Data Processing Addendum

1. Applicability & roles

This Data Processing Addendum ("DPA") forms part of, and is incorporated into, the agreement between you ("Customer") and Metatrix Labs governing your use of the metatrix.ai platform and the "Max" model, image, vision, video, 3D, terminal, and real-time services (together, the "Services"). It applies whenever Metatrix Labs processes personal information on Customer's behalf in the course of providing the Services.

For the personal information Metatrix Labs processes on Customer's behalf: Customer acts as the controller (the "organization" that determines the purposes and means of processing), and Metatrix Labs acts as the processor / service provider that processes personal information solely on Customer's behalf. The sub-processors listed in Section 8 process personal information under Metatrix Labs' instruction. Where Metatrix Labs determines its own purposes (for example, account administration, billing, security, and improving the reliability of the Services in aggregate), Metatrix Labs acts as controller and the Privacy Policy applies to that processing.

This DPA supplements the Terms of Service. Where this DPA conflicts with the Terms of Service on matters of data protection, this DPA prevails (see Section 14).

2. Definitions

Terms used in this DPA carry the meaning given to them under applicable data-protection law, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), and, where it applies, the EU and UK General Data Protection Regulation ("GDPR").

"Personal information" / "personal data" means information about an identifiable individual, as those terms are defined under PIPEDA, Law 25, and the GDPR respectively. "Processing" means any operation performed on personal data, whether or not by automated means (collection, use, storage, disclosure, transfer, deletion, and similar). "Data subject" / "individual" / "concerned person" means the individual to whom personal data relates. "Controller" corresponds to the "organization" under PIPEDA and Law 25 and the "controller" under the GDPR. "Processor" corresponds to a "service provider" under Law 25 and a "processor" under the GDPR. "Sub-processor" means a third party engaged by Metatrix Labs to process personal data on Customer's behalf. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses adopted by the European Commission for the transfer of personal data to third countries, together with the UK International Data Transfer Addendum where UK data is transferred.

3. Scope, nature, purpose & duration of processing

Subject-matter and nature. Metatrix Labs processes personal data to host, operate, secure, and deliver the Services: authenticating accounts, storing creations and application data, running AI inference (text, image, and vision), generating video, 3D, and upscaled media, relaying real-time video and voice, executing sandboxed terminal sessions, and returning results to Customer and its authorized end users.

Purpose. Processing is carried out for the sole purpose of providing the Services in accordance with Customer's documented instructions and this DPA.

Duration. Processing continues for the term of the underlying agreement and for as long as Metatrix Labs provides the Services, followed by return or deletion of personal data in accordance with Section 13.

4. Categories of personal data & data subjects

Categories of data subjects: Customer's authorized users and account holders, and individuals whose personal data appears in prompts, uploads, camera scenes, voice, or other content that Customer or its users submit to the Services.

Categories of personal data: account email and account identifiers; prompts and uploaded content; generated creations and media; the iomx_session session identifier; camera images (processed for scene description only, not stored as identifying imagery); voice; WebRTC connection data; location; and device, log, and IP data. Customer controls what content it submits; Customer should not submit special categories of personal data unless it has a lawful basis to do so.

5. Processor obligations

Metatrix Labs will:

(a) process personal data only on Customer's documented instructions — including the instructions set out in the underlying agreement, this DPA, and Customer's configuration and use of the Services — and to the extent necessary to provide the Services, except where required to act otherwise by applicable law (in which case Metatrix Labs will inform Customer of that legal requirement before processing, unless the law prohibits such notice);

(b) not sell personal data and not retain, use, or disclose personal data for any purpose other than providing the Services or as otherwise permitted under applicable law;

(c) ensure that personnel authorized to process personal data are bound by appropriate obligations of confidentiality and are trained to handle personal data in line with this DPA;

(d) implement and maintain the technical and organizational security measures described in Section 6; and

(e) promptly inform Customer if, in Metatrix Labs' opinion, an instruction from Customer infringes applicable data-protection law.

6. Security measures

Metatrix Labs maintains technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including:

• Encryption in transit and at rest — personal data is encrypted in transit using current TLS, and data stored in the database and media storage is encrypted at rest.
• Access controls & least privilege — access to production systems and personal data is restricted to authorized personnel on a need-to-know basis, with authentication controls and role-based, least-privilege permissions.
• Network isolation — production environments are logically segregated, and the terminal runs in a sandboxed, isolated execution environment to contain untrusted input and output.
• Logging & monitoring — system, request, and security events are logged and monitored to detect and respond to anomalous or unauthorized activity.
• Reputable cloud infrastructure — the Services run on established cloud providers (identified in Section 8) that maintain their own physical, network, and operational security controls and recognized security certifications.

7. Sub-processing

Customer authorizes Metatrix Labs to engage the sub-processors listed in Section 8 to process personal data in connection with the Services. Metatrix Labs enters into written agreements with each sub-processor imposing data-protection obligations that provide a comparable level of protection to those in this DPA. Metatrix Labs remains responsible to Customer for the performance of its sub-processors' obligations.

Metatrix Labs will give Customer advance notice of any intended addition or replacement of a sub-processor. Customer may object on reasonable data-protection grounds; if Customer and Metatrix Labs cannot resolve the objection, Customer may terminate the affected Services as its exclusive remedy.

8. Sub-processor list

Sub-processor	Service / role	Data handled	Location
Cloudflare	AI inference (Max model, image model, vision model); media storage; real-time video/voice relay	Prompts, images, camera frames, generated media, connection/log data	Global edge, incl. US
fal.ai	Video, 3D, and upscale generation	Prompts and images	United States
Vercel	Hosting / front-door and sandboxed terminal	Request/log/IP data, terminal input and output	United States
Supabase (on AWS)	Database — accounts, creations, application data	Email, creations, session id	Canada, ca-central-1
Google	OAuth sign-in	Email, Google account ID	US / global

9. International transfers

Account, creation, and application data held in the database is stored in Canada (ca-central-1). Other processing — AI inference, generation, hosting, real-time relay, and OAuth sign-in — may involve transfer to and processing in the United States and at global edge locations, as indicated in Section 8.

For transfers of personal data outside Canada, Metatrix Labs relies on contractual measures with its sub-processors that provide a comparable level of protection to that required under PIPEDA. For personal information originating in Quebec, transfers outside Quebec are subject to a privacy-impact assessment addressing the factors set out in section 17 of Law 25, including the sensitivity of the information, the purposes of its use, and the protective measures — contractual and otherwise — that apply to it. Where personal data protected by the EU/EEA or UK GDPR is processed, Metatrix Labs and the relevant sub-processors rely on the European Commission's Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum) as the transfer mechanism, together with supplementary technical measures such as encryption.

10. Assistance

Taking into account the nature of the processing and the information available to it, Metatrix Labs will provide reasonable assistance to help Customer:

(a) respond to requests from data subjects to exercise their rights of access, correction, deletion, portability, and similar rights under applicable data-protection law; and

(b) meet its obligations regarding security of processing, breach notification, privacy-impact and Law 25 assessments, and consultation with supervisory authorities. Where Metatrix Labs receives a data-subject request directed at Customer's data, it will, unless legally required to respond, refer the request to Customer.

11. Personal-data-breach notification

Metatrix Labs will notify Customer without undue delay after becoming aware of a personal-data breach affecting personal data processed on Customer's behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate volume of personal data and data subjects concerned, the likely consequences, and the measures taken or proposed to address it. Metatrix Labs will cooperate reasonably with Customer so that Customer can meet its own breach-notification obligations to individuals and regulators.

12. Audit

Metatrix Labs will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including relevant sub-processor certifications and summaries of its security measures. Where Customer reasonably requires further information to satisfy an audit obligation under applicable data-protection law, the parties will cooperate in good faith to agree on the scope, timing, and confidentiality of that review, conducted in a manner that does not compromise the security or confidentiality of other customers' data.

13. Return or deletion of personal data

On termination or expiry of the Services, and at Customer's choice, Metatrix Labs will return or delete the personal data it processes on Customer's behalf, and delete existing copies, unless applicable law requires continued retention. Personal data held in the database and media storage is deleted in accordance with the retention practices described in the Privacy Policy. Residual copies retained in routine backups are deleted in the ordinary course of the backup cycle and remain protected by the security measures in Section 6 until deleted.

14. Liability & order of precedence

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the underlying agreement. In the event of a conflict between this DPA and the Terms of Service or any other agreement between the parties, this DPA prevails to the extent of the conflict on matters of data protection. All other terms of the underlying agreement remain in full force.

15. Contact

Questions about this DPA, sub-processor notices, or data-processing matters may be directed to Metatrix Labs at support@metatrix.ai. See also the Privacy Policy and Cookies Policy.