itogai Data Processing Agreement

Effective Date: October 15, 2026 for any Account created on or after that date. For an Account existing on that date, this version takes effect thirty (30) days after itogai gives notice under the Customer Terms of Service, and the version in effect before this one governs until then. Last Modified: October 15, 2026 Document Version: DPA-2026-10-15 v5.1

This Data Processing Agreement (“DPA”) forms part of the Customer Terms of Service (the “Agreement”) between Itogai LLC (“itogai”) and the Customer, and governs itogai’s processing of Personal Data on the Customer’s behalf.

This DPA is incorporated automatically when the Customer creates an Account or pays any fee, and applies whenever itogai processes Customer Personal Data as a Processor. A Customer requiring a countersigned counterpart may request one at legal@itogai.com.

1. Definitions

1.1 “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “processing” and “supervisory authority” have the meanings given in the GDPR, and equivalent terms under other Data Protection Laws are read accordingly.

1.2 “Customer Personal Data” means Personal Data contained within Customer Data that itogai processes on the Customer’s behalf under the Agreement.

1.3 “Data Protection Laws” means all laws applicable to the processing of Personal Data under this DPA, including the GDPR, the UK GDPR, the Swiss FADP, the CCPA as amended, the LGPD, and other applicable United States state privacy laws.

1.4 “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as it forms part of United Kingdom domestic law, read with the UK Data Protection Act 2018. “UK Addendum” means the United Kingdom International Data Transfer Addendum to the SCCs, issued by the Information Commissioner’s Office under section 119A of that Act.

1.5 “SCCs” means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.

1.6 “Sub-processor” means a third party engaged by itogai to process Customer Personal Data.

1.7 “Subscription Service” has the meaning given in the Agreement and means the itogai relationship intelligence platform wherever and however it is accessed. This DPA applies to every surface on which the Subscription Service is delivered, including any surface added after the date of this DPA, and no amendment is required for it to do so. The Subscription Service is described as designed, whether or not a capability is enabled for a particular Account at a particular time, as the Agreement states.

1.8 “Registers” means the Sub-processors register, the AI Provider Register and the Product Surface Register, each published at itogai.app/legal and each incorporated into this DPA by reference. The page Supported sources and import methods, published at the same address, is informational and is not incorporated; Section 1.5 of the Agreement defines a Data Source by the way data enters an Account.

2. Roles and scope

2.1 Roles. With respect to Customer Personal Data, the Customer is the Controller and itogai is the Processor. Where the Customer is itself a Processor acting for a third-party Controller, itogai is a sub-processor, and the Customer warrants that it holds the authority to engage itogai on those terms.

2.2 Where itogai is a Controller. itogai acts as a Controller in respect of Account Data, Billing Data, Usage Data, Device and Log Data and its communications with the Customer. itogai is also the Controller of the shared copy of fields it obtains from data providers, which Section 5.8a of the Privacy Policy describes: it holds nothing the Customer brought in, saw in its own account or typed, and what the Customer receives from it becomes Customer Personal Data in the Customer’s own copy, under this DPA. The Privacy Policy governs the processing in this Section, and this DPA does not.

2.3 Groups. Where a Customer’s organization holds a Group, the organization is the Controller of the Group record and this DPA governs itogai’s processing of it. A Group makes visible business-card depth only: a contact’s name, employer, role, and the fact that a named colleague knows them. It does not expose relationship scores, communication metadata, message content, or the strength or history of any member’s relationship, and no setting widens it. A member contributes a contact by choosing to, member by member. A Group held by an organization pools derived, aggregate signals at Group level, scoped to that Group, where the organization has made contribution a condition of membership and the member joined on that condition, or where the member has opted in. A person outside any Group pools nothing. In either case a member’s individual relationship data stays with the member who observed it, and nothing pools across Groups.

2.4 Instructions. itogai processes Customer Personal Data only on the Customer’s documented instructions, which comprise the Agreement, this DPA, the Customer’s configuration of the Subscription Service, and any further written instruction the parties agree. itogai informs the Customer if, in itogai’s opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is resolved.

2.5 Duration. This DPA applies for as long as itogai processes Customer Personal Data.

3. itogai’s obligations as Processor

3.1 Compliance. itogai processes Customer Personal Data in accordance with Data Protection Laws and this DPA.

3.2 Confidentiality of personnel. Every person authorized to process Customer Personal Data is bound by confidentiality, contractually or by statute. Access is limited to itogai personnel and approved Sub-processors who need it, is role-restricted, and is logged. Every itogai contractor, and every member of itogai’s development partner’s staff, works inside systems Itogai LLC owns, under written terms that bind them to process Customer Personal Data only on itogai’s documented instructions as persons acting under itogai’s authority, to disclose it to nobody, to store none of it locally, to report a suspected incident within twenty-four (24) hours, and to return or delete everything and certify it on exit. itogai’s personnel access its production systems from the United States and from Colombia, and the Sub-processors register says so.

3.3 Security. itogai implements technical and organizational measures appropriate to the risk, including those in Annex II.

3.4 Content levels. itogai processes content at one of three levels, set per Data Source, stated by category in Section 7 of the Agreement and Section 4 of the Privacy Policy, and shown in the Subscription Service for each source the Customer has brought in:

Level	What happens
Level 1. Metadata only	Envelope metadata only is read and retained. Body content is never read and never stored. The default for every source
Level 2. Derived signal	Content is read in memory to extract relationship signal, then discarded. Only the derived signal persists
Level 3. Retained content	Raw text persists. Only where a person saves it by hand. No automated path writes to this level

Two commitments bind permanently: email message bodies never rise above Level 1, by any means; and a level is raised only on the Customer’s own consent for that specific source, never by default, by a product update, or by the addition of a new source. Email is read through each provider’s narrowest permission for message metadata, so the provider itself returns no body; Gmail’s restricted scope is held at Level 1 permanently; and the text of a message a User sends through their own account is deleted once the provider confirms the send.

3.5 Assistance with Data Subject requests. Taking into account the nature of the processing, itogai assists the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to requests for access, rectification, erasure, restriction, portability and objection.

Where a Data Subject contacts itogai directly about Customer Personal Data, itogai acknowledges receipt, promptly forwards the request to the Customer, and does not decide the substance of it, because that decision is the Customer’s to make as Controller.

Three things itogai does without waiting for the Customer, and the Customer instructs itogai to do them by accepting this DPA:

itogai tells the Data Subject which Customer holds their data, so that the person has somewhere to go, unless telling them would breach a legal obligation itogai owes.
Where the Customer does not respond within thirty (30) days of itogai forwarding a request, itogai suppresses the affected record so that it is no longer processed for relationship signals, and notifies the Customer that it has done so. The Customer may reverse the suppression by instructing itogai in writing that it holds a lawful basis for continuing.
itogai deletes, at once and in every Customer’s account, the enrichment results and profile completions it supplied about the Data Subject, together with the shared copy of Section 2.2, because itogai supplied those fields rather than the Customer.

These are standing instructions. They exist because a person who is not a customer should not be left with no route, and a Controller who does not answer should not become itogai’s reason for inaction.

3.6 Assistance with compliance. Taking into account the nature of the processing and the information available to it, itogai assists the Customer in complying with Articles 32 to 36 of the GDPR and equivalent provisions of other Data Protection Laws.

3.7 Personal Data Breach notification. itogai notifies the Customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. Where seventy-two hours is not feasible, itogai notifies as soon as reasonably possible with reasons for the delay, and in every case no later than ten (10) days after itogai determines that the breach occurred, which is the outer limit section 501.171 of the Florida Statutes sets for a third-party agent and which the seventy-two-hour commitment already satisfies. The notification includes, to the extent then known:

the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
its likely consequences;
the measures taken or proposed to address it and mitigate its effects; and
a point of contact at itogai for further information.

itogai may provide information in phases. A notification is not an admission of fault or liability.

3.8 Return or deletion. On termination of the Agreement or on the Customer’s earlier written request, itogai returns or deletes Customer Personal Data at the Customer’s election, subject to:

the thirty (30) day post-termination export window in the Agreement, during which the Customer may export its Customer Data in a structured, machine-readable format;
backup retention, under which backup copies are overwritten on rolling cycles within ninety (90) days; and
any retention applicable law requires, during which itogai continues to protect the data under this DPA.

Where itogai deletes, it deletes the data or irreversibly anonymizes it so that it can no longer be attributed to an identified or identifiable person. Where a record must persist for the integrity of surrounding data, itogai strips it of every identifier rather than removing the row, and the result cannot be re-linked by itogai, and itogai holds no key or auxiliary dataset that would permit re-linking. On written request itogai provides written confirmation.

3.9 Records and audit. itogai maintains records of processing to the extent Article 30(2) of the GDPR requires. On written request, and no more than once in any twelve (12) month period except where a supervisory authority requires it or where reasonably necessary to investigate a suspected Personal Data Breach, itogai makes available such information as is reasonably necessary to demonstrate compliance with this DPA. Responses may take the form of written summaries, completed security questionnaires, or third-party assessment reports where available. Where the Customer reasonably requires more after reviewing them, the parties agree in good faith the scope, timing and cost of an on-site audit, conducted at the Customer’s expense during regular business hours and subject to a confidentiality undertaking from the auditor satisfactory to itogai, acting reasonably. itogai responds to the initial written request within thirty (30) days.

3.10 Akai™ and model providers.

Akai does not send anything on the Customer’s behalf and takes no external action without a User’s review and explicit click to send. There is no configuration that produces one.
itogai engages a model provider only where that provider commits that Customer Personal Data will not be used to train the provider’s general-purpose models, and a provider that will not commit is not engaged. What each engaged provider has committed to, and the date itogai last verified it, is stated per provider in the AI Provider Register.
Email message bodies are never sent to any model provider, because the sources they would come from are held at Level 1 permanently.
Akai’s outputs are probabilistic and support rather than replace the Customer’s own judgment. A TrustGraph™ score is not an assessment of any person’s character, creditworthiness, employability or eligibility for any benefit, and may not be used as one.
itogai does not carry out automated decision-making producing legal or similarly significant effects on a Data Subject within the meaning of Article 22 of the GDPR, and does not enable the Customer to do so through the Subscription Service.
Nothing pooled across customers trains, tunes or calibrates the scoring model, and nothing received from Google feeds it or any model beyond the features of the Account it belongs to. What the scoring learns from an Account’s own data is used for that Account only and is deleted with the Account’s data.

4. The Customer’s obligations as Controller

4.1 Representations. The Customer represents and warrants that it has the legal right and authority to provide Customer Personal Data to itogai for the processing the Agreement contemplates; that it has given every notice and obtained every consent applicable Data Protection Laws require to enable itogai to process Customer Personal Data lawfully on its behalf; and that its instructions to itogai comply with applicable Data Protection Laws.

The Customer is responsible for the accuracy, quality and legality of Customer Personal Data, and for the means by which the Customer acquired it.

4.2 Obligations. The Customer shall:

determine the purposes and means of the processing of Customer Personal Data;
ensure it has a lawful basis for the processing it instructs, including for Personal Data about people who are not Users and for every person who appears in a conversation the Customer imports or reads on screen, and comply with the terms of the source service in producing any export or file and in connecting any account;
provide the notices and obtain the consents Data Protection Laws require, including any consent required before raising a Data Source to Level 2;
maintain its own records of processing to the extent required;
not submit any excluded category of data as Section 7.6 of the Agreement sets out, which covers the special categories in Article 9 of the GDPR and Sensitive Personal Information under the CCPA; and
respond to communications from Data Subjects and supervisory authorities, with itogai’s assistance under Section 3.

5. Sub-processors

5.1 General authorization. The Customer gives itogai general written authorization to engage Sub-processors, subject to this Section.

5.2 The register. itogai’s Sub-processors are listed in the Sub-processors register at itogai.app/legal/sub-processors, incorporated into this DPA by reference. The other Registers record model providers and surfaces respectively, on the same basis.

5.3 Notice and objection. The following definition governs, and is identical to the one in the Agreement, the Privacy Policy and every Register:

A change is material when it expands the categories of personal data processed, expands the purposes of processing, expands the categories of recipients, or reduces a right the customer holds.

A material change carries at least thirty (30) days’ advance notice, by publication and by email to the registered Account Owner. The Customer may object in writing to legal@itogai.com within thirty (30) days. itogai and the Customer discuss the objection in good faith, and if they cannot agree a path forward within a further thirty (30) days, the Customer may terminate the affected portion of the Subscription Service for material breach of this DPA, and itogai refunds prepaid fees attributable to the period after termination.

A routine change is published immediately with the register’s version incremented. Adding or replacing a Sub-processor is never a routine change: it always carries the advance notice above, and the Customer may object to it as above.

5.4 Sub-processor obligations. itogai enters into a written agreement with each Sub-processor imposing data protection obligations substantially equivalent to those imposed on itogai here. itogai remains responsible to the Customer for each Sub-processor’s acts and omissions to the same extent as for its own.

6. International transfers

6.1 itogai’s location. itogai is established in the United States. Customer Personal Data may be transferred to and processed in the United States and in other countries where itogai or a Sub-processor operates.

6.2 EEA, United Kingdom and Switzerland. Where itogai processes Customer Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP and transfers it to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and completed as set out in Annex III, together with the UK International Data Transfer Addendum and the Swiss adaptations. From the day the United States Department of Commerce lists Itogai LLC on the Data Privacy Framework List, a transfer the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework covers may also rest on that Framework, on the terms in Section 10.1a of the Privacy Policy; the SCCs remain incorporated for every transfer the Framework does not cover and take over in full for any transfer the Framework ceases to cover. Until that day itogai makes no claim of Framework participation.

6.3 Conflict. Where the SCCs conflict with any other term of this DPA or the Agreement, the SCCs govern as to the transfers they cover.

6.4 Brazil. Transfers from Brazil rely on Article 33 of the LGPD, including standard contractual clauses, necessity for performance of a contract with the Data Subject, and consent where applicable.

6.5 Transfer impact assessments. On the Customer’s reasonable written request, itogai provides reasonable assistance in carrying out any transfer impact assessment applicable Data Protection Law requires, including information about the legal regimes governing itogai’s and its Sub-processors’ processing locations, and about any government access request itogai has received.

6.6 Brazil, forward. Where the Autoridade Nacional de Proteção de Dados issues standard contractual clauses or another approved transfer instrument, the parties shall amend this DPA to incorporate it.

6.7 Government access. itogai has received no order requiring it to provide Customer Personal Data to a public authority in a manner incompatible with Data Protection Laws. Where itogai receives a legally binding request from a public authority for Customer Personal Data, itogai notifies the Customer unless prohibited by law, seeks to redirect the request to the Customer, challenges a request it considers unlawful or overbroad, and discloses only the minimum the request requires.

6.8 Colombia. Where the Customer is a responsable del tratamiento subject to Ley 1581 de 2012 and Decreto 1377 de 2013 and itogai processes Customer Personal Data on its behalf, itogai acts as encargado del tratamiento, and the transfer of that data to itogai in the United States is a transmisión under Article 25 of Decreto 1377 de 2013. This DPA is the contract that Article requires: itogai processes the data only for the purposes the Customer instructs and this DPA states, guarantees the safeguards in Annex II and the confidentiality in Section 3.2, complies with the duties Article 18 of Ley 1581 places on an encargado to the extent they apply to processing outside Colombia, assists the Customer in answering the titulares’ requests and the Superintendencia de Industria y Comercio’s inquiries, keeps the data for no longer than Section 3.8 states, and does not transfer it onward except to the Sub-processors this DPA authorizes. itogai is not established in Colombia, holds no database there and is not required to register in the Registro Nacional de Bases de Datos; nothing in this Section is an undertaking to register. The Customer remains the responsable and keeps the authorizations and the privacy notice that Ley 1581 requires of one.

6.9 Mexico. Where the Customer is a responsable subject to the Ley Federal de Protección de Datos Personales en Posesión de los Particulares published in the Diario Oficial de la Federación on March 20, 2025 and its Reglamento, itogai acts as encargado under Article 4, fraction II, of that Reglamento, and the disclosure of Customer Personal Data to itogai is a remisión that does not require the titular’s consent. itogai assumes the obligations the law and Article 50 of the Reglamento place on an encargado: to process the data only in accordance with the Customer’s instructions; to process it for no purpose other than the ones instructed; to implement the security measures the law requires, being those in Annex II; to keep the data confidential; to delete the data once the relationship ends or as the Customer instructs, subject to Section 3.8; and to transfer it to no one except as the Customer instructs or this DPA authorizes. The Customer remains the responsable and keeps the aviso de privacidad the law requires of one. The competent authority is the Secretaría Anticorrupción y Buen Gobierno. itogai has no establishment in Mexico and registers nothing there.

6.10 Peru. Where the Customer is a titular del banco de datos personales subject to Ley 29733 and its Reglamento, Decreto Supremo 016-2024-JUS, itogai acts as encargado de tratamiento and assumes the obligations that law and Reglamento place on one: to process the data only on the Customer’s instructions and for the purposes instructed, to apply the security measures in Annex II, to keep confidentiality, to assist the Customer with the titulares’ rights and with the Autoridad Nacional de Protección de Datos Personales, to notify the Customer of a security incident as Section 3.7 states so that the Customer can meet the Reglamento’s own notification period, and to return or delete the data as Section 3.8 states. The flow of Customer Personal Data to itogai in the United States is a cross-border flow on the terms of this DPA; the Customer, as titular del banco de datos, keeps the registration and reporting duties the law places on it, and itogai undertakes none of them in Peru. itogai has no establishment in Peru.

6.11 Chile. Where the Customer is a responsable de datos subject to Ley 19.628 and, from December 1, 2026, to Ley 21.719, itogai acts as mandatario (or encargado, as the law in force names it) and, from that date, assumes the obligations Ley 21.719 places on one: to process the data only on the Customer’s written instructions and for the purposes instructed, to apply the security measures in Annex II, to keep confidentiality, to assist the Customer with the titulares’ rights and with the Agencia de Protección de Datos Personales, to notify the Customer of a security incident as Section 3.7 states, and to delete or return the data as Section 3.8 states. The international transfer to itogai rests on this DPA as the contractual instrument that law recognizes. itogai has no establishment in Chile.

7. CCPA provisions

7.1 Service provider status. With respect to Personal Information subject to the CCPA, itogai is a service provider and the Customer is a business.

7.2 itogai’s undertakings. itogai shall not sell or share Personal Information; shall not retain, use or disclose it for any purpose other than performing the services specified in the Agreement, including for any commercial purpose of its own; shall not retain, use or disclose it outside the direct business relationship between itogai and the Customer; and shall not combine it with Personal Information received from another source, except as the CCPA permits a service provider to do. The shared copy of Section 2.2 is held apart from Customer Personal Data: nothing the Customer holds is written into it, it holds only professional fields obtained from data providers, and what it supplies to the Customer at the Customer’s request is copied into the Customer’s own copy and becomes the Customer’s own data.

7.3 Certification. itogai certifies that it understands the restrictions in Section 7.2 and will comply with them.

7.4 Assistance. itogai assists the Customer in responding to a verifiable consumer request and in meeting the Customer’s own CCPA obligations.

7.5 Notification of inability to comply. itogai shall notify the Customer promptly if itogai determines that it can no longer meet its obligations under the CCPA.

7.6 The Customer’s remedy. On written notice to itogai, the Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information by itogai.

7.7 Level of protection. itogai shall provide the same level of privacy protection with respect to Personal Information as the CCPA requires of a business.

8. LGPD provisions

With respect to Personal Data subject to the LGPD, itogai acts as an operador and the Customer as controlador.

itogai processes Personal Data only as the Customer instructs, adopts the security measures in Annex II, maintains records of processing in accordance with Article 37 of the LGPD, and assists the Customer in responding to communications from the Autoridade Nacional de Proteção de Dados at gov.br/anpd.

The Customer remains responsible for fulfilling data subject rights under Articles 17 to 22 of the LGPD, and itogai assists with them under Section 3.5 and notifies the Customer of any incident affecting Personal Data within the period Section 3.7 sets.

itogai’s designated privacy contact for LGPD purposes, being the encarregado, is reachable at privacy@itogai.com.

9. Liability

The limitations and exclusions of liability in the Agreement apply to this DPA and to any claim arising under it, and the Customer’s and itogai’s aggregate liability under the Agreement and this DPA together is subject to the single cap in the Agreement, except where Data Protection Laws provide otherwise and except as the SCCs require in respect of the transfers they cover.

For the avoidance of doubt: a claim brought by a Data Subject under the SCCs is not subject to that cap, to the extent the SCCs themselves give the Data Subject a separate basis of liability as a third-party beneficiary.

10. Term and termination

This DPA takes effect with the Agreement and terminates when the Agreement terminates and itogai has completed its obligations under Section 3.8. Sections 3.7, 3.8, 3.9, 6, 7, 9 and this Section survive.

11. Miscellaneous

11.1 Precedence. In the event of a conflict, this DPA governs over the Agreement as to the processing of Customer Personal Data on the Customer’s behalf, and the SCCs govern over this DPA as to the transfers they cover.

11.2 Changes. itogai may update this DPA where required by a change in Data Protection Law, by a supervisory authority, or by a change to the SCCs. Any other change that is material under the definition in Section 5.3 takes effect thirty (30) days after notice.

11.3 Severability and governing law. Severability follows the Agreement. This DPA and the Agreement are governed by the laws of the State of Florida and are subject to the dispute resolution provisions of Section 19 of the Agreement, and neither the governing law nor the jurisdiction is open to negotiation. One exception exists, because the instruments fix their own law and forum and cannot be varied: where the Standard Contractual Clauses apply under Section 6.2, they are governed by the law of Ireland under Clause 17 and disputes under them are resolved by the courts of Ireland under Clause 18; and where the UK International Data Transfer Addendum applies, it is governed by the laws of England and Wales and disputes under it are resolved by the courts of England and Wales. The exception reaches those two instruments alone and nothing else in this DPA or the Agreement.

11.4 Counterparts. This DPA may be executed in counterparts, and electronic acceptance is valid and effective.

Annex I: Description of the processing

Subject matter. Provision of the Subscription Service and any Professional Services to the Customer under the Agreement.

Duration. The term of the Agreement, plus the post-termination export window and the backup retention period in Section 3.8.

Nature of the processing. Hosting, storing, organizing, structuring, analyzing and surfacing Customer Personal Data through the TrustGraph scoring algorithm, TrustRings™ network organization, the TrustReach™ action layer and Akai; receiving Customer Personal Data from Data Sources the Customer authorizes; completing profiles with professional information from the sources Section 3.3 of the Privacy Policy names; computing relationship signals; and supporting outbound communication that a User composes, reviews and sends from the User’s own connected account. Akai drafts, surfaces and explains. Akai does not send.

Purpose. To provide the Subscription Service in accordance with the Customer’s documented instructions.

Categories of Data Subjects. (a) the Customer’s authorized Users; (b) the Customer’s contacts, including prospects, customers, partners, candidates and other relationship counterparts, whose details are imported or read from an authorized Data Source; (c) other natural persons referenced in an event or record accessed through an authorized Data Source; (d) the participants in, and the people named in, a conversation the Customer imports as a file or saves from its screen with the itogai companion, who are third parties that have no relationship with itogai; and (e) the contacts whose profiles are completed in an import the Customer starts, and the one person a User names to reach, whose professional information is completed as Section 3.3 of the Privacy Policy describes.

Categories of Personal Data. Name, work email address, phone number, employer, role, a birthday where the Customer records one, professional information (such as title, work history and education) and a professional web address, an email address or phone number that came with an archive the Customer imported, a work or mobile phone number from enrichment, communication envelope metadata being sender, recipient, timestamp and subject, calendar metadata, conversation metadata from an imported or on-screen conversation, being who took part, when, how often, in which conversation and in which direction, and the names and phone numbers shown for the people in it, structured signals derived from interactions, the circle a User places a contact in, text a User saves by hand at Level 3 including a note and the address and title of a page saved with it, audio a person records and submits for transcription, and enrichment results retained against a contact record.

No location is held for any contact. Body content of email messages is never read and never stored. Content from a source the Customer has consented to at Level 2 is read in memory to extract a relationship signal and then discarded, with only the derived signal retained.

Special categories of Personal Data. None are permitted. The Customer shall not submit special categories of Personal Data under Article 9 of the GDPR, or Sensitive Personal Information under the CCPA, and itogai processes none knowingly. A conversation the Customer imports or reads on screen may incidentally contain such content; itogai reads it only at the level the Customer consented to for that source, derives relationship signals, never stores the text, and never derives or retains a signal that reveals a special category.

Raw files. A file the Customer uploads is deleted as soon as it has been processed and within twenty-four (24) hours where processing fails or the Customer does not finish the steps; records derived from a source are deleted per import, per source on revocation of the content signals setting, and within thirty (30) days of Account deletion.

Frequency of transfer. Continuous for the term of the Agreement.

Retention. As set out in Section 11 of the Privacy Policy and Section 3.8 of this DPA.

Annex II: Technical and organizational measures

itogai maintains the following, and may update them provided the update does not reduce the overall level of security. Each measure is a control in itogai’s written control set. The controls are described in plain words on the security page at itogai.app/legal/security, and the policies that carry them, with the reference that traces each measure to its control, are available under a confidentiality agreement on request to legal@itogai.com.

Domain	Measures
Encryption	Encryption in transit and at rest using industry-standard encryption, currently TLS 1.2 or higher in transit and AES-256 at rest, on every datastore, backup and integration token; integration tokens and any key the Customer provides additionally encrypted at the application layer; keys rotated on suspected compromise and on the departure of anyone who could have read them. itogai does not describe this as end-to-end encryption, because it is not.
Tenant isolation	Multi-tenant architecture with logical isolation enforced at the database layer and verified automatically on every database change; no path serves one customer’s contact data to another except network sharing that the customer whose contacts it shows switched on, or a Group both belong to; the shared copy of fields obtained from data providers holds no customer’s contact data and serves an account only for a person it already holds.
Secrets	Secrets held only in a managed secrets store, scoped to the service that needs them, never in code, logs, tickets or a browser bundle; rotated on any exposure or departure.
Network and administrative access	No datastore reachable from the public internet, in any environment; administrative access to production restricted to named roles, protected by multi-factor authentication, logged and reviewed quarterly and after every incident.
Access control	Role-based access; least-privilege provisioning through an approved request; multi-factor authentication for every itogai administrative and tool account; quarterly access review recorded and signed; revocation of every access within one business day of offboarding, with secrets rotated.
Internal access to Customer Personal Data	Access through any internal operating console is role-restricted, logged, and limited to the purposes stated in the Privacy Policy; support views show counts and never message bodies, because none are stored.
Architecture controls	The three content levels in Section 3.4, applied per Data Source and stated by category in Section 4 of the Privacy Policy; email message bodies held at Level 1 permanently; a standing acceptance test on every build that fails the build where message content appears anywhere it must not be stored. Gmail’s restricted scope held at Level 1 permanently, which is the subject of itogai’s App Defense Alliance CASA verification at Assurance Level 1 (formerly Tier 2), renewed annually.
Connected accounts and sending	Mail read under metadata-only permissions; permission to send and to write events asked for only at first use; the text of a sent message deleted on the provider’s confirmation.
AI governance	No outbound message without a person’s review and click, and no auto-send path in code; scores and generated text presented as probabilistic support with a marker on every generated text; only providers in the AI Provider Register reachable, through a list fixed in configuration; every request inside a limit on the text it may carry, with no email bodies on any key and an opaque batch token in place of account identifiers whenever consented content transits a provider at import; AI tools used to build the Subscription Service never merge a change and hold no production secret.
Logging and monitoring	Audit logging of administrative and security-relevant events to an append-only trail with actor, time, object and action, retained twelve months, or until an investigation that implicates a log closes, including access to restricted fields, fee changes, introduction lifecycle events and other sensitive changes; never containing message bodies, tokens or secrets; production monitored for errors, availability and security signals with alerting to an on-call role and weekly triage.
Change management and secure development	Every change through required automated checks (build, tests, dependency and secret scanning, the acceptance test above), a review by someone other than the author, and a merge only by authorized engineers; separated development, preview and production environments with no production data outside production; vulnerabilities fixed on a severity clock.
Data classification, retention and disposal	Every category of Customer Personal Data classified with a handling, retention, access, deletion and permitted-recipient rule; one retention schedule whose windows are never longer than the Privacy Policy states; deletion cascading to backups, providers and analytics within the periods in Section 3.8 and the Privacy Policy Section 11; raw uploaded files deleted on processing.
Vendor management	Security and privacy review before engagement; a written agreement with every Sub-processor imposing obligations substantially equivalent to this DPA; the public Sub-processors register with locations and thirty days’ notice of additions and replacements; annual review of every vendor; monitoring of public security disclosures; preference for vendors publishing independent assessment reports and their own processor terms.
Incident response	A documented plan with severity levels, defined roles, a notification clock covering the Customer, the supervisory authorities and the individuals under every law that applies to itogai, a post-incident review, and an annual exercise; the notification obligation in Section 3.7.
Personnel	Confidentiality, security and processor obligations signed before access; a device baseline (full-disk encryption, screen lock, current operating system, multi-factor authentication) attested at onboarding and annually; security and privacy awareness on hire and annually; verification proportionate to the role before production access; the development partner bound as personnel inside Itogai LLC-owned systems.
Backups and continuity	Encrypted daily backups with rolling ninety-day retention as the Privacy Policy describes, restore-tested quarterly; a business continuity and disaster recovery plan with recovery objectives and named dependencies.
Governance and risk	Every policy with an owner role, a version, an approval date and a review date, reviewed at least annually; a risk register reviewed annually and on major change, with vendor and business-partner risk in scope; named roles for security, privacy and AI governance.
Truth in public statements	No certification, audit or attestation claimed before the report or certificate exists; every public statement about security and privacy true when published and afterwards.

What itogai does not hold. itogai is not certified under SOC 2 Type II or ISO/IEC 27001, and does not describe either as in progress or under way.

Annex III: Standard Contractual Clauses configuration

For transfers under Section 6.2, the parties complete the SCCs as follows.

Module. Module Two (Controller to Processor) where the Customer is a Controller, or Module Three (Processor to Processor) where the Customer is a Processor.
Clause 7 (Docking). Not used unless agreed in writing.
Clause 9 (Sub-processors). Option 2, general written authorization, with the notification period as set out in Section 5.3 of this DPA.
Clause 11 (Redress). The optional independent dispute resolution body language is not used.
Clause 17 (Governing law). The law of Ireland.
Clause 18 (Forum and jurisdiction). The courts of Ireland.
Annex I.A (Parties). itogai is the data importer; the Customer and its authorized Affiliates are the data exporter. Contact for itogai: privacy@itogai.com. Contact for the Customer: the address on the Account.
Annex I.B (Description of the transfer). As set out in Annex I to this DPA.
Annex I.C (Competent supervisory authority). The supervisory authority of the Member State in which the Customer is established. Where the Customer is not established in the EEA, the supervisory authority of the Member State in which the data subjects whose Personal Data is transferred are located.
Annex II (Technical and organisational measures). As set out in Annex II to this DPA.
Annex III (Sub-processors). As published at itogai.app/legal/sub-processors, which states for each Sub-processor its name, the service it provides, the categories of data it processes and its processing location; each Sub-processor’s registered address and contact route are available on request to legal@itogai.com.

United Kingdom. The UK International Data Transfer Addendum is incorporated, with the parties’ details as in Annex I, the version of the SCCs above, and an end date corresponding to termination of the Agreement. Either party may end the Addendum as set out in Section 19 of the Addendum.

Switzerland. References to a Member State are read as Switzerland where appropriate, references to the GDPR include the Swiss FADP, and the competent authority is the Federal Data Protection and Information Commissioner.

Annex IV: Complementary user entity controls

The measures in Annex II assume that the Customer runs the following controls for its own Account. They are the controls Section 2.6a of the Agreement names, together with three that Sections 8.8, 14.2 and 8.2 of the Agreement place on the Customer, restated here so that an assessment of itogai’s controls can state what it assumes of the Customer. Nothing in this Annex reduces any obligation itogai has under this DPA.

#	Control the Customer runs	Why it matters
CUEC-1	Keeps Account credentials confidential, uses them only through the Subscription Service, and never shares an Account between people	itogai never stores a password and cannot detect a shared credential
CUEC-2	Turns multi-factor authentication on for the Account Owner and for every User who administers a Team or a Group, and encourages it for every User	The identity provider offers it; only the Customer can turn it on for its Users
CUEC-3	Administers Team and Group membership, and removes a person who leaves the Customer or no longer needs access, promptly	itogai does not know when a User leaves the Customer
CUEC-4	Revokes a Data Source it no longer wants read, inside the Subscription Service or at the source, and reviews the sources connected to its Account from time to time	A connected source is read until it is revoked
CUEC-5	Brings in only the data Section 2.4a of the Agreement allows and keeps those warranties true for the life of the Account	itogai cannot know the Customer’s lawful basis for the people it brings in
CUEC-6	Reports a suspected compromise of an Account, a credential or a device used to reach the Subscription Service to legal@itogai.com as soon as it learns of it	The Section 3.7 clock and the Customer’s own clocks depend on it
CUEC-7	Reads the security and account notices itogai sends and acts on the ones that ask the Customer to do something	Notices of a sub-processor addition, a material change or an incident require the Customer’s decision
CUEC-8	Reviews every Akai output before acting on it or sending it	Section 8.5 of the Agreement; the human-in-the-loop rule is completed by the Customer’s review
CUEC-9	Where the Customer runs Akai on its own provider key, holds and maintains its own agreement with that provider	Section 8.8 of the Agreement; that traffic leaves under the Customer’s agreement
CUEC-10	Keeps its use of an account it connects within that service’s terms, and does not use the Subscription Service to get around a limit that service sets	Sections 2.4a and 14.2 of the Agreement; itogai reads such an account only to provide the Subscription Service to the Customer
CUEC-11	Treats each message its Users send from their own accounts as theirs, and keeps it within the law that governs it	Section 8.2 of the Agreement; the User who clicks send is the sender

Contact

Questions about this DPA, requests for a countersigned counterpart, sub-processor objections and audit requests: legal@itogai.com. Data Subject requests: privacy@itogai.com.

Postal address: Itogai LLC Attn: Privacy 4821 Jumping Way Lake Worth, Florida 33467 United States of America

Changelog

Amended October 15, 2026, version DPA-2026-10-15 v5.1. This is a material change, and for an Account existing on October 15, 2026 it takes effect thirty (30) days after notice. Section 2.2 records that itogai is the Controller of the shared copy of fields it buys from data providers, which holds nothing the Customer brought in, and Section 7.2 states that the shared copy is kept apart from Customer Personal Data and never combined with it. Section 3.4 states that email is read through each provider’s metadata-only permission and that sent text is deleted once the provider confirms the send. Section 3.10 adds that the scoring model learns inside one Account only. Section 4.2 adds the source service’s terms in connecting an account, as Section 2.4a of the Agreement already said. Annex I adds profile completion and sending from a User’s own account to the nature of the processing, the contacts whose profiles are completed and the person a User names to reach to the categories of Data Subjects, and the professional profile fields to the categories of Personal Data, and removes general location, which no contact record holds. Annex II describes network sharing and the shared copy under tenant isolation and adds a row for connected accounts and sending. Annex IV adds two controls the Customer runs.

What changed from DPA v2.0, May 11, 2026, and why.

The three content levels replace the two-architecture description, and Annex II follows.
Section 7 now carries the CCPA service provider terms the statute requires, including notification of inability to comply and the Customer’s right to stop and remediate.
Section 8 designates the LGPD encarregado, which the prior version named only in passing.
Section 6.5 adds transfer impact assessment cooperation and Section 6.7 adds a government access commitment.
Section 2.3 covers Groups (the shared container is called a Group in every document of this set, and a Team under Section 9.7 of the Customer Terms of Service is a billing arrangement, never a container), and Section 3.5 sets out what itogai does when a data subject contacts it directly, including the suppression fallback.
The training commitment is now stated as an engagement rule with a per-provider verified position, rather than as a blanket claim.

Also amended September 21, 2026, before first publication, on the security, privacy and AI governance layer. Section 3.2 states the written terms that bind every itogai contractor and the development partner’s staff, and discloses that itogai’s personnel access production systems from the United States and Colombia. Section 3.7 adds the ten-day outer limit that Florida’s Information Protection Act sets for a third-party agent. Section 6.2 adds the Data Privacy Framework line, operative from the listing date with the SCCs remaining for everything else. New Sections 6.8 to 6.11 carry the Colombia transmisión clause under Decreto 1377 de 2013, the Mexico encargado clause under the 2025 law and its Reglamento, the Peru encargado clause under Ley 29733 and DS 016-2024-JUS, and the Chile mandatario clause from December 1, 2026, and state that itogai registers nothing and establishes nothing in any of them. Section 11.3 states the governing law in full: Florida, non-negotiable, with the one exception the SCCs and the UK Addendum force. Annex II is restated as the control set by control ID, carrying every measure the prior text listed and adding secrets, network access, AI governance, change management, retention, continuity, governance and public-statement controls. New Annex IV lists the complementary user entity controls the Customer runs, mirroring Section 2.6a of the Agreement, and states that it reduces no obligation of itogai’s.

Also amended September 21, 2026, before first publication. Section 3.5 applies the suppression fallback to every forwarded request, matching Section 13.6 of the Privacy Policy, Annex I adds the participants in an imported or on-screen conversation to the categories of Data Subjects, conversation metadata to the categories of Personal Data, the treatment of incidental special-category content, and the deletion of raw files; Section 4.2 adds the Customer’s lawful basis for those people; and Section 1.8 records that the page Supported sources and import methods is informational and not incorporated. Also, Section 2.3 states the pooling defaults for a Group: a Group held by an organization pools derived, aggregate signals only where the organization made contribution a condition of membership or the member opted in, and a person outside any Group pools nothing unless they opt in.

A copy of the prior version is available on written request to legal@itogai.com.

Document version: DPA-2026-10-15 v5.1. Published at itogai.app/legal/data-processing-agreement.