Revised October 4, 2026.
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or a written agreement (“Agreement”) between AI Psychometrics Inc. (“Company”) and the Customer. It concerns personal data Company processes on Customer’s behalf in providing applicant assessment, reporting and related contracted services (“Customer Personal Data”). It does not cover Company-controlled business-account, billing and website consultation data except when explicitly agreed. Acceptance requires a complete processing and transfer schedule. Publication alone does not establish Customer acceptance or satisfy a mandatory transfer requirement.
1. Definitions, order and roles
“Data Protection Law” means privacy/security law applicable to this processing in the planned supported markets of the Republic of Korea, Australia, Singapore, the United States and Canada, including where applicable Korea’s Personal Information Protection Act (“PIPA”), Australia’s Privacy Act 1988 and Australian Privacy Principles (“APPs”), Singapore’s Personal Data Protection Act 2012 (“PDPA”), Canadian federal or provincial privacy law and applicable US federal/state law. GDPR and UK GDPR may become relevant to a separately approved EU/UK processing route but are not activated by interface-language support. “Subprocessor” means a third party engaged by Company to process Customer Personal Data. “Personal Data Breach” means a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data. “SCCs” means the European Commission’s 2021/914 Standard Contractual Clauses when validly incorporated. Defined legal roles take their meaning from the relevant law: GDPR controller/processor labels do not replace PIPA consignor/consignee or Canada’s accountable-organization duties. In the Korea module the terms personal information handler (consignor) and consignee are used. The Customer normally determines hiring purposes and acts as controller or consignor; Company normally processes that data for the Customer. If Customer acts for another controller, it represents that it has authority to appoint Company as subprocessor. This DPA controls over the Agreement on Customer Personal Data, including Section 12 of the Terms to the extent expressly agreed there; mandatory transfer terms and local statutory rights control over conflicting terms here. The privacy/security Enhanced Cap (referred to in earlier versions as the “Super-Cap”) is stated in Terms Section 12 and this DPA Section 12 with the same figure and scope. No contractual allocation removes direct duties that law imposes on either party.
2. Instructions and use limits
Customer’s documented instructions consist of the Agreement, a completed Annex 1, authorized Service settings and later written instructions accepted by Company. Company processes only on those instructions to provide, secure and support the Service, including approved transfers, unless law requires otherwise; it will inform Customer first unless prohibited. Company will promptly inform Customer if it believes an instruction infringes applicable Data Protection Law and may pause the affected processing while the parties resolve it. Customer is responsible for legal basis, accurate applicant notices and required choices, fair and lawful employment use, and authorization from any upstream controller. Company will not sell or share Customer Personal Data for cross-context behavioral advertising, use it for another customer’s hiring decision, or train a provider model on it outside an express, lawful documented arrangement. Any de-identification, including pseudonymization and anonymization, must meet applicable law; pseudonymization alone does not remove this DPA. Company will conduct optional pseudonymized differential-item-functioning (DIF) research only with a documented purpose, choice or other lawful basis, separation from operational records, access limits and a retention/deletion process that meets Section 9. Applicant public badges and optional research require separately defined instructions and choices; an assessment invitation alone is not an instruction to publish a credential.
3. Processing details and personnel
Annex 1 sets out subject matter, purpose, duration, data subjects, types of data and operations. Company limits personnel access to those with a legitimate need, binds them to confidentiality, and provides suitable privacy/security instruction. Customer controls which of its users and permitted partners can access its tenant. Tenant access is controlled by database membership and applicable RLS policies. Privileged administration and public sharing require separate controls; no service-wide isolation certification is made.
4. Security
Company will implement appropriate technical and organizational measures based on risk, including the measures in Annex 2. Measures may improve without materially decreasing overall protection. Company does not promise SOC 2 or ISO certification. Company will make reasonably available existing security information to assist with Customer’s lawful review, subject to confidentiality, and will record the applicable security measures in Annex 2.
5. Subprocessors
Customer gives Company general written authorization to engage the verified Subprocessors listed in completed Annex 3 and, subject to the notice and objection process in this Section, later routine additions or replacements. Company remains responsible for their relevant processing and will ensure applicable written obligations protect Customer Personal Data. Before a routine new or replacement Subprocessor processes Customer Personal Data, Company will give Customer at least 30 calendar days’ advance notice by email to the designated security or legal contact and through the maintained portal list. Customer may object on documented data-protection grounds within 15 calendar days after receiving that notice. Company and Customer will work in good faith to find a reasonable alternative. If no reasonable alternative is available, Customer may terminate only the affected service and receive a refund of the amount paid for the unused purchased Credits of that service, calculated under the refund terms of the Agreement; other services and fees are not affected. An urgent replacement needed for security or continuity may be notified as soon as practicable, with the reason for urgency and the same objection route; mandatory law and any stricter authorization requirement remain controlling. PIPA re-consignment requires the consignor’s consent under applicable law; general authorization does not override a stricter instruction or local requirement. Annex 3 must identify actual contracting entities, tasks, data categories, processing and support-access countries, retention and transfer safeguards before acceptance. Stripe or other account processors belong in this DPA only to the extent they process Customer Personal Data.
6. Overseas processing and transfers
Company and approved Subprocessors may process data only in countries and through transfer routes accurately disclosed in completed Annex 3. The Customer and Company will cooperate on required disclosure, legal bases and safeguards; the Customer remains accountable for its own applicant notices and lawful transfer instructions, while Company provides accurate recipient and processing details. For EEA restricted transfers, parties may separately execute or validly incorporate the correct 2021/914 SCC module (controller-to-processor or processor-to-processor), fill the official annexes, choose an appropriate governing law and forum, and perform supplementary assessment where required. UK transfers need the UK Addendum or other lawful mechanism; Swiss transfers need jurisdiction-specific adaptation. A bare reference to SCCs with incomplete countries and annexes is not presented as an effective transfer mechanism. For Korea, determine the applicable Article 28-8 ground for each transfer, with recipient/country/purpose/retention/refusal particulars where the ground and law require them; consent is one possible ground, not a blanket requirement for every transfer. The transfer notice must also distinguish overseas provision, consignment and storage, and consider onward transfers. A runtime in Seoul does not eliminate other overseas routes. For Australia and Singapore, use the dedicated modules in Annex 4 and complete their actual recipient, country, purpose, safeguards and transfer routes before processing there. Other markets, including Japan and China, need a separately approved supplement and documented lawful basis before onboarding; merely naming APPI or PIPL does not activate a market. For Canadian data, the accountable organization must use contractual or other means for comparable protection and address foreign-access transparency under applicable law. Each party will comply with the country-specific obligations applicable to its role. The known compute/storage locations are set out in Annex 3. Compute or storage region does not identify provider support-access countries or establish zero retention.
7. Assistance and rights
Taking into account processing and information available, Company will reasonably assist Customer with access, correction, deletion, objection, portability, security, breach assessment, impact assessments and regulator inquiries where applicable. If a person asks Company directly about Customer Personal Data, Company will verify and refer or coordinate with Customer unless law requires direct action. Company will handle such requests without undue delay, subject to applicable statutory deadlines. Non-standard assistance may be charged only under a fee agreed in advance, except to remedy Company breach. Customer decides its hiring response and human review; Company supplies available system information but does not claim a completed validation or bias audit it has not conducted.
8. Personal Data Breach
Reports and follow-up inquiries may be sent to help@ai-psychometrics.com. Company will notify Customer without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will be sent to the account owner and designated security contact through the agreed notification procedure. The initial notice will include available facts about the nature of the breach, affected records, likely consequences, containment and the contact for follow-up; it need not await a complete investigation. Company will provide material updates as facts are verified, take reasonable containment and investigation steps, and assist Customer with legally required notifications. Customer must maintain accurate contact details. Each party retains its direct statutory duties and may make a legally required notification; no contractual deadline extends a shorter mandatory period or permits delaying a notice required without undue delay.
9. Data return, retention and deletion
Company will retain candidate assessment data for a default period of up to three years (1,095 days), subject to Customer instructions and applicable law. Company will document each category’s start event, any agreed shorter Customer setting and lawful retention exceptions in Annex 1. Following Customer’s written return/deletion request or termination of Service, Company will provide a 30-day export window for Customer Personal Data it may lawfully provide, delete relevant data from active systems and backup copies within the verified periods stated in Annex 1 for each system and category. Company will state a period in Annex 1 only after verifying the actual deletion cycle of the relevant system or Subprocessor. Company will reapply deletion to restored copies and coordinate the relevant obligations with its processors.
These obligations cover raw answers, assessments, individual and cohort reports, object storage, badges, audit/outbox logs, third-party artifacts and backups. Company will protect retained data, limit access and use, identify any lawful retention or justified hold where permitted, and delete data when the basis ends. Company will provide a factual deletion record after checking the relevant systems. Separately approved pseudonymized DIF data will be retained for no more than 12 months, kept separate from primary assessment records, and deleted when the approved period expires. Optional research requires its applicable lawful basis and consent where required. Company will keep the category schedule in Annex 1 current.
10. Information, audits and regulator oversight
Company will provide information reasonably necessary to demonstrate compliance and allow audits or inspections required under applicable law, subject to reasonable advance notice, security, confidentiality and protection of other customers’ data. Unless applicable law or a regulator requires otherwise, an audit will start with remote review of documents and written answers; will be requested on at least 30 calendar days’ written notice and no more than once in any 12 months (except after a confirmed Personal Data Breach); will be conducted under written confidentiality terms; and will be at Customer’s cost, including Company’s reasonable documented costs of supporting it. An on-site inspection takes place only where remote review cannot satisfy a requirement of applicable law. The parties can agree a different scope and cost allocation that does not obstruct a statutory audit, post-breach investigation or supervisory request. Company will correct material verified non-compliance. Audit arrangements must not obstruct mandatory statutory supervision or audit rights. Company will cooperate with lawful regulator requests while protecting other customers.
11. Government requests and models
Company will assess lawful public-authority requests, disclose only what law requires, and notify Customer when legally permitted. Company will assess each government request under applicable law and the terms of this DPA. Where a model provider processes Customer Personal Data, Company will seek service terms and settings appropriate to the stated purpose and disclose actual provider use, training and retention terms rather than guarantee every API feature has zero retention. A setting enabled in one organization is not proof for every route. The Customer should avoid submitting information not needed by the model task.
12. Liability, duration and language
The Agreement’s liability provisions apply only insofar as lawful and not contrary to mandatory SCCs or local statutory rights. For claims between the contracting parties, the General Cap equals fees actually paid by Customer to Company for the Service during the 12 months immediately before the event giving rise to the claim, with no USD 100 minimum. Claims between the parties arising from breach of confidentiality, security obligations or this DPA are subject to a single aggregate Enhanced Cap (referred to in earlier versions as the “Super-Cap”) equal to the greater of (a) two times the General Cap or (b) US$15,000, not added to the General Cap. These definitions and tiers mirror Terms Section 12; the Terms exclusions for fraud, willful misconduct, gross negligence, unpaid fees and non-waivable liability remain. No cap alters valid SCC terms or an individual’s or regulator’s independent rights. This DPA applies while Company processes Customer Personal Data covered by it, and any protection duties survive until return or verified deletion and end of lawful retained copies. Language. This DPA is in English, which is the controlling language of this agreement. Any translation is provided for convenience only. Where Customer is located in Korea, Quebec or another jurisdiction whose mandatory law requires a local-language version or notice, Company will make that version available before acceptance, and Customer confirms by its acceptance that it has had the opportunity to review it and to obtain advice, and that it agrees to be bound by the English version. Nothing in this Section limits mandatory law that requires a term, notice or consent to be provided in a particular language or that gives priority to the local-language text. Notices to individuals, including privacy notices, are effective in the language in which they are provided to those individuals. A Customer located in Quebec confirms that the parties have expressly required that this agreement and all related documents be drawn up in English, and Company will provide a French translation on request.
Annex 1. Processing description
Parties. Customer: identity and security/privacy contact in the Order. Company: AI Psychometrics Inc., help@ai-psychometrics.com.
Subject matter and purpose. Invitations, hosting Theta AI/Titan AI assessments, delivery of items, scoring, response-integrity records, individual and cohort reports, Customer-authorized sharing and support. Applicant badge processing follows a separate choice; employer/partner programs have separate status records.
Operations. Collection, storage, delivery, adaptation of items, statistical/model evaluation, scoring, report generation, limited disclosure, export and deletion.
Subjects. Invited applicants and Customer users to the extent their data forms Customer-controlled content; optional badge holders where Customer instructs the credential.
Data. Name/identifier/email, role and invitation records, answers including free text, presented items, timing, status, scores, bands, rationale, integrity records, reports, IP/session/access logs, badge consent and status. Free text may incidentally include sensitive data.
Duration and schedule. Company will apply the three-year (1,095-day) default retention period, 30-day export window and the verified active-system deletion and backup periods stated in Annex 1 under Section 9. Company will document each category’s start event, lawful exceptions and any agreed shorter Customer setting, coordinate processor deletion and reapply deletion after restoration. A processing or transfer route requiring additional particulars or a legal basis will not start until those requirements are satisfied.
Independent processing. Company-controlled website consultation, account billing, and independent security/legal duties are separately described in the Privacy Policy.
Annex 1A. Category schedule
Invitations, raw answers, score state. Company will document the completion or withdrawal start event and apply Section 9’s retention and deletion periods, subject to lawful holds.
Individual reports, cohort PDFs and object storage. Company will document the report-generation start event, delete file bytes and related references, and close associated share links under Section 9.
Badge records, consent and public tombstones. Company will distinguish withdrawal and expiry, end public display as required by the holder’s choice, and retain only a limited, lawfully justified audit record.
Account/billing records and payments. Company will apply the statutory and accounting retention period applicable to each record. Applicant retention periods do not silently override those legal obligations.
Access/security logs, mail outboxes and temporary processor artifacts. Company will document each applicable start event and retention period, apply the relevant deletion obligation and coordinate provider deletion.
Backups and restored copies. Company will enforce the verified backup period stated in Annex 1, subject to lawful exceptions, and reapply deletion to restored copies. Company will test the procedure and keep a record.
Annex 2. Security measures
Company will use role-based access controls, encrypted transport and private storage for Customer Personal Data. Company will maintain and test backup-restoration, termination-deletion and security-response procedures, document the tests, and correct identified defects. Company will not materially reduce the overall protection provided by its security measures.
Incident reports, refund requests and badge appeals may be submitted to help@ai-psychometrics.com. The notification commitments in Sections 5 and 8 remain unchanged.
Annex 3. Service providers and international processing
The service uses Vercel for hosting; Supabase for authentication, database and file storage; Google Cloud for assessment runtime; OpenAI for model processing; GitHub for source, jobs and temporary artifacts; Neon for assessment databases; Resend for transactional email; and Stripe for payment processing. Stripe is within this DPA only to the extent it processes Customer Personal Data rather than independent Company billing data. Groq is not included as an active processor.
Known assessment compute locations include South Korea and the United States. Database and other service processing includes the United States. These compute/storage locations do not establish all provider support-access or onward-transfer countries. Company will establish any required support-access and onward-transfer restrictions with its providers before the relevant transfer. Applicable recipient, data category, purpose, retention and lawful-transfer particulars must be completed before a route requiring them is accepted.
The provider-change and objection policy in Section 5 is unchanged.
Annex 4. Local law supplements (each activated only for an approved market)
No country supplement is activated merely by including its heading here. For an approved market, Company and Customer will document that market’s roles, notices, data categories, required transfer instrument, contact and actual route, local rights and language/assent mechanics; the accepted Order must identify the applicable supplement. The planned supported market modules are Korea PIPA consignment and international transfers; Australia Privacy Act 1988 and APPs; Singapore PDPA; Canada including applicable provincial requirements; and US federal/state/local employment and privacy rules. EU/EEA GDPR and the official SCCs (correct module and complete annexes), UK Addendum, Japan and China are not activated by this market list; they need separate approval if a relevant offer or data route is proposed. The five-market designation does not mean any module is operationally completed.
Korea PIPA consignment module (for an approved market)
The Customer is the consignor and Company the consignee for work in Annex 1 where PIPA applies. Processing outside the consigned purpose is prohibited; technical and managerial protections are in the finalized Annex 2; the Customer may supervise and inspect as applicable under Section 10; re-consignment requires the required Customer consent and flow-down; each party’s damage liability follows mandatory law and the valid Agreement to the extent lawful. Customer publishes the consignment details required by law, using accurate provider and work descriptions Company supplies. Any direct duty of Company as consignee remains.
(a) Terminology. In this module, Customer is the consignor, Company is the consignee, and Subprocessors are re-consignees.
(b) Breach notice. For Customer Personal Data subject to PIPA, Company will notify Customer without undue delay and in any event within 72 hours after Company becomes aware of a Personal Data Breach, or of unauthorized access to systems processing Customer Personal Data that may have resulted in one, with the information then available.
(c) Re-consignment consent. Customer consents to the Subprocessors listed in Annex 3 at acceptance. The notice-and-objection procedure in Section 5 is the procedure by which Customer’s consent to re-consignment under Article 26(6) of PIPA is requested and given; a Subprocessor added after the notice period without a timely documented objection is treated as consented to, and if Customer objects, the termination remedy in Section 5 applies.
(d) Company’s own-purpose use. Company will not use Customer Personal Data subject to PIPA for its own research or product-improvement purposes, including pseudonymized DIF research, unless (i) Customer has authorized it in writing identifying the purpose and the legal basis under PIPA (including Article 28-2 where relied on), and (ii) any resulting transfer to Company outside Korea has a valid ground under Article 28-8 of PIPA. Provision to Company for its own purposes is treated as provision to a third party, not as consigned processing or storage.
(e) Pseudonymized and anonymized data. Pseudonymized data remains Customer Personal Data under this DPA. Anonymized data means data from which an individual can no longer be identified; it may be created only on Customer’s written instruction.
Australia Privacy Act 1988 / APP module (for an approved market)
For an Australian Customer or applicant where the Privacy Act 1988 and APPs apply, each party will carry out its own statutory role and give or support required collection notices and access/correction processes. Customer must identify the lawful assessment purpose and provide the collection and overseas-disclosure information required for its role. Company will give Customer accurate information about approved overseas recipients, actual destinations, onward subcontractors and safeguards so the relevant APP entity can assess APP 8 and other applicable obligations; Company will contractually require appropriate protection from its own subprocessors and reasonably assist with security and eligible-data-breach assessments. For each route, the parties will determine whether a recipient obtains access outside the disclosing entity’s effective control (ordinarily a disclosure) or whether a tightly controlled storage arrangement remains a use, and whether any APP 8.2 exception actually applies. Neither overseas hosting nor use of a contractor alone answers that classification. Under the Notifiable Data Breaches scheme, a suspected eligible breach requires prompt assessment and an eligible breach generally turns on likely serious harm. If the Company and Customer jointly hold affected information, each may have statutory obligations, although a coordinated assessment and one valid notification can discharge the common scheme steps; their incident plan must name an assessment and notice lead, information-sharing path and backup if the lead fails. The incident plan will identify the applicable roles and response responsibilities. Each party will assess its status under the Privacy Act and comply with APP 8 where applicable. The exact data route, responsibilities, overseas recipient list, complaint contact and notice language must be completed and reviewed before use.
Singapore PDPA module (for an approved market)
For a Singapore Customer or applicant where the PDPA applies, Customer identifies its purposes and applicable notification/consent basis for applicant collection and assessment; Company processes on documented instructions and takes appropriate protection, retention-limitation and access controls for its role. Company will supply actual overseas recipient and destination information, and the parties will document any required comparable-protection contractual obligations before a transfer, taking account of the PDPA Transfer Limitation Obligation. For processing solely as a data intermediary under the PDPA, Company must notify the Customer without undue delay once it has credible grounds to believe a breach occurred; the engaging organization assesses notifiability and makes any required PDPC/individual notice. Where Company processes for its own independent purpose, assess its own direct statutory duties separately. Company and Customer will maintain the applicable statutory reporting workflow. Company and Customer will document the applicable roles, notices, transfer safeguards, recipients and timelines before the relevant processing.
Canada PIPEDA / provincial law module (for an approved market)
Where federal PIPEDA or a relevant provincial private-sector privacy statute applies, Customer identifies the purposes and notice or consent basis for applicant collection and assessment, remains responsible for decisions in its control, and makes rights and complaint contacts available. Company will provide its verified data-flow and subprocessor inventory, bind each relevant service provider to appropriate confidentiality, security and restricted-use terms, and assist Customer with access/correction, incident assessment and return or deletion. Company will maintain comparable protection, identify relevant subcontractors and jurisdictions, and document retention and exit arrangements for the applicable Canadian processing route. For purposes of PIPEDA and applicable provincial law, de-identified or pseudonymized information is treated as personal information unless there is no serious possibility that an individual could be identified from it, alone or in combination with other available information.
For a PIPEDA-covered breach at a third-party processor, the principal organization ordinarily has control and the reporting, affected-person notice and record-keeping responsibility; Company must give it facts promptly and assess any direct duty arising from Company-controlled data or a distinct processing role. The breach record includes incidents whether or not reportable, while reporting/individual notice turns on real risk of significant harm. These role allocations must be checked against the actual relationship, including any provincial law. A British Columbia, Quebec or other provincial route must be separately checked for its applicable requirements rather than treated as identical to PIPEDA. Actual parties, applicant locations, processors, countries and any provincial addendum remain to be completed.
United States federal, state and local module (for an approved market)
Customer will identify the hiring location and use of any scores, rankings or thresholds before use and provide legally required applicant notices, accommodation routes, human review and alternative procedures. Company will provide available product-use limitations, version information and documented audit evidence, if any, without asserting a completed bias audit or job-validity study. The parties will determine whether any specific local automated employment decision tool rule, state privacy/biometric law or video-interview rule applies to the deployed workflow and allocate notices, audits and response tasks by written schedule. A label such as “decision support” does not settle the tool’s actual classification. This supplement neither declares compliance with New York City Local Law 144 nor asserts that any voice/video or biometric feature is deployed; Company will give accurate notice of any such feature before its use.