Data Processing Agreement
Last updated: October 28, 2026
This Data Processing Agreement ("DPA"), including its schedules, forms part of the binding agreement ("Agreement") between Strukt Corporation, operating as 4loop ("Provider"), and the applicable customer ("Customer"), where incorporated into that Agreement. This DPA applies only where Provider processes Customer Personal Data on Customer's behalf in providing the Service. This DPA applies to Customers using the Service for business purposes. It does not apply to individuals using the Service for personal, family, or household purposes; the Privacy Policy covers them.
Definitions
These definitions apply wherever the corresponding terms appear in this document.
“Agreement” means the Terms and any signed Enterprise or master services agreement between Customer and Provider, together with the DPA where it applies.
“Applicable Data Protection Laws” means privacy and data-protection laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, where applicable, British Columbia's Personal Information Protection Act, Canada's Personal Information Protection and Electronic Documents Act, the EU GDPR, the UK GDPR, and the California Consumer Privacy Act, in each case only to the extent applicable.
“Authorized User” means an individual whom Customer permits to access or use the Service under Customer's account, role assignments, or other permitted access arrangements, including personnel and reviewers where authorized by the Agreement. Customer remains responsible for the permissions and activities of its Authorized Users.
“Content” means information, text, documents, graphics, files, data, prompts, inputs, outputs, review materials, communications, and other materials posted, linked, stored, shared, submitted, generated, received, or otherwise made available through the Service.
“Controller” means a person or organization that determines the purposes and means of Processing Personal Data, or the corresponding role under Applicable Data Protection Laws, in each case to the extent the relevant law applies.
“Customer” means the customer identified in the Agreement.
“Customer Content” means Content that Customer or its Authorized Users post, link, store, share, submit, generate, receive, or otherwise make available through the Service, including task submissions, source materials, prompts, files, generated outputs, review comments, decisions, and related workflow materials. Customer Content does not include Provider-owned Service software, models, interfaces, or infrastructure merely because Customer can access them.
“Customer Personal Data” means Personal Data that Provider Processes on Customer's behalf through the Service, including Personal Data in submitted materials, generated outputs, review records, and related Service records. It excludes Provider-controlled marketing, billing, account-administration, business-relationship, security-telemetry, and fraud-prevention records only where Provider acts as an independent Controller for those records and Applicable Data Protection Laws permit. Aggregated or deidentified analytics are excluded only where they do not constitute Personal Data under applicable law. A record's operational classification does not exclude Personal Data Processed on Customer's behalf.
“Customer Provider” means an AI provider or other third-party product or service that Customer independently selects and contracts with, and connects to the Service through Customer-controlled accounts, credentials, endpoints, or configurations. A third party appointed by Provider to Process Customer Personal Data on Provider's behalf is not a Customer Provider for that Processing merely because Customer enables the related feature.
“DPA” means Provider's Data Processing Agreement available at https://www.4loop.ai/dpa, including its schedules, which forms part of the applicable Agreement where Provider Processes Customer Personal Data on Customer's behalf.
“Feedback” means suggestions, ideas, comments, feature requests, error reports, and other feedback that Customer intentionally provides concerning the Service. Materials submitted solely for processing as Customer Content do not become Feedback merely because they are submitted through the Service.
“MCP” means Model Context Protocol, a protocol that can be used to connect AI-enabled systems to authorized tools, integrations, and data sources.
“Personal Data” means information relating to an identified or identifiable individual, or information otherwise treated as personal data or personal information under applicable privacy law. The terms 'personal data' and 'personal information' are used interchangeably where the context permits.
“Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, within the scope of Applicable Data Protection Laws.
“Processing” means any operation performed on Personal Data, such as collecting, recording, organizing, storing, accessing, using, analyzing, transmitting, disclosing, modifying, restricting, returning, or deleting it, whether by automated means or otherwise. 'Process' and 'Processed' have corresponding meanings.
“Processor” means a person or organization that Processes Personal Data on behalf of a Controller, or the corresponding role under Applicable Data Protection Laws, in each case to the extent the relevant law applies.
“Provider” means Strukt Corporation, a Delaware corporation operating as 4loop, with its head office at 6129 River Rd, Port Alberni, British Columbia V97 6Z8. References to 'we,' 'us,' and 'our' mean Provider when referring to the operator of the Service.
“Privacy Policy” means Provider's 4loop Privacy Policy, available at https://www.4loop.ai/privacy, describing its collection, use, disclosure, retention, and protection of Personal Data in connection with the website and Service, subject to the applicable DPA for Customer Personal Data.
“Service” means 4loop, including its public websites, hosted application, software, APIs, MCP connections, integrations, documentation, AI-assisted features, support interfaces, and related services supplied by Provider.
“Subprocessor” means a third party appointed by Provider to Process Customer Personal Data on Provider's behalf in providing the Service when Provider acts as a Processor or subprocessor. Customer Providers acting under Customer's independent arrangements are excluded for that independent Processing; Provider-appointed Subprocessors are governed by the DPA and, where applicable, listed in its Schedule C.
“Subscription” means a recurring subscription to the Service selected by Customer and billed in advance on the applicable recurring billing cycle, subject to the Agreement and the plan.
“Terms” means the 4loop Terms of Service available at https://www.4loop.ai/terms, together with documents incorporated into those terms by reference to the extent applicable.
“Fine-Tuning Authorization” means Customer’s separate, affirmative, documented instruction, accepted by Provider, authorizing Provider to use specified Customer Content for customer-directed fine-tuning of designated AI or machine-learning models for Customer’s benefit. Such authorization may be provided through an agreed order form or an expressly enabled Service feature and must identify or incorporate the applicable processing scope, permitted data, purposes, and material conditions. Acceptance of these Terms or ordinary use of the Service does not, by itself, constitute Fine-Tuning Authorization.
As between the parties, Customer acts as Controller or, where applicable, Processor for another Controller. Provider acts as Processor or Subprocessor, respectively, for Customer Personal Data. Each party will comply with the obligations that apply to it under Applicable Data Protection Laws.
2. Instructions and permitted processing
Provider will process Customer Personal Data only on Customer's documented instructions, including those reflected in the Agreement, Customer's configuration and authorized use of the Service, and other written instructions accepted by Provider, except where processing outside those instructions is required by law and permitted under Applicable Data Protection Laws. These instructions authorize Provider to process Customer Personal Data as reasonably necessary to provide, operate, maintain, secure, and support the Service, as described in Schedule A. The Provider will not process Customer Personal Data for its own purposes. Provider may generate usage and performance metrics about the Service that do not include Customer Content or any Personal Data.
To the extent required by Applicable Data Protection Laws, Provider will notify Customer of legally required processing outside Customer's instructions before such processing, unless legally prohibited, and will immediately inform Customer if, in Provider's opinion, an instruction infringes those laws. Provider may decline or suspend instructions that are unlawful, pose a material security risk, or fall outside the agreed scope of the Service.
Where the Customer acts as a Processor, Customer represents that its instructions, including its engagement of Provider, have been authorized by the relevant Controller.
Customer is responsible for the lawfulness of Customer Personal Data and its instructions, including obtaining any legally required notices, permissions, consents, and other legal bases. Unless otherwise agreed in writing, Customer must not intentionally submit categories of sensitive or regulated Personal Data requiring additional safeguards not supported by the Service.
3. Confidentiality and security
Provider will limit access to Customer Personal Data to personnel and contractors with a legitimate need to perform the Service and who are bound by appropriate confidentiality obligations. Provider will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, loss, and destruction, taking account of the nature of the processing and associated risks. These measures are specified in Schedule B (Annex II to the EU SCCs, where applicable).
Security Policy: The safeguards for Customer Personal Data are the measures in Schedule B (Annex II). Provider will maintain those measures during the term of this DPA and will not materially reduce the overall level of protection. Provider may update those measures as its systems and practices evolve, subject to that obligation. Where the Privacy Policy states that this DPA describes security measures, it refers to Schedule B (Annex II). This DPA does not incorporate a separate security policy or a security certification and does not guarantee uninterrupted availability of the Service.
4. Subprocessors
Customer grants Provider general written authorization to engage the Provider-appointed Subprocessors listed in Schedule C to process Customer Personal Data as necessary to provide the Service. Provider will impose written data protection obligations on such Subprocessors as required by Applicable Data Protection Laws, including Article 28(4) of the GDPR where applicable. Provider remains fully responsible to Customer for its subprocesses’ performance.
Provider will not use Customer Personal Data or other Customer Content to train, fine-tune, or improve AI or machine-learning models except where Customer separately and expressly authorizes specific customer-directed fine-tuning.
Such authorization constitutes a documented Customer instruction and is limited to the authorized data, purpose, and model. Provider will require its appointed AI Subprocessors to process Customer Content solely for the authorized activity and not for independent training, model improvement, or other unauthorized purposes.
Customer Providers independently selected and contracted for by Customer remain governed by Customer's own arrangements, without limiting Provider's obligations concerning its own processing.
Customer may connect Customer Providers under Customer's independent arrangements and is responsible for their selection, configuration, permissions, and applicable terms. A Customer Provider is not a Provider-appointed Subprocessor solely because Customer connects it to the Service. Third parties independently appointed by Provider to process Customer Personal Data on Provider's behalf remain subject to this Section.
Provider will give Customer at least thirty (30) calendar days' prior written notice of intended additions or replacements of Subprocessors processing Customer Personal Data. Customer may object during that period on reasonable data protection grounds. The parties will work in good faith to address timely objections. If no resolution is available, either party may terminate the affected Service in accordance with the Agreement. Provider will not commence the disputed processing contrary to Applicable Data Protection Laws or applicable transfer clauses. Provider may engage a replacement Subprocessor on shorter notice where necessary to maintain the security or availability of the Service and will notify Customer as soon as practicable.
5. Personal Data Breaches
Provider will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, the notice will describe, to the extent known, the nature of the breach, the categories and approximate number of individuals and records affected, its likely consequences, the measure taken or proposed, and a contact point. Provider may provide information in phases.
Provider will take reasonable steps to investigate, contain, and mitigate the breach. A notification is not an admission of fault or liability. Customer remains responsible for determining whether it must notify regulators, individuals, or other parties, with Provider providing assistance as required by law and this DPA.
6. Cooperation and compliance information
Taking account of the nature of the processing and information available to Provider, Provider will provide reasonable assistance to Customer in responding to data subject requests and meeting obligations relating to security, breach notification, data protection impact assessments, and consultations with supervisory authorities, to the extent required by Applicable Data Protection Laws. Where practicable, Customer will first use the Service's available controls to address a request. Provider may charge reasonable costs for assistance beyond the Service's standard functionality, except where prohibited by law.
Provider will make available information reasonably necessary to demonstrate compliance with this DPA and permit audits or inspections as required by Applicable Data Protection Laws or applicable transfer clauses. Where lawful, audits are subject to reasonable notice, confidentiality, security safeguards, and coordination to limit disruption. To the extent legally permitted, Provider is not required to disclose information where disclosure would compromise the security or confidentiality of the Service or any person's data, violate law or third-party obligations, waive legal privilege, or expose credentials, cryptographic material, source code, exploitable vulnerabilities, or similarly sensitive information. Provider may satisfy an audit request initially through written responses to security questionnaires and documentation of it controls. Where direct access is legally required, the parties will adopt proportionate safeguards. Customer bears its reasonable audit costs unless applicable law requires otherwise.
If the Provider receives a request relating to Customer Personal Data from a data subject, Provider will promptly notify Customer and will not respond except to refer the requester to Customer or as required by law.
If provider receives a legally binding request from a public authority for Custoner Personal Data, it will, where lawful, promptly notify Customer, redirect the authority to Customer, redirect the authority to Customer, challenge requests it reasonably considers unlawful, and disclose only the minimum required.
7. Return and deletion
During the Agreement, Customer may access, export, or delete Customer Personal Data using available Service functionality. Following termination or expiry of the Agreement, Customer may choose to have Customer Personal Data returned in a reasonably available export format or deleted. Provider will delete Customer Personal Data contained in content submitted to or generated through the Service from the Service's primary active production data stores within sixty (60) days after termination or expiry of the Agreement or after receiving a valid Customer deletion instruction for the affected data, unless continued retention is required or permitted by applicable law. Other Customer Personal Data processed on Customer's behalf will be returned or deleted in accordance with documented deletion procedures and Applicable Data Protection Laws, subject to the exceptions below. Operational and security records, Personal Data Breach records, and records subject to preservation obligations follow the separate retention provisions in Schedule B (Annex II); residual backups and other lawfully retained records are addressed below. Provider will restrict further processing of lawfully retained records to the applicable permitted purposes and continue to protect them.
Residual copies in backups may remain until removed under ordinary backup-retention cycles and will remain protected and unavailable for routine Service use. If backup data is restored, Provider will reapply outstanding deletion instructions where reasonably practicable. Where required by applicable transfer clauses, Provider will confirm completion of deletion on request.
Training datasets, evaluation records, and model-related artifacts are subject to this Section to the extent they constitute Customer Personal Data. Provider will return or delete such Personal Data in accordance with this DPA and Applicable Data Protection Laws. Nothing in this Section constitutes a representation that individual training records can be selectively removed from an existing trained model.
Customers may request return of Customer Personal Data in a standard export format at any time before, and for thirty (30) days after, termination.
8. International transfers
Customer authorizes Provider and its authorized Subprocessors to process Customer Personal Data in the locations stated in Schedule C or the Subprocessor. Where a transfer requires a specific legal safeguard, the parties will use an applicable adequacy mechanism, standard contractual clauses, or another lawful transfer mechanism.
For transfers from the European Economic Area that require standard contractual clauses, the parties incorporate by reference the European Commission's Standard Contractual Clauses under Implementing Decision (EU) 2021/914 ("EU SCCs"), using Module Two (Controller to Processor) or Module Three (Processor to Processor), as appropriate. Clause 9 Option 2 applies; the advance notice period is the period in Section 4; the optional wording in Clauses 7 and 11 does not apply; and, for Clauses 17 and 18, the laws and courts of Ireland apply. Information for Annexes I, II, and III is set out in Schedules A, B, and C and the Agreement
Competent supervisory authority (Annex I.C). Where the EU SCCs apply: (a) if the data exporter is established in an EU Member State, the supervisory authority responsible for ensuring the data exporter's compliance with Regulation (EU) 2016/679 as regards the transfer; (b) if the data exporter is not established in an EU Member State but is subject to Regulation (EU) 2016/679 under its Article 3(2) and has appointed a representative under its Article 27(1), the supervisory authority of the Member State in which that representative is established; and (c) if the data exporter is not established in an EU Member State, is subject to Regulation (EU) 2016/679 under its Article 3(2), and is not required to appoint a representative under its Article 27(2), the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under the EU SCCs in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as Customer notifies to Provider in writing.
For transfers from the United Kingdom that require contractual safeguards, the UK International Data Transfer Addendum to the EU SCCs (version B1.0, as applicable and lawfully updated) is incorporated by reference. Its Part 2 Mandatory Clauses apply; Tables 1 through 3 are completed by the party, transfer, and security information in this DPA and the Agreement; and, for Table 4, neither party may terminate the Addendum solely under its optional revision-termination provision. For transfers subject to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs apply with these adaptations: (a) references to Regulation (EU) 2016/679 are references to the FADP to the extent the transfer is subject to the FADP; (b) the competent supervisory authority under Clause 13 and Annex I.C is the Swiss Federal Data Protection and Information Commissioner to the extent the transfer is subject to the FADP, and the authority identified in Schedule A to the extent the transfer is subject to Regulation (EU) 2016/679; and (c) the term "Member State" is not to be read to prevent data subjects in Switzerland from suing for their rights in Switzerland, their place of habitual residence, in accordance with Clause 18(c).
The transfer clauses apply only when legally required and prevail over conflicting terms of this DPA or the Agreement to the extent of the conflict. Nothing in this DPA limits the rights of data subjects or regulators under those clauses.
9. California-specific terms
Where the CCPA applies and Customer is a "business" disclosing Customer Personal Data to Provider as its "service provider," Provider will process that information only for the limited and specified business purposes in Schedule A and as otherwise permitted by the CCPA. Provider will not sell or share that information, retain, use, or disclose it for purposes outside those permitted, or combine it with Personal Data from other sources except as permitted under the CCPA. Provider will comply with applicable CCPA obligations and provide the level of privacy protection required of a service provider.
Provider will notify Customer if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to verify Provider's compliant use of the information and to stop or remediate unauthorized use, subject to appropriate security and confidentiality safeguards. Provider will reasonably cooperate with Customer's CCPA consumer requests and, where legally required, cybersecurity audits and risk assessments, to the extent information is available to Provider. Provider certifies that it understands and will comply with the restrictions applicable to it under this Section.
Provider will not retain, use, or disclose Customer Personal Data outside the direct business relationship between Provider and Customer. Provider will engage subcontractors only under written contracts requiring the same obligations and will notify Customer of such engagements under Section 4. Customer will inform Provider of consumer requests and provide the information needed to comply.
10. Liability, Precedence, and Duration
The liability limitations and exclusions in the Agreement apply to this DPA to the maximum extent permitted by law. They do not limit liability that cannot lawfully be limited, including rights and remedies preserved by applicable transfer clauses.
In a conflict concerning the Processing of Customer Personal Data: (a) the EU SCCs and UK Addendum prevail where they apply; (b) this DPA prevails over the Terms and any Enterprise or master services agreement, unless that agreement expressly refers to this DPA and states that it overrides specified provisions; (c) in all other matters, Section 22.1 of the Terms applies.
This DPA supplements the Agreement for Processing Customer Personal Data on Customer's behalf and does not independently override higher-priority contractual provisions. Nothing in this Section limits obligations required by Applicable Data Protection Laws or the mandatory precedence of applicable EU Standard Contractual Clauses or UK Addendum.
This DPA remains in effect while Provider Processes Customer Personal Data on Customer's behalf under the Agreement. Termination does not relieve either party of obligations concerning retained Personal Data that continue under applicable law or this DPA. Except where applicable transfer clauses require otherwise, governing law and jurisdiction are determined by the Agreement.
11. Customer Responsibility for Fine-Tuning Data
Customer determines and is responsible for the selection, content, lawfulness, and permitted use of all Customer Content designated for fine-tuning, including establishing applicable legal bases, obtaining required permissions and consents, providing required notices, and determining and responding to applicable data-subject requests.
Customer is responsible for identifying the Personal Data and affected records within Customer-provided training materials and for providing documented instructions concerning applicable access, correction, restriction, and deletion requests, including requests affecting resulting model artifacts.
Provider is not responsible for independently reviewing Customer Content, verifying Customer's legal bases or permissions, or determining the lawfulness of Customer's selection of training materials, except to the extent required by Applicable Data Protection Laws.
Provider may process designated Customer Content to fine-tune, host, operate, and maintain models on Customer's behalf in accordance with Customer's documented instructions. Provider will provide assistance required by the DPA and Applicable Data Protection Laws.
Nothing in this section limits obligations independently imposed on Provider by Applicable Data Protection Laws.
Schedule A - Processing details and transfer information
Service and subject matter. 4loop is a hosted human-in-the-loop review platform. It receives work submitted by Customers or their AI-enabled systems, makes it available for human review, records approvals, edits, rejections, and related workflow events, and supports associated account, integration, and administrative functions.
Nature and purpose. Receiving, transmitting, hosting, organizing, retrieving, displaying, analyzing where a Service feature requires it, making available to authorized reviewers, recording decisions, securing, supporting, returning, and deleting Customer Personal Data to deliver the Service and respond to Customer instructions. This description does not authorize Provider to determine independent purposes for Customer Personal Data. Where separately authorized by Customer, preparing training and evaluation datasets, training, fine-tuning, testing, evaluating, hosting, and operating Customer-specific AI models in accordance with Customer's documented instructions.
Data subjects. Customer's employees, representatives, authorized reviewers, end users, customers, and other individuals identified in material Customer chooses to submit.
Types of Personal Data. Depending on Customer's use: names and contact details; account and access information; identifiers and technical or activity data; task submissions, source content, AI-generated outputs, review comments, decisions, and audit records that may identify an individual. Sensitive or special-category data is not an intended category of processing unless separately agreed in writing. Where separately authorized, training examples, prompts, reviewer decisions and corrections, evaluation datasets, and model-related artifacts to the extent they contain Personal Data.
Frequency and duration. Processing occurs as Customer uses the Service and continues for the term of the Agreement, subject to Section 7 and applicable legal retention obligations.
Parties for transfer clauses. Data exporter: Customer identified in the Agreement, with its address and contact details as recorded in the Agreement or Customer account; role: Controller or Processor, as applicable. Data importer: Strukt Corporation (operating as 4loop), 6129 River Rd, Port Alberni, BC V9Y 6Z8, Canada; contact: Richard Banh, Founder, privacy@4loop.ai.; role: Processor or Subprocessor, as applicable. Each party's acceptance of the Agreement also constitutes its acceptance of the incorporated transfer clauses when applicable. The activities of both parties are described above.
Competent supervisory authority. Where the EU SCCs apply, the authority is determined under Clause 13 of those clauses.
Schedule B (Annex II) - Technical and organizational security measures
The following safeguards serve as Annex II to the EU SCCs, where applicable.
Operational and security records. Provider retains the following records, which may identify Authorized Users: (a) operator logs, which expire one-hundred eighty (180) days after creation; (b) in-app notification events, which expire 180 days after creation, and inbox copies, which expire one-hundred eighty (180) days after creation; (c) the authority audit trail, which is retaine1d for the life of the workspace and deleted with it; and (d) platform request and error logs, which are retained for ninety (90) days. These records are deleted when a workspace is deleted or expire on this schedule, whichever is first. Provider applies access controls and security safeguards to them, and may retain records longer only as provided in the items below.
Personal Data Breach records. Where applicable law requires Provider to maintain records concerning a Personal Data Breach, Provider will retain those records for the required period, including for at least twenty-four (24) months after Provider determines that the breach occurred where the PIPEDA Breach of Security Safeguards Regulations apply.
Legal-hold and preservation records. Retained until the relevant litigation, investigation, regulatory inquiry, or other lawful preservation obligation ends, to the extent permitted or required by law.
Customer Personal Data in Service content. The 60-day deletion period applies to Customer Personal Data in content held in the Service's primary active production data stores, as provided in Section 7. Other Service records and protected backups follow the applicable deletion and retention procedures in Section 7, subject to retention required or permitted by law.
The measures described in this Schedule are security measures and do not establish availability, business-continuity, disaster-recovery, service-level, certification, or product-configuration commitments beyond those expressly stated in the Agreement or an applicable service-level agreement.
Schedule C (Annex III) - Provider-appointed Subprocessors
The following Provider-appointed Subprocessors may process Customer Personal Data for the identified Service functions. Processing locations depend on vendor arrangements and may include the United States and other countries. Customer Providers under Section 4 are excluded. Before separately appointing additional AI providers or other Subprocessors, Provider will follow Section 4’s authorization, notice, and objection requirements; its training restrictions apply to all appointed AI Subprocessors.
Google LLC / Google Cloud: Cloud hosting, storage, infrastructure, identity-related infrastructure, and, where enabled as part of the Service, hosted AI inference or related processing. Customer-authorized AI model training, fine-tuning, evaluation, hosting, and inference.
Amazon Web Services, Inc. / AWS (and applicable contracting affiliates): Cloud hosting, storage, infrastructure, and hosted AI inference when enabled. Customer-authorized AI model training, fine-tuning, evaluation, hosting, and inference.
Microsoft Corporation / Microsoft Azure (and applicable contracting affiliates): Cloud hosting, storage, infrastructure, and hosted AI inference when enabled. Customer-authorized AI model training, fine-tuning, evaluation, hosting, and inference.
Mailgun Technologies, Inc.: Transactional email delivery, including account invitations and Service notifications, involving recipient contact details and information contained in those specific communications as needed for delivery.
Intercom R&D Unlimited Company / Intercom, Inc. (United States): In-application support chat, Fin AI-assisted support, and Service-related outbound messaging, including processing of Authorized Users’ names, email addresses, voluntarily submitted support messages and attachments, and related technical and interaction records, only to the extent such activities involve Customer Personal Data processed on Customer’s behalf. Public-website inquiries and Provider-controlled sales, support, account-administration, and business-relationship communications are outside the scope of this DPA to the extent Provider acts as an independent Controller for that processing. This exclusion does not apply to Customer Personal Data otherwise processed on Customer’s behalf.
PostHog, Inc. (United States): Optional analytics and session replay on the public marketing website. It is not used by the product app.
