Data Processing Agreement

Last updated October 16, 2026

This Data Processing Agreement ("DPA") forms part of the Adeli Terms of Service (the "Terms") between King's Cross Labs, Inc., a Delaware corporation at 175 West 90th Street, New York, NY 10024, United States ("King's Cross Labs", "we", "us"), and the customer that accepted the Terms ("Customer", "you"). It applies automatically from the date you accepted the Terms and needs no separate signature.

1. Definitions

1.1 "Data Protection Laws" means all laws on data protection and privacy that apply to the processing of Customer Personal Data under the Terms, including, where applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as it forms part of UK law, together with the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").

1.2 "Customer Personal Data" means personal data that we process on your behalf as your processor in providing the Service, as described in Annex I.

1.3 "Service" has the meaning given in the Terms: the Adeli API, dashboard, MCP server, agent skills and related services.

1.4 "Subprocessor" means a third party we engage to process Customer Personal Data on your behalf.

1.5 "SCCs" means the standard contractual clauses for transfers of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914, as amended or replaced.

1.6 "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

1.7 "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. Under other Data Protection Laws they include the equivalent terms, such as "business" and "service provider" under the CCPA.

2. Scope and roles

2.1 Controller and processor. For Customer Personal Data, you are the controller and King's Cross Labs is your processor.

2.2 Agencies and platforms. If you use the Service to process personal data on behalf of your own clients, you act as their processor and we act as your subprocessor. You are responsible for having the authority from your clients to give us the instructions in this DPA.

2.3 Data we control ourselves. This DPA does not cover personal data we process as a controller, such as your account, billing and sign-in data, website analytics, and the security and abuse-prevention logs we keep to run the Service. Our Privacy Policy describes how we handle that data.

2.4 Social platforms are not our subprocessors. The social platforms you connect and instruct us to publish to or read from, such as Instagram, Facebook, WhatsApp, TikTok, YouTube, X, Bluesky, LinkedIn and Reddit, process data under their own terms as independent controllers. So do AI assistants and agents you authorize to use the Service under Section 9 of the Terms. Neither is a Subprocessor of ours.

3. Processing on your instructions

3.1 We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law forbids that.

3.2 Your instructions are: the Terms and this DPA; the API calls, MCP tool calls and dashboard actions made under your account; and the settings you configure. Any additional instruction must be agreed in writing.

3.3 We will tell you promptly if we believe an instruction infringes Data Protection Laws. We may suspend the processing concerned until you confirm or change the instruction.

3.4 No selling, sharing or training. We will not sell or share Customer Personal Data (as those terms are defined in the CCPA). We will not use it for any purpose other than providing, securing and supporting the Service. We will not combine it with personal data from other sources except as the Service requires. We will not use it to train, fine-tune or evaluate machine learning or AI models, and we do not permit our Subprocessors to do so.

3.5 Your responsibilities. You are responsible for having a lawful basis for the processing you instruct, for giving the notices and obtaining the consents Data Protection Laws require, and for the accuracy of the Customer Personal Data you provide. That includes the notices and consents your own users need before they connect a social account (Section 4 of the Terms).

4. Confidentiality

We ensure that everyone we authorize to process Customer Personal Data has committed to confidentiality or is under an appropriate legal duty of confidentiality. We also ensure they access it only as needed to provide, secure and support the Service.

5. Security

5.1 We implement and maintain the technical and organizational measures in Annex II. They are designed to protect Customer Personal Data to a level appropriate to the risk, as required by Article 32 GDPR.

5.2 We may update those measures over time, provided we do not materially reduce the overall level of protection.

6. Subprocessors

6.1 General authorization. You authorize us to engage Subprocessors. Our current Subprocessors are listed at tryadeli.com/subprocessors, which forms Annex III of this DPA.

6.2 Our obligations. Before a Subprocessor processes Customer Personal Data, we bind it by written contract to data protection obligations no less protective than those in this DPA. We remain liable to you for its performance of those obligations.

6.3 Notice of changes. We will post any intended addition or replacement of a Subprocessor on that page at least 14 days before it starts processing Customer Personal Data. We will also email the notice to anyone who has subscribed, as that page explains.

6.4 Objection. You may object to a change on reasonable data protection grounds by emailing hello@tryadeli.com within that 14-day period. We will work with you in good faith to resolve the objection. If we cannot, you may terminate the affected part of the Service, and we will refund any fees you prepaid for the period after termination.

6.5 Emergency replacement. If we must replace a Subprocessor urgently for reasons outside our control, such as a security issue or a vendor shutting down, we will give notice as soon as reasonably possible. Your objection right under Section 6.4 still applies.

7. Assistance

7.1 Data subject requests. If we receive a request from a data subject about Customer Personal Data, we will pass it to you without undue delay and will not respond ourselves unless you instruct us to or the law requires it. Taking into account the nature of the processing, we will help you respond to such requests. Most of this is self-serve: through the API and dashboard you can retrieve, correct, disconnect and delete the data held for a connected account.

7.2 Impact assessments and regulators. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and prior consultations with supervisory authorities, as required by Articles 35 and 36 GDPR.

8. Security Incidents

8.1 We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident.

8.2 The notice will include, as far as we know at the time: the nature of the incident; the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed. Where we cannot provide everything at once, we will provide it in phases without further undue delay.

8.3 We will take reasonable steps to contain, investigate and remedy the incident, and will cooperate with you so you can meet your own notification obligations.

8.4 Our notice of a Security Incident is not an admission of fault or liability.

9. Deletion and return

9.1 During the term, you can export or delete Customer Personal Data through the API and dashboard.

9.2 When the Service ends, we will delete Customer Personal Data within 30 days, following the retention schedule in Section 10 of our Privacy Policy, unless the law requires us to keep it. For 30 days after termination you may ask us to return it in a commonly used format first. Copies in backups expire within 90 days of deletion from live systems, and are protected under this DPA until they do.

9.3 On request, we will confirm the deletion in writing.

10. International transfers

10.1 Where we process data. King's Cross Labs is established in the United States. We and our Subprocessors process Customer Personal Data in the United States and in the other locations listed on the Subprocessor page.

10.2 EU transfers. Where Customer Personal Data is transferred from the European Economic Area to us, the SCCs are incorporated into this DPA and apply as follows:

• Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you are a processor.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorization) applies, with the 14-day notice period in Section 6.3.
• Clause 11: the optional language does not apply.
• Clause 13: the competent supervisory authority is the one determined by Clause 13 based on your establishment or representative.
• Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
• Clause 18: disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed with Annexes I, II and III of this DPA.

10.3 UK transfers. Where Customer Personal Data is transferred from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner ("UK Addendum") applies. Its Table 1 to 3 information is set out in this DPA and its Annexes. In Table 4, either party may end the UK Addendum as set out in its Section 19.

10.4 Swiss transfers. Where Customer Personal Data is transferred from Switzerland, the SCCs apply as set out in Section 10.2, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to "Member State" include Switzerland, so that data subjects in Switzerland can bring claims in their place of habitual residence; and references to the GDPR mean the FADP.

10.5 Conflict. If the SCCs or the UK Addendum conflict with this DPA or the Terms, they prevail.

10.6 Government requests. If a public authority asks us for Customer Personal Data, we will:

• try to redirect the authority to you
• notify you promptly, unless the law forbids it
• challenge any request we reasonably consider unlawful
• disclose only the minimum the law requires.

We have not received such a request to date.

10.7 Other transfer mechanisms. If we adopt another lawful transfer mechanism, such as certification under the EU-US Data Privacy Framework, we may rely on it in place of the SCCs for the transfers it covers.

11. Audits

11.1 We will make available to you, on request, the information reasonably necessary to demonstrate compliance with this DPA. This includes our security documentation and completed security questionnaires.

11.2 If that information is not enough to meet a requirement of Data Protection Laws, or a supervisory authority requires it, you may audit our compliance with this DPA. You, or an independent auditor bound by confidentiality, may do so no more than once a year, on at least 30 days' written notice, during business hours, and in a way that does not disrupt the Service or reveal other customers' data. You bear the cost of the audit.

12. US state privacy laws

Where the CCPA or a similar US state law applies, we act as your "service provider" or "processor". We will not sell or share Customer Personal Data, or retain, use or disclose it outside our direct business relationship with you. We will comply with the obligations those laws place on service providers and will tell you if we can no longer meet them. You may take reasonable steps to stop and remediate any unauthorized use.

13. General

13.1 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where those limitations are not permitted under the SCCs or Data Protection Laws.

13.2 Order of precedence. If documents conflict, the order of precedence is: the SCCs and UK Addendum; then this DPA; then the Terms.

13.3 Term. This DPA lasts for as long as we process Customer Personal Data on your behalf.

13.4 Governing law. Except for the SCCs (Section 10.2), this DPA is governed by the law and jurisdiction set out in the Terms.

13.5 Changes. We may update this DPA to reflect changes in Data Protection Laws or the Service, with notice as described in Section 20 of the Terms. No update will reduce the overall protection this DPA gives Customer Personal Data.

Annex I: Description of processing

A. List of parties

B. Description of transfer

Categories of data subjects

• The Customer's personnel and authorized users of its Adeli organization
• The Customer's end users and clients whose social accounts are connected through the Service
• People who interact with connected accounts, such as commenters, people who send direct messages, and WhatsApp contacts

Categories of personal data

• Names, email addresses and roles of the Customer's users
• Social account identifiers, handles, display names, profile images and follower counts
• OAuth access and refresh tokens (encrypted at rest)
• Post content, captions and media submitted for publication, with delivery status
• Analytics and insights the platforms provide for connected accounts
• Comments, replies, direct messages, inbox history and WhatsApp messages retrieved from or sent through connected accounts, including the sender's name, handle or phone number
• Logs of API and MCP calls made under the Customer's account

Sensitive data. The Service is not designed to process special categories of personal data. Such data may appear incidentally in content, comments or messages that the Customer or third parties submit. Annex II applies to it.

Frequency of the transfer. Continuous, for as long as the Customer uses the Service.

Nature of the processing. Hosting, storage, transmission, formatting and display of Customer Personal Data. This is done as needed to publish and schedule content, to retrieve engagement data, comments and messages, and to send the replies and messages the Customer instructs on the platforms the Customer connects.

Purpose of the processing. Providing, securing and supporting the Service under the Terms.

Retention. For the term of the Terms, then deletion under Section 9. Shorter periods for specific data are set out in Section 10 of our Privacy Policy. For example, OAuth tokens are deleted as soon as an account is disconnected, and cached messages and comments are deleted after 30 days.

Transfers to Subprocessors. As listed in Annex III, for the purposes stated there, for the duration above.

C. Competent supervisory authority

As determined by Clause 13 of the SCCs, based on the Customer's establishment or representative.

Annex II: Technical and organizational measures

Encryption

• All traffic to the Service and between the Service and platform APIs is encrypted in transit with TLS
• Data is encrypted at rest in our database and object storage
• OAuth tokens for connected accounts get an additional layer of encryption at the application level, and API keys are stored only as one-way hashes, so we cannot read them back

Access control

• Every request is scoped to one organization. A customer's API keys, MCP sessions and dashboard users can only reach that organization's data
• Inside each organization, roles (owner, admin, member) limit who can do what
• Dashboard sign-in uses Google. Agent access uses OAuth 2.0 with PKCE and short-lived access tokens
• Access to production systems is limited to the founders, with multi-factor authentication on infrastructure and vendor accounts
• Each founder uses an individual account for production systems, with no shared logins
• Administrative actions on our hosting platform are recorded in an audit log

Data minimization and retention

• We request only the platform permissions each feature needs
• Cached copies of platform data, such as messages and comments, are deleted automatically after 30 days. Other data is deleted on the schedule in Section 10 of the Privacy Policy
• Uploaded media can be deleted once its post is delivered or cancelled. On request, we delete it within 30 days at the latest

Application and infrastructure security

• We host on managed cloud providers (Annex III) and do not run our own data centers
• Production and development environments use separate databases, and development never uses production customer data
• Code changes go through pull requests that run automated tests, type checks and linting
• Dependencies are kept up to date with automated scanning

Resilience

• Our managed database provider keeps a continuous restore history, so we can recover the database to any point in the last 6 hours. Backup copies expire within 90 days
• We monitor uptime and errors, and failed platform deliveries are retried where the platform allows it

Incident response

• We have an incident response process for identifying, containing and reporting Security Incidents, including the customer notification in Section 8

Vendors and personnel

• We review Subprocessors before we engage them and bind each one to written data protection terms (Section 6)
• Everyone with access to Customer Personal Data is bound by confidentiality

AI

• No Customer Personal Data is used to train AI models, and our Subprocessors may not use it for that either

Annex III: Subprocessors

The current list is at tryadeli.com/subprocessors.

Signed copy

Nothing needs to be signed for this DPA to apply. If your records need a signed copy anyway, save this page as a PDF, add your company's details and sign it. You don't need to send it back.