has been terminated and the export window in Section 9.2(c) has passed, or withdraw that mark; download a backup; and, if the Service fails, restore it from a backup. Profusia uses these acts only for support, security, recovering the Service, legal compliance or enforcement of the Agreement. Three of them — rotating an access key, issuing an owner invitation and issuing a reset link — hand the operator a working credential (the new key, or the link) that could open the Workspace's content until it is handed on or used; Profusia issues them only to pass to Customer or to the person they are for, and does not use them itself. Each of these acts except a restore is recorded in Profusia's operator log and, where it concerns particular Workspaces rather than the whole platform, in each such Workspace's own audit trail as well — except a legal hold, which is recorded in Profusia's operator log and its own audit trail and not in the Workspace's, because Profusia tells the Workspace owner about a preservation only where that is lawful and safe (Section 9.6). A backup download made through the operator console is also recorded in Profusia's own audit trail, naming the operator and the night downloaded. Profusia does not record: viewing records in the operator console or through Evadaroo HQ, because only acts that change something, and a backup download, are recorded; a restore, which is carried out with the hosting provider's own tools; and reading or changing the database or storage directly with the hosting provider's own dashboard, command-line tools or programming interface, which Profusia's credentials allow, including the one its AI coding tools deploy with (Section 3.4). Profusia uses that direct access, by hand, for the requests that no product act or operator act serves — supplying records the export leaves out (Section 6.2), deleting a sign-in account or a User's kept conversations at that person's request (Sections 6.2 and 8.3), and erasing a Workspace early at an owner's request (Section 9.3) — and those are recorded only in Profusia's correspondence about the request. Profusia's internal operations console, Evadaroo HQ, can view whatever the operator console shows and take the same acts except downloading a backup, releasing a legal hold, marking a Workspace for erasure, reinstating a suspended Workspace while anything in it is waiting to be erased, or issuing anything that could give someone access to the operator console, such as an owner invitation that names nobody or names an address of Profusia's own. Where Profusia takes down one of Customer's documents, suspends Customer's Workspace, rotates its access key, disconnects its assistants, or issues a reset link or an owner invitation for it, Profusia will tell the Workspace owner by email as soon as practicable, unless the act was taken at the request of an owner or of the person it concerns, or the law, a person's safety or the integrity of an investigation prevents it. Profusia's operator writes and sends that email; the Service does not send it, although the Workspace's members see the reason for a takedown or a suspension in the product. Downloading a backup and restoring the Service from one are platform-wide acts, taken only to recover the Service or to test that it can be recovered; Profusia does not notify each Workspace of them, but will tell Customer if a restore lost or changed Customer Personal Data or an erasure could not be re-applied (Section 9.5).

4. Customer's obligations

Customer will:

(a) have a lawful basis for the personal data it puts into the Service and for Profusia's processing of it;

(b) provide the notices and obtain the consents Data Protection Laws require, including, where needed, notice to Recipients and portal visitors of the cookies the Service sets on their browsers (Annex I);

(c) give instructions that comply with Data Protection Laws;

(d) configure sharing, roles, audience groups and portals so that personal data reaches only intended recipients, and decide what its Users and connected assistants publish, including web pages, which run their own scripts in readers' browsers (Annex II). Every outward link the Service mints, and the address of a live data table, is a bearer link, and Customer is responsible for who holds one, including a link a User or Recipient passes to their own assistant (Annex III). A link has no expiry unless Customer sets one, and a link posted publicly can be found and indexed by search engines;

(e) not put into the Service the data described in Section 3 of the Acceptable Use Policy;

(f) where its ordinary business records incidentally contain special categories of personal data (for example, a staff record noting that someone is on sick leave), decide for itself whether the measures in Annex II are adequate before putting them into the Service, and remain responsible for its lawful basis for them. The Service has no controls designed for those categories. Such incidental content is not a breach of (e); and

(g) make sure its Users do not put Customer Personal Data or other confidential Customer Content into the product-help assistant (Section 8.6).

Customer will defend Profusia against any third-party claim, including a claim by a data subject and an investigation or proceeding by a supervisory authority, arising from Customer's breach of this Section 4, and pay the damages, settlement amounts and reasonable legal fees and costs that result. This obligation is part of Customer's obligations under Section 13.2 of the Terms and follows the procedure in Section 13.3 of the Terms.

5. Sub-processors

5.1 General authorization. Customer authorizes Profusia to engage the sub-processors listed in Annex III, and others on the terms of this Section. An AI provider listed there receives Customer Content only as Section 8.4 allows.

5.2 Notice of change. Profusia will post any new or replacement sub-processor in the list at profusia.ai/privacy (or a successor address it announces) at least 30 days before that sub-processor begins processing Customer Personal Data, and will email each Workspace owner at the address on file. Customer may also ask, by writing to legal@profusia.ai, to be emailed about every change to the list. Where a sub-processor must be replaced urgently to keep the Service secure or available, or because a sub-processor stops providing its service, Profusia may, to the extent the SCCs allow, make the change sooner and will give notice as soon as practicable; Customer's right to object under Section 5.3 still applies.

5.3 Objection. Customer may object to a new or replacement sub-processor on reasonable data protection grounds within 30 days after the notice. The parties will discuss the objection in good faith. If Profusia cannot offer a reasonable alternative, Customer may, without penalty, either end its subscription (and, if it wishes, the Agreement, by deleting its Workspace) and receive a refund of the fees prepaid for the remaining days of the term, or, where the new sub-processor serves only some features, move to a plan without them and receive the difference in price for the remaining days, as the Refund Policy describes. Refunds are issued through Paddle, Profusia's reseller and Merchant of Record.

5.4 Flow-down and responsibility. Profusia engages each sub-processor under that sub-processor's own published data-protection terms, which apply to Profusia's use of its service (or which Profusia signs, where the sub-processor requires a signature), and will have them in place before a new sub-processor first processes Customer Personal Data. Profusia will use only sub-processors whose terms impose data-protection obligations meeting the requirements of Article 28(3) GDPR for the processing they perform, as Article 28(4) requires. Profusia has not negotiated individual agreements with them. Profusia remains responsible to Customer for its sub-processors' performance as Data Protection Laws require, subject to Section 11. On request, Profusia will provide a copy of, or a link to, those terms.

6. Data subject requests

6.1 Assistance. Taking account of the nature of the processing, Profusia will assist Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights.

6.2 Product acts first, and the time allowance. Many requests can be served by acts in the product:

• Access and portability. The Workspace export provides the current version of each document the exporting person can see, plus projects, datasets, sites and collections and, for owners and admins, the most recent 5,000 entries of the audit log and the most recent 5,000 records of who accepted the Agreement's documents. It does not include earlier versions of documents, comments and chat messages, member records and preferences, notifications, a member's own list of what they recently opened, a User's kept assistant conversations, older audit entries, or the other records listed in Annex I.B, such as share-link and portal records, open counts, the AI usage record and the record of email sent. Profusia will provide the personal data in those records on Customer's written request, gathering it by hand (Section 3.11), except that a User's kept assistant conversations and their own list of what they recently opened are provided only to that User, unless Customer is legally required to produce them (Section 8.3).
• Rectification. Content and profile details are corrected by editing them. Profusia will correct other records on request where Data Protection Laws require it.
• Erasure. An owner can erase any other person from the Workspace except its last owner, and an admin can erase members and viewers, except while the Workspace is suspended or held or in the few days after that ends (Section 9.2(c)), when they can still be removed; an owner can delete the whole Workspace (Section 9.2). Nobody can erase themselves from a Workspace in the product. Removing or erasing a person from Customer's Workspace is for its owners and admins, and if that person asks Profusia, Profusia refers the request to Customer under Section 6.3. A person may ask legal@profusia.ai to delete their own sign-in account, which Profusia handles as controller under Section 2.2(a), by hand (Section 3.11). After a person is erased, what they wrote in the Workspace stays as the Workspace's content, attributed to "A removed member"; their record of accepting the Agreement's documents in that Workspace is erased; the audit trail keeps its record of their actions, including a line for each acceptance, which may include their email address, for up to 400 days; an address that bounced or was reported as spam stays on the do-not-send list; and backups expire as Section 9.5 describes.

Where a request needs data no product act reaches, Profusia will assist at Customer's written request within a reasonable time. Assistance under this Section and Section 3.6 is free for the first four hours of Profusia's time in any 12-month period. Beyond that, Profusia will give Customer an estimate and may charge for the further work at a reasonable rate, and is not obliged to begin it until Customer has agreed, unless the request arises from Profusia's breach of this DPA or Data Protection Laws require Profusia to act without charge.

6.3 Requests made to Profusia. If a data subject contacts Profusia directly about Customer Personal Data, Profusia will not respond substantively; it will refer them to Customer and tell Customer promptly. The one exception is a User's request for their own kept assistant conversations or their own list of what they recently opened, which only that User can see: Profusia gives those to that User, on Customer's behalf, as Section 6.2 describes.

7. International transfers

7.1 EU transfers. Profusia is established in the United States. Where Customer Personal Data protected by the GDPR is transferred to Profusia, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) where Customer is a controller; Module Three (processor to processor) where Customer is itself a processor.
• Clause 7 (docking) applies. Clause 9: Option 2 (general written authorization), with the notice period in Section 5.2. Clause 11: the optional independent dispute-resolution body is not used. Clause 13: as set out in Annex I.C. Clause 17: governed by the law of Ireland. Clause 18(b): the courts of Ireland.
• Annexes I.A and I.B of the SCCs are populated by Annex I of this DPA, Annex II by Annex II of this DPA, and Annex III (sub-processors) by Annex III of this DPA.

7.2 United Kingdom. For transfers subject to the UK GDPR, the UK Addendum is incorporated into this DPA: Table 1 is populated by the parties' details in Annex I.A; Tables 2 and 3 by Section 7.1 and the Annexes; and under Table 4, neither party may end the UK Addendum as set out in its Section 19.

7.3 Switzerland. For transfers subject to the FADP, the SCCs apply as Section 7.1 sets out, with these changes: references to the GDPR are to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; and "Member State" includes Switzerland, so that data subjects habitually resident in Switzerland may bring claims there under Clause 18(c).

7.4 Transfer mechanisms, assessments and representation. Profusia is not certified under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions, and relies on the SCCs and the UK Addendum for transfers to it. It has not appointed a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR. On request, Profusia will give Customer the information it reasonably needs for its own transfer impact assessment, including the measures in Annex II, the sub-processors and locations in Annex III, and the information in Section 7.6.

7.5 Conflict. Where the SCCs or the UK Addendum conflict with this DPA, the SCCs or the UK Addendum prevail.

7.6 Government access. To the extent the law allows, Profusia will promptly tell Customer about any legally binding request from a public authority for Customer Personal Data. Profusia will review the lawfulness of the request, and will challenge it where, after careful assessment, it concludes that there are reasonable grounds to consider it unlawful, as Clause 15 of the SCCs requires. It will disclose only the minimum the request requires. Where the law forbids it to tell Customer, Profusia will use reasonable efforts to obtain a waiver. On request, and to the extent the law allows, Profusia will tell Customer whether it has received any such request, including a national-security order, concerning Customer Personal Data.

8. AI processing

8.1 What is available. The in-app AI features that read workspace content — Ask a document; Discuss a site, space, project or card; the Navigator's ask; Draft and Break it down; Say what you did; filing proposals; Propose a turn; Set this page; the two plan checks (reading a plan as its recipient would, and checking it against its own documents); and Build — run in Customer's Workspace only where its plan includes in-app AI. A Free trial includes them, using only Profusia's lower-cost models; the Free plan does not. When they run, Customer Content is sent to the AI providers that Annex III lists as receiving it — as of the effective date, Anthropic (Claude), which answers; Annex III also lists Cloudflare Workers AI, which is not connected as of the effective date and receives nothing until it is, and once connected answers only when a User picks one of its models or Profusia places it in the order a feature uses; and Amazon Bedrock (Amazon Web Services), which never answers by default and receives Customer Content only when a User picks one of its models or Profusia places one in the order a feature uses — and to no other AI provider. The Service's code leaves every AI provider Annex III does not list out of each request that carries Customer Content. Customer's owners and administrators can restrict which models its Users may use, or allow none, in the Workspace's AI access settings. Engaging any other AI provider to receive Customer Content is a change under Section 5: Profusia will first give the notice in Section 5.2, naming the provider, and Customer may object under Section 5.3 as though it were a new sub-processor. Spoken questions are not available in Customer's Workspace, because none of the providers that receive Customer Content can hear one.

8.2 What is sent when a feature runs. When one of these features runs, the content it needs is sent to the AI provider that answers, in the request that produces the answer. That can include document and page text, card fields and checklists, comments with their authors' names, outlines of a site or project, passages from across the Workspace that the asking User can see, the names of live data tables, share links and portals with their dates and counts, the columns and rows of live data tables a User brings into the request, and the earlier turns of the same conversation. If the provider that would answer fails, the same request may be retried and then sent to the next provider in the order Profusia has configured — always one that Annex III lists as receiving Customer Content — so one request can reach more than one of them. The models are given no tools: a model cannot act on the Workspace, and anything an AI feature proposes takes effect only when a User accepts it.

8.3 Kept conversations. Where in-app AI is available to Customer's Workspace, a User's conversations with the in-app assistant are kept for that User, so they can pick one up again. Keeping is on by default, and a Workspace owner can switch it off. A conversation holds the questions as typed (or, for a spoken question, the words the model heard), the answers, the links and the names of the documents shown with each answer (what it read and what it only listed), and the subject of the conversation. Each conversation is kept until 90 days after its last turn, and while keeping is switched on the User can delete any or all of their own at any time. Switching keeping off stops new conversations being kept; those already kept expire on the same schedule, and while keeping is off they are hidden from the User as well, who can ask legal@profusia.ai to delete them sooner, which Profusia then does by hand (Section 3.11). No interface in the Service shows a User's conversations to anyone else, including Customer's administrators, and they are not in the Workspace export. Profusia does not open them except at that User's request, where needed to investigate a security incident or a reported breach of the AUP, where it cannot otherwise keep the Service running or recover it after a failure (Section 9.5), where the law requires, or to preserve or disclose them as Section 9.6 describes. If Customer is legally required to produce a User's kept conversations, Profusia will assist on receipt of that legal requirement, as assistance under Section 3.6; Customer can prevent conversations being kept at all by switching keeping off. Deleted conversations remain in backups until those expire (Section 9.5). No audio recording of a spoken question is kept.

8.4 No training tiers for Customer Content. Profusia will send Customer Content only to an AI provider account whose terms do not permit the provider to use it to train or improve its models. Several providers' free tiers do permit that. Profusia uses such tiers only for the company's own internal workspace and for the product-help assistant (Section 8.6), and never for Customer's Workspace; they receive no Customer Content and are not sub-processors of Customer Personal Data. Profusia meets this commitment with a check in the Service's code that fails closed: on every request that carries Customer Content, it leaves out each AI provider that Profusia's own list of providers records as one whose terms may permit training, unless the Workspace asking is one Profusia has named in its configuration as accepting that — and Profusia names only the company's own internal workspace — and it refuses the request if no other provider can answer. Which providers are connected to the Service, and in what order a request may use them, is set by Profusia's operator; Profusia will not connect an AI provider in a way that lets it receive Customer Content unless Annex III lists it as receiving Customer Content, which for a provider not listed there today follows the notice in Section 5.2.

8.5 Provider terms. Each AI provider processes the content of a request under its own API terms, which may allow it to keep that content for a limited period, for example to detect abuse, before deleting it. No AI provider is currently engaged under zero-data-retention terms. Except where Annex III states that a provider processes requests in a named country, Profusia does not pin the country in which a provider processes a request: each processes it on its own infrastructure, wherever that provider runs it (Annex III states each provider's location). Profusia does not control, and does not warrant, a provider's retention beyond what that provider's terms say.

8.6 The product-help assistant. The product-help assistant — the question box on the help pages, the "Ask about Profusia" assistant in Workspace settings and on All sites, and the Uiia assistant on profusia.ai/help — answers from Profusia's own published help and reads no workspace content. It is available on every plan. What a person types into it, with the last few turns of the conversation, may be answered by an AI provider tier that keeps and may train on its inputs. It is Profusia's own service, outside this DPA, and Customer will not use it for Customer Personal Data or other confidential Customer Content (Section 4(g)).

8.7 Outputs may be inaccurate. Profusia makes no representation that AI output is accurate, complete or fit for Customer's purpose, and Customer is responsible for reviewing it before relying on it. Profusia does not use AI to make decisions that produce legal or similarly significant effects on data subjects.

9. Return and deletion

9.1 Export. While the Workspace is active, Customer may export its documents (the current version of each), projects, datasets, sites and collections and, for owners and admins, the most recent 5,000 entries of the audit log and of the record of who accepted the Agreement's documents, using the product's own export, on every plan, without charge. Profusia will provide other records on written request, as Section 6.2 describes.

9.2 When the Service ends.

(a) Cancelling a paid plan is not termination. The Workspace moves to the Free plan at the end of the paid term, and nothing is deleted at cancellation; Customer Personal Data stays until it is deleted under this Section.

(b) An owner deletes the Workspace. An owner cannot delete the Workspace while it has a subscription that is live and not set to end, including one in a trial, overdue or paused. Once deleted, the Workspace becomes unreachable at once. For 30 days an owner can restore it with one action at the Workspace's address, and then export from it. After that window, a nightly job permanently erases the Workspace's database rows and stored files; erasure waits until Profusia has confirmed with the payment provider that no subscription can charge for the Workspace again (cancelling one that could), and while the Workspace is suspended or held and for 30 days after that ends ((c)). Sections 9.4 to 9.7 still apply.

(c) Profusia suspends the Workspace, or either party terminates the Agreement. A Workspace Profusia has suspended, or must preserve for an investigation or legal process (Section 9.6), is held, not erased: none of Profusia's erasure jobs — erasing a deleted Workspace under (b), erasing an unused one under (d), or erasing items emptied from its trash — erases it until the suspension or hold ends, including where an owner asked for deletion before the suspension or hold began; meanwhile nothing in its trash can be erased at once and no person can be erased from it. When the suspension or hold ends, normal retention resumes, but not the same night: nothing it held is erased until that erasure's own waiting period has passed again, counted from that day (30 days for a deleted Workspace, during which an owner can restore it; a few days for items emptied from its trash, and before a person can be erased from it; and, for a Workspace being erased after termination, 30 days after a legal hold ends, while the end of a suspension changes nothing for it, as the last sentence of this paragraph describes), and the periods in (d) are counted from that day. Apart from those erasures waiting, a hold changes nothing in the Workspace; what its Users delete themselves is still deleted. Records that expire by age (Section 9.5) go on expiring meanwhile, unless Profusia keeps them, or a copy of them, under Section 9.6. For 30 days after termination, a Workspace owner may ask support@profusia.ai or legal@profusia.ai for an export, and Profusia will either reinstate the Workspace long enough for the owner to use the product's export, after taking down anything that was the reason for the termination, or provide the export itself by a secure method it chooses. Reinstating reopens the whole Workspace — to its members, their connected assistants and its outward links as well as to the owner — so Profusia chooses it only where that is safe. Profusia will do one or the other unless doing so would be unlawful or would create a security risk. Profusia will not provide material that is unlawful to hold or return, material taken down on a valid legal notice, or anything an authority directs it to withhold. After that window, Profusia marks the Workspace for erasure, and the nightly job erases it 30 days after the mark, in the way (b) describes but without a further restore period, whether or not it is suspended, unless Profusia must preserve it under Section 9.6; a legal hold delays that erasure, and once the hold ends it waits 30 days more.

(d) A Workspace nobody uses. Under Section 4.13 of the Terms, Profusia erases (i) a Workspace opened through self-serve sign-up that has never been paid for, once nobody has used it for 90 days since its trial ended (or, if it started without a trial, since it was opened); and (ii) any Workspace that has been placed on the Free plan, including one whose paid plan was cancelled, once nobody has used it for 12 months since it was placed on the Free plan. A member of the Workspace signing in (there or in any other Workspace) or using it while signed in, or an assistant connected to it acting in it or renewing its connection, counts as using it; visits to its published pages do not. Profusia tells the Workspace's owners 60, 30 and 7 days before, in Notifications and by email where it can send it, and using the Workspace during that time keeps it and starts its period again. Otherwise the Workspace is closed as if an owner had deleted it, so (b) applies, including the 30 days in which an owner can restore it; a member signing in during those 30 days also puts it back. This never applies to a Workspace with a live subscription, or to a Workspace on an Order signed by both parties or a custom arrangement agreed with Customer; the Service recognizes such an Order or arrangement by the custom price, plan, free period or individually granted features Profusia's operator records against the Workspace, and Profusia records one when it is agreed. Nor does it apply while a Workspace is suspended or held, as (c) describes.

9.3 Earlier erasure, and confirmation. An owner may ask, by writing to legal@profusia.ai, for the Workspace to be erased before the 30-day window in Section 9.2(b) ends. Where reasonably practicable, Profusia will do so within ten business days of confirming that the request came from an owner. The Service has no control for this, so Profusia does it by hand (Section 3.11), and not while the Workspace is suspended or held (Section 9.2(c)) or while a subscription could still charge for it. On Customer's written request, Profusia will confirm in writing that erasure has taken place, noting what Section 9.4 keeps.

9.4 What remains after erasure. After erasure, Profusia keeps Customer Personal Data only: (a) in backups, which expire as Section 9.5 describes; (b) as an email address on the do-not-send list where a message to it bounced or was reported as spam, so that the Service never writes to it again (an entry Profusia then holds as its own record under Section 2.2, and removes on request); and (c) where the law requires, or as Section 9.6 describes, for as long as that requires and while continuing to protect it. Copies already delivered to the sub-processors in Annex III, or to services Customer directed (a connected assistant's vendor, Customer's own Google Drive, or Recipients), are held under their own terms. Profusia also keeps, as its own records, the plan, trial and limits the erased Workspace had, against its id and with nothing about any person; a hold on the former Workspace's web address so that nobody else can take it (one year, or ten years if the Workspace was ever suspended); its log of billing notices from Paddle; its operator log; a one-way fingerprint of the email address that opened a Workspace through self-serve sign-up (400 days); a receipt naming the erased Workspace's id, how many records and files were erased, and its subscription id (400 days); and, for a Workspace that was ever under a legal hold, the lines in Profusia's own audit trail recording when the hold was placed and released, and by whom (400 days). None of these carries document content, except that the operator log keeps the reason given for a takedown, a suspension or a legal hold, which may describe the document or material concerned.

9.5 Backups and operational records. Profusia keeps a nightly copy of its database for 14 nights, and Cloudflare keeps a point-in-time recovery history of that database for up to 30 days, depending on Profusia's hosting plan. The database holds the Service's records — including metadata, projects, datasets, comments, chat, kept conversations, and the text the search index holds for each document (up to the first 64,000 characters of the current version of each text or Office document, and, for an HTML page, up to 64,000 characters of its source as well) — but not the uploaded files themselves, in any version. Erased database records therefore remain in those copies until the copies age out, within about 30 days at most, and are then gone from them. Profusia uses those copies only to recover the Service from a failure and to test that recovery works, except as Section 9.6 allows. Any copy Profusia takes by hand — a backup it downloads, or an export it makes before a restore — is kept only on a device or in an account under Profusia's control, and is deleted once that recovery or test is complete, and in any case within 30 days of being taken, unless Profusia keeps it under Section 9.6, for as long as that purpose requires. If Profusia restores from a copy, it re-applies the erasures made since that copy was taken, as far as the records it still holds identify them, and tells Customer if any could not be re-applied, or if a failure leaves it unable to tell what was erased since then, so that Customer can check and erase again. File contents are stored once, in Cloudflare R2, and are not separately backed up: once erased, or if lost by the storage provider, they cannot be recovered. The operational records listed in Annex I expire on the cycles stated in the Privacy Policy's retention schedule, which also says which records have no age-based expiry.

9.6 Preservation and disclosure. Where the law requires it, including the duty to report and preserve child sexual abuse material, or where reasonably necessary for an investigation of a breach of the AUP, for legal process, or to establish, exercise or defend a legal claim, Profusia may preserve Customer Personal Data and related records beyond the periods in this DPA, for as long as that purpose requires, and holds a Workspace it must preserve as Section 9.2(c) describes. It discloses them only as Section 16.13 of the Terms allows — for example to law enforcement, the National Center for Missing & Exploited Children or a court. For Customer Personal Data transferred under the SCCs or the UK Addendum, Profusia discloses to a public authority only as Section 7.6 and Clause 15 of the SCCs allow, except where the law requires a report, such as a report to the National Center for Missing & Exploited Children, or where Data Protection Laws permit a disclosure to protect a person's vital interests. Profusia will tell the Workspace owner where it is lawful and safe to do so, will continue to protect what it preserves, and will use it only for that purpose.

9.7 Kept conversations and visit lists at the end of the Service. For a User's kept assistant conversations and that User's own list of what they recently opened, Customer chooses deletion rather than return, under Article 28(3)(g) GDPR and Clause 8.5 of the SCCs. When the Service ends they are erased with the Workspace and are not returned to Customer. Until then, Profusia will provide them to that User on request, or to Customer where it is legally required to produce them (Section 8.3).

10. Audit

10.1 Information. Profusia will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including the descriptions in Annexes II and III, the public trust and privacy pages (profusia.ai/trust and profusia.ai/privacy) and the forwardable security packet (profusia.ai/trust/packet). Those pages describe Profusia's practice on the date they show; they are not part of this DPA, and where they differ from it, this DPA governs.

10.2 Questionnaire. For a Customer on a paid plan, once in any 12-month period, Profusia will complete Customer's reasonable written security or privacy questionnaire at no charge, and may answer any question by reference to this DPA or profusia.ai/trust/packet where they answer it. For a Customer on the Free plan or a trial, the descriptions in Section 10.1 are Profusia's answer.

10.3 Audit. Where that information is not sufficient for a Customer subject to Data Protection Laws, Customer may audit Profusia's compliance with this DPA once in any 12-month period, on 30 days' written notice, and also after a Personal Data Breach or where a supervisory authority requires it. Audits are remote and document-based: Profusia has no premises of its own, and its infrastructure is operated by its sub-processors, whose own audit reports satisfy any audit of their facilities. The auditor must be Customer or an independent auditor who is not a competitor of Profusia and who signs a confidentiality agreement reasonably acceptable to Profusia. Audits take place during business hours and without unreasonable disruption. Customer bears its own costs. Profusia may charge for its own time at a reasonable rate agreed in advance — for a Customer on the Free plan or a trial, all of it, and otherwise its time beyond eight hours for any one audit — unless the audit finds a material breach of this DPA by Profusia. The parties agree that audits under this Section satisfy Clause 8.9 of the SCCs. This Section does not limit a supervisory authority's right to audit.

10.4 No certifications. Profusia holds no SOC 2 report, ISO 27001 certificate, HIPAA attestation or third-party penetration test, and none is in progress. This is stated plainly rather than implied otherwise; a customer whose procurement requires one should raise it before contracting.

11. Liability

11.1 One cap. Each party's total liability arising out of or relating to this DPA, the SCCs and the UK Addendum (to the extent the SCCs and the UK Addendum permit a limitation between the parties), taken together with the rest of the Agreement, is subject to the exclusions in Section 14.1 of the Terms, the single aggregate cap in Section 14.2 of the Terms and the exceptions in Section 14.3 of the Terms. This DPA does not create a separate or additional cap, and claims under it count toward that same cap.

11.2 A data-protection claim is not a confidentiality claim. For the purposes of Section 14.3 of the Terms, a breach of this DPA or of Annex II, and any Personal Data Breach, is subject to the cap and is not treated as a breach of Section 10 (Confidentiality) of the Terms, except to the extent it results from a party's willful misconduct (as Section 14.3 of the Terms defines it) or fraud.

11.3 Fines. Each party bears any fine or penalty a supervisory authority imposes on it for its own infringement of Data Protection Laws, and may not recover that fine from the other party, except that Customer will reimburse Profusia for a fine or penalty imposed on Profusia to the extent it results from Customer's breach of Section 4 (for example, processing without a lawful basis, an unlawful instruction, or putting into the Service data that AUP Section 3 excludes). That reimbursement is part of Customer's obligations under Section 13.2 of the Terms; otherwise, Section 13.2 of the Terms does not apply to such fines. This does not limit Customer's obligation under Section 4 to defend Profusia against, and pay the reasonable legal fees and costs of, an investigation or proceeding by a supervisory authority arising from Customer's breach of Section 4.

11.4 Leaving after a Personal Data Breach. If a Personal Data Breach caused by Profusia's breach of this DPA affects Customer Personal Data, Customer may terminate the Agreement by written notice within 60 days of Profusia's notice of it and receive a pro-rata refund of the fees prepaid for the unused term, as Section 14.5 of the Terms provides. A refund under this Section counts toward the cap in Section 14.2 of the Terms.

11.5 What this Section does not limit. Nothing in this DPA limits a data subject's rights against either party under Data Protection Laws or the SCCs, or any liability that cannot lawfully be limited.

12. Term, execution and changes

12.1 Term. This DPA takes effect when Customer accepts the Agreement and continues until Profusia has ceased all processing of Customer Personal Data, including in backups (Section 9.5). After the Agreement ends, the free questionnaire in Section 10.2 and the free time in Section 6.2 no longer apply; Profusia's other obligations continue for the Customer Personal Data it still holds.

12.2 Execution. By accepting the Agreement, each party is treated as having signed this DPA, the SCCs and the UK Addendum, including their Annexes, as of that date. Profusia will countersign a copy on request to legal@profusia.ai.

12.3 Changes. Profusia posts each version of this DPA with its effective date and keeps every earlier version, which it will send on request. Profusia may update this DPA: (a) at any time, to reflect a change in Data Protection Laws, a decision of a competent authority or new standard contractual clauses, or to address a security risk or an active harm, giving notice as soon as practicable; (b) by posting it, where the update is not material; or (c) otherwise, by email to the Workspace owner at least 30 days before it takes effect, provided it does not materially reduce the protection of Customer Personal Data. If Customer objects to a material update under (c), Customer may cancel before it takes effect and Profusia will refund, through Paddle, the fees prepaid for the unused term, as Section 16.3 of the Terms provides. Changes to the list of sub-processors, and making the features in Section 8.1 available, follow Section 5 rather than this Section.

12.4 Governing law and disputes. The SCCs keep the law and courts they name in Section 7.1, and the UK Addendum keeps the law and courts of England and Wales. Otherwise, this DPA is governed by the law that governs the Terms, and disputes under it are resolved as Section 15 of the Terms provides.

12.5 Notices. Notices to Profusia under this DPA go to legal@profusia.ai, with a copy to Evadaroo & Company, LLC, 502 W 7th St, Ste 100, Erie, PA 16502, USA. Notices to Customer go to the email address on file for the Workspace owner(s), which Customer will keep current.

12.6 Successors. This DPA binds and benefits the parties and their successors and permitted assigns, and it goes with the Agreement whenever the Agreement is assigned under Section 16.4 of the Terms.

---

Annex I — Details of processing

A. List of parties

• Data exporter / controller: the Customer that accepted the Agreement. Contact: the Workspace owner's email address on file. Role: controller (or processor acting for a third-party controller). Activities: using the Service described in the Agreement. Signature and date: by acceptance of the Agreement, on the date of acceptance (Section 12.2).
• Data importer / processor: Evadaroo & Company, LLC, a Pennsylvania limited liability company trading as Profusia AI, 502 W 7th St, Ste 100, Erie, PA 16502, USA. Contact: legal@profusia.ai. Role: processor. Activities: providing the Profusia AI service described in the Agreement — hosting, publishing and sharing documents and data, projects and work tracking, and the optional AI features in Section 8. Signature and date: by Customer's acceptance of the Agreement (Section 12.2); a countersigned copy on request.

B. Description of transfer

C. Competent supervisory authority. Determined under Clause 13 of the SCCs by the Member State of the data exporter's establishment or of its EU representative; where the data exporter is not established in the EU and has no representative, the authority of the Member State where the data subjects are located.

---

Annex II — Technical and organizational security measures

These describe the measures in place on the date of this DPA. Nothing here is aspirational: where a measure is partial or missing, the stated limitations at the end say so. Profusia may change these measures, but not in a way that materially reduces the overall protection of Customer Personal Data.

Tenant isolation. Most reads and writes of Workspace data are designed to go through a single workspace-scoping layer that attaches the Workspace to every query it makes. Other paths query the database directly. Where such a path serves one Workspace, it is designed either to name that Workspace in the query or to check a record's Workspace before using it (file and dataset delivery, for example, look a record up and then check its Workspace against the address it was asked for). Some paths work across Workspaces by design — among them sign-in and credential resolution, rate limiting, billing, the nightly jobs and the operator console. Each Workspace is also served from its own subdomain, so the browser's own origin rules separate Workspaces independently of application code and of whether a share token is valid. An automated suite authenticates two independent Workspaces and shows that one, handed the other's real identifiers, is refused; it runs before every release. Profusia's development rule is that every new workspace-scoped table gets a cross-tenant proof in that suite before it ships.

Access control. Owner, admin, member and viewer roles govern what a person may do, and the same rules apply to an assistant a person connects; an assistant connected with a Workspace access key is not limited by roles (Section 3.1). On plans that include groups, a document can be limited to a named group, and a space can be hidden from people outside a named group. Hiding a space hides the space and its pages, not the documents placed in it, which keep their own settings. Removing a membership ends that person's sessions and disconnects the assistants they connected, at once. Whether a person may share outside the Workspace is a separate right from whether they may edit. Sign-in attempts are limited per account and per network address. An owner can rotate the Workspace's access key and disconnect connected assistants from Workspace settings, and Profusia can do the same from its operator console; they are different credentials and are cut separately. There is no multi-factor sign-in.

Credential handling. Share links, site links, embed tokens, project links, portal tokens, sign-in sessions, connected-assistant (OAuth) tokens and per-Workspace access keys are high-entropy random values stored only as SHA-256 hashes, and account passwords only as salted hashes, so a database read alone does not yield a working link, session or access key. The one exception is the address of an ordinary live data table, which is itself the key that reads it; rotating the table revokes it. A password on a share link is stored as a PBKDF2-SHA256 derivation at the runtime's maximum iteration count, and the unlock door is rate-limited per IP address and per link before any verification work, so it is not a token oracle.

Encryption. TLS in transit on every route, with HSTS. Files in Cloudflare R2 and metadata in Cloudflare D1, encrypted at rest by the platform. The one third-party credential the Service can hold — the optional Google drive.file authorization — is AES-GCM encrypted at rest under a wrapping key held outside the database, never returned by any interface, and erased with the Workspace. Profusia adds no further encryption to content or backups.

Content isolation. Customer content is never executed on Profusia's servers, and stored files are never altered. Delivered pages run under a strict Content Security Policy under which a page can load no scripts, styles, images or fonts from other sites, cannot submit forms, and can fetch data only from its own live table. When delivering a document, the Service adds link-preview tags, the address of a page's live data, security headers, and its own frame, strip or notices; pages of an unpaid self-serve Workspace additionally run in a sandbox with an opaque origin. Profusia's host, Cloudflare, adds a small analytics tag to pages it serves for Profusia; on the pages that carry Customer Content, Profusia's security policy blocks it from running, so it collects nothing there. Profusia intends to switch it off, which is a setting at Cloudflare it has not yet changed. A page Customer publishes runs its own scripts in the reader's browser and, on Customer's own Workspace address, can act with the permissions of a signed-in member who opens it, so Customer should publish only pages it trusts; such a page cannot reach another customer's Workspace. Comment highlighting reads a delivered document from the surrounding page rather than injecting into it.

Logging and audit. Publishing, sharing, revoking, permission changes, sign-ins and other privileged changes are written to an append-only audit trail, kept 400 days, of which an owner or admin can export the most recent 5,000 entries as CSV (Profusia provides older entries on request); some entries name a person by email address. AI calls are recorded against the model that actually answered. Profusia's own operator acts are recorded in a separate operator log, as Section 3.11 describes; viewing records in the operator console or through Evadaroo HQ is not recorded.

Abuse resistance. Rate limits on anonymous and credential-guessable surfaces; per-Workspace daily and monthly AI spend ceilings, checked before each call, which stop rather than bill (a single call already in flight may finish); one in-app AI request in progress at a time for each User, so requests one User sends together cannot all pass the same check (one call per User already in flight may finish); and a per-site emergency lock that refuses that site's links and portals at once.

Availability and recoverability. A nightly copy of the whole database is written to the same Cloudflare R2 storage bucket that holds the Service's uploaded files, verified by reading it back and re-hashing it before it is recorded as good, and the 14 most recent nights are kept. Cloudflare also keeps a point-in-time recovery history of the database for up to 30 days, depending on Profusia's hosting plan. The copy includes the text the search index holds for each document (Section 9.5) but not the uploaded files themselves, which are stored once in Cloudflare R2 without object versioning: a purged file, or one lost by the storage provider, cannot be recovered. A confirmed purge of items in the trash is carried out only after that night's copy has verified, unless a Workspace access key chose to erase at once (see Deletion), and never while the Workspace is suspended or held or in the few days after that ends (Section 9.2(c)). Other erasure does not wait for a backup: erasing a deleted Workspace (which waits while it is suspended or held and for 30 days after that ends, Section 9.2(c), and until no subscription can charge for it again), erasing a person (which waits while the Workspace is suspended or held and for a few days after that ends), deleting a kept conversation, and the retention periods in the Privacy Policy take effect on their own schedule. An operator readiness page computes the state of every nightly job and the last verified backup. The restore procedure is exercised automatically on test data in every release test run, and was performed once against a copy of the production database, on 18 August 2026. If Profusia restores from a backup, it re-applies the erasures made since the backup was taken, as far as the records it still holds identify them, and tells Customer if any could not be re-applied, or if it cannot tell what was erased since then. Customer should keep its own copies of anything it cannot afford to lose; the export makes that free.

Deletion. Deletion is soft by default: every read, including anonymous delivery lookups, filters deleted items, so a share link stops resolving the moment its document is trashed. Permanent erasure is a separate, explicitly confirmed act that takes effect about three days later unless the item is restored first; a Workspace access key may choose to erase at once, except while the Workspace is suspended or held or in the few days after that ends, while an assistant a person connects may not.

Organizational measures. Profusia is operated by one person, its principal, who is the only person with operator access; as of the date of this DPA it has no employees. Software is written with AI coding tools (Anthropic's Claude Code) working under the principal's direction. The credential those tools deploy with can also read production data; a written rule forbids them to read Customer Content, and this is a policy control, not a technical one. The company's own internal operations console, Evadaroo HQ, can read whatever the operator console shows and take the operator acts in Section 3.11, through single-use signed requests; each act is recorded as Section 3.11 describes, naming the operator, while its reads, like the operator console's, are not recorded. It cannot download a backup, release a legal hold, mark a Workspace for erasure, reinstate a suspended Workspace while anything in it is waiting to be erased, or issue anything that could give someone access to the operator console. The operator console opens to the operator's password, to the platform key (a static secret held in the hosting environment) and to Evadaroo HQ's signed requests; none of these uses multi-factor sign-in. Profusia's access to Customer Content is limited as Section 3.4 sets out. Change management runs through an automated test suite, a typecheck gate and a recorded verification of every deploy. A vulnerability disclosure contact (security@profusia.ai) is published under RFC 9116.

Stated limitations. Isolation is logical, not physical. There is no dedicated security officer and no formal third-party audit or penetration test (Section 10.4). Where in Cloudflare's network data is stored was chosen by Cloudflare and is not pinned to a region. There is no multi-factor sign-in anywhere in the Service, including the operator console; single sign-on is built but not offered. Account passwords are stored as salted PBKDF2-SHA256 at 100,000 iterations, the hosting runtime's ceiling and below current OWASP guidance. Sign-in sessions last 30 days; connected-assistant authorizations and access keys last until revoked; links last until revoked unless an expiry is set. A web page Customer publishes can act with the permissions of a signed-in member who opens it on Customer's own Workspace address. Backups are kept in the same Cloudflare storage bucket as the Service's uploaded files, so a failure of that bucket, or a credential that reaches it, affects both; uploaded file contents are not backed up. Nothing alerts automatically when something goes wrong; problems are found through the operator's own checks and reports to security@profusia.ai. Profusia is operated by one person, so incident response depends on that person's availability, and its written incident-response plan has not yet been exercised. Profusia does not record viewing records in the operator console or through Evadaroo HQ, a restore, or reading or changing the database or storage directly with the hosting provider's dashboard, command-line tools or programming interface — which is also how it carries out, by hand, the requests in Sections 6.2, 8.3 and 9.3 that no product act serves. The notices to a Workspace owner about operator acts (Section 3.11) are written and sent by hand, not by the Service. The coding tools' credential is limited by policy rather than technically. These are recorded here rather than omitted.

---

Annex III — Sub-processors

Current list. These are all the outside services that receive Customer Personal Data from Profusia in providing the Service, together with Profusia's own systems that do and the development tool Profusia builds the Service with, and whether each receives Customer Content today. The list is published at profusia.ai/privacy, and changes follow Section 5.2. Each provider's published terms are linked from its name where available, and Profusia will send a copy or link on request.

Infrastructure, email and operations

AI model providers that receive Customer Content. Where Customer's plan includes in-app AI and a User uses a feature that reads Customer Content, the content described in Section 8.2 is sent to the provider that answers and, if it fails, to the next in the configured order — always one of these.

These are the only AI providers that may receive Customer Content. Profusia also uses other AI providers, including free tiers whose terms may permit training, for the company's own internal workspace and for the product-help assistant; they receive no Customer Content and are not sub-processors of Customer Personal Data (Sections 8.4 and 8.6). A question typed into the product-help assistant carries no workspace content and is outside this DPA (Section 8.6).

Profusia's own systems, and a development tool not engaged to process Customer Personal Data

Not a sub-processor — Paddle. Paddle (Paddle.com Market Limited and its affiliates) is Profusia's reseller and Merchant of Record for paid plans. It processes billing contact, payment and tax details as an independent controller under its own privacy notice (paddle.com/legal/privacy), for the purchase itself. It receives no Customer Content. To identify a purchase, Profusia tells Paddle the Workspace's id, its web address and the number of seats, which is part of Profusia's own billing record (Section 2.2). Payment details go to Paddle, never to Profusia.

Not sub-processors — services Customer directs. A Google Drive account Customer connects is Customer's own destination: Profusia writes into it and has no read path. An assistant Customer or its Users connect over MCP is Customer's own vendor relationship (Section 3.1). Recipients Customer shares with receive what Customer chose to give them.

Take to AI, and the assistant buttons a reader sees. When a User presses Take to AI, or a Recipient reading through a share link, a site link or an embed presses a control that opens Claude or ChatGPT, that person's own browser hands the assistant a prompt (in the address it opens, or through the clipboard) naming the document and carrying its link. For a User, that is the document's address in the Workspace and where it sits there. For a Recipient, it is the link they were given, which opens the document for whoever holds it, so the assistant can read the document at that link. Profusia sends nothing to the assistant itself; the assistant's vendor holds what it receives under that person's own terms with it. On the share strip this control is on by default; it can be switched off for the Workspace in Workspace settings, and a handling notice on a share link switches it off for that link.

---

Evadaroo & Company, LLC · 502 W 7th St, Ste 100, Erie, PA 16502 · USA · legal@profusia.ai