Data Processing Addendum

Hyprtell Labs, Inc. ("Hyprtell") and Customer have entered into an agreement for Hyprtell's services (the "Agreement"). This Data Processing Addendum ("DPA") governs Hyprtell's Processing of Customer Personal Data and forms part of the Agreement. If you accept on behalf of Customer, you warrant you are authorized to bind it.

1. Definitions

"Data Protection Laws" means U.S. State Privacy Laws (CCPA as amended by the CPRA; VCDPA; CPA; CTDPA; UCPA; and comparable laws of Texas, Oregon, and other states) and, where applicable, European Data Protection Legislation and the LGPD. "Customer Personal Data" means Personal Data within Customer Data that Hyprtell Processes on Customer's behalf, including advertising-performance data with demographic/geographic/placement/device breakdowns, CRM contact records, and any customer-list data Customer directs Hyprtell to process for audience features (see Section 5A). "Data Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data on systems controlled by Hyprtell.

2. Roles & Scope

Hyprtell is a Processor / Service Provider of Customer Personal Data; Customer is the Controller / Business (or a processor, in which case Hyprtell is a sub-processor). Customer is responsible for the lawfulness of Customer Personal Data and for providing all required notices and obtaining all consents from data subjects (including its own end-customers).

3. Customer Instructions

Hyprtell Processes Customer Personal Data only to provide, secure, and support the platform, as further documented in Customer's written instructions, and as required by law (with notice unless prohibited). Hyprtell will notify Customer if it believes an instruction violates Data Protection Laws.

4. U.S. State Privacy Laws: Service-Provider Commitments

Hyprtell will not: (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose it other than for the business purpose of providing the platform, outside the direct business relationship, or for any other commercial purpose; or (c) combine it with data from other sources except as permitted for Service Providers. Hyprtell certifies its understanding and compliance and will notify Customer if it can no longer meet these obligations. Aggregated/de-identified data is not Customer Personal Data; Hyprtell will maintain and use it only in de-identified form and will not attempt to re-identify it.

5. Artificial-Intelligence Processing

Customer instructs Hyprtell to Process Customer Personal Data using AI features (HyprAI), including transmitting relevant marketing metrics, identifiers, and Customer-entered chat content to Hyprtell's AI sub-processor (Google Gemini) to generate outputs. Hyprtell's AI sub-processor Processes Customer Personal Data only to provide the service and, under the Gemini API paid-tier data-governance terms, does not use Customer Personal Data to train its models; Hyprtell does not use Customer Personal Data to train third-party or public models. Clarification of the redaction safeguard: Hyprtell applies secret-key scrubbing to certain session data at the persistence (storage) layer only (masking token/credential-shaped values); this is not comprehensive PII redaction and is not applied to data before it is sent to the AI service. Customer should not enter sensitive Personal Data into the chat.

5A. Audience / Customer-List Features

If Customer uses features that upload customer lists to advertising platforms (e.g., Custom Audiences), Customer instructs Hyprtell to transmit that data to the designated platform and represents it has obtained all legally required consents. Such data will be hashed (e.g., SHA-256) as required by the destination platform prior to transmission. This capability is not generally available as of this version and is not represented as live.

6. Security

Hyprtell will implement and maintain technical and organizational measures appropriate to the risk, including encryption in transit, encrypted storage of OAuth tokens/secrets, access controls, logging/monitoring, and a written information-security program. Customer is responsible for securing its credentials and systems.

7. Data Incidents

Hyprtell will notify Customer without undue delay after becoming aware of a Data Incident affecting Customer Personal Data, provide reasonably available information, and take reasonable steps to mitigate. Customer is responsible for notifications to data subjects or regulators; Hyprtell's notice is not an admission of fault.

8. Sub-processors

Customer authorizes the sub-processors listed on our Sub-processor page. Hyprtell imposes protective obligations on each and remains responsible for their performance. Hyprtell will notify Customer of new sub-processors at least ten (10) business days before they Process Customer Personal Data; Customer may object on reasonable data-protection grounds and, if unresolved, terminate the affected service as its sole remedy.

9. Data-Subject Requests, Deletion & Retention

Taking into account the nature of Processing, Hyprtell will assist Customer, insofar as possible, to respond to data-subject requests, and will not respond directly except on Customer's instruction. On termination or expiration, Hyprtell will, at Customer's option, delete or return Customer Personal Data within 30 days and delete existing copies except as required by law. Deletion covers all stores holding Customer Personal Data, including OAuth tokens and warehouse/audit data.

10. International Transfers

Where European Data Protection Legislation applies, the applicable EU Standard Contractual Clauses (Module Two or Three), the UK International Data Transfer Addendum, and Swiss FDPA adaptations are incorporated by reference. This does not apply to U.S.-only processing.

11. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Master Subscription Agreement, including the data-protection super-cap stated there, which is the single controlling statement of data-protection liability across the MSA, this DPA, and the HyprAI Addendum.

Appendix: Sub-processors & Platform Terms

See the published Sub-processor page. Platform-partner terms incorporated where applicable: Google Ads processor terms, the Google Cloud Data Processing Addendum, the HubSpot DPA, and Meta data-processing terms.