DATA PROCESSING AGREEMENT

Last Updated: May 21, 2026

Version: 2.0

This Data Processing Agreement ("DPA") supplements and forms part of the Terms of Service or other agreement ("Service Agreement") between Halogen AI, Inc. ("Halogen AI," "we," "us," or "our") and our customers ("Customer," "you," or "your") governing the use of Halogen Presence™, our Answer Engine Optimization (AEO) platform, and related services. This DPA applies when Customer Data processed through the Services includes Personal Data as defined under applicable data protection laws. By using the Services, you agree to the terms of this DPA.

1. DEFINITIONS

"Applicable Laws" means all applicable data protection and privacy laws and regulations applicable to the processing of Personal Data, including without limitation the General Data Protection Regulation (EU) 2016/679 ("GDPR"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"); the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial laws including Quebec's Law 25; and other applicable federal, state, provincial, and international privacy laws.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by Halogen AI on behalf of the Customer through the Services.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

"Security Incident" means any breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data.

"Sub-processor" means any third party engaged by Halogen AI to process Personal Data on behalf of our Customers.

2. SCOPE OF PROCESSING

2.1 Relationship of the Parties

Halogen AI acts as a data processor (or "service provider" under the CCPA/CPRA) with respect to Personal Data processed on behalf of Customers, who act as data controllers. This DPA defines the responsibilities and obligations of both parties regarding data protection.

2.2 Nature and Purpose of Processing

Halogen AI processes Personal Data for the following purposes:

  • Providing the Halogen Presence™ platform, including tracking and measuring how a brand is described and cited in the responses of generative AI assistants, performing audits, generating reports and content drafts, and publishing content to platforms the Customer connects at its direction;
  • User account management and authentication;
  • Service delivery, maintenance, and support;
  • Service improvement and development;
  • Compliance with legal obligations.

2.3 Categories of Data and Data Subjects

Types of Personal Data we process:

  • Identification data (names);
  • Contact information (business email addresses, phone numbers);
  • Account and authentication credentials;
  • Platform inputs and configuration provided by the Customer (which may incidentally contain Personal Data), such as tracked prompts, brand and competitor names, and submitted URLs;
  • Usage and analytics data.

Categories of Data Subjects:

  • Customer's authorized users, employees, and contractors;
  • Customer's business contacts and prospects;
  • Other individuals whose Personal Data may be contained in Customer-provided inputs.

2.4 Duration of Processing

Personal Data is processed for the duration of the Service Agreement and retained for a limited period following termination as described in Section 7, unless a different retention period is required by law or agreed upon in writing.

3. HALOGEN AI'S OBLIGATIONS

3.1 Compliance with Instructions

  • We process Personal Data only in accordance with documented instructions from our Customers, including as set out in the Service Agreement and this DPA;
  • We will notify Customers if we believe an instruction violates Applicable Laws;
  • We do not process Personal Data for our own purposes, and we do not "sell" or "share" Customer Personal Data as those terms are defined under the CCPA/CPRA.

3.2 Confidentiality

All Halogen AI personnel authorized to process Customer Personal Data are subject to confidentiality obligations, are informed of applicable data-protection and security requirements, and are granted access only on a need-to-know basis.

3.3 Security Measures

We implement and maintain technical and organizational measures designed to protect Personal Data appropriate to the risk, including:

  • Encryption of data in transit using TLS/HTTPS;
  • Encryption of sensitive credentials at rest, including connected-service credentials encrypted using AES-256; database storage is provided by infrastructure that supports encryption at rest;
  • Access controls with unique user authentication and role-based permissions;
  • Scoped session management, including time-limited administrative and support-impersonation sessions;
  • System access logging and monitoring, including an internal audit log of sensitive administrative actions;
  • Secure development practices and regular updates;
  • Security awareness practices for personnel.

We continue to invest in our security program, including pursuing recognized security certifications and enhancements over time. We describe our current measures here and update them as our program matures; we do not, however, condition our obligations under this DPA on future enhancements.

3.4 Security Incident Management

In the event of a Security Incident affecting Customer Personal Data, we will notify affected Customers without undue delay, and in any event within forty-eight (48) hours of becoming aware of the incident. Notifications will describe, to the extent known, the nature of the incident, the categories of data affected, the likely consequences, and the measures taken or proposed to address it. We will cooperate in good faith in investigation and remediation efforts.

4. SUB-PROCESSORS

4.1 Current Sub-processors

We use the following sub-processors to deliver the Services:

Sub-processorPurposeLocation
Anthropic, PBCAI provider (Claude) for visibility analysis and content generationUnited States
OpenAI, L.L.C.AI provider (GPT models) for visibility analysisUnited States
Google LLCAI provider (Gemini) for visibility analysis; analyticsUnited States
Stripe, Inc.Payment processingUnited States
Vercel, Inc.Application hosting and infrastructureUnited States
Neon, Inc.Database hosting and storageUnited States
Resend, Inc.Transactional and report email deliveryUnited States

The locations above reflect the primary processing location for each provider; certain providers may process data in additional regions in accordance with their own terms. We maintain written data-protection terms with our sub-processors as required by Applicable Laws. An up-to-date list of sub-processors is available on this page or upon request.

4.2 Sub-processor Management

  • We maintain written agreements with our sub-processors imposing data-protection obligations consistent with this DPA;
  • We will notify Customers before adding or replacing a sub-processor that processes Personal Data, and Customers may object on reasonable data-protection grounds;
  • We remain responsible for our sub-processors' processing of Personal Data as required by Applicable Laws.

5. YOUR RIGHTS AND OBLIGATIONS

5.1 Customer Responsibilities

As the data controller, you are responsible for ensuring you have a legal basis for collecting and providing Personal Data to us; providing necessary notices and obtaining required consents from Data Subjects; ensuring your instructions comply with Applicable Laws; ensuring you are authorized in respect of any website or property you submit for tracking or audit; and maintaining your own records of processing activities. You agree not to provide Personal Data to the Services beyond what is necessary for the Services, and to avoid submitting special categories of Personal Data.

5.2 Data Subject Rights

We will provide reasonable assistance to help you respond to Data Subject requests regarding access, correction, deletion, portability, objection, and restriction of processing. We will not respond directly to Data Subjects unless instructed by you or required by law. Reasonable assistance is provided at no additional charge.

5.3 Audit Rights

You may verify our compliance with this DPA through reasonable means, including security questionnaires, review of available security documentation and certifications, and, on reasonable prior notice and no more than once per year (or as required by a supervisory authority), an audit of relevant processing activities, subject to confidentiality and to not unreasonably disrupting our operations.

6. INTERNATIONAL DATA TRANSFERS

6.1 Data Location

We operate primarily from the United States and store the data underlying the Services in the United States. However, because the Services rely on third-party AI providers and other sub-processors, certain Personal Data may be processed in, or transmitted to, jurisdictions outside the United States and Canada in accordance with those providers' terms.

6.2 Transfer Safeguards

  • Canada to US transfers: Permitted under PIPEDA with the safeguards described in this DPA;
  • EU/EEA and UK to US transfers: Standard Contractual Clauses (and the UK Addendum, where applicable) are available and are incorporated by reference where required;
  • Other jurisdictions: Appropriate transfer mechanisms based on Applicable Laws, including reliance on the transfer mechanisms maintained by our sub-processors.

7. DATA RETENTION AND DELETION

7.1 Retention Periods

  • Active accounts: Personal Data is retained while the Services are active;
  • Post-termination: Personal Data is retained for a limited period after account closure and then deleted or anonymized;
  • Legal requirements: Extended retention only where required by law.

7.2 Data Deletion

  • Customers may request export of their data in a standard format prior to deletion;
  • Following termination, we will delete or anonymize Personal Data within a commercially reasonable period (and in any event within the period required by Applicable Laws), unless legal retention applies;
  • Written confirmation of deletion is available upon reasonable request.

8. LIABILITY AND COMPLIANCE

  • Liability arising under or in connection with this DPA is governed by, and subject to the limitations of liability in, the Service Agreement;
  • Each party is responsible for its own compliance with Applicable Laws;
  • Our insurance commitments, if any, are as set out in the Service Agreement.

9. PRIVACY IMPACT ASSESSMENTS

We will provide reasonable assistance, taking into account the nature of processing and the information available to us, with Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities where required by Applicable Laws.

10. UPDATES TO THIS DPA

We may update this DPA to reflect changes in Applicable Laws, to accommodate new services or features, to improve security measures, or to add or change sub-processors. Updates will be posted on this page with a new version number and date. Material changes will be communicated by email or through the service dashboard.

11. CONTACT INFORMATION

For questions about this DPA or our data-protection practices:

Halogen AI, Inc.
1545 NE 90th St, Seattle, WA 98115
Email: privacy@halo-gen.ai

12. JURISDICTION-SPECIFIC PROVISIONS

12.1 European Economic Area (EEA) and United Kingdom

  • Halogen AI acts as a data processor under GDPR Article 28;
  • Standard Contractual Clauses, and the UK International Data Transfer Addendum where applicable, are available as an addendum to this DPA;
  • You may appoint an EU/UK representative if required.

12.2 California

  • We act as a service provider under the CCPA/CPRA;
  • We do not sell Personal Data and do not retain, use, or disclose it other than to provide the Services or as permitted by the CCPA/CPRA;
  • We assist with consumer rights requests as described in Section 5.2.

12.3 Canada

  • We comply with PIPEDA and applicable provincial laws, including Quebec's Law 25;
  • Data may be processed in the United States and other jurisdictions as described in Section 6;
  • We maintain comparable protection standards.