Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between Ment Tech Labs Private Limited, CIN U62099MP2023PTC064895, 8 Sarswati Nagar, Annapurna Road, Indore CGO Complex, Indore, Madhya Pradesh 452001, India ("Ment Labs" or "Processor") and the business customer that accepts the Agreement ("Customer" or "Controller"). It applies whenever Ment Labs processes personal data on behalf of Customer in providing Social Agent by Ment Labs and the Agents Hub platform (the "Service").

Customers who need a signed copy, or who need the EU Standard Contractual Clauses or the UK Addendum executed, should email privacy@ment.tech. This DPA applies automatically to every business customer without signature.

1. Definitions

"Data Protection Laws" means all laws that apply to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules under it, and any other applicable privacy law.

"Customer Personal Data" means personal data that Customer or its users upload to or make available through the Service, including personal data contained in Brand Brain sources, in content published to Customer's social accounts, and in data retrieved from Customer's connected social accounts.

"Subprocessor" means a third party engaged by Ment Labs to process Customer Personal Data.

"Personal data", "processing", "controller", "processor", "data subject", "data fiduciary", "data processor" and "data principal" have the meanings given in the Data Protection Laws. Under the DPDP Act, Customer is the data fiduciary and Ment Labs is the data processor.

2. Roles and Scope

2.1Customer is the controller (or data fiduciary) of Customer Personal Data. Ment Labs is the processor (or data processor).

2.2Ment Labs is an independent controller for account data of Customer's users (name, email, sign-in records), billing data, and usage and security data about the Service, as described in the Privacy Policy. This DPA does not apply to that data.

2.3The social platforms (Meta, LinkedIn, X) are independent controllers of data held on their platforms.

3. Details of Processing

• Subject matter

  Provision of an AI social media content planning, generation and publishing service

• Duration

  The term of the Agreement plus the deletion period in Section 9

• Nature and purpose

  Hosting, storing, chunking and embedding Customer sources; storing, transcribing, analysing and editing video recordings Customer uploads to the Library; generating marketing content using AI and video providers; publishing content to Customer's social accounts; retrieving performance metrics; displaying all of this to Customer's users

• Categories of data subjects

  Customer's employees and users; Customer's customers, clients, partners and other people mentioned in Customer sources or content; social media users who interact with Customer's published posts (names, handles, public comments as returned by platform APIs)

• Categories of personal data

  Names, job titles, contact details, testimonials, quotes, photographs and other content Customer uploads; video and audio recordings of people, their voices and transcripts of what they say; face positions in video frames (boxes only, used for framing, never for identification); consent and rights confirmations recorded by Customer; social media identifiers and public profile data; engagement metrics; any other personal data Customer chooses to include

• Special categories

  None intended. Customer must not upload special category data (health, religion, political opinions, sexual orientation, biometric data, criminal records) or data of children. Ment Labs does not process recordings to identify people: face detection stores face positions only, with no landmarks or templates.

4. Customer Obligations

Customer will: (a) have a lawful basis and give all required notices for the Customer Personal Data it provides; (b) ensure its instructions comply with Data Protection Laws; (c) not upload special category data or data of children; (d) configure the Service appropriately, including using approval mode where publishing without review would be inappropriate; and (e) be responsible for the accuracy and lawfulness of content published to its accounts.

5. Processor Obligations

Ment Labs will:

5.1Process Customer Personal Data only on Customer's documented instructions, which are: the Agreement, this DPA, Customer's configuration of the Service (sources uploaded, accounts connected, campaign settings, approvals, chat instructions to Aura), and any further written instructions agreed by the parties. Ment Labs will inform Customer if it believes an instruction breaches Data Protection Laws.

5.2Ensure that staff authorised to process Customer Personal Data are bound by confidentiality.

5.3Implement the technical and organisational measures in Annex 1.

5.4Assist Customer, taking into account the nature of processing, in responding to data subject requests (Section 7), in meeting security, breach notification, impact assessment and prior consultation obligations (Sections 8 and 10).

5.5Delete or return Customer Personal Data at the end of the Service (Section 9).

5.6Make available the information needed to demonstrate compliance and allow audits (Section 11).

5.7Not sell Customer Personal Data, use it for advertising, or use it to train machine learning models.

6. Subprocessors

6.1Customer gives general authorisation for Ment Labs to engage the Subprocessors listed in Section 5 of the Privacy Policy (app.ment.tech/legal/privacy), which at the date of this DPA are:

• Contabo GmbH

  Function

  Server hosting for the app, API, workers, database and Redis

  Location

  Asia (Singapore)

• Cloudflare, Inc.

  Function

  DNS, network protection, object storage (R2) and database backups

  Location

  Global network; R2 storage in Asia-Pacific

• Anthropic, PBC

  Function

  AI text generation, planning, review, Aura chat, describing still frames and transcripts of recordings

  Location

  United States

• OpenAI, L.L.C.

  Function

  Embeddings, image generation, transcription of recording audio

  Location

  United States

• Google LLC

  Function

  Image, some text and generative video (Gemini)

  Location

  United States

• Tavily

  Function

  Web search (keywords only)

  Location

  United States

• Pexels

  Function

  Stock video search (keywords only)

  Location

  Germany

• ElevenLabs, Inc.

  Function

  Voiceover, transcription of recording audio, owner voice cloning where enabled

  Location

  United States

• fal (Features and Labels, Inc.)

  Function

  Generative video with fallback models

  Location

  United States

• Runway AI, Inc.

  Function

  Generative video, on plans that include it

  Location

  United States

• Luma AI, Inc.

  Function

  Generative video, on plans that include it

  Location

  United States

• HeyGen

  Function

  Avatar video, on plans that include it

  Location

  United States

• Resend (Plus Five Five, Inc.)

  Function

  Service email

  Location

  United States

• Functional Software, Inc. (Sentry)

  Function

  Error monitoring

  Location

  United States

• Razorpay Software Private Limited

  Function

  Payments in INR

  Location

  India

6.2Ment Labs will give Customer at least 14 days' notice by email before adding or replacing a Subprocessor that processes Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Service and receive a pro rata refund of prepaid fees.

6.3Ment Labs will impose data protection obligations on each Subprocessor that are no less protective than this DPA and remains liable for Subprocessors' performance.

6.4Where Customer brings its own AI, video or voice provider key (in Settings, Integrations or Settings, Video Providers), that provider is Customer's own processor, not a Subprocessor of Ment Labs. Google Drive, when Customer imports recordings from it, is Customer's own service; Ment Labs accesses only the files Customer picks.

7. Data Subject Requests

If Ment Labs receives a request from a data subject relating to Customer Personal Data, it will direct the data subject to Customer and will not respond except on Customer's instruction or where required by law. Ment Labs will assist Customer with reasonable requests within 10 business days. The Service lets Customer search and delete sources, posts and connected accounts directly.

8. Personal Data Breach

Ment Labs will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Ment Labs will cooperate with Customer's investigation and notifications. Notification is not an admission of fault.

9. Deletion and Return

9.1Customer can export its workspace data (including the Brand Profile, sources, campaigns, calendar and posts) from Settings, Privacy at any time, and can delete any source, post, connection or the whole workspace.

9.2When Customer deletes the workspace, Ment Labs deletes all Customer Personal Data 30 days after the request (a grace period in which Customer can undo it; access tokens are deleted at once), except: (a) data Ment Labs must keep under applicable law (billing records, 8 years); (b) data in encrypted backups, which is overwritten within 30 days; and (c) a record of the deletion itself kept for 12 months.

9.3Data already transmitted to social platforms (published posts) is outside Ment Labs' control after publishing.

10. Assistance and Impact Assessments

Ment Labs will provide reasonable assistance with Customer's data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to the Service and Ment Labs has the relevant information. Assistance beyond two person-days per year may be charged at Ment Labs' standard professional rates.

11. Audit

Ment Labs will make available on request, no more than once per year: a description of its security measures, the current Subprocessor list, results of any third-party security assessment or penetration test (summary form), and completed security questionnaires. Where this is not sufficient to demonstrate compliance, Customer may conduct an audit on 30 days' written notice, during business hours, no more than once per year (unless required by a supervisory authority or following a breach), at Customer's cost, subject to confidentiality, and without unreasonable disruption to Ment Labs' operations.

12. International Transfers

12.1Ment Labs processes data in India and through Subprocessors in the locations listed in Section 6.

12.2For Customer Personal Data subject to the GDPR, UK GDPR or Swiss law, transfers to Ment Labs in India and onward to Subprocessors are made under the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), with the UK International Data Transfer Addendum where UK law applies, and with the Swiss amendments where Swiss law applies. The Clauses are incorporated into this DPA by reference; Annex I and II of the Clauses are completed by Sections 3 and 6 and Annex 1 of this DPA; the governing law and forum for the Clauses are those of Ireland unless Customer specifies another EU member state in writing; and the optional docking clause applies. Customer can request an executed copy at privacy@ment.tech.

12.3For Customer Personal Data of Indian data principals, Ment Labs will comply with any transfer restrictions notified under the DPDP Act.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits liability that cannot be limited by Data Protection Laws.

14. Term and Precedence

This DPA lasts as long as Ment Labs processes Customer Personal Data. If there is a conflict between this DPA and the Agreement, this DPA prevails for the subject matter it covers. If there is a conflict between this DPA and the Standard Contractual Clauses, the Clauses prevail.

Annex 1: Technical and Organisational Measures

Access control. Production server access restricted to named staff using SSH keys. Staff panel (admin.ment.tech) restricted to invited staff with mandatory two-step verification; staff views of a customer workspace need a fresh two-step check and are logged with actor and time; every admin change is recorded in an audit log.

Tenant isolation. Every tenant table carries a workspace identifier; every query is scoped to the workspace at the data access layer; cross-workspace queries exist only in the admin application.

Encryption. TLS for all traffic. Object storage and backups encrypted at rest by Cloudflare. OAuth tokens, bring-your-own API keys and other secrets encrypted with AES-256-GCM using a key stored outside the database; one-time sign-in links stored only as hashes.

Secrets handling. Third-party credentials stored encrypted in the database and edited only through the admin panel; never in source code or logs; never returned to browsers.

Media. Post media stored in Cloudflare R2 at long random addresses; social platforms fetch it through signed links that expire within one hour. Uploaded Brand Brain documents, Library recordings and their derived files, unpublished clips and data exports are private: no public address, served only through the API after a membership check, or through signed links that expire within five minutes. Upload links for recordings are write-only and expire after one hour. A clip becomes public post media only when it is published, after a check that its consent and rights are still in place.

Logging and monitoring. Logs with secrets and sign-in codes kept out; error monitoring (Sentry) with tokens removed; health and readiness checks for every service.

Backups. Automated nightly database backups to Cloudflare R2, kept for 30 days; restore procedure tested at least quarterly.

Development. Automated linting, type checking and tests in CI; dependency vulnerability scanning; separate development and production environments; no production data in development.

Webhooks and APIs. Signature verification on all inbound webhooks; idempotent processing; rate limiting per client, shared across servers.

Personnel. Confidentiality obligations in employment and contractor agreements; access revoked on departure within one business day.

Incident response. Documented runbook for provider outages, key rotation and breaches; 48-hour customer notification commitment.

Data minimisation. Only the platform permissions needed for enabled features are requested; research data from platforms cached for a maximum of 6 hours. Face detection in recordings stores positions only. Google Drive access uses the drive.file permission and is deleted when an import ends. Media files are checked against an allowlist of formats and network protocols before processing.

Contact

privacy@ment.tech
Ment Tech Labs Private Limited, 8 Sarswati Nagar, Annapurna Road, Indore CGO Complex, Indore, Madhya Pradesh 452001, India