Skip to content
Thorn StreetBack to home

Effective October 16, 2026 · Version 1.1.0

Data Processing Addendum

This Data Processing Addendum (including its Annexes, this "DPA") is between Thorn Street, Inc. ("Provider") and the customer that has agreed to Provider's Terms of Service, or signed another written agreement with Provider for the Services ("Customer") (each a "Party"). It forms part of that agreement (as amended, the "Agreement"). It takes effect when Customer accepts the Terms of Service as a business or organization, or when the Parties sign it or an Order Form that refers to it, and applies only to Personal Data that Provider Processes on Customer's behalf. Customers who want a signed copy may request one at legal@thornstreet.com.

1. Definitions

The following terms have the meanings set out below for purposes of this DPA. Any capitalized terms not defined in this DPA have the meanings given in the Agreement.

Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" refers to the power to direct or cause the direction of the subject entity, whether through ownership of voting securities, by contract or otherwise.

Applicable Data Protection Laws means the privacy, data protection and data security laws and regulations applicable to Provider's Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws, the GDPR and the FADP.

Controller means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including, as applicable, any "business" or "controller" as such term is defined by the California Consumer Privacy Act (the "CCPA") or other State Privacy Laws.

Customer Data means information provided or otherwise made available by or on behalf of Customer to Provider for Processing on Customer's behalf to perform the Services, including "Your Content" as defined in the Terms of Service.

Data Subject means the identified or identifiable natural person to whom Personal Data relates.

EEA means the European Economic Area.

FADP means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances.

FDPIC means the Swiss Federal Data Protection and Information Commissioner.

GDPR means, as and where applicable to the Processing concerned: (i) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"); and/or (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"), including, in each case, any applicable national implementing or supplementary legislation (e.g., the UK Data Protection Act 2018), and any successor, amendment or re-enactment of the foregoing.

Information Security Incident means a breach of Provider's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider's possession, custody or control. Information Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

Personal Data means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" as defined in Applicable Data Protection Laws, provided that Personal Data does not include information about Customer's own personnel who use the Services or are Customer's business contacts, which Provider Processes as a Controller under its Privacy Policy, or information that Provider receives, collects or generates independently of the Services.

Process or Processing means any operation or set of operations performed by Provider (or on Provider's behalf) for Customer under the Agreement on Personal Data, whether or not by automated means.

Processor means the entity that Processes Personal Data on behalf of the Controller, including, as applicable, any "service provider" or "contractor" as those terms are defined by the CCPA.

Restricted Transfer means the disclosure, grant of access or other transfer of Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA which does not benefit from an adequacy decision from the European Commission (an "EU Restricted Transfer"); (ii) in the context of the UK, any country or territory outside the UK which does not benefit from an adequacy decision from the UK Government (a "UK Restricted Transfer"); and (iii) in the context of Switzerland, a country or territory outside of Switzerland which does not benefit from an adequacy decision from the Swiss Government (a "Swiss Restricted Transfer"), in each case, which would be prohibited without a legal basis under applicable data protection law.

SCCs means the standard contractual clauses approved by the European Commission pursuant to implementing Decision (EU) 2021/914.

Security Measures has the meaning given in Section 4(a).

State Privacy Laws means the comprehensive U.S. state data privacy laws (and their implementing regulations) in effect and applicable to Provider's Processing of Personal Data under the Agreement.

Subprocessors means Provider's Affiliates and third parties that Provider engages to Process Personal Data in relation to the Services.

Supervisory Authority means any entity with the authority to enforce Applicable Data Protection Laws, including (i) for the EEA and the EU GDPR, as defined in the EU GDPR; (ii) for the UK and the UK GDPR, the UK Information Commissioner's Office; and (iii) for Switzerland and the FADP, the FDPIC.

UK Transfer Addendum means the template Addendum B.1.0 issued by the UK Information Commissioner's Office and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of its Mandatory Clauses.

2. Duration and scope

(a) This DPA remains in effect for as long as Provider Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

(b) Processing of Personal Data subject to the GDPR or the FADP is also subject to Annex 2 (European Annex).

(c) Processing of Personal Data subject to the State Privacy Laws is also subject to Annex 3 (State Privacy Laws Annex).

3. Customer instructions

(a) Provider will Process Personal Data only in accordance with Customer's documented instructions, including as set out in this DPA, the Agreement, any applicable Order Form, and Customer's use and configuration of the Services, and any other written instructions Customer provides that are consistent with the Agreement and this DPA. Instructions outside the scope of the Services, or that would require Provider to materially change the Services, require a written agreement between the Parties. By entering into this DPA, Customer instructs Provider to Process Personal Data to provide the Services and to perform its other obligations and exercise its rights under the Agreement. The details of the Processing are described in Annex 1 (Data Processing Details).

(b) The Services let users turn on a setting ("Help improve Leif") that allows Provider's personnel to review threads to troubleshoot and improve the Services. The setting is on by default. Customer's users leaving that setting on, or turning it on, is an instruction from Customer to Process Personal Data for that purpose. Customer may require that the setting be turned off for all its users by notice to Provider.

4. Security

(a) Provider Security Measures. Provider will implement and maintain technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, as described in Annex 4 (the "Security Measures"), taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing and the risks to Data Subjects. Provider may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Data.

(b) Security Compliance by Provider Staff. Provider will require that its personnel who are authorized to access Personal Data are subject to appropriate confidentiality obligations.

(c) Information Security Incidents. Provider will notify Customer without undue delay of any Information Security Incident of which Provider becomes aware. Such notifications will describe, to the extent then known, available details of the Information Security Incident, including steps taken to mitigate the potential risks and steps Provider recommends Customer take to address it. Provider's notification of or response to an Information Security Incident will not be construed as an acknowledgement of fault or liability. Provider will reasonably cooperate with Customer and take such commercially reasonable steps, to the extent within Provider's control, as Customer reasonably requests and the Parties agree in good faith, to assist in investigating the Information Security Incident. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling any third-party notification obligations related to an Information Security Incident. If Customer determines that an Information Security Incident must be notified to any Supervisory Authority, Data Subject, the public or others, and the notice refers to or identifies Provider, Customer will, where permitted by law, (i) notify Provider in advance, and (ii) in good faith consult with Provider and consider any clarifications or corrections Provider reasonably requests about Provider's involvement.

5. Customer's security responsibilities and assessment

(a) Customer's Security Responsibilities. Without limiting Provider's obligations under Section 4, Customer is responsible for its use of the Services, including (i) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Personal Data; (ii) securing the account authentication credentials, systems and devices Customer uses to access the Services; (iii) securing Customer's systems and devices that Customer provides or makes available for Provider to access in order to provide the Services; (iv) deciding what Customer Data to make public through Published Links; and (v) backing up Personal Data, as applicable.

(b) Customer's Security Assessment. Customer acknowledges that it has evaluated the Services, the Security Measures and Provider's commitments under this DPA and has determined that they are adequate to meet Customer's needs, including with respect to any security obligations of Customer under Applicable Data Protection Laws.

6. Data Subject rights and Customer responsibilities

(a) Data Subject Request Assistance. Provider will (taking into account the nature of the Processing) provide Customer with assistance reasonably necessary and technically feasible for Customer to fulfill requests by Data Subjects to exercise their rights under Applicable Data Protection Laws ("Data Subject Requests") with respect to Personal Data in Provider's possession or control. If Provider receives a Data Subject Request, Provider will (i) promptly notify Customer, unless prohibited by law; and (ii) advise the Data Subject to submit the request to Customer. Customer is responsible for responding to such requests, unless otherwise required by law. Customer will compensate Provider, at Provider's then-current rates, for any such assistance that requires work beyond the Services, and Provider will provide a good-faith estimate on request.

(b) Restricted Data. Customer represents and warrants that Customer Data does not and will not contain any social security numbers or other government-issued identification numbers; protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA) or other information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance information; biometric information; passwords or other credentials for third-party online accounts (other than credentials created for and used solely to access the Services); credentials to any financial accounts; tax return data; payment card information subject to the Payment Card Industry Data Security Standard; personal data of children under 16 years of age; or any other information that falls within any special categories of data under Applicable Data Protection Laws (together, "Restricted Data"), unless the Parties have agreed otherwise in writing. Provider is not a business associate under HIPAA, and nothing in the Agreement makes it one, unless the Parties sign a business associate agreement. Provider has not agreed to receive Restricted Data or to apply to it any protections beyond the Security Measures that apply to all Customer Data (such as those HIPAA requires), does not monitor Customer Data for it, and has no obligation to find, remove or report it. Customer is solely responsible for any Restricted Data submitted in breach of this Section 6(b) and for any resulting obligations to Data Subjects or authorities, and, to the extent permitted by Applicable Data Protection Laws, Provider has no liability for it. Provider may, but is not required to, delete it, notifying Customer where practicable.

(c) Notices, consents and legal basis. Customer is responsible for providing all notices to, and obtaining all consents and permissions from, Data Subjects and other third parties, and for ensuring that there is and will be a valid legal basis for Provider's Processing of Personal Data under this DPA and the Agreement (including, where applicable, under Articles 6, 9(2) and 10 of the GDPR), in each case as Applicable Data Protection Laws require.

7. Subprocessors

(a) Consent to Subprocessor Engagement. Customer specifically authorizes the engagement of Provider's Affiliates as Subprocessors and generally authorizes Provider to engage third parties as Subprocessors in accordance with this Section 7.

(b) Information about Subprocessors. Information about Subprocessors, including their functions and locations, is available at https://thornstreet.com/subprocessors (the "Subprocessor Site") and in Annex 5. Provider may continue to use the Subprocessors already engaged as of the effective date of this DPA.

(c) Requirements for Subprocessor Engagement. When engaging any Subprocessor, Provider will enter into a written contract with it containing data protection obligations no less protective than those in this DPA, to the extent applicable to the nature of the services it provides. Provider remains responsible for the performance of all obligations subcontracted to a Subprocessor and is liable for its acts and omissions to the same extent as if Provider had performed the Processing itself.

(d) Opportunity to Object to Subprocessor Changes. When Provider engages a new Subprocessor, Provider will notify Customer (including the Subprocessor's name and location and the activities it will perform) by updating the Subprocessor Site and by email to Customer's account email address or other designated contact. If Customer objects in writing within 15 days after that notice, on reasonable grounds relating to the protection of Personal Data, the Parties will work together in good faith to find a mutually acceptable resolution. If they cannot within a reasonable time, Customer may, as its sole and exclusive remedy, terminate the Agreement and stop using the Services by written notice to Provider, and pay Provider all amounts due as of the date of termination.

8. Audits

Customer may audit Provider's compliance with this DPA up to once per year, and at other times only to the extent Applicable Data Protection Laws or a competent Supervisory Authority require, upon written request with reasonable detail. Provider will contribute to such audits by providing the information and assistance reasonably necessary. Customer must submit a proposed audit plan, describing the scope, duration and start date, at least two weeks in advance; the Parties will agree a final plan in good faith; and any third-party auditor must be independent, not a competitor of Provider, and bound by a customary confidentiality agreement. Where the controls to be assessed are covered by a SOC 2 Type 2, ISO 27001 or similar report issued by a qualified third-party auditor within the prior 12 months, with no known material changes since, Customer will accept that report instead. Audits take place during regular business hours, subject to Provider's security and other policies, and may not unreasonably interfere with Provider's business. Nothing in this Section 8 requires Provider to breach any duty of confidentiality. Customer will share any audit report with Provider and use it only to meet its regulatory requirements or confirm compliance with this DPA. Audits are at Customer's expense, including Provider's reasonable costs at its then-current rates, which Provider will provide on request.

9. Return and deletion

(a) Subject to Sections 9(b) through 9(d), upon cessation of the Services involving Processing of Personal Data (the "Cessation Date"), Provider will promptly stop Processing Personal Data for any purpose other than storage and Processing necessary to return, delete or anonymize it, or as this DPA or the law otherwise permits or requires.

(b) On written request made within 30 days after the Cessation Date (the "Post-cessation Storage Period"), Provider will, to the extent technically feasible, and as Customer elects, either (i) return a copy of all Personal Data in Provider's possession to Customer by secure file transfer or another commercially reasonable secure method, and then delete or anonymize all other copies, or (ii) delete or anonymize all Personal Data in Provider's possession.

(c) If Customer does not instruct Provider during the Post-cessation Storage Period, Provider will, within a commercially reasonable time after it ends, delete or anonymize all Personal Data then in its possession, custody or control to the fullest extent technically feasible. Backup copies are deleted on Provider's normal backup cycle, as described in Provider's Privacy Policy.

(d) Provider may retain Personal Data to the extent required or permitted by law, for no longer than that law requires, provided that Provider will (i) keep it confidential and protect it in accordance with the Security Measures, (ii) Process it only as necessary for the purpose for which the law requires or permits retention, and (iii) delete or anonymize it once it is no longer required or permitted to be retained.

10. Artificial intelligence and automated processing

(a) Provider will not use Personal Data to train, fine-tune, develop or improve any artificial intelligence or machine learning model, whether Provider's own or a third party's, unless (i) such use is reasonably necessary to provide the Services in accordance with Customer's documented instructions (for example, creating text embeddings of Customer's own data so that Customer can search it), or (ii) Customer expressly authorizes it in writing.

(b) Provider will prohibit its Subprocessors, including AI model providers, from using Personal Data for their own model training, fine-tuning, development or improvement, except as Customer expressly authorizes in writing.

(c) The Services are not designed to make decisions that produce legal or similarly significant effects on Data Subjects. If Customer uses the Services as part of such decision-making, Customer is responsible for complying with Applicable Data Protection Laws on automated decision-making, and Provider will reasonably cooperate with Customer, as those laws require, by providing information about the Services reasonably available to it, without disclosing its trade secrets or confidential information.

11. Miscellaneous

(a) Except as this DPA modifies it, the Agreement remains in full force and effect. Provider's access to Personal Data is not part of the consideration exchanged by the Parties under the Agreement. Provider may give notices under this DPA (i) under the notice clause of the Agreement; (ii) to Customer's data protection contact in Annex 1; (iii) to Customer's account email address; or (iv) to any other email address Customer designates in writing for Services-related communications. Customer is responsible for keeping those addresses valid.

(b) Provider will cooperate in good faith with Customer to consider amendments reasonably necessary to comply with Applicable Data Protection Laws.

(c) Provider may, on written notice, vary this DPA to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided that the variation does not materially reduce the protection of Personal Data or materially increase Customer's obligations without Customer's written agreement, including by varying or replacing the SCCs under Paragraph 3.4 of Annex 2.

(d) To the extent permitted by Applicable Data Protection Laws and the SCCs, each Party's total aggregate liability under or in connection with this DPA and the SCCs is subject to the limitations and exclusions of liability in the Agreement; nothing in this Section 11(d) affects any person's liability to Data Subjects under the third-party beneficiary provisions of the SCCs.

(e) In the event of any conflict or inconsistency between (i) this DPA and the Agreement, this DPA prevails, and (ii) any SCCs entered into under Paragraph 3 of Annex 2 and this DPA or the Agreement, the SCCs prevail in respect of the Restricted Transfer to which they apply.

(f) This DPA is governed by the law that governs the Agreement, except where Annex 2 or Applicable Data Protection Laws require otherwise.

Annex 1: Data Processing Details

Provider ("data importer")

  • Name: Thorn Street, Inc.
  • Address: 3152 30th Street, San Diego, CA 92104, United States
  • Contact for data protection: privacy@thornstreet.com
  • Activities: Provider makes Leif, an AI assistant for geographic and spatial work, and related services.
  • Role: Processor (or Subprocessor, as applicable).

Customer ("data exporter")

  • Name: the entity or other person that is a party to the Agreement.
  • Address and contact for data protection: as given in the Order Form, or the account's billing details and email address.
  • Activities: use of the Services under and in accordance with the Agreement as part of Customer's business operations.
  • Role: Controller or Processor (as applicable).

Categories of Data Subjects: any individuals whose Personal Data Customer causes Provider to Process through the Services, which may include Customer's personnel, clients and business contacts, and individuals who appear in data Customer uploads, connects or has Leif retrieve (for example, in property, permit or other records).

Categories of Personal Data: any Personal Data Customer causes Provider to Process as part of the Services, which may include:

  • Personal details, such as names and contact information.
  • Location and property information, such as addresses and information linked to a place or parcel.
  • Content, such as messages, documents, files and other Customer Data that contain Personal Data.
  • Technical details of Customer's users, such as IP addresses and identifiers, where they are Processed on Customer's behalf.

Sensitive data: none. Restricted Data, which includes "sensitive data" (as defined in Clause 8.7 of the SCCs), must not be submitted to the Services without the Parties' prior written agreement (Section 6(b)). Additional safeguards: not applicable.

Frequency of transfer: continuous, as initiated by Customer through its use of the Services.

Nature of the Processing: hosting, storage, transmission, retrieval, analysis by AI models and other software, display, publication at Customer's direction (at Published Links, or to Customer's connected services such as ArcGIS), and deletion, as needed to provide the Services.

Purpose of the Processing: to provide the Services as initiated by Customer, and to comply with Customer's documented instructions, under the Agreement and this DPA.

Duration of Processing and retention: for the term of the Agreement and as determined under Section 9, and as described in Provider's Privacy Policy for each type of data.

Transfers to Subprocessors: as described in Annex 5 and on the Subprocessor Site, for the purposes described there, for the duration of the Processing.

Annex 2: European Annex

1. Processing of Personal Data

1.1. Where Provider receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Provider will inform Customer.

1.2. Customer will ensure that its instructions regarding the Processing of Personal Data comply with the GDPR and all other applicable laws.

2. Data protection impact assessment and prior consultation

2.1. Provider, taking into account the nature of the Processing and the information available to it, will provide reasonable assistance to Customer, at Customer's cost and upon written request, to the extent reasonably necessary and technically feasible, with any data protection impact assessments and prior consultations with Supervisory Authorities required of Customer under Article 35 or 36 of the GDPR, in each case solely in relation to Provider's Processing of Personal Data.

2.2. Except where prohibited by law, Customer will reimburse Provider, at Provider's then-current rates, for its time spent providing assistance under Paragraph 2.1.

3. Restricted transfers

3.1. EU Restricted Transfers. To the extent any Processing of Personal Data under this DPA involves an EU Restricted Transfer from Customer to Provider, the Parties will comply with their respective obligations under the SCCs, which are deemed (a) populated in accordance with Part 1 of Attachment 1 to this Annex 2, and (b) entered into by the Parties and incorporated by reference into this DPA.

3.2. UK Restricted Transfers. To the extent any Processing involves a UK Restricted Transfer from Customer to Provider, the Parties will comply with their respective obligations under the SCCs as varied by the UK Transfer Addendum, which are deemed (a) varied and populated in accordance with Part 2 of Attachment 1, and (b) entered into by the Parties and incorporated by reference into this DPA.

3.3. Swiss Restricted Transfers. To the extent any Processing involves a Swiss Restricted Transfer from Customer to Provider, the Parties will comply with their respective obligations under the SCCs, which are deemed (a) varied and populated in accordance with Part 3 of Attachment 1, and (b) entered into by the Parties and incorporated by reference into this DPA. Nothing in the SCCs as so varied limits the rights of Data Subjects under Clause 18(c) to bring proceedings before the courts in Switzerland where Switzerland is their place of habitual residence.

3.4. Adoption of new transfer mechanism. Provider may, on notice, vary this DPA and replace the relevant SCCs with (a) any new form of them or replacement for them, populated accordingly, to the extent necessary to maintain compliance with Applicable Data Protection Laws, provided the replacement does not materially decrease the overall protection of Personal Data; or (b) another valid transfer mechanism, such as the EU-U.S. Data Privacy Framework or its UK or Swiss extension, that Provider reasonably determines maintains compliance with Chapter V of the GDPR and does not materially diminish the safeguards for Personal Data under this DPA.

3.5. Provision of full-form SCCs. If a Supervisory Authority, Data Subject or further Controller requests it of Customer, Provider will, on Customer's specific written request (made to the contact in Annex 1, with reasonable supporting evidence) and to the extent required to evidence Customer's compliance, provide within a reasonable time an executed version of the relevant SCCs, populated in accordance with Attachment 1, for countersignature by Customer.

3.6. When complying with its transparency obligations under Clause 8.3 of the SCCs, Customer will not disclose, and will take appropriate steps to protect, Provider's and its licensors' trade secrets, confidential information and other commercially sensitive information.

3.7. For the purposes of Clause 10(a) of Module Three of the SCCs, Customer agrees that it will not be appropriate for Provider to notify any third-party controller of a Data Subject Request, and that any such notification is Customer's responsibility.

3.8. For the purposes of Clause 15.1(a) of the SCCs, except where prohibited by law or the relevant public authority, Customer is responsible for making any required notifications to Data Subjects.

3.9. Section 7 of this DPA applies to Provider's appointment and use of Subprocessors under the SCCs. Any approval of a Subprocessor given or deemed given under Section 7 is Customer's documented instruction to make onward transfers to it solely in connection with the Services, as required under Clause 8.8 of the SCCs.

3.10. The audits described in Clauses 8.9(c) and 8.9(d) of the SCCs are subject to Section 8 of this DPA.

3.11. Certification of deletion under Clauses 8.5 and 16(d) of the SCCs will be provided only on Customer's written request.

Attachment 1 to Annex 2: Population of the SCCs

Part 1: EU Restricted Transfers

  1. Signature. Where the SCCs apply under Paragraph 3.1 of Annex 2, each Party is deemed to have signed them at the relevant signature block in Annex I to their Appendix.

  2. Modules. Module Two applies to any EU or Swiss Restricted Transfer of Personal Data for which Customer is a Controller in its own right; Module Three applies to any EU, UK or Swiss Restricted Transfer of Personal Data for which Customer acts as a Processor on behalf of another person.

  3. Body of the SCCs. For each Module, as applicable: (a) the optional Clause 7 (Docking Clause) is not used; (b) in Clause 9, Option 2 (general written authorisation) applies, with the advance notice period for adding or replacing Subprocessors set out in Section 7(d) of this DPA (currently 15 days), and Option 1 and Annex III are not used; (c) in Clause 11, the optional language is not used; (d) in Clause 13, all square brackets are removed and the text in them retained; (e) in Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland; and (f) for Clause 18, disputes arising from the SCCs are resolved by the courts of Ireland.

  4. Annexes to the Appendix. Annex I is populated with the information in Annex 1 to this DPA, with Customer as "data exporter" and Provider as "data importer." In Part C of Annex I, the competent supervisory authority is: where Customer is established in an EU Member State, the supervisory authority of that Member State; where Customer is not established in the EU but has appointed an EU representative under Article 27 of the GDPR, the supervisory authority of the Member State where that representative is based; and otherwise, the supervisory authority of the Member State Customer notifies to Provider's data protection contact, being one in which the relevant Data Subjects are located. Annex II is populated by reference to Section 4 and Annex 4 of this DPA; for assistance with Data Subject Requests, Customer should email Provider's data protection contact in Annex 1. Provider will bind each Subprocessor by contract to data protection obligations that, to the extent applicable to its services, meet or exceed the standards required under the SCCs and this DPA, including appropriate security measures, notification of Information Security Incidents to Provider, return or deletion of Personal Data as required, and the engagement of further Subprocessors.

Part 2: UK Restricted Transfers

Where the SCCs apply to UK Restricted Transfers under Paragraph 3.2 of Annex 2, they are varied by the UK Transfer Addendum as follows: (a) as permitted by Section 17 of the UK Transfer Addendum, Tables 1, 2 and 3 are deemed populated with the corresponding details in Annex 1 to this DPA and Part 1 of this Attachment, and in Table 4 the "Data Importer" box is deemed ticked; and (b) the Parties agree to be bound by the Mandatory Clauses of the UK Transfer Addendum. Where the context requires, references in this DPA to the SCCs mean the SCCs as so varied.

Part 3: Swiss Restricted Transfers

Where the SCCs apply to Swiss Restricted Transfers under Paragraph 3.3 of Annex 2, "GDPR" means the FADP; "European Union," "Union" and "Member State(s)" mean Switzerland; and "supervisory authority" means the FDPIC. Where the context requires, references in this DPA to the SCCs mean the SCCs as so varied.

Annex 3: State Privacy Laws Annex

  1. In this Annex 3, "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider" and "contractor" have the meanings given in the applicable State Privacy Laws, and "personal information" means Personal Data to the extent it is "personal information" or "personal data" (or a similar term) governed by the State Privacy Laws.

  2. The Parties intend that, with respect to personal information, Provider is a service provider, contractor and/or processor, as applicable. Provider (a) acknowledges that Customer discloses personal information only for the limited and specified purposes described in the Agreement; (b) will comply with its applicable obligations under the State Privacy Laws and provide the same level of privacy protection as they require; (c) agrees that Customer may take reasonable and appropriate steps to help ensure that Provider's Processing is consistent with Customer's obligations under the State Privacy Laws; (d) will notify Customer in writing if it determines that it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer may, upon reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

  3. Provider will not (a) sell or share personal information; (b) retain, use or disclose personal information for any purpose other than the specific purpose of providing the Services, or as otherwise permitted by the State Privacy Laws; (c) retain, use or disclose personal information outside the direct business relationship between Provider and Customer; or (d) combine personal information received under the Agreement with personal information received from or on behalf of another person, or collected from Provider's own interactions with the Data Subject, except as permitted by the State Privacy Laws and necessary to provide the Services. Provider certifies that it understands and will comply with this Paragraph 3.

  4. Notice of Subprocessor engagements under Section 7 of this DPA satisfies any obligation under the State Privacy Laws to give notice of, and an opportunity to object to, such engagements.

  5. Customer may conduct audits under Section 8 of this DPA to help ensure that Provider's use of personal information is consistent with its obligations under the State Privacy Laws.

  6. The Parties acknowledge that Provider's retention, use and disclosure of personal information as authorized by Customer's instructions in the Agreement and this DPA are integral to Provider's provision of the Services and the business relationship between the Parties.

Annex 4: Security Measures

  1. Program and responsibility. Named personnel are responsible for developing, implementing and maintaining Provider's information security program, which is reviewed periodically, including when the Services change materially.

  2. Hosting. The Services run on a major cloud provider's infrastructure in the United States (currently Amazon Web Services, as Annex 5 lists), in a private network, and rely on that provider's physical and environmental security for its data centers.

  3. Encryption. Personal Data is encrypted in transit over public networks using TLS, and at rest, including databases, file storage, thread workspaces, and backups.

  4. Isolation. Each Leif thread runs in its own isolated worker with its own storage. Workers do not hold the credentials for Provider's third-party providers; calls to those providers go through Provider's gateway, which authorizes and records each one.

  5. Access control. Access to production systems and Personal Data is limited to authorized personnel on a need-to-know and least-privilege basis, uses unique accounts with multi-factor authentication, and is removed promptly when no longer needed. Provider's administrative tools show personnel usage numbers, not the content of users' threads, unless the user has turned on "Help improve Leif."

  6. Authentication. Users sign in with one-time email codes or with Google or Microsoft accounts. The Services do not store user passwords. Sign-in codes and access passes are stored hashed, and third-party access tokens are stored encrypted.

  7. Logging and monitoring. System access and activity are logged and monitored, and network logs are kept for 30 days.

  8. Secure development and change management. Changes to the Services are reviewed and tested before release, dependencies are kept up to date, and infrastructure is defined as code.

  9. Vulnerability management. Provider monitors for and remediates security vulnerabilities in its systems and dependencies, and accepts reports of security concerns at security@thornstreet.com.

  10. Incident response. Provider maintains procedures to investigate, respond to, mitigate and notify Information Security Incidents as this DPA requires.

  11. Backup and recovery. Personal Data is backed up, and backup copies of deleted data are removed within 30 days. Provider maintains procedures to restore the Services after a failure.

  12. Data minimization and deletion. Provider keeps Personal Data only for the periods described in its Privacy Policy, and deletes thread data when users delete their threads.

  13. Personnel. Personnel with access to Personal Data are bound by confidentiality obligations and are instructed in their security responsibilities.

  14. Subprocessors. Provider reviews the security of its Subprocessors before engaging them and binds them by contract as Section 7 describes.

Annex 5: List of Subprocessors

Customer approves Provider's engagement of the following Subprocessors, as updated from time to time at https://thornstreet.com/subprocessors:

Subprocessor Location What it does
Amazon Web Services, Inc. United States (Oregon, us-west-2) Hosting, computing, databases, file storage and logs; email for sign-in codes and account messages (Amazon SES); AI text embeddings (Amazon Bedrock); maps, geocoding, places and routing (Amazon Location Service)
Anthropic, PBC United States The AI models that power Leif: the content of a user's threads is sent to them to carry out the user's requests
Stripe, Inc. United States Payments, subscriptions and invoices
Brave Software, Inc. United States Web search: the search queries Leif makes for a user
Perplexity AI, Inc. United States Web search: the search queries Leif makes for a user