Data Processing Addendum

Last updated: August 18, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Aglyn LLC, a Texas limited liability company ("Aglyn," "Processor," "Service Provider"), and the customer ("Customer," "Controller"). It applies where Aglyn processes Customer Personal Data on Customer's behalf in providing the Services. If there is a conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Data, this DPA controls.

1. Definitions

• "Data Protection Laws" means all applicable laws relating to privacy and the processing of personal data, including the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and U.S. state privacy laws including the California Consumer Privacy Act as amended ("CCPA/CPRA").
• "Customer Personal Data" means personal data contained in Customer Content that Aglyn processes on Customer's behalf as a processor/service provider.
• "Controller," "Processor," "Data Subject," "Personal Data," "Processing," and "Sub-processor" have the meanings given in the Data Protection Laws. Under CCPA/CPRA, Aglyn acts as a "Service Provider."

2. Roles & Scope

2.1 With respect to Customer Personal Data, Customer is the Controller (or a processor acting on behalf of a third-party controller) and Aglyn is the Processor/Service Provider. For personal data Aglyn processes for its own business purposes (e.g., account administration, billing, securing and improving the Services), Aglyn is an independent controller and the Privacy Policy applies.

2.2 Customer is responsible for the accuracy and legality of Customer Personal Data and for having all rights, consents, and lawful bases necessary for Aglyn to process it as contemplated by the Services.

3. Processing Instructions

3.1 Aglyn will process Customer Personal Data only: (a) to provide, maintain, secure, and support the Services in accordance with the Terms of Service; (b) as further documented in Customer's use and configuration of the Services; and (c) as required by applicable law (in which case Aglyn will, where legally permitted, inform Customer).

3.2 Aglyn will not "sell" or "share" Customer Personal Data (as defined by CCPA/CPRA), will not retain, use, or disclose it for any purpose other than performing the Services or as permitted by law, and will not combine it with other data except as permitted by CCPA/CPRA. Aglyn certifies it understands and will comply with these restrictions.

4. Details of Processing (Annex I)

• Subject matter: provision of the Aglyn Services.
• Duration: the term of the Terms of Service, plus any period required for deletion/return as set out below.
• Nature and purpose: hosting, storage, transmission, and processing of Customer Content as necessary to operate the Services (site building and hosting, forms, CRM/contacts, commerce/orders, memberships, datasets, media, analytics, and related features).
• Categories of Data Subjects: Customer's Authorized Users and Customer's End Users (e.g., site visitors, form submitters, customers/subscribers of Customer's Hosts).
• Categories of Personal Data: identifiers and contact details (e.g., name, email, address, phone); account and authentication data; order, transaction, and membership metadata; content submitted through forms and CRM; usage/analytics and device data (e.g., IP address); and any other personal data Customer chooses to process through the Services.
• Special categories: not intended; Customer must not submit special-category/sensitive data except as configured and lawful, and remains responsible for any such data.

5. Confidentiality

Aglyn ensures that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

6. Security

Aglyn will implement and maintain reasonable technical and organizational measures designed to protect Customer Personal Data appropriate to the risk, as described in Annex B (Technical and Organisational Measures). Aglyn does not guarantee that such measures will prevent all security incidents. Customer is responsible for its own configuration, access controls, and use of the Services in a secure manner.

7. Sub-processors

7.1 Customer provides general authorization for Aglyn to engage Sub-processors to process Customer Personal Data. The current Sub-processors are those listed on the Subprocessors page, which is the authoritative list and forms Annex III to the SCCs.

7.2 Aglyn will impose data-protection obligations on Sub-processors that are substantially similar to those in this DPA, and remains responsible for their performance. Aglyn may add or change Sub-processors. Before a new Sub-processor begins processing Customer Personal Data, Aglyn will publish it in the change log on the Subprocessors page at least thirty (30) days in advance. Customer may object to a new Sub-processor on reasonable data-protection grounds within that period by writing to support@aglyn.com, and Aglyn will work with Customer in good faith to address the objection. Where a change is required to protect the security or availability of the Services, or is imposed by an existing Sub-processor, Aglyn may make it on shorter notice and will publish it in the change log as soon as practicable.

8. Data Subject Requests

Taking into account the nature of the processing, Aglyn will provide reasonable assistance (including through Service functionality) to enable Customer to respond to Data Subject requests to exercise their rights. If Aglyn receives a request directly from a Data Subject relating to Customer Personal Data, it will, where legally permitted, refer the Data Subject to Customer.

9. Personal Data Breach

Aglyn will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide reasonably available information to assist Customer in meeting its notification obligations. Aglyn's notification is not an acknowledgment of fault or liability.

10. Assistance

Taking into account the nature of processing and information available to Aglyn, Aglyn will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, as required by Data Protection Laws.

11. Deletion or Return

Upon termination of the Services, Aglyn will, at Customer's choice and where technically feasible, delete or return Customer Personal Data, except to the extent retention is required by law. Customer Personal Data may persist in routine backups after deletion: database backups are retained on a 14-week cycle and deleted storage objects are recoverable for 7 days, after which they expire. Backup copies remain protected under this DPA until they expire, are not restored to live systems except for disaster recovery, and a deletion instruction survives any restoration — data deleted at Customer's instruction and later restored from a backup will be deleted again. Deletion requested by Customer during the term (including organization erasure) is preceded by a 7-day reversible hold, after which it is permanent. Customer is responsible for exporting its data before termination.

12. Audits

Aglyn will make available information reasonably necessary to demonstrate compliance with this DPA. Any audit right will be satisfied, to the extent possible, by Aglyn providing relevant documentation or third-party reports; on-site audits, if any, are subject to reasonable notice, confidentiality, scope, frequency, and cost limitations.

13. International Transfers

13.1 EEA transfers. To the extent Customer Personal Data originating in the EEA is transferred to Aglyn in the United States or another country without an adequacy decision, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA by reference and form part of it. Module Two (controller to processor) applies where Customer acts as a controller of Customer Personal Data, and Module Three (processor to processor) applies where Customer acts as a processor on behalf of a third-party controller. In each case Customer is the "data exporter" and Aglyn is the "data importer."

13.2 How the SCCs are completed. The SCCs are completed as follows: (a) Clause 7 (the docking clause) is included; (b) for Clause 9, Option 2 (general written authorisation) applies, and the notice period and objection mechanism are those set out in Section 7 of this DPA and on the Subprocessors page; (c) for Clause 11(a), the optional independent dispute-resolution language does not apply; (d) for Clause 13 and Annex I.C, the competent supervisory authority is identified in Annex A; (e) for Clause 17 (governing law), the SCCs are governed by the law of Ireland, and for Clause 18 (forum), disputes arising from the SCCs are resolved before the courts of Ireland; (f) Annex I to the SCCs is completed by Annex A below; Annex II is completed by Annex B below; and Annex III is the then-current Subprocessors list published at aglyn.com/legal/subprocessors, which is incorporated by reference. If there is a conflict between this DPA and the SCCs, the SCCs control for the data transfers they govern.

13.3 UK transfers. For Customer Personal Data originating in the UK, the SCCs as completed above apply as amended by the UK International Data Transfer Addendum to the EU SCCs (version B1.0) issued by the UK Information Commissioner ("UK Addendum"). Tables 1 to 3 of the UK Addendum are completed with the information in this DPA, Annex A, Annex B, and the Subprocessors list; for Table 4, either party may end the UK Addendum as set out in its Section 19.

13.4 Swiss transfers. For Customer Personal Data originating in Switzerland, the SCCs as completed above apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner ("FDPIC"): references to the GDPR are understood as references to the Swiss Federal Act on Data Protection, the competent supervisory authority is the FDPIC, and data subjects in Switzerland may enforce their rights in Switzerland.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service (including Sections 14 and 15), to the maximum extent permitted by Data Protection Laws.

15. General

This DPA is governed by the laws of the State of Texas and the same dispute-resolution provisions as the Terms of Service, except where Data Protection Laws require otherwise. If any provision is invalid, the remainder remains in effect.

Annex A — Description of the transfer (SCCs Annex I; UK Addendum Tables 1–3)

A. List of parties.

Data exporter: the Customer identified in the applicable Aglyn account (name, address, and contact details as provided at signup or in the account settings); contact: the account owner's registered email. Role: controller (Module Two) or processor (Module Three).

Data importer: Aglyn LLC, a Texas limited liability company, United States. Contact: privacy@aglyn.com. Role: processor.

B. Description of the transfer.

Categories of data subjects, categories of personal data, special categories, and the nature and purposes of the processing are as set out in Section 4 of this DPA (Details of Processing). Frequency: continuous, for the duration of the Services. Retention: as set out in Section 11 of this DPA. Transfers to sub-processors: as set out in Section 7 of this DPA and the Subprocessors list (SCCs Annex III), for the purposes stated there.

C. Competent supervisory authority. The supervisory authority of the EU member state in which the data exporter is established or, where the data exporter is not established in an EU member state, the supervisory authority of the member state in which the data subjects whose personal data is transferred are located.

Annex B — Technical and organisational measures (SCCs Annex II; UK Addendum Table 3)

Aglyn maintains the following technical and organisational measures for Customer Personal Data. Aglyn holds no third-party security certifications (e.g., SOC 2, ISO 27001) and does not represent otherwise; the measures below describe what is actually implemented.

Encryption in transit. All Services endpoints are served exclusively over TLS; plaintext HTTP is redirected, and HSTS is enforced with a two-year max-age, including subdomains, with preload.

Encryption at rest. Customer Personal Data is stored in Google Cloud services (Firestore, Cloud Storage), which encrypt all data at rest by default under Google's published practices.

Access control. Every database read and write is gated by security rules evaluated by Google's infrastructure, scoped per document, so access is enforced at the database rather than in application code; server routes that bypass rules by design independently re-verify authentication, membership, and scope before answering. Storage-bucket security rules deny all direct access; media is reachable only through per-object tokens or authenticated server routes.

Authentication and session security. State-changing API routes authenticate with short-lived bearer tokens rather than cookies (foreclosing cross-site request forgery for those routes); sessions are HttpOnly cookies with bounded lifetimes and idle expiry; sign-ins from unrecognized devices generate security alerts; Firebase App Check (reCAPTCHA-attested) is enforced on database and authentication access; rate limiting is durable across serverless instances.

Personnel and confidentiality. Access to production systems is limited to authorized personnel bound by confidentiality obligations (see Section 5 of this DPA).

Auditability. Administrative actions are recorded in an audit log capturing who acted, on what, and what changed; audit entries are retained for approximately 15 months (90 days hot, then a 365-day archive).

Availability and recoverability. Weekly database backups are retained for 14 weeks; point-in-time recovery covers a rolling 7-day window; deleted storage objects are recoverable for 7 days (soft delete).

Deletion. Organization erasure is a genuine recursive delete of documents, files, and back-references, executed after a 7-day reversible hold that protects against accidental or malicious deletion; account closure is self-serve and requires recent re-authentication and explicit confirmation. See Section 11.

Third-party code isolation. Marketplace plugins execute on a separate origin under a restrictive content-security policy; published plugin versions are content-addressed by SHA-256 so the running bytes are the reviewed bytes, and any version can be revoked platform-wide at render time.

Sub-processor measures. Sub-processors are bound as described in Section 7; the current list, including processing locations, is published at aglyn.com/legal/subprocessors.

© 2026 Aglyn LLC. All rights reserved.