Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms & Conditions (the "Terms") between LeafCraft Studios Private Limited ("LeafCraft", "we", "us") and the customer that accepts the Terms ("Customer", "you"). It sets out how we process Customer Content on your behalf.

Last updated: 27 October 2026

1. Scope and Roles

1.1 Definitions

• Customer Content means the data, prompts, documents, recordings, transcripts, messages and other material that you, your users or your systems submit to the Services, together with the outputs the Services generate from it, to the extent it contains personal data.
• Personal data, processing, Data Principal, Data Fiduciary and Data Processor have the meanings given in the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"). Where the GDPR applies, "Data Fiduciary" reads as "Controller", "Data Processor" as "Processor" and "Data Principal" as "Data Subject".
• Services means the LeafCraft products and services described in the Terms, including the LeafMesh framework and any hosted, voice or agent services we operate for you.
• Sub-processor means a third party that we engage to process Customer Content on our behalf.

1.2 Roles of the parties

For Customer Content, you are the Data Fiduciary (Controller) and LeafCraft is the Data Processor (Processor). You decide what Customer Content is submitted to the Services and why. We process it only to provide the Services to you.

This DPA does not apply to personal data that LeafCraft processes as a Data Fiduciary in its own right, such as your account and billing details or visits to our website. That processing is described in our Privacy Policy.

2. Processing on Documented Instructions

We process Customer Content only on your documented instructions. The Terms, this DPA, your configuration of the Services and your use of their features are your documented instructions. We will tell you if we believe an instruction breaks applicable data protection law.

Where a law we are subject to requires us to process Customer Content in another way, we will inform you of that requirement before processing, unless the law forbids us from doing so.

No model training. We do not use Customer Content to train, fine-tune or otherwise improve any machine learning or language model, whether our own or a third party's. Our LLM sub-processors are engaged on terms under which Customer Content is likewise not used for training.

3. Confidentiality of Staff

Only staff and contractors who need access to Customer Content to provide the Services are given access. Each of them is bound by a written confidentiality obligation that continues after their engagement ends, and receives data protection and security training.

4. Security Measures

We maintain technical and organisational measures appropriate to the risk of processing Customer Content. In summary, they include:

• Encryption of Customer Content in transit (TLS) and at rest.
• Multi-factor authentication for staff access to production systems and administrative consoles.
• Least-privilege access, granted per role, reviewed regularly and removed promptly when no longer needed.
• Logging and monitoring of access to production systems and of security-relevant events.
• Backups that are encrypted, access-controlled and tested for restoration.
• Secure development: code review, dependency and secret scanning, and separation of production from development environments.

We may update these measures over time, provided the update does not reduce the overall level of protection for Customer Content.

5. Sub-processors

You authorise us to engage the Sub-processors listed at leafcraft.ai/sub-processors. Each Sub-processor is bound by written terms that protect Customer Content to a standard no lower than this DPA. We remain responsible to you for the performance of our Sub-processors.

Before we add or replace a Sub-processor, we will email the notice address on your account at least 30 days in advance and update the list. If you reasonably object on data protection grounds within that period and we cannot resolve the objection, you may terminate the affected Services and we will refund any prepaid fees for the period after termination.

6. Assistance with Data Principal Requests

If a Data Principal (Data Subject) contacts us directly about Customer Content, we will not respond on the merits, except to refer them to you, unless the law requires otherwise. We will tell you about the request without undue delay.

Taking into account the nature of the processing, we will help you respond to requests to access, correct, erase, restrict or port personal data, and to withdraw consent, by making the Services' tools available and, where those are not enough, by reasonable additional assistance.

7. Personal Data Breach Notification

If we confirm a personal data breach affecting Customer Content, we will notify you without undue delay and in any event within 72 hours of confirming it. The notice will describe, as far as is known at the time, the nature of the breach, the categories and approximate number of Data Principals and records concerned, the likely consequences and the measures taken or proposed. We will provide further information as it becomes available.

We will cooperate reasonably with you in your own notifications to the Data Protection Board of India, any other supervisory authority, and affected Data Principals. Our notice to you is not an admission of fault or liability.

8. Deletion or Return of Customer Content

During the term, you may export Customer Content through the Services' export features or by written request. Within 30 days after termination or expiry of the Services, we will, at your choice, return Customer Content to you in a commonly used format or delete it, and will confirm deletion in writing on request.

Copies held in encrypted backups are purged in the normal backup rotation within a further 30 days. Until then they remain protected by this DPA and are not restored except as needed to recover from a system failure. We may retain Customer Content for longer only where a law requires it, for as long as that law requires.

9. Audits

On written request, no more than once in any 12-month period, we will make available the information reasonably needed to show that we comply with this DPA. We meet this obligation by providing our most recent independent third-party audit report, such as a SOC 2 report, under confidentiality, together with written answers to reasonable follow-up questions.

If a supervisory authority requires it, or if the report does not reasonably address a specific concern, you may conduct an audit on 30 days' written notice, during business hours, in a way that does not disrupt the Services, and subject to our confidentiality and security requirements. You bear the cost of any such audit unless it reveals a material breach of this DPA.

10. Governing Law and International Transfers

This DPA is governed by the laws of India, including the DPDP Act and the rules made under it. Disputes are resolved as set out in the Terms.

Customer Content is processed in the locations shown on the sub-processor list. We will not transfer Customer Content to a country that the Central Government of India has restricted for transfer under the DPDP Act.

Where the GDPR or the UK GDPR applies to Customer Content, the Standard Contractual Clauses approved by the European Commission (Module Two, controller to processor), and the UK International Data Transfer Addendum where relevant, are incorporated into this DPA by reference and take precedence over it in the event of conflict. The parties' details and the description of processing in this DPA and the Terms complete the annexes of those clauses.

11. General

• This DPA takes precedence over the Terms to the extent they conflict about the processing of Customer Content.
• Our liability under this DPA is subject to the limitations of liability in the Terms.
• We may update this DPA to reflect changes in law or in the Services. Material changes are notified by email at least 30 days before they take effect; continued use after that date is acceptance.
• This DPA ends when the Services end, except for obligations that by their nature continue, including Sections 3, 8 and 9.

12. Contact

For questions about this DPA, to give notice under it, or to update the notice address on your account: