Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the Customer (as "Controller") and InnerFrame LLC (as "Processor") and forms part of the Business Terms of Service("Terms"). It governs Processor's processing of personal data contained in Customer Data when Customer uses the Service. By accepting the Terms, Customer accepts this DPA. A countersigned copy is available on request to innerframetests@gmail.com.

1. Definitions

• "Applicable Data Protection Laws" — all privacy and data-protection laws applicable to the processing, including the EU GDPR, the UK GDPR, and US state privacy laws such as the CCPA/CPRA.
• "Controller," "Processor," "Data Subject," "Personal Data," "Processing," and "Personal Data Breach" have the meanings given in Applicable Data Protection Laws.
• "Customer Personal Data" — Personal Data within Customer Data that Processor processes on Customer's behalf.
• "Subprocessor" — a third party engaged by Processor to process Customer Personal Data.
• "SCCs" — the Standard Contractual Clauses for international transfers approved under EU and/or UK law.

2. Roles and scope

Customer is the Controller and Processor is the Processor of Customer Personal Data. Where Customer is itself a processor for a third party, Processor acts as a subprocessor. The subject matter, duration, nature, purpose, types of data, and categories of Data Subjects are set out in Annex 1.

3. Processor obligations

Processor will:

• Instructions. Process Customer Personal Data only on Customer's documented instructions — which include the Terms, this DPA, and use of the Service's features — unless required by law (in which case Processor will inform Customer unless legally prohibited).
• Confidentiality. Ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
• Security. Implement and maintain the technical and organizational measures described in Annex 2.
• Data-subject requests. Taking into account the nature of the processing, assist Customer by appropriate measures to respond to requests from Data Subjects exercising their rights. Where a Data Subject contacts Processor directly, Processor will refer them to Customer.
• Assistance. Assist Customer, taking into account the information available to Processor, with security, breach notification, data protection impact assessments, and prior consultation obligations.
• Breach notice. Notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information reasonably available.
• Deletion / return. On termination, delete or return Customer Personal Data as described in Section 8.

4. Subprocessing

Customer provides general authorization for Processor to engage Subprocessors. Processor will: (a) impose data-protection obligations on each Subprocessor no less protective than this DPA; (b) remain liable for its Subprocessors' performance; and (c) maintain the current list in Annex 3. Processor will give Customer notice of any intended addition or replacement of a Subprocessor (for example, by email to account administrators or an updated list), and Customer may object on reasonable data-protection grounds within 30 days; the parties will work in good faith to resolve the objection.

5. International transfers

Processor stores Customer Personal Data primarily in the United States. Where Processor processes Personal Data subject to EU or UK law and transfers it outside the EEA or UK without an adequacy decision, the SCCs apply and are incorporated into this DPA, with Customer as data exporter and Processor as data importer, completed with the details in Annexes 1–3.

6. Audits and information

Processor will make available to Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor it mandates — on reasonable prior notice, no more than once per year (unless required by a supervisory authority or following a Breach), during business hours, and subject to confidentiality. Processor may satisfy audit requests by providing relevant third-party reports or certifications where available.

7. CCPA / CPRA

To the extent Processor processes Personal Data subject to the CCPA/CPRA, Processor acts as a "service provider" and will not (a) sell or share such Personal Data; (b) retain, use, or disclose it other than for the business purpose of providing the Service or as permitted by the CCPA/CPRA; or (c) combine it with data from other sources except as permitted. Processor certifies it understands and will comply with these restrictions.

8. Deletion and return

On expiry or termination of the Service, Customer may export Customer Personal Data during the subscription and for a limited post-termination window. After that window, Processor will delete or return Customer Personal Data and delete existing copies, except where retention is required by law (for example, financial records) or for backups that are deleted on their ordinary cycle.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. Where the SCCs apply, nothing in the Terms limits liability in a way the SCCs prohibit.

10. Order of precedence

In the event of a conflict between this DPA and the Terms regarding the processing of Personal Data, this DPA controls. Where the SCCs apply and conflict with this DPA, the SCCs control.

Annex 1 — Details of processing

• Subject matter: provision of the InnerFrame business platform to Customer.
• Duration: for the term of the Terms, plus the deletion/return period in Section 8.
• Nature and purpose: hosting, storing, and processing Customer Personal Data to deliver assessments, profiles, team/manager views, goals, one-on-ones, AI insights, and Frame Bot, and to support and secure the Service.
• Types of Personal Data: name, email, login/authentication data; assessment answers, selected words, frame code, flexibility score, axis calculations; profile content, department, position, direct-report relationships; goals, one-on-one records; Frame Bot conversations and AI-generated insights.
• Categories of Data Subjects: Customer's employees, workers, applicants, and other individuals Customer invites to the Service.
• Special categories: the Service is not intended for special-category data; Customer should not submit health, biometric, or other special-category data except as strictly necessary and lawful.

Annex 2 — Technical and organizational measures

• Encryption in transit (HTTPS/TLS) for all connections.
• Row Level Security at the database layer; application and service routes scope access to the caller's own company (tenant isolation).
• Authentication and password hashing managed by Supabase Auth; secrets stored server-side only and never shipped to clients.
• Access controls limiting personnel access to Customer Personal Data on a need-to-know basis.
• Rate limiting and abuse/fraud detection on sensitive endpoints.
• Logging and monitoring for security and availability; regular dependency audits and code review.
• Use of reputable infrastructure subprocessors (Annex 3) with their own security programs.

Annex 3 — Subprocessors

Contact

For DPA matters, SCC execution, or security questions, contact innerframetests@gmail.com or innerframetests@gmail.com. InnerFrame LLC.