Effective Date: 01 Dec 2026 — for new Registrations from this date; for existing Subscriptions, as set out in Section 19 of the Terms of Service.

This Data Processing Addendum (“DPA”) amends and supplements the Terms of Service (the “Terms”) between You and Caphyon, and forms an inseparable part of them. It sets out the terms on which Caphyon processes Personal Data on Your behalf in the course of providing the Service, in accordance with Article 28 of the GDPR. Capitalized terms not defined in this DPA have the meaning given to them in the Terms or, where not defined there, in the Data Protection Legislation.

By accepting the Terms, You also accept this DPA. This DPA does not apply to existing Enterprise customers who have signed a custom contract or service level agreement (SLA) with Caphyon for the Service: the data processing terms of that contract continue to apply, and this DPA applies only where that contract contains none. If You and Caphyon have otherwise signed a separate data processing agreement for the Service, that agreement prevails over this DPA to the extent of any conflict.

1. Definitions

“Data Protection Legislation” means all data protection laws that apply to the processing of Personal Data under the Terms, including the GDPR, Romanian Law No. 190/2018 implementing the GDPR, Directive 2002/58/EC (the “ePrivacy Directive”) and its national implementations and, where applicable, the UK GDPR, the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection, and U.S. Privacy Laws, each as amended or replaced from time to time.

“U.S. Privacy Laws” means all United States federal and state laws and regulations that apply generally to the processing of Personal Data, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CCPA”), and the comprehensive consumer privacy laws of other U.S. states, each as amended or replaced from time to time.

“Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Processing” (and “process”), and “Supervisory Authority” have the meanings given to them in the GDPR. Where U.S. Privacy Laws apply, “Controller” includes “business”, “Processor” includes “service provider” and “contractor”, “Data Subject” includes “consumer”, and “Personal Data” includes “personal information”, as those terms are defined in U.S. Privacy Laws. “Sell” and “Share” have the meanings given to them in the CCPA.

“Customer Personal Data” means Personal Data contained in User Data that Caphyon processes as a Processor on Your behalf in the course of providing the Service, as further described in Annex 1.

“Subprocessor” means any External Supplier or other third party engaged by Caphyon that processes Customer Personal Data on Caphyon’s behalf in order to provide the Service.

“Third-Party Controller” means a Controller, such as one of Your clients, on whose behalf You process Customer Personal Data as a Processor.

“EEA” means the European Economic Area.

“International Transfer” means a transfer of Customer Personal Data to a recipient located in a country outside the EEA.

“EU-U.S. Data Privacy Framework” means the framework recognized as providing an adequate level of protection by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, together with its UK Extension and the Swiss-U.S. Data Privacy Framework, as applicable.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

2. Scope and Roles of the Parties

2.1 Scope. This DPA applies to the processing of Customer Personal Data by Caphyon in the course of providing the Service under the Terms. The subject matter, duration, nature, and purpose of the processing, the types of Customer Personal Data, and the categories of Data Subjects are described in Annex 1.

2.2 Roles. With respect to Customer Personal Data, You are the Controller and Caphyon is Your Processor. Where You process Customer Personal Data on behalf of a Third-Party Controller, for example when providing search engine optimization and digital marketing services to Your clients, You act as a Processor and Caphyon acts as Your Subprocessor. In that case, You warrant that You have obtained from the Third-Party Controller all authorizations needed to engage Caphyon under this DPA, You remain Caphyon’s sole point of contact, and You will give all instructions and exercise all rights on behalf of the Third-Party Controller. Caphyon is not obliged to deal with Third-Party Controllers directly.

2.3 Caphyon as Independent Controller. This DPA does not apply to the following processing, for which Caphyon acts as an independent Controller and which is described in the Privacy Policy:

• Personal Data provided during Registration and for billing and payment, used for Account administration, invoicing, Taxes, accounting records, fraud prevention, and Caphyon’s own communications with You about the Service. Online orders and card payments are processed by 2Checkout (Verifone), which acts as merchant of record and processes Your order and payment data as an independent Controller under its own Privacy Policy;

• Usage Data under Section 7.9 of the Terms, and data about visitors to the Website;

• Public Data under Section 7.12 of the Terms, to the extent Caphyon collects, stores, and reuses it for the Service as a whole, even where the same Public Data also forms part of Your User Data;

• Personal Data that Caphyon processes to comply with a legal obligation, to enforce the Terms, or to establish, exercise, or defend legal claims, as described in Sections 7.7 and 10.2 of the Terms.

Caphyon processes such Personal Data in compliance with the Data Protection Legislation.

2.4 Aggregated Data. You instruct Caphyon to create Aggregated Data from User Data as described in Section 7.9 of the Terms. Caphyon will aggregate and de-identify Customer Personal Data in accordance with the GDPR, so that the resulting Aggregated Data no longer constitutes Personal Data, and will not attempt to re-identify any Data Subject from it. Aggregated Data is not Customer Personal Data and is not subject to this DPA.

3. Your Obligations

3.1 Compliance as Controller. You will comply with Your obligations as a Controller, or as a Processor under Section 2.2, under the Data Protection Legislation in relation to Customer Personal Data. In particular, You are responsible for the lawfulness of the processing You instruct, for having a lawful basis for it, for providing the required notices to Data Subjects and obtaining any required consents, for the accuracy of Customer Personal Data, and for having the right to provide Customer Personal Data to Caphyon, as set out in Sections 7.3 and 9.1 of the Terms.

3.2 No Review of Content. Caphyon does not review or assess User Data or Input to determine whether it contains Personal Data or whether its processing is lawful.

3.3 Prohibited Data. As set out in Section 7.3 of the Terms, the Service is not designed to process sensitive data. You must not submit to the Service, including through AI Features, tracked keywords and prompts, or External Connections: special categories of Personal Data under Article 9 of the GDPR; Personal Data relating to criminal convictions and offences under Article 10 of the GDPR; protected health information under HIPAA; payment card data; or government-issued identification numbers. You should not include other Personal Data in tracked keywords, prompts, or other Input unless it is necessary for Your use of the Service and You have a lawful basis for it. This applies in particular to keywords and prompts tracked on search engines and AI platforms that Caphyon accesses through their public interfaces, as identified in Annex 3, because they are submitted to the platform under its own terms, as described in Section 5.5.

3.4 Disclosures at Your Instruction. You decide which Users to invite to Your Account under Section 6.7 of the Terms, which External Connections to establish under Section 7.4, to whom Output is sent or made accessible under Section 7.11, and to which of Your clients or systems Output is delivered under Section 8.6, including through the API and other export and integration features. These recipients, and the External Suppliers whose platforms You connect, receive or provide data at Your instruction under their own terms with You and are not Subprocessors of Caphyon. You are responsible for ensuring that each such disclosure is lawful, and Caphyon is not responsible for how these recipients process the data.

3.5 Security Within Your Control. You are responsible for the security measures within Your control, including keeping Account credentials and API keys confidential, managing invited Users and their access, and disabling shareable links that are no longer needed, as set out in Sections 6.1, 6.7, 6.10, and 7.11 of the Terms.

4. Caphyon’s Obligations

4.1 Documented Instructions. Caphyon will process Customer Personal Data only on Your documented instructions, including with regard to International Transfers, unless required to do so by Union or Member State law to which Caphyon is subject; in that case, Caphyon will inform You of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. Your documented instructions are: the Terms and this DPA; Your configuration and use of the Service, including Account settings, tracked items, AI Features, External Connections, scheduled reports, shareable links, exports, and integrations; and any other written instructions that You give and Caphyon accepts, consistent with the Terms. Instructions that go beyond the Service as described in the Terms may be subject to additional fees agreed in advance. Caphyon will inform You without undue delay if, in its opinion, an instruction infringes the Data Protection Legislation, and may suspend carrying out that instruction until You confirm or modify it.

4.2 Purpose Limitation. Caphyon will not process Customer Personal Data for any purpose other than providing the Service in accordance with Your instructions, except as set out in Section 2.4. Caphyon will not sell Customer Personal Data or use it for advertising or marketing purposes.

4.3 No AI Training. In accordance with Section 7.10 of the Terms, Caphyon does not use Customer Personal Data, including Customer Personal Data contained in Input or Output, to train or fine-tune artificial intelligence or machine learning models, whether its own or those of third parties. Where Caphyon sends Customer Personal Data to AI platforms or large language models through their APIs, including to provide AI Features and to capture AI responses for the items You track, Caphyon uses them under terms that do not permit the Subprocessor to use such data to train its models. This commitment does not apply to queries submitted through the public interfaces of search engines and AI platforms, which are governed by Section 5.5.

4.4 Confidentiality. Caphyon will ensure that its employees and other persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, access Customer Personal Data only to the extent necessary for their role, and receive appropriate training. Customer Personal Data is Your Confidential Information under Section 7.6 of the Terms.

4.5 Security. Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks for the rights and freedoms of natural persons, Caphyon implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including the measures described in Annex 2. Caphyon may update these measures from time to time, provided that the overall level of security is not materially reduced. You acknowledge that the measures in Annex 2 are appropriate for the processing described in Annex 1.

4.6 Data Subject Requests. Taking into account the nature of the processing, Caphyon will assist You by appropriate technical and organizational measures, insofar as possible, in fulfilling Your obligation to respond to requests from Data Subjects to exercise their rights under Chapter III of the GDPR. You can access, correct, export, and delete most Customer Personal Data directly in the Service; where You cannot, Caphyon will provide reasonable assistance on Your written request. If Caphyon receives a request directly from a Data Subject relating to Customer Personal Data and can identify You as the relevant Controller, it will forward the request to You without undue delay and will not respond to it other than to refer the Data Subject to You, unless required to do so by law.

4.7 Other Assistance. Taking into account the nature of the processing and the information available to it, Caphyon will provide reasonable assistance to You in ensuring compliance with Your obligations under Articles 32 to 36 of the GDPR, including in relation to the security of processing, the notification of Personal Data Breaches, data protection impact assessments, and prior consultations with Supervisory Authorities. Caphyon may charge a reasonable fee for assistance that goes beyond the features of the Service and the information Caphyon makes generally available, except where the assistance is needed because of Caphyon’s breach of this DPA.

4.8 Records. Caphyon maintains a record of the processing activities it carries out on Your behalf, in accordance with Article 30(2) of the GDPR.

4.9 U.S. Privacy Laws. To the extent U.S. Privacy Laws apply to Customer Personal Data, Caphyon acts as Your service provider or processor, and processes Customer Personal Data on Your behalf for the business purposes described in Annex 1. In that capacity, Caphyon:

• will not Sell or Share Customer Personal Data;

• will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes described in Annex 1, or outside the direct business relationship between You and Caphyon, except as permitted by U.S. Privacy Laws;

• will not combine Customer Personal Data with Personal Data that it receives from or on behalf of another person, or collects from its own interactions with individuals, except as necessary to provide the Service and as permitted by U.S. Privacy Laws;

• will comply with the obligations that apply to it under U.S. Privacy Laws and provide the same level of privacy protection as required by them, and will notify You if it determines that it can no longer meet those obligations;

• certifies that it understands and will comply with the restrictions in this Section 4.9.

Where Caphyon notifies You under this Section 4.9, or You reasonably believe that Caphyon is using Customer Personal Data in breach of U.S. Privacy Laws, You may, on written notice, take reasonable and appropriate steps to stop and remediate the unauthorized use. The parties acknowledge that Customer Personal Data is not disclosed to Caphyon as consideration for the Service.

5. Subprocessors

5.1 General Authorization. You give Caphyon general written authorization to engage Subprocessors to process Customer Personal Data. The Subprocessors engaged at the date of this DPA are listed in Annex 3.

5.2 Subprocessor Obligations. Before a Subprocessor processes Customer Personal Data, Caphyon will enter into a written agreement with it that imposes data protection obligations providing at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Caphyon remains responsible to You for the performance of each Subprocessor’s obligations as for its own, in accordance with Article 28(4) of the GDPR and subject to Section 10.

5.3 Changes to Subprocessors. Caphyon will inform You of any intended addition or replacement of a Subprocessor at least thirty (30) days before the change takes effect, by email to the primary email address associated with Your Account in accordance with Section 21.5 of the Terms, and will update Annex 3 accordingly. For the data providers described in Section 5.5, this applies to changes in the locations of processing or the transfer basis set out in Annex 3, not to the replacement of individual providers within the category. You may object to the change on reasonable grounds relating to data protection, by written notice to legal@caphyon.com within that thirty-day period. The parties will discuss the objection in good faith, and Caphyon may propose a reasonable alternative, such as a change in the configuration of the Service that avoids processing of Customer Personal Data by the new Subprocessor. If the objection is not resolved before the change takes effect, You may terminate Your Subscription, or the affected part of the Service, by written notice with effect from the date of the change, and Caphyon will refund any prepaid fees for the period following the termination effective date on a pro-rata basis. If You do not object within the notice period, You are deemed to have approved the change.

5.4 Urgent Replacement. Where Caphyon must replace a Subprocessor at short notice for reasons beyond its reasonable control, including a Dependency Change under Section 2.9 of the Terms or a Subprocessor ceasing to provide its services, or where this is necessary to maintain the security, integrity, or availability of the Service, Caphyon may engage the replacement Subprocessor with immediate effect and will inform You without undue delay. Your right to object and terminate under Section 5.3 applies, with the thirty-day period running from that notice.

5.5 AI Platforms, Search Engines, and Data Providers. To capture search results and AI responses for the items You track, and to provide AI Features, Caphyon submits Your tracked keywords, prompts, and other Input, together with the related settings such as location, device, and language, to search engines, AI platforms, and large language models, either directly or through data providers, and either through their APIs or through their publicly available interfaces. Caphyon submits only the tracked keyword or prompt and the related settings, without identifying You or Your Users.

• API access. Where Caphyon accesses an AI platform or large language model through its API, including to provide AI Features, the provider is a Subprocessor, is listed in Annex 3, and processes the submitted data under terms that do not permit it to use that data to train its models.

• Data providers. Data providers that collect search results or AI responses on Caphyon’s behalf for the items You track are Subprocessors. They receive only the tracked keyword or prompt and the related settings, without identifying You or Your Users. Because the set of providers changes frequently and their identity is commercially sensitive, they are described in Annex 3 as a category, and Caphyon will disclose the current providers to You on request, subject to confidentiality.

• Public interfaces. Where a tracked keyword or prompt is submitted through the publicly available interface of a search engine or AI platform, in the same way as by any other user, the provider of that search engine or AI platform processes the submitted query under its own terms and privacy policy, which may permit it to retain the query and use it to improve its services, including to train its models. These providers are not Subprocessors, because Caphyon cannot impose on them the obligations set out in Section 5.2. The AI platforms that Caphyon accesses in this way are identified in Annex 3.

By tracking a keyword or prompt for a search engine or AI platform, You instruct Caphyon to submit it in the manner described in this Section 5.5. Because Caphyon cannot ensure that providers accessed through public interfaces process the submitted queries in accordance with this DPA, You should not include Personal Data in keywords or prompts tracked through public interfaces unless it is necessary and You have a lawful basis for it, as set out in Section 3.3.

6. Personal Data Breaches

6.1 Notification. Caphyon will notify You without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Caphyon will send the notification by email to the primary email address associated with Your Account and, where appropriate, through the Service. You are responsible for keeping Your contact details current, as set out in Section 21.5 of the Terms. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, or failed login attempts, are not Personal Data Breaches.

6.2 Content. The notification will, to the extent the information is available to Caphyon, describe the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned, its likely consequences, the measures taken or proposed to address it and mitigate its possible adverse effects, and a contact point for further information. Where this information cannot be provided at the same time, Caphyon will provide it in phases without undue further delay.

6.3 Response. Caphyon will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach, and will cooperate with You in meeting Your obligations to notify Supervisory Authorities and Data Subjects. You are responsible for any such notification, and Caphyon will not notify Supervisory Authorities or Data Subjects on Your behalf unless required to do so by law or agreed with You.

6.4 No Admission. Caphyon’s notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

7. Location of Processing and International Transfers

7.1 Hosting Location. Caphyon stores Customer Personal Data in data centers located in the United States and the European Union, as described in Annex 2. Storage of Customer Personal Data in the United States is an International Transfer made in accordance with Section 7.2.

7.2 International Transfers. Caphyon makes International Transfers only where necessary to provide the Service, for example to Subprocessors based in the United States listed in Annex 3, and only on the basis of an appropriate transfer mechanism under Chapter V of the GDPR, namely:

• an adequacy decision under Article 45 of the GDPR, including the EU-U.S. Data Privacy Framework for Subprocessors certified under it; or

• appropriate safeguards under Article 46 of the GDPR, in particular the Standard Contractual Clauses (Module 3, processor to processor) concluded with the Subprocessor, together with any supplementary measures required following a transfer impact assessment.

International Transfers of Personal Data subject to the UK GDPR or the Swiss Federal Act on Data Protection are made on the basis of the corresponding adequacy regulations or decisions or, where none applies, the Standard Contractual Clauses as supplemented by the UK Addendum or the adaptations required under Swiss law. Caphyon will not make International Transfers for any other purpose without Your prior written approval. Queries submitted through public interfaces under Section 5.5 are made at Your instruction and are subject to the restrictions in Section 3.3.

7.3 Transfers to You. Where You are located in a country outside the EEA that is not covered by an adequacy decision, and Caphyon’s provision of Customer Personal Data to You constitutes a transfer under Chapter V of the GDPR, Caphyon, as data exporter, and You, as data importer, conclude Module 4 (processor to controller) of the Standard Contractual Clauses, which are incorporated into this DPA by reference and completed as follows: the optional docking clause in Clause 7 does not apply; the optional language in Clause 11(a) does not apply; the Standard Contractual Clauses are governed by the laws of Romania (Clause 17); disputes are resolved by the courts of Romania (Clause 18); and Annex I of the Standard Contractual Clauses is completed with the information in Annex 1 of this DPA and the parties’ details in the Terms and Your Account.

7.4 Changes to Transfer Mechanisms. If a transfer mechanism relied on under this Section 7 is invalidated, amended, or replaced, Caphyon will rely on an alternative lawful transfer mechanism or take other appropriate measures, and may amend this DPA to the extent necessary to do so, informing You of the change.

7.5 Infrastructure Information. For the purposes of Section 15.2 of the Terms, Annex 2 and Annex 3 set out the location of the infrastructure used to provide the Service and the jurisdictions to which Caphyon and its Subprocessors are subject.

8. Return and Deletion of Customer Personal Data

8.1 During the Subscription. You may export Customer Personal Data at any time using the export features of the Service, as set out in Section 15.1 of the Terms, and may correct or delete it directly in the Service. When You delete Customer Personal Data from Your Account, Caphyon deletes it from its production systems within a reasonable time, and from backups as set out in Section 8.4.

8.2 After Termination. Upon cancellation or termination of Your Account, for any reason, Caphyon handles Customer Personal Data in accordance with Section 7.8 of the Terms. From the Termination Date, Caphyon stops collecting new data for Your Account. During the 30-day Export Window, You may request an export of Your User Data, which Caphyon will provide without undue delay in a commonly used, machine-readable format. After the Export Window ends, User Data is archived securely for 6 months and then permanently deleted. By accepting the Terms, You instruct Caphyon to retain Customer Personal Data in this way. During the archive period, Caphyon will not process Customer Personal Data except to store it securely and, at Your request, to return or delete it.

8.3 Earlier Deletion. You may instruct Caphyon in writing to delete Customer Personal Data before the end of the Export Window or the archive period. Caphyon will then delete it within thirty (30) days of Your request, subject to Sections 8.4 and 8.5, and will confirm the deletion to You in writing on request.

8.4 Backups. Copies of deleted Customer Personal Data may remain in Caphyon’s backups until they are overwritten in the ordinary course of Caphyon’s backup cycle. Until then, they remain protected under this DPA and are not used for any purpose other than recovery from an incident. If a backup is restored, Caphyon will delete again any Customer Personal Data that should already have been deleted.

8.5 Legal Retention. Caphyon may retain Customer Personal Data beyond the periods set out in this Section 8 only to the extent required by Union or Member State law. Any data retained in this way remains protected under this DPA and is processed only for the purpose for which its retention is required.

8.6 Switching under the Data Act. Where You exercise switching rights under Section 15.2 of the Terms, the data retrieval and erasure periods set out there apply instead of Sections 8.2 and 8.3.

9. Information and Audits

9.1 Information. On Your reasonable written request, Caphyon will make available to You the information necessary to demonstrate its compliance with Article 28 of the GDPR and this DPA, such as responses to reasonable security and privacy questionnaires, a summary of its technical and organizational measures and, where available, audit reports or certifications of its Subprocessors. Such information is Caphyon’s Confidential Information under Section 7.6 of the Terms.

9.2 Audits. Where the information provided under Section 9.1 is not sufficient to demonstrate Caphyon’s compliance with this DPA, or where a Supervisory Authority requires it, Caphyon will allow for and contribute to audits, including inspections, conducted by You or by an independent auditor mandated by You, subject to the following:

• You give Caphyon at least thirty (30) days’ prior written notice, describing the proposed scope of the audit;

• audits take place no more than once in any twelve (12) month period, unless required by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data;

• audits are conducted during normal business hours, in a manner that does not unreasonably disrupt Caphyon’s operations, and are limited to the processing of Customer Personal Data;

• the auditor is bound by confidentiality obligations and is not a competitor of Caphyon;

• audits do not give access to data of Caphyon’s other customers, or to Subprocessors’ facilities beyond the audit rights Caphyon has under its agreements with them.

Each party bears its own costs of an audit. You will share the results of the audit with Caphyon, and Caphyon will remedy without undue delay any non-compliance with this DPA identified by the audit.

10. Liability

10.1 Caphyon’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in Section 11 of the Terms, including the aggregate limit in Section 11.9, which applies to all claims under the Terms and this DPA together. Nothing in this DPA limits either party’s liability to Data Subjects under Article 82 of the GDPR, or any liability that cannot be limited under the Data Protection Legislation.

11. Term, Changes, and Final Provisions

11.1 Term. This DPA applies for as long as Caphyon processes Customer Personal Data on Your behalf, including after the termination of the Terms until Customer Personal Data has been returned or deleted in accordance with Section 8.

11.2 Changes. Caphyon may update this DPA in accordance with Section 19 of the Terms. Changes to Subprocessors are governed by Section 5, updates to technical and organizational measures by Section 4.5, and changes required by Section 7.4 by that Section. Caphyon will not make changes that reduce the protection afforded to Customer Personal Data under the Data Protection Legislation.

11.3 Order of Precedence. In accordance with Section 21.6 of the Terms, this DPA prevails over the Terms with respect to the processing of Personal Data. Where the Standard Contractual Clauses apply under Section 7, they prevail over this DPA in the event of a conflict.

11.4 Assignment. If Caphyon assigns the Terms in accordance with Section 18.2 of the Terms, this DPA continues to apply, and the assignee will process Customer Personal Data in accordance with it.

11.5 Governing Law. This DPA is governed by the law and jurisdiction provisions in Section 17 of the Terms, except where the Data Protection Legislation or the Standard Contractual Clauses require otherwise.

11.6 Previous Versions. This version of the DPA replaces the previous version from the date on which it applies to You under Section 19 of the Terms. Processing carried out before that date remains governed by the previous version.

11.7 Contact. You may send questions, requests, and objections relating to the processing of Personal Data to legal@caphyon.com. Other notices are given in accordance with Section 21.5 of the Terms.

Annex 1 — Description of the Processing

Subject matter. The provision of the Service to You under the Terms.

Duration. The term of Your Subscription, followed by the periods set out in Section 8.

Nature of the processing. Collection, recording, organization, structuring, storage, retrieval, analysis, use, transmission, restriction, erasure, and destruction of Customer Personal Data, including:

• storing Your Account configuration, such as tracked keywords, prompts, websites, competitors, locations, and project settings;

• submitting tracked keywords and prompts, with the related location, device, and language settings, to search engines, AI platforms, and large language models, directly or through data providers, and through their APIs or public interfaces, as described in Section 5.5;

• capturing, storing, and analyzing search results and AI responses for the items You track, and compiling statistics, reports, and other Output;

• sending Input and User Data to large language models to provide AI Features, and returning the Output;

• retrieving and storing data from platforms You connect through External Connections;

• sending scheduled reports to the recipients You choose, and making Output available through shareable links, exports, the API, and integrations at Your instruction;

• managing the access of invited Users to Your Account;

• processing Customer Personal Data that You or Your Users share with Caphyon in support requests, to the extent needed to resolve them;

• backups, security, monitoring, and maintenance of the Service;

• de-identification and aggregation to create Aggregated Data under Section 2.4;

• return and deletion of Customer Personal Data under Section 8.

Purposes. Providing, maintaining, securing, and supporting the Service for You in accordance with the Terms, and creating Aggregated Data as described in Section 2.4.

Categories of Data Subjects.

• Your Users, including invited Users;

• recipients of reports and shared Output designated by You;

• Your personnel, collaborators, clients, suppliers, customers, prospects, and subcontractors, and their personnel;

• individuals whose Personal Data is included in Input, such as tracked keywords, prompts, or websites, or in search results and AI responses stored for Your Account;

• individuals whose Personal Data is contained in data obtained through External Connections.

Types of Personal Data.

• identification and contact data of Users and report recipients, such as name and email address;

• Account data of invited Users, such as user roles, permissions, and encrypted login credentials;

• Personal Data contained in tracked keywords, prompts, websites, web pages, and other Input or Account configuration;

• Personal Data contained in search results, AI responses, reports, and other Output stored for Your Account;

• Personal Data contained in data obtained through External Connections, to the extent the connected platform makes it available;

• Customer Personal Data that You or Your Users share with Caphyon in support requests.

Special categories of Personal Data. None. Special categories of Personal Data and the other data listed in Section 3.3 must not be submitted to the Service.

Frequency. Continuous, for the term of Your Subscription.

Retention. As set out in Section 8.

Annex 2 — Technical and Organizational Measures

Caphyon implements the following technical and organizational measures, which it regularly reviews and may update in accordance with Section 4.5. Caphyon applies the same level of security to User Data that is not Personal Data.

1. Hosting and location. The Service is hosted on Amazon Web Services and Google Cloud Platform infrastructure in data centers located in the United States and the European Union. Physical security of the data centers, including access control, surveillance, and environmental protection, is provided by Amazon Web Services and Google Cloud Platform. Caphyon is established in Romania and is subject to Romanian and European Union law. Subprocessors established outside the EEA are also subject to the laws of their country of establishment, as set out in Annex 3.

2. Access control. Physical and logical access controls; restriction of access to User Data to authorized personnel on a need-to-know basis; access to production systems limited to Engineering roles; multi-factor authentication for Caphyon personnel accessing production systems and administrative tools; periodic review of access rights and prompt revocation when they are no longer needed; individual credentials for each User of the Service.

3. Encryption. Data in transit is encrypted using TLS, and all pages of the Service are served over HTTPS. Account passwords are stored only in encrypted form.

4. External Connections. Connections to External Suppliers are established using the OAuth authorization protocol, so that Your credentials for the External Supplier are not shared with the Service. Access tokens are stored securely and can be revoked by You at any time.

5. Backups and recovery. Backups of production data, stored in the United States and the European Union encrypted and retained as set out in Section 8.4; periodic testing of restoration from backups; failover arrangements.

6. Logging and monitoring. Logging of access to production systems; monitoring of the Service for availability, performance, and security events, supporting the Availability commitments in Section 3 of the Terms.

7. Secure development and vulnerability management. Code review before changes are deployed to production; separation of development, test, and production environments; automated monitoring of software dependencies for known vulnerabilities; timely application of security patches; periodic security testing of the Service.

8. Devices and remote work. Caphyon personnel use company-managed devices with automatic screen lock, and up-to-date operating systems and security software, and access internal systems only through authenticated connections.

9. Personnel. Confidentiality obligations for all employees who handle Personal Data or User Data; data protection and security training for employees engaged in processing; access granted only as needed for their role and removed when an employee leaves Caphyon or changes role.

10. Subprocessor management. Assessment of the security and data protection practices of Subprocessors before they are engaged; written agreements with Subprocessors under Section 5.2; use of AI platforms and large language models accessed through their APIs only under terms that do not permit the provider to train its models on data sent by Caphyon, in accordance with Section 4.3.

11. Data minimization. When capturing results from search engines, AI platforms, and large language models, Caphyon submits only the tracked keyword or prompt and the related settings needed to obtain the result, and does not submit Account or User identifiers.

12. Incident management. Procedures to detect, investigate, contain, and respond to security incidents and to notify Personal Data Breaches in accordance with Section 6.

13. Controls available to You. Individual User credentials, revocable API keys, two-factor authentication, single sign-on where included in Your Subscription, the ability to disable shareable links, and export and deletion features, as described in the Terms.

14. Review. Caphyon maintains and regularly reviews its security program, taking into account the state of the art, the costs of implementation, and the nature and risks of the processing, as set out in Section 10.3 of the Terms.

Annex 3 — Subprocessors

Caphyon engages the following Subprocessors to process Customer Personal Data.

Amazon Web Services, Inc.

• Address: 410 Terry Avenue North, Seattle, WA 98109-5210, United States

• Processing: Hosting and infrastructure for the Service, including databases, storage, and backups

• Location of processing: United States and European Union

• Transfer basis: EU-U.S. Data Privacy Framework; SCCs in the AWS data processing addendum

• Provider terms: Privacy Policy, GDPR Center

Intercom R&D Unlimited Company and Intercom, Inc.

• Address: Intercom R&D Unlimited Company, 124 St Stephen’s Green, Dublin 2, D02 C628, Ireland; Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, United States

• Processing: Website and in-app chat and customer communication, including message content, name, email address, and related technical data

• Location of processing: United States

• Transfer basis: EU-U.S. Data Privacy Framework for Intercom, Inc.; SCCs for Intercom R&D Unlimited Company

• Provider terms: Privacy Policy, GDPR

Help Scout PBC

• Address: 68 Harrison Avenue #605, PMB 78505, Boston, MA 02111, United States

• Processing: Email support, including message content, name, email address, and related technical data

• Location of processing: United States

• Transfer basis: EU-U.S. Data Privacy Framework; SCCs in the Help Scout data processing addendum

• Provider terms: Privacy Policy, Terms of Service, DPA

Google Cloud EMEA Limited (Google Cloud Platform)

• Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

• Processing: backend services, BigQuery, object storage

• Location of processing: European Union

• Transfer basis: Not required (processing in the EU)

• Provider terms: Privacy Notice, DPA

ClickHouse, Inc.

• Address: 650 Castro Street, Suite 120 #92426, Mountain View, CA 94041, United States

• Processing: Columnar analytics database: usage and event data with user identifiers; server access log data

• Location of processing: European Union (europe-west4, Netherlands; ClickHouse Cloud accessed via Private Service Connect)

• Transfer basis: Not required for processing in the EU; for access from the United States, the EU-U.S. Data Privacy Framework

• Provider terms: Privacy Policy, DPA

PostHog, Inc.

• Address: 2261 Market Street #4008, San Francisco, CA 94114, United States

• Processing: Product analytics: in-app usage events, session identifiers; after login, events may be associated with an account ID or email address; occasional session recordings of interactions with the Service, with all input fields masked

• Location of processing: United States

• Transfer basis: EU-U.S. Data Privacy Framework

• Provider terms: Privacy Policy, DPA

Functional Software, Inc. (Sentry)

• Address: 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States

• Processing: Error and performance monitoring: error messages, stack traces, timestamps, and user or session identifiers; error reports are retained for 90 days and system logs for 30 days

• Location of processing: European Union (Germany, Sentry DE region)

• Transfer basis: Not required for processing in the EU; for access from the United States, the SCCs (Modules 2 and 3) in the Sentry data processing addendum

• Provider terms: Privacy Policy, DPA

OpenRouter, Inc.

• Address: 169 Madison Avenue #2404, New York, NY 10016, United States

• Processing: Model routing: prompts and Input are forwarded through the API to the upstream model provider selected by the router, only to endpoints with a zero data retention policy, and the model responses are returned; the providers may not use them to train their models (Section 4.3)

• Location of processing: United States

• Transfer basis: SCCs (Modules 2 and 3) in the OpenRouter data processing agreement

• Provider terms: Privacy Policy, Terms of Service, DPA

OpenAI Ireland Ltd and OpenAI, L.L.C.

• Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

• Processing: Model inference: prompts and Input are submitted through the API and the model responses are returned; the provider may not use them to train its models (Section 4.3)

• Location of processing: United States

• Transfer basis: SCCs in the OpenAI data processing addendum

• Provider terms: Privacy Policy, DPA

Anthropic Ireland, Limited

• Address: 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland

• Processing: Model inference for AI Features and automated customer support: prompts, Input, and support messages are submitted through the API and the model responses are returned; the provider may not use them to train its models (Section 4.3)

• Location of processing: United States

• Transfer basis: SCCs (Modules 2 and 3) in the Anthropic data processing addendum

• Provider terms: Privacy Policy, DPA

X.AI LLC

• Address: 1450 Page Mill Road, Palo Alto, CA 94304, United States

• Processing: Model inference: prompts and Input are submitted through the API and the model responses are returned; the provider may not use them to train its models (Section 4.3)

• Location of processing: United States

• Transfer basis: SCCs in the xAI data processing addendum

• Provider terms: Privacy Policy, DPA

Perplexity AI, Inc.

• Address: 115 Sansome Street, Suite 900, San Francisco, CA 94104, United States

• Processing: Model inference: prompts and Input are submitted through the API and the model responses are returned; the provider may not use them to train its models (Section 4.3)

• Location of processing: United States

• Transfer basis: EU-U.S. Data Privacy Framework

• Provider terms: Privacy Policy, DPA

Google Cloud EMEA Limited (Gemini API)

• Address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

• Processing: Model inference through the Gemini API, invoked directly rather than through Vertex AI: prompts and Input are submitted and the model responses are returned; the provider may not use them to train its models (Section 4.3)

• Location of processing: United States and other countries where Google or its subprocessors operate

• Transfer basis: SCCs in Google’s processor terms

• Provider terms: Privacy Policy, Gemini API Terms, DPA

Search and AI data providers

• Processing: Collection of search results and AI responses for tracked keywords and prompts; the providers receive only the keyword or prompt and the related location, device, and language settings, without Account or User identifiers

• Location of processing: European Union and United States

• Transfer basis: EU-U.S. Data Privacy Framework or SCCs, as applicable to each provider

• Provider identities: available to You on request, subject to confidentiality (Section 5.5)

AI platforms accessed through public interfaces (not Subprocessors)

The following AI platforms are accessed through their publicly available interfaces, directly or through the search and AI data providers described above. Their providers process tracked prompts under their own terms and privacy policies, which may permit them to retain the prompts and use them to train their models, and are not Subprocessors (Section 5.5). You should not include Personal Data in prompts tracked for these platforms unless it is necessary and You have a lawful basis for it (Section 3.3).

• Google AI Overviews and AI Mode (Google): Terms of Service, Privacy Policy

• ChatGPT (OpenAI): Terms of Use, Privacy Policy

• Perplexity (Perplexity AI): Terms of Service, Privacy Policy

• Gemini (Google): Terms of Service, Gemini Apps Privacy Notice