Effective October 14, 2026

Data Processing Addendum

Standard business terms. This DPA is for a business customer (“Customer”) and Latent Ape LLC, a Tennessee limited liability company (“Processor”), for personal data processed through Bookmarqer on Customer’s behalf. It becomes binding only when both parties execute it or validly incorporate this version into a service agreement. It is not required merely to save personal bookmarks.

1. Scope and roles

Customer acts as controller, or as a processor authorized by its controller. Latent Ape acts as processor/subprocessor for Customer Content. Latent Ape acts separately as controller for account administration, security, billing if applicable, and legal compliance, as described in the Privacy Policy. Applicable data-protection law includes EU/UK GDPR where it applies and relevant US state privacy laws where their scope and thresholds apply.

2. Documented instructions

Processor shall process Customer Personal Data only on documented lawful instructions, including the agreement, this DPA, and Customer’s use/configuration of the Service, except as required by law. Processor shall inform Customer if an instruction appears unlawful and may pause that instruction. Customer is responsible for lawful collection, notices, permissions, accuracy, minimization, and recipients/integrations it authorizes.

3. Confidentiality and security

Processor shall restrict access to authorized personnel bound to confidentiality and implement risk-appropriate technical and organizational measures. The measures in Annex II apply to covered processing. Processor shall not sell/share Customer Personal Data for cross-context behavioral advertising, use it outside the agreed business purpose, or combine it with unrelated customer data except as permitted by law and the agreement. Use to train general-purpose models requires separate explicit authorization and may be prohibited by applicable platform rules.

4. Subprocessors

Customer grants general authorization only for the Annex III schedule incorporated into the Customer’s service agreement. Processor shall impose written protections no less protective for the entrusted processing and remains responsible for its subprocessors’ obligations. Processor shall provide at least 30 days’ advance notice of additions/replacements. Customer may object on reasonable data-protection grounds during that period; the parties shall seek a reasonable alternative, and Customer may terminate the affected processing if no resolution is available. Notices will be sent by email to Customer’s designated privacy or account contact.

5. Requests and assistance

Processor shall promptly forward data-subject requests concerning Customer Content, avoid responding substantively except on Customer’s instructions or as required by law, and reasonably assist with access, correction, deletion, portability, objections, impact assessments, and regulator consultations, considering the nature of processing and information available.

6. Personal-data breaches

Processor shall notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content, provide available information about its nature, likely consequences, and mitigation, and supplement information as investigation proceeds. Processor shall cooperate in containment and remediation. Notification is not an admission of liability. Customer controls notices to individuals/regulators unless law requires otherwise.

7. Return and deletion

On termination or Customer’s lawful instruction, Processor shall, at Customer’s choice, return or delete Customer Personal Data and delete existing copies unless retention is legally required. Customer Content is retained while the account remains open unless Customer instructs earlier deletion. Customer may request return through support@latentape.com before closing the account; the parties will arrange a commonly used machine-readable format. Account deletion blocks access and removes active database content, with object storage and external identity cleanup retried in the background without undue delay. Backup copies remain isolated from ordinary use until their applicable expiry and any restoration must reapply deletion records. A minimal deletion record may be retained to prevent stale sessions or jobs from recreating deleted data. Any additional customer-specific deadlines and backup requirements must be agreed in the service agreement before covered processing begins.

8. Compliance and audit

Processor shall make information reasonably needed to demonstrate compliance available and allow/contribute to audits by Customer or its independent auditor. Audits shall protect other customers’ data and system security and use reasonable notice and coordination, without limiting legally required access or regulator powers. Processor shall notify Customer if it can no longer meet its obligations and allow reasonable remediation or cessation of affected processing.

9. International transfers

Restricted transfers may occur only with a valid legal mechanism and required supplementary measures. This DPA alone does not incorporate EU Standard Contractual Clauses or a UK Addendum/IDTA. Before a restricted transfer begins, the parties shall agree and incorporate the required transfer instrument, parties, modules and annexes. If no applicable transfer mechanism is in place, the affected processing is not authorized. No EU-only hosting or certification is represented.

10. Priority and term

This DPA applies for the duration of covered processing. It prevails over inconsistent service terms for data-protection matters; mandatory transfer clauses prevail where applicable. Liability follows the executed service agreement and mandatory law. Amendments require agreement or a valid agreed change mechanism.

Annex I — Processing details

Customer: the entity, address, designated contact and role identified in the executed service agreement. Processor: Latent Ape LLC, Tennessee LLC; 937 Glendale, Nashville, TN 37204, United States; privacy contact: support@latentape.com. Subject/purpose: hosting a bookmark library and retrieving, summarizing, classifying, scoring and sending selected content. Operations: collection, storage, retrieval, analysis, organization, disclosure on instructions and deletion. Duration: service term plus agreed deletion/retention periods. Frequency: as users save/reprocess content and request scheduled email.

Data subjects: Customer users and people identified in Customer-submitted content. Data: account identifiers, URLs, titles, page/shared text, notes, project information, image content, generated results, interest profiles, revisit activity, recipients and operational records. Special categories: not intended or authorized; incidental sensitive content must be minimized and separately assessed. Customer must not submit regulated data without an approved written arrangement.

Annex II — Security measures

Implemented application controls include HTTPS, authenticated owner-scoped queries, OAuth authentication, iOS Keychain credential storage, restricted extension storage, server-side secrets, public-URL validation, and limited operational logs. Processor shall maintain appropriate access controls, personnel confidentiality, incident response and deletion procedures for covered processing. Recovery procedures must preserve deletion safeguards. Customer may request information about infrastructure, retention and vendor safeguards under section 8. This annex makes no SOC 2, ISO, HIPAA, or other certification claim.

Annex III — Subprocessors

The provider inventory identifies Bookmarqer’s infrastructure and feature providers. The parties shall incorporate a schedule identifying the authorized legal entities, processing locations, purposes and applicable transfer safeguards before Customer Personal Data is processed under this DPA. Providers not included in that agreed schedule are not authorized for Customer’s covered processing. X/FxTwitter and external source sites may act independently; Customer instructions must expressly cover retrieval involving these parties, or that retrieval must be excluded.

Execution

Customer authorized signatory: __________________ Date: __________
Latent Ape LLC authorized signatory: __________________ Date: __________