Data Processing Addendum

This Data Processing Addendum ("DPA") applies when Universal Syntax, LLC ("Universal Syntax", "we") processes personal data on behalf of a customer ("you") under the Initfinity Terms of Service (the "Terms"), and the GDPR, UK GDPR, Swiss FADP or similar data-protection law applies. It forms part of the Terms. Capitalised terms not defined here have the meaning given in the GDPR.

1. Roles and scope

You are the controller (or processor for your own customer) of personal data in Your Content; we are your processor. We process it only to provide the Service as described in the Terms and the Privacy Policy, and on your documented instructions (the Terms, your use of the features, and your written requests), unless law requires otherwise, in which case we tell you first where permitted. For account, billing, security and analytics data we use for our own purposes, we are an independent controller as the Privacy Policy describes.

2. Details of processing

• Subject matter and duration: providing the Service, for as long as your account exists plus the deletion periods in the Privacy Policy.
• Data subjects: you, your team members and users, and people whose data appears in your flows, files and messages.
• Types of data: account identifiers, content you store or process, execution payloads and results, and technical data, as described in the Privacy Policy.
• Special categories: the Service is not intended for sensitive data (see the Terms, section 2). You are responsible for what you put into your flows.

3. Our obligations

We will: (a) ensure people authorised to process the data are bound by confidentiality; (b) apply the technical and organisational measures in section 5; (c) help you respond to data-subject requests, taking into account the nature of the processing (the tools in the app, or privacy@initfinity.io); (d) help with security, breach notification, impact assessments and prior consultation where reasonably required; (e) tell you if we think an instruction breaks the law; and (f) make available information reasonably needed to show compliance, and allow audits as in section 7.

4. Subprocessors

You authorise the subprocessors listed at https://initfinity.io/subprocessors. We bind them to data-protection terms no less protective than this DPA and remain responsible for them. We will update that page and give at least 30 days' notice (by email or in the app) before adding or replacing a subprocessor. You may object on reasonable data-protection grounds within that period; if we cannot resolve it, you may terminate the affected service and receive a refund of prepaid fees for the unused period.

5. Security

We maintain measures appropriate to the risk, including encryption in transit; encryption of stored credentials; access controls and least-privilege staff access; hashed access tokens; sandboxed execution of user code; rate limiting and abuse monitoring; logging; and backups. We review them periodically.

6. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, with the information we reasonably have to help you meet your own obligations.

7. Audits

On reasonable written request, no more than once a year (unless a breach or regulator requires more), we will provide relevant documentation or third-party reports. If that is not enough, you may carry out an audit during business hours with 30 days' notice, under confidentiality, at your cost, without access to other customers' data or our security-sensitive systems.

8. International transfers

We process data in the United States and other countries where our subprocessors operate. For transfers of personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (EU Commission Decision 2021/914), which are incorporated by reference: Module Two (controller to processor), or Module Three where you act as processor, with Clause 7 (docking) included, Clause 9(a) option 2 (general authorisation, 30 days' notice), the optional wording of Clause 11 omitted, Clause 17 option 1 and Clause 18(b) governed by the law and courts of Ireland. Annex I is section 2 and your account details; Annex II is section 5; Annex III is the subprocessor list. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with references to the GDPR read as the Swiss FADP. Where available we also rely on a recipient's EU-U.S. Data Privacy Framework certification.

9. Return and deletion

When the Terms end, you can export your data; we delete Your Content according to the Privacy Policy retention periods, and delete remaining copies within 30 days after that, except what law requires us to keep.

10. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, to the extent the law allows. If this DPA conflicts with the Terms, this DPA prevails on data protection; if it conflicts with the Standard Contractual Clauses, the clauses prevail.

11. Contact

Universal Syntax, LLC, 701 South St. STE 100, Mountain Home, AR 72653, United States; privacy@initfinity.io. To have this DPA countersigned for your records, email legal@initfinity.io.

Last updated: November 7, 2026