Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions (or other similarly titled written or electronic agreement addressing the same subject matter, including any Order Form) (“Agreement”) between Customer (as defined in the Agreement), acting as the controller (“Controller”), and Keevs Health Inc., a Delaware corporation operating Documentation.AI (“Documentation.AI” or “Processor”), under which the Processor provides the Controller with the software and services (the “Services”). The Controller and the Processor are individually referred to as a “Party” and collectively as the “Parties”.

The Parties seek to implement this DPA to comply with the requirements of the EU GDPR (defined below) in relation to the Processor’s processing of Personal Data (as defined under the EU GDPR) as part of its obligations under the Agreement.

This DPA shall apply to the Processor’s processing of Personal Data provided by the Controller as part of the Processor’s obligations under the Agreement. It does not apply to personal data for which Documentation.AI is itself the controller (such as account administration, billing, security logs, and our own website analytics), which is covered by our Privacy Policy.

Except as modified below, the terms of the Agreement shall remain in full force and effect.

1. Definitions

Terms not otherwise defined herein shall have the meaning given to them in the EU GDPR or the Agreement. The following terms shall have the corresponding meanings assigned to them below:

1. “Data Transfer” means a transfer of the Personal Data from the Controller to the Processor, or between two establishments of the Processor, or with a Sub-processor by the Processor.
2. “EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
3. “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of Personal Data to third countries adopted by the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021, as incorporated by reference in Section 10 and completed by Schedule 1.
4. “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
5. “Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
6. “Sub-processor” means a processor or sub-contractor appointed by the Processor for the provision of all or parts of the Services that Processes the Personal Data provided by the Controller.
7. “Data Protection Laws” or “Data Privacy Laws” means the EU GDPR and, where applicable, the UK GDPR, the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection.

2. Purpose of this Agreement

This DPA sets out various obligations of the Processor in relation to the Processing of Personal Data and shall be limited to the Processor’s obligations under the Agreement. If there is a conflict between the provisions of the Agreement and this DPA, the provisions of this DPA shall prevail.

3. Categories of Personal Data and Data Subjects

The Controller authorizes the Processor to process the Personal Data to the extent determined and regulated by the Controller. The current nature of the Personal Data is specified in Annex I to Schedule 1 to this DPA.

4. Purpose of Processing

The objective of Processing of Personal Data by the Processor shall be limited to the Processor’s provision of the Services to the Controller, pursuant to the Agreement.

5. Duration of Processing

The Processor will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing by the Controller, and thereafter only as set out in Section 13.

6. Data Controller’s Obligations

1. The Data Controller warrants that it has all necessary rights to provide the Personal Data to the Data Processor for the Processing to be performed in relation to the agreed Services. To the extent required by Data Privacy Laws, the Data Controller is responsible for ensuring that it provides such Personal Data to the Data Processor based on an appropriate legal basis allowing lawful processing activities, including that any necessary Data Subject consents to this Processing are obtained, and for ensuring that a record of such consents is maintained. Should such consent be revoked by the Data Subject, the Data Controller is responsible for communicating the fact of such revocation to the Data Processor.
2. The Data Controller shall provide all natural persons from whom it collects Personal Data with the relevant privacy notice, including readers of documentation sites it publishes through the Services and any third-party analytics, chat, or custom scripts it enables on those sites.
3. The Data Controller shall request the Data Processor to purge Personal Data when required by the Data Controller or any Data Subject from whom it collects Personal Data, unless the Data Processor is otherwise required to retain the Personal Data by applicable law.
4. The Data Controller shall promptly advise the Data Processor in writing if it receives or learns of any:
   1. complaint or allegation indicating a violation of Data Privacy Laws regarding Personal Data;
   2. request from one or more individuals seeking to access, correct, or delete Personal Data;
   3. inquiry or complaint from one or more individuals relating to the collection, processing, use, or transfer of Personal Data; and
   4. regulatory request, search warrant, or other legal, regulatory, administrative, or governmental process seeking Personal Data,
   in each case to the extent it relates to the Processor’s Processing under this DPA.

7. Data Processor’s Obligations

1. The Processor will process Personal Data only on documented instructions received, including by email, from the Controller, its affiliates, agents, or personnel, with respect to the Processing of Personal Data (each, an “Instruction”), unless required to do otherwise by applicable law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information.
2. The Processing described in the Agreement and the related documentation, and the Controller’s configuration and use of the Services, shall be considered Instructions from the Controller.
3. At the Data Controller’s request, the Data Processor will provide reasonable assistance to the Data Controller in responding to and complying with requests by Data Subjects exercising their rights, and with directions of the applicable regulatory authorities, regarding the Data Processor’s Processing of Personal Data. If the Processor receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Controller, it will refer the Data Subject to the Controller and will not respond to the request except as instructed by the Controller or required by law.
4. Where shared Personal Data is transferred outside the Data Processor’s territorial boundaries, the transferor shall ensure that the recipient of such data is under contractual obligations to protect such Personal Data to the same or higher standards as those imposed under this DPA and the Data Protection Laws.
5. The Processor shall inform the Controller if, in its opinion, a processing Instruction infringes applicable legislation or regulation.
6. Taking into account the nature of the processing and the information available to the Data Processor, the Data Processor shall assist the Data Controller in conducting any necessary Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, as required under the EU GDPR.
7. The Processor will not use Personal Data processed on behalf of the Controller to train, or permit any Sub-processor to train, artificial intelligence models.

8. Data Secrecy

1. To Process the Personal Data, the Processor will use personnel who are (i) informed of the confidential nature of the Personal Data, (ii) bound by written confidentiality obligations, and (iii) perform the Services in accordance with the Agreement.
2. The Processor will ensure that individuals having access to Personal Data are regularly trained in data security and data privacy in accordance with accepted industry practice, and shall ensure that all the Personal Data is kept strictly confidential.
3. The Processor will maintain appropriate technical and organizational measures for the protection of the security, confidentiality, and integrity of the Personal Data, including the measures described in Annex II of Schedule 1.

9. Audit Rights

1. Upon the Controller’s reasonable request, the Processor will make available to the Controller the information reasonably necessary to demonstrate the Processor’s compliance with its obligations under the EU GDPR or other applicable laws in respect of its Processing of the Personal Data.
2. Where the Controller wishes to conduct an audit (by itself or through an independent representative bound by confidentiality) at the Processor’s site, it shall provide at least fifteen (15) days’ prior written notice to the Processor; the Processor will provide reasonable cooperation and assistance in relation to audits, including inspections, conducted by the Controller or its representative. Audits shall take place during normal business hours, no more than once in any twelve (12) month period unless required by a supervisory authority or following a Personal Data Breach, and in a manner that does not compromise the security or confidentiality of other customers’ data.
3. The Controller shall bear the expense of such an audit.

10. Mechanism of Data Transfers

The Processor and its Sub-processors process Personal Data in the United States and in the other locations listed in Annex III. Any Data Transfer for the purpose of Processing by the Processor in a country outside the European Economic Area (the “EEA”) that is not subject to an adequacy decision shall only take place in compliance with this Section 10 and Schedule 1.

1. EEA transfers. The Standard Contractual Clauses are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is itself a processor; Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Section 11; the optional wording in Clause 11 does not apply; under Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; under Clause 18(b), disputes shall be resolved before the courts of Ireland; and Annexes I, II, and III of the SCCs are completed by Annexes I, II, and III of Schedule 1.
2. UK transfers. For transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated by reference, with its Tables completed by the information in this DPA and Schedule 1; neither Party may end the Addendum under its Section 19 except as permitted by the Agreement.
3. Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the EU GDPR read as references to that Act, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.
4. Where the Processor is certified under the EU-U.S. Data Privacy Framework (or its UK or Swiss extensions) or another valid transfer mechanism applies, the Parties may rely on it. If the SCCs are amended or replaced, the Processor shall not unduly withhold execution of the updated clauses where the transfer of Personal Data outside the EEA is required for the performance of the Agreement.
5. In the event of a conflict between this DPA and the SCCs, the SCCs prevail.

11. Sub-processors

1. The Controller acknowledges and agrees that the Processor may engage third-party Sub-processors in connection with the performance of the Services, provided such Sub-processors are bound by written agreements that require them to take technical and organizational measures to ensure the confidentiality of Personal Data shared with them and that impose data protection obligations no less protective than those in this DPA. The current Sub-processors engaged by the Processor and approved by the Controller are listed in Annex III of Schedule 1 and on our subprocessors page. The Processor shall notify the Controller at least thirty (30) calendar days in advance of any intended changes or additions to its Sub-processors by updating that page and emailing notice of the intended change to Customer, except for emergency replacements, which the Processor will notify promptly thereafter. In accordance with Article 28(4) of the EU GDPR, the Processor shall remain liable to the Controller for any failure on behalf of a Sub-processor to fulfil its data protection obligations under the DPA in connection with the performance of the Services.
2. If the Controller has a concern that a Sub-processor’s Processing of Personal Data is reasonably likely to cause the Controller to breach its data protection obligations under the EU GDPR, the Controller may object to the Processor’s use of such Sub-processor by emailing supportdocumentation.ai with “Subprocessor Objection” in the subject within the notice period, and the Processor and Controller shall confer in good faith to address such concern. If the Parties cannot resolve the objection within thirty (30) days, the Controller may terminate the affected Services and receive a pro-rata refund of any prepaid fees for the terminated portion.

12. Personal Data Breach Notification

1. The Processor shall maintain defined procedures in case of a Personal Data Breach (as defined under the EU GDPR) and shall notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Controller.
2. The Processor shall provide the Controller with all reasonable assistance to comply with the notification of a Personal Data Breach to the Supervisory Authority and/or the Data Subjects, to identify the cause of such Personal Data Breach, and to take such commercially reasonable steps as reasonably required to mitigate and remedy such Personal Data Breach. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed.
3. No Acknowledgement of Fault by Processor. The Processor’s notification of or response to a Personal Data Breach under this DPA will not be construed as an acknowledgement by the Processor of any fault or liability with respect to the data incident.

13. Return and Deletion of Personal Data

1. Within thirty (30) days from the end of the Agreement or cessation of the Processor’s Services under the Agreement, whichever occurs earlier, the Processor shall, at the Controller’s choice, return to the Controller all the Personal Data or delete it. The Processor shall return such Personal Data in a commonly used format or in the format in which it was stored, at the discretion of the Controller, as soon as reasonably practicable following receipt of the Controller’s notification. Customers may also export documentation content at any time through the Git integration and export analytics data from the dashboard.
2. In any case, the Processor shall delete Personal Data, including all copies of it, as soon as reasonably practicable following the end of the Agreement, except to the extent retention is required by applicable law. Copies held in backups will be deleted in the ordinary course of the backup cycle and will remain protected by this DPA until deleted.

14. Technical and Organizational Measures

Having regard to the state of technological development and the cost of implementing any measures, the Processor will take appropriate technical and organizational measures against the unauthorized or unlawful processing of Personal Data and against the accidental loss or destruction of, or damage to, Personal Data to ensure a level of security appropriate to: (a) the harm that might result from unauthorized or unlawful processing or accidental loss, destruction or damage; and (b) the nature of the data to be protected, including the measures stated in Annex II of Schedule 1. The Processor will not materially reduce the overall level of these measures during the term of the Agreement.

Schedule 1

Annex I

A. List of parties

Data exporter(s)

• Name: Customer (as set forth in the Agreement or the relevant Order Form).
• Address: As set forth in the Agreement or the relevant Order Form.
• Contact person’s name, position, and contact details: As set forth in the Agreement or the relevant Order Form, or the account owner’s details in the Services.
• Activities relevant to the data transferred under these Clauses: Recipient of the Services provided by Keevs Health Inc. in accordance with the Agreement.
• Signature and date: Signature and date are set out in the Agreement. Acceptance of the Agreement constitutes execution of this DPA and the SCCs.
• Role (controller/processor): Controller (or processor, where Customer processes Personal Data on behalf of its own customers).

Data importer(s)

• Name: Keevs Health Inc. (Documentation.AI)
• Address: 2925 Manor Bridge Drive, Alpharetta, GA 30004, USA
• Contact person’s name, position, and contact details: Privacy contact, Keevs Health Inc., supportdocumentation.ai
• Activities relevant to the data transferred under these Clauses: Provision of the Services to the Customer in accordance with the Agreement.
• Signature and date: Signature and date are set out in the Agreement.
• Role (controller/processor): Processor.

B. Description of transfer

Categories of data subjects whose personal data is transferred

• Customer’s authorized users of the Services (account owners, admins, editors, and viewers).
• Readers of documentation sites that Customer publishes through the Services.
• Individuals whose personal data Customer includes in its documentation content (“Customer Content”).

Categories of personal data transferred

• User account data: name, email address, profile picture, user ID, organization membership and role, authentication and session metadata.
• Integration data: Git provider account name and avatar, commit metadata (author names, commit messages), and encrypted access credentials.
• Reader usage data: session identifier, pages viewed, page titles, timestamps, time on page, referrer, user agent, and viewport size; IP address, processed for delivery, security, and rate limiting.
• Authenticated reader data (only where Customer enables password, JWT, or OAuth access): the identity claims Customer configures, such as first name, company, and access roles.
• Ask AI and feedback data: questions and messages readers submit to Ask AI, and page feedback (rating and optional free-text comment).
• Customer Content: any personal data Customer chooses to include in pages, images, files, and API specifications.
• Usage and billing metadata: AI credit usage and request identifiers associated with the Customer account.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved

None. The Services are not designed to process special categories of personal data, and under the Agreement Customer must not submit such data unless expressly permitted in writing.

The frequency of the transfer

Continuous basis, for the duration of the Agreement.

Nature of the processing

Collection, storage, hosting, organization, indexing, retrieval, transmission, and deletion of Personal Data in order to provide the Services, including: authoring, version control, and publishing of documentation sites; full-text and semantic search; AI-assisted writing and AI-generated answers to reader questions using retrieval over Customer Content; documentation analytics and page feedback; access control for private documentation; usage metering; and customer support.

Purpose(s) of the data transfer and further processing

The purpose of the transfer is to facilitate the performance of the Services more fully described in the Agreement and accompanying Order Forms.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

For the duration of the Agreement, unless deleted earlier by Customer through the Services or on Customer’s request, and thereafter as set out in Section 13. Ask AI conversations are processed transiently to generate a response and are not stored by the Processor, other than question text retained in Customer’s analytics.

For transfers to (sub-)processors, also specify subject matter, nature, and duration of the processing

As set out in Annex III, for the duration of the Agreement. Sub-processors process Personal Data only to the extent necessary to provide their part of the Services.

C. Competent supervisory authority

The competent supervisory authority is determined in accordance with Clause 13 of the SCCs: where the data exporter is established in an EU Member State, the supervisory authority of that Member State; where the data exporter is not established in the EU but has appointed a representative under Article 27(1) of the EU GDPR, the supervisory authority of the Member State in which the representative is established; and otherwise, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located. For UK transfers, the UK Information Commissioner’s Office; for Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Annex II

Technical and organisational measures, including technical and organisational measures to ensure the security of the data

Description of the technical and organisational security measures implemented by Keevs Health Inc. as the data processor/data importer to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Security organization and policies

• Organization. Keevs Health Inc. designates personnel responsible for the security of the Services and for responding to security incidents.
• Standards. Keevs Health Inc. operates an information security management system aligned with ISO/IEC 27001:2022 and is in the process of obtaining formal certification.
• Vendor management. Keevs Health Inc. engages Sub-processors under written agreements with data protection terms and reviews their security and privacy commitments before engaging them (see Annex III).
• Incident management. Keevs Health Inc. maintains incident response procedures, including escalation, containment, root-cause analysis, corrective action, and notification of Customers in accordance with Section 12.

Personnel security

• Personnel with access to Customer Personal Data are bound by written confidentiality obligations and are required to protect Customer Personal Data at all times.
• Keevs Health Inc. conducts background checks on personnel who will have access to Customer Personal Data, to the extent legally permissible and in accordance with applicable local law.
• Personnel receive privacy and security training when they join and periodically thereafter, and must acknowledge Keevs Health Inc.’s confidentiality, privacy, and security policies.
• Personnel will not process Customer Personal Data without authorization.

Access controls

• Least privilege. Access to production systems and Customer Personal Data is limited to authorized personnel with a need to know, using individual accounts. Multi-factor authentication is required for personnel access to production systems and administrative consoles.
• Customer access. Customer users authenticate through a central authentication service (Clerk). Access within a workspace is governed by roles (admin, editor, viewer).
• Private documentation. Customers can restrict published documentation with password, JWT, or OAuth 2.0/OIDC authentication, and can limit pages, search results, and AI answers by reader access role.
• Abuse prevention. Public endpoints, including Ask AI, are protected by rate limiting and bot detection.

Infrastructure and network security

• Infrastructure. The Services run on established cloud providers: Render (application services), Vercel (dashboard and published sites), Supabase (database), and Cloudflare (object storage and CDN), in the United States, as listed in Annex III.
• Environment separation. Production and non-production environments use separate infrastructure and credentials. Production Customer Personal Data is not copied into non-production environments.
• Resilience and backups. Customer data is stored on managed cloud services whose providers handle backups and replication, including automatic backups of the production database, to protect against accidental loss.
• Logging. Application and system logs are collected centrally to support troubleshooting, security monitoring, and investigation of incidents.
• Change management. Code changes are tracked in version control and deployed to production through automated pipelines.

Encryption

• In transit. Data is transmitted over HTTPS/TLS between users, the Services, and Sub-processors, including TLS-encrypted database connections.
• At rest. Data is encrypted at rest by the database, object storage, and cache providers.
• Application-level encryption. Git provider credentials and deployment secrets are additionally encrypted by the application before storage.

Data isolation, AI processing, and deletion

• Tenant isolation. The Services are multi-tenant. Customer data is logically isolated by organization: database queries are scoped by organization, stored files are partitioned by organization and documentation, and search and vector data is kept in a separate namespace per organization.
• AI processing. AI model providers receive only the content needed to answer a request. Customer Personal Data is not used to train AI models, and Ask AI conversations are not stored by the Processor.
• Deletion. Customers can delete pages, members, and documentation sites in the Services, and can request deletion of their data in accordance with Section 13.

Annex III

List of sub-processors

The Controller has authorized the use of the following sub-processors:

The current list, with safeguards for each provider, is maintained at documentation.ai/legal/subprocessors.

Contact

Questions about this DPA, requests for a countersigned copy, and subprocessor objections: supportdocumentation.ai.

Keevs Health Inc. (Documentation.AI)
2925 Manor Bridge Drive, Alpharetta, GA 30004, USA