Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Master Services Agreement (the "Agreement") between Synth AI Labs Inc.—doing business as Infer ("Processor," "we," "us," or "our")—and the Customer ("Controller"). It reflects the parties' agreement on the processing of Data in accordance with all applicable data‑protection laws and regulations.
1. Introduction
This DPA governs our Processing of Data on behalf of Controller through the Infer platform available at https://infer.so, a product of Synth AI Labs Inc.
2. Definitions
| # | Term | Meaning |
|---|---|---|
| 2.1 | Customer | The individual or entity that entered into the Agreement and accepted incorporation of this DPA. |
| 2.2 | Customer Data | Customer's content—application data, files, text, images, reports, personal information, or other content—uploaded or submitted to the Services by Customer or its Users and processed by Synth AI Labs Inc. on Customer's behalf. Usage statistics or technical data that do not reveal the contents of Customer Data are excluded. |
| 2.3 | Customer Personal Data | Personal Data contained within Customer Data. |
| 2.4 | Personal Data | Any information relating to, identifying, describing, or reasonably capable of being associated with an individual or household ("Data Subject"). |
| 2.5 | Data | Collectively, Customer Data, Customer Content, Customer Personal Data, and Personal Data processed by Processor while providing the Services. |
| 2.6 | Processing | Any operation performed on Data—whether automated or not—such as collection, recording, organization, storage, retrieval, use, disclosure, alignment, restriction, erasure, or destruction. |
| 2.7 | Sub‑processor | Any third party engaged by Processor to process Data in connection with the Agreement. |
| 2.8 | Data Protection Laws | All legislation protecting fundamental rights and freedoms of individuals regarding Processing of Data (e.g., GDPR, CCPA). |
3. Processing of Data
3.1 Processor's Obligations
- Processor shall Process Data only on documented instructions from Controller, including regarding transfers to third countries or international organizations, unless Union or Member‑State law to which Processor is subject requires otherwise.
- Where such law requires Processing, Processor will notify Controller (unless prohibited on important public‑interest grounds).
3.2 Controller's Obligations
- Controller will provide lawful, written instructions consistent with Data Protection Laws.
- Controller warrants that all necessary consents, permissions, and notices required for Processor's Data Processing have been obtained.
3.3 Use-Limitation (No Model Training)
Processor shall not use, access, or permit access to Customer Data for the purpose of developing, training, or improving machine-learning or other artificial-intelligence models, except where Processor receives Controller's prior written instructions to do so.
4. Security Measures
4.1 Confidentiality
Processor ensures that persons authorized to Process Data are bound by confidentiality obligations.
4.2 Technical & Organizational Measures
Processor maintains measures appropriate to the risk, including:
- Pseudonymization and encryption of Data;
- Ongoing confidentiality, integrity, availability, and resilience of systems;
- Timely restoration of access following an incident;
- Regular testing and evaluation of security measures.
4.3 Security Incident Management
Processor shall notify Controller in writing within 24 hours of confirming any Data Breach affecting Customer Personal Data. Such notice shall include known impact, remediation steps taken, and a point of contact. Processor will provide status updates every 24 hours until containment and a written root-cause analysis within 30 days.
4.4 Regulatory Compliance Alignment
Processor's information-security program is designed to satisfy the requirements of the NAIC Insurance Data Security Model Law 668, the GLBA Safeguards Rule (16 CFR 314), and NYDFS 23 NYCRR 500, where applicable to Processor's services.
4.5 Audit Rights
Once per calendar year, Controller may conduct a remote security review consisting of Processor's latest SOC report and a written questionnaire. An on-site review may be performed with 30 days' prior written notice and is subject to mutually agreed scheduling and scope.
4.6 Data Retention & Deletion
Within 30 days of contract termination or Controller's written request, Processor shall irreversibly delete or crypto‑erase all Customer Data and certify completion.
5. Multi‑Tenant Secure‑System Measures
To protect Data in a multi‑tenant environment, Processor implements, without limitation:
- Data Isolation – strict logical separation between tenants;
- Access Control – role‑based access and multi‑factor authentication;
- Encryption – industry‑standard encryption for Data in transit and at rest;
- Monitoring & Logging – continuous auditing of access and activity;
- Regular Audits – scheduled security audits and vulnerability assessments;
- Data Minimization – Processing only the minimum Data necessary for stated purposes.
6. Sub‑processors
6.1 General Authorization
Controller grants Processor a general authorization to engage Sub‑processors. Processor shall inform Controller of any intended addition or replacement, giving Controller an opportunity to object.
6.2 Sub‑processor Obligations
Processor shall ensure each Sub‑processor is bound by data‑protection obligations no less protective than those in this DPA.
7. Miscellaneous
- Conflict – Where this DPA conflicts with the Agreement, this DPA prevails on matters relating to Data Protection.
- Governing Law & Jurisdiction – As set out in the Agreement unless Data Protection Laws require otherwise.
- Severability – If any provision of this DPA is held invalid, the remainder shall remain in effect.