1. Parties, Incorporation and Electronic Acceptance
1.1 This Data Processing Addendum (DPA) is an annex to the applicable Terms of Use between Bleanx Inc., 2810 N Church St STE 88757, Wilmington, DE 19802, United States (Bleanx), and the Customer identified under this Section. It applies only to processing of Covered Personal Data by Bleanx as a processor or subprocessor. Contact: support@bleanx.org; telephone (302) 407-0567.
1.2 Customer means the individual user acting as a controller or processor, or an identified company, client, or other principal on whose behalf an authorized user validly accepts this DPA. Where a principal is represented, its identity, the relevant Services and data, and the user's authority must be established in the applicable account or contractual records or a documented instruction or communication with Bleanx before processing on its behalf begins. A company name, work email domain, payment, or product role alone does not establish authority or bind an unidentified principal.
1.3 This DPA, including its Schedules and the applicable version of Service Providers incorporated into Schedule C, is made accessible with the Terms before acceptance and in a form that can be retained. Acceptance of the identified version of the Terms includes this DPA within its scope, through the same electronic act, without a separate signature, additional checkbox, or corporate tariff. Bleanx retains the relevant version and acceptance record. A user acting for a principal must have authority to enter this DPA for that principal. This does not automatically make that principal the holder of the individual account or the Project Owner or change the party responsible for an individual purchase under the Terms.
1.4 This DPA does not give a represented principal, employer, Project Owner, or participant additional access to another person's account, Projects, personal conversations, or payment information. Acceptance is not consent from data subjects and does not replace separate permissions for external AI processing or search. Changes follow Section 22 of the Terms and any stricter applicable data protection requirements; continued use is not a substitute for required express acceptance.
2. Scope, Roles and Definitions
2.1 Applicable Data Protection Law means personal data protection law applicable to the relevant processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and associated UK legislation, and the Swiss Federal Act on Data Protection (FADP), where applicable. Controller, processor, processing, personal data, and personal data breach have the meanings given by the applicable law. Other capitalized product terms have the meanings in the Terms.
2.2 Covered Personal Data means personal data in content supplied or generated for the Customer and associated records that Bleanx processes on the Customer's documented instructions, as described in Schedule A. Not all business information or Output is personal data, and neither its location in a Project nor ownership of intellectual property determines the legal processing role.
2.3 Bleanx is a processor where the Customer is the controller and Bleanx acts on its behalf. Where the Customer is a processor acting for another controller, Bleanx is a subprocessor for the corresponding operations. The Customer must hold the upstream authorization required to appoint Bleanx and its applicable subprocessors, convey lawful documented instructions, and provide the cooperation needed to fulfil the relevant controller's rights and obligations. It must not authorize processing beyond its actual mandate. Bleanx's statutory obligations are not transferred to the Customer.
2.4 The DPA does not govern Bleanx's processing as an independent controller for administering individual accounts, purchases, billing, resource accounting, or its own necessary security, abuse-prevention and legal-compliance purposes, to the extent these are genuinely independent purposes described in the Privacy Policy. This exclusion is not a blanket exclusion of technical data or security measures: processing necessary to secure Covered Personal Data on the Customer's behalf remains governed by this DPA. Actual purposes and decisions determine the role, not a label. Bleanx may not reclassify covered content as account or security data merely to use or retain it for an unrelated purpose.
3. Documented Instructions and Purpose Limitation
3.1 Bleanx processes Covered Personal Data only on documented instructions, including instructions on disclosures and international transfers, to provide the contracted functions described in Schedule A. Instructions consist of this DPA, the applicable Terms, and lawful actions and settings selected by persons authorized for the relevant data and function. Necessary written clarification may be provided through support@bleanx.org. The Services' ordinary controls do not require a separate written instruction for every action.
3.2 Instructions remain subject to applicable access permissions, the scope of the Customer's authority, and mandatory law. A Project Owner cannot instruct disclosure of another user's private Ask, AI Dialogue, correspondence, account settings, or purchases merely because of Project ownership. Shared contributions, private content, and export rights remain distinct under Sections 1 and 4 of the Terms.
3.3 Bleanx immediately informs the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. It does not carry out an unlawful instruction and may restrict the affected processing to the extent necessary while seeking a lawful resolution. Such a restriction does not create an unrestricted right to terminate unrelated Services or defeat mandatory rights.
3.4 Where Bleanx must process otherwise than on instructions under a legal requirement recognized by Applicable Data Protection Law, it informs the Customer before doing so unless legally prohibited. For processing subject to Article 28(3)(a) GDPR, the applicable Union or Member State law requirements govern that exception. A foreign authority's request does not itself override the requirements for lawful processing or international transfers. Section 10 applies.
3.5 The Customer determines an appropriate lawful basis, necessary notices, and lawful disclosure scope for processing for which it is the controller. Where special-category data or criminal-conviction and offence data is involved, the additional applicable conditions must also be met. An individual's acceptance of the Terms, ownership of a Project, or permission to use AI is not consent from every person mentioned in the content. Bleanx retains its own duties, including minimization, lawful instructions, confidentiality, and security.
4. No Training; External AI, Search, Payment and Email Boundaries
4.1 Bleanx does not use application data for training, fine-tuning, or improving AI models or for independent research, development, or improvement of products or features. The restriction includes aggregated, de-identified, anonymized, or otherwise transformed information derived from that data. The limited processing necessary to provide, support, and protect the Services is not permission for such reuse.
4.2 External AI inference involving Covered Personal Data is performed only within authorized functions and context, with the initiating user's required active permissions and under provider agreements and settings consistent with this DPA and Section 4 of the Terms. AI model providers are not authorized to use the supplied application data for model training or independent product development. A no-training restriction is not a representation that no provider retention occurs. Personal AI permission applies to actions initiated by the relevant user. Another author's withdrawal of that personal setting does not, by itself, revoke documented instructions for permitted processing of shared Project content in actions initiated by other authorized users. Such processing remains limited to authorized functions and context, the initiating user's necessary active permissions, lawful documented instructions, and Applicable Data Protection Law. This provision does not permit Bleanx to disregard mandatory erasure or restriction of processing, a valid withdrawal of consent on which the particular processing relies, or a lawful controller instruction to stop the affected processing.
4.3 Voluntary bug reports and accompanying materials are used only as necessary to diagnose, reproduce, correct, and verify correction of the reported error. Bleanx does not submit user data through provider feedback channels permitting training or product development. Necessary provider assistance must use a compatible support channel or a reproduction without user data.
4.4 The narrowly scoped provider uses of transmitted search queries, payment data, and email-delivery metadata described in Section 4 of the Terms do not authorize Bleanx's own training or product-development use. Each exception is limited to the data, recipients and purposes expressly stated there. The search exception is confined to the transmitted query under the applicable search scenario. The payment exception does not authorize independent improvement use of underlying Project materials, full AI context, personal conversations, or consumption records. The Resend / AWS / SES exception is confined to sender and recipient addresses, delivery statuses, bounces and delivery failures, and technical transmission metadata for operating and optimizing the relevant email-delivery services. It does not authorize reuse of email subjects, bodies, attachments or information extracted from them beyond processing necessary for delivery, and does not extend to Project materials, User Content, Output, private AI interactions, direct messages, or Bleanx's allowance and consumption records or transformed information derived from them. It does not extend to Google Workspace's separate support-mail processing. These exceptions do not waive the safeguards in Section 4.5.
4.5 A recipient's independent use is not processing solely on the Customer's instructions and must not be described as subprocessing merely by placing the recipient in a vendor list. Before any disclosure of Covered Personal Data for such a purpose, Bleanx must establish a lawful disclosure route, the required authority and permissions, appropriate contractual protection, and a valid transfer mechanism where required. Acceptance of this DPA does not authorize an incompatible provider use or waive Article 28 safeguards. Where those requirements cannot be met, the affected personal data must not be transmitted through that flow. Relevant data-free or appropriately minimized alternatives may be used only where they genuinely satisfy the applicable requirements.
5. Confidentiality and Security
5.1 Bleanx limits access to Covered Personal Data to authorized personnel who need it for an allowed task and are bound by contractual or appropriate statutory confidentiality obligations. Access is limited by role and necessity; personnel must follow applicable instructions and security requirements. The confidentiality period in Section 17 of the Terms does not authorize retention of data for that period.
5.2 Bleanx implements and maintains technical and organizational measures appropriate to the risks, taking account of the nature, scope, context and purposes of processing, the state of the art, and implementation costs, as required by Applicable Data Protection Law. Schedule B specifies the required measures. These include appropriate confidentiality, integrity, availability and resilience, restoration capability and assessment of safeguards; encryption and pseudonymization are used where appropriate to the risk.
5.3 Changes to implementation must not reduce the protection required by this DPA. Bleanx documents the relevant safeguards and makes appropriate information available to the Customer. This provision is not a promise of uninterrupted Services, end-to-end encryption, a particular certification, or absence of all vulnerabilities. It does not excuse a failure to apply required security measures.
6. Subprocessors and Changes
6.1 The Customer gives general written authorization for the named subprocessors and corresponding processing activities identified in the applicable version of Service Providers incorporated into Schedule C made available before acceptance. Authorization does not extend to an unspecified service category, an unresolved placeholder, or every independent activity of a named provider. Bleanx verifies sufficient guarantees before entrusting Covered Personal Data to a subprocessor.
6.2 Before adding or replacing a subprocessor, Bleanx provides written notice through the Customer's recorded service or data-protection contact, with at least 14 calendar days before the proposed subprocessor first processes the affected data. The notice identifies the legal entity, service, processing locations, data and activities involved, relevant safeguards, proposed date, and a channel for objection. Updating a public list alone is not sufficient notice. A longer period or specific authorization required by applicable law or an applicable transfer instrument prevails.
6.3 The Customer may object before the proposed processing begins on reasonable data protection grounds by contacting support@bleanx.org. Bleanx considers the grounds in good faith and seeks a compliant resolution, such as additional safeguards or an appropriate alternative. The objected-to subprocessor is not given the affected data before the objection is resolved through a lawful arrangement. Silence following a compliant notice may operate only within the general written authorization; it does not replace a separate consent or specific authorization required for a different purpose.
6.4 If no compliant resolution is available, the parties arrange an alternative or lawful ending of the affected processing in accordance with the Terms and mandatory law, preserving applicable notice, refund, return and deletion rights. This DPA introduces no automatic forfeiture, new termination charge, or right to end unrelated Services. Urgency does not dispense with prior authorization or make unlawful processing permissible.
6.5 Bleanx binds each subprocessor to data protection obligations providing the protection required for the entrusted processing, including instructions, confidentiality, security, assistance, deletion and applicable transfer safeguards. Bleanx remains fully responsible to the Customer for performance of the subprocessor's obligations to the extent required by Article 28(4) GDPR and other applicable law. Appropriate evidence of the arrangement is provided on request, with proportionate protection of unrelated confidential information.
7. Assistance, Rights and Assessments
7.1 Taking account of the nature of processing, Bleanx assists the Customer through appropriate technical and organizational measures, insofar as possible, in fulfilling requests for access, rectification, erasure, restriction, portability, objection, and other applicable rights. The existing export and account controls supplement this assistance; they are not a prerequisite for a valid request through support.
7.2 Bleanx informs the Customer without undue delay of a data-subject request concerning Covered Personal Data where the Customer is responsible for deciding it and provides necessary cooperation. Where the Customer is a processor, assistance follows the lawful upstream chain. Bleanx does not disclose another user's private data or grant access based only on the assertion of a principal's identity. Requests involving Bleanx's own controller processing are handled by Bleanx. A person without an account may contact support@bleanx.org, and a valid request is not ignored or unnecessarily required to be repeated.
7.3 Bleanx assists with compliance with applicable security, breach-notification, data protection impact assessment and prior-consultation obligations, taking account of the nature of processing and information available to it. This includes supplying relevant processing and security information, evaluating affected data and risks, and cooperating on necessary safeguards. Assistance does not replace the controller's own decisions and duties or postpone mandatory deadlines.
8. Personal Data Breaches
8.1 Bleanx notifies the Customer without undue delay after becoming aware of a personal data breach affecting Covered Personal Data. An initial notification is not delayed pending a complete investigation. Information not available initially is provided in phases without undue further delay.
8.2 To the extent available, notification describes the nature of the breach, affected categories and approximate numbers of data subjects and records, a contact for further information, likely consequences, and measures taken or proposed to address the breach and mitigate adverse effects. Bleanx investigates, contains and remedies the breach and cooperates with the Customer on required notifications and protective measures, while preserving necessary evidence in a proportionate manner.
8.3 The controller's time limit for notifying an authority is not a separate waiting period available to Bleanx as processor. Notification under this Section does not depend on proving fault or completing a liability assessment. Bleanx does not make notifications on the Customer's behalf to authorities or individuals without the appropriate instruction unless required by applicable law; its own independent notification obligations remain unaffected.
9. Demonstrating Compliance and Audits
9.1 Bleanx makes available information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Customer or an auditor mandated by it, as required by applicable law. Relevant existing reports may be used where they adequately address the request, but do not automatically replace a justified audit or the powers of a competent authority.
9.2 Reasonable arrangements concerning scope, timing, confidentiality and security may protect other customers' data and unrelated confidential information. They must not obstruct a necessary audit, impose an unjustified categorical restriction, or delay urgent verification required following an incident or by an authority. This DPA does not create an additional audit fee or limit mandatory cooperation to a fixed number of audits. No particular certification or completed audit is represented unless factually established.
10. International Transfers and Public-Authority Requests
10.1 Bleanx is a United States company and is not certified under the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework. This DPA does not rely on Bleanx's participation in those frameworks. Each international disclosure or access arrangement must satisfy applicable transfer requirements before it begins, including onward transfers to providers.
10.2 For a restricted transfer from the EEA, the parties establish an appropriate Chapter V mechanism. Where legally applicable, this may be the relevant module of the European Commission's standard contractual clauses under Decision (EU) 2021/914, completed and made binding on the correct parties, together with the required assessment and supplementary measures. Module Two concerns a controller-to-processor transfer; Module Three concerns a processor-to-subprocessor transfer. Other flows require their correct qualification rather than automatic use of those modules.
10.3 The 2021/914 clauses must not be relied upon outside their legal scope, including where the importer's relevant processing is directly subject to the GDPR and those clauses are not an eligible transfer tool. In that case, an applicable alternative Article 46 mechanism must be established, including any required authority approval for individually agreed clauses. Merely reproducing the 2021 clauses or citing this DPA does not establish such approval. Routine service transfers are not justified by treating acceptance of the Terms as an Article 49 derogation.
10.4 A restricted UK transfer requires an appropriate UK mechanism, such as the applicable ICO International Data Transfer Agreement or UK Addendum to eligible EU standard contractual clauses, with completed mandatory information, binding acceptance and the required transfer assessment and supplementary measures. EU clauses without the necessary UK instrument do not, by themselves, satisfy this requirement.
10.5 A restricted transfer governed by Swiss law requires a mechanism permitted by the FADP, such as FDPIC-recognized standard clauses with the necessary Swiss adaptations and safeguards. The parties record the relevant entities, roles, countries, categories, competent authorities, governing-law and forum selections, and contractual instruments in the binding transfer records maintained under Schedule D. A choice of Delaware law in the Terms does not displace mandatory transfer-clause law, jurisdiction or data-subject remedies.
10.6 Before reliance on any transfer instrument, the parties complete its required selections and annexes, assess relevant destination-country laws and practices, implement necessary supplementary measures, and provide enforceable rights. Required instruments may be incorporated and accepted electronically where valid under their governing rules; the absence of a separate DPA signature does not waive their execution requirements. Bleanx ensures that the instrument applicable to each restricted transfer is binding on the relevant parties before that transfer begins and maintains evidence of its application. If protection cannot be maintained, the affected transfer is suspended and a lawful solution or return/deletion is arranged.
10.7 Bleanx verifies the authority and legal basis of a public-authority request, limits any disclosure to what is necessary and legally permitted, and gives the Customer notice where permitted. It reviews and, where appropriate and legally available, challenges unlawful or disproportionate requests and seeks protective measures. Where notification is prohibited, it seeks permission to provide notice where appropriate and documents its response to the extent lawful. Mandatory requirements, including Article 48 GDPR and applicable transfer-clause duties, remain applicable.
11. Return, Deletion and End of Processing
11.1 At the end of the relevant processing services, Bleanx returns and then deletes, or deletes, Covered Personal Data at the controller's choice, and deletes existing copies, except to the extent retention is required by law recognized for that purpose under Applicable Data Protection Law. For Article 28(3)(g) GDPR, the Union or Member State law condition applies. General commercial interests, unpaid disputed sums, or confidentiality obligations do not create a right to retain covered content indefinitely.
11.2 Return may use the complete self-service package under Settings > Account > Export all user data, the protected read-only interface with a revocable export access key, applicable Project exports, or support assistance under Sections 1 and 12 of the Terms. The format preserves relevant structure, metadata, content and applicable AI-origin indicators. Data and third-party safeguards remain applicable without restricting mandatory return rights. Export alone does not cancel a Subscription, delete data, or commence a deletion period.
11.3 Confirmed account deletion follows Section 12 of the Terms: the account and owned Projects are immediately deleted from operational systems, with no recovery period, and personal Ask and AI Dialogue content is deleted. This DPA does not delay that chosen route to impose a switching period. It does not require deleting another controller's data, another user's Project, or an independently and lawfully held correspondence copy merely because one individual leaves or deletes an account. Retained contributions and messages remain subject to mandatory erasure, restriction, lawful-basis and platform requirements; ownership does not override personal data rights.
11.4 Where the EU Data Act switching procedure applies, Bleanx provides the transition, assistance and continued contractual service required by Section 12, followed by at least 30 calendar days for retrieval after the applicable transition and then the required erasure. This retrieval period is not an account-recovery window. An ordinary request for a copy, a switching request and a confirmed immediate deletion are distinct instructions. Statutory access and portability deadlines are not extended by the switching timetable.
11.5 Residual backup copies are subject to the finite retention and overwrite arrangements in Schedule B and disclosed in the Privacy Policy. They remain protected and unavailable for ordinary operational use pending deletion. If infrastructure is restored, previous deletions are reapplied so that deleted data is not returned to ordinary processing. The Customer is informed of the applicable residual-copy treatment; technical inconvenience is not a general retention exception. The Supabase backup settings, residual-copy limits, and restoration safeguards are specified in Schedule B6.
11.6 Bleanx instructs applicable subprocessors to return or delete affected data and takes necessary steps to verify completion. On request it provides confirmation explaining the scope completed, any lawful retention, and residual copies awaiting scheduled deletion rather than certifying unverified destruction of every record. Its own financial, tax, settlement or other independently necessary controller records are handled separately under the Privacy Policy; the distinction cannot be used to retain unrelated content or use retained data for prohibited training or product development.
12. Precedence, Duration and Preserved Rights
12.1 Mandatory law and any applicable binding international-transfer instrument prevail over inconsistent provisions. Within its scope this DPA governs processor obligations if the Terms contain less specific or conflicting processing language. It does not change intellectual property ownership, introduce a new tariff or payment, expand participant access, or authorize processing prohibited by Sections 1 and 4 of the Terms.
12.2 The limitations and safeguards in Sections 14–16 of the Terms apply only to the extent lawful and do not limit non-waivable compensation rights, regulatory powers, mandatory processor responsibility, or rights under an applicable transfer instrument. This DPA creates no additional indemnification duty or separate general monetary cap. The scope of the Terms' governing-law and dispute-resolution provisions is not expanded to bind an unidentified principal or data subject to individual arbitration.
12.3 The DPA applies while Bleanx processes Covered Personal Data, including limited lawful post-termination processing, until the relevant return and deletion duties are fulfilled. Surviving confidentiality and other safeguards do not extend retention. Data subjects retain applicable rights, including complaints to competent authorities and judicial remedies. The DPA may be obtained through support@bleanx.org together with information needed to understand the applicable version and processing arrangement.
Schedule A — Description of Processing
A1. Subject matter and nature: cloud software-as-a-service for organizing business information into Projects, Contours, Modules and Sections, and providing the authorized collaborative and personal functions described in the Terms and Privacy Policy. Operations include receipt, organization, storage, retrieval, display, permitted editing, technical formatting, version and Journal handling, authorized disclosure, export, return, restriction and deletion. Where enabled and authorized, processing also includes preparing task-specific context, external AI inference, handling results and supported external search subject to the separate safeguards in Sections 3, 4 and 10.
A2. Purpose: provide the Customer's requested content-management, collaboration and related functions on documented instructions, not independently exploit the content. Private Ask, AI Dialogue and direct-message content is covered only insofar as the Customer is the relevant controller or authorized processor; Project ownership does not place every participant's private content under that Customer's instructions.
A3. Categories of personal data: personal data actually included in Project settings, text, fields, tables, images, user inputs, saved or generated Output, permitted personal conversations and correspondence; names, contact and professional information and other business-related information about identifiable people included in that content; invitation addresses, participant roles and access instructions; and the necessary content-related identifiers, structure, versions, authorship, times and AI-origin indicators. The actual dataset depends on the Customer's lawful use. This description does not require collection of every category or incorporate all independent account, billing or security records into Covered Personal Data.
A4. Categories of data subjects: relevant Project Owners, Team participants, Reviewers and invited persons; employees, advisers, partners, investors, customers, suppliers, client representatives and other individuals mentioned in supplied materials, AI results, search results or authorized correspondence, including people without a Bleanx account. The minimum age for a Bleanx account does not establish the age of every person mentioned in content.
A5. Sensitive data: processing special-category or criminal-offence data is not authorized merely by the general categories above. Where such data is actually involved, the relevant controller must establish the additional legal conditions and safeguards, and Bleanx must not process or disclose it incompatibly with applicable law or instructions. Ordinary acceptance of the Terms or enabling AI is not an Article 9 exception or Article 10 authorization.
A6. Duration and frequency: storage continues while necessary to supply the relevant contracted function; other processing follows authorized actions and operational requirements. End-of-service return and deletion follow Section 11, the chosen lawful route and mandatory deadlines. Residual copies are retained only within the limits in Schedule B and Section 11, not for an unlimited period or merely because an account exists.
Schedule B — Required Security and Deletion Measures
Bleanx implements and maintains the following technical and organizational measures for Covered Personal Data, consistently with Sections 7 and 8 of the Privacy Policy and the more specific obligations in this DPA. Bleanx documents their implementation, responsible systems, and relevant provider coverage and assesses their effectiveness in light of the risks. Supporting evidence is made available under Section 9 through an appropriately protected channel without disclosing secret credentials or another person's data. This Schedule does not represent a particular certification or independent audit.
B1. Access and separation: individual authentication; server-side authorization by account, Project, role and Contour; isolation of personal histories, correspondence, account settings and payment records; least-privilege personnel access, prompt removal of unnecessary access, and protected administrative credentials. Export keys are purpose-limited, read-only and revocable.
B2. Transmission and storage: appropriately protected connections and storage, including encryption where appropriate; restricted key and credential management; protection of stored images and export packages; and measures to prevent unauthorized disclosure through generated context or output. Merely hiding a Contour in the interface is not a substitute for required personal-data safeguards.
B3. Minimization and permitted use: task-specific AI and search context; enforcement of active, separate AI and search permissions; no inclusion of another user's private content merely because of Project membership; no optional provider training or feedback programs inconsistent with the Terms; restricted operational logs, with measures against excessive content and live secrets. No analytics or advertising tracking is authorized by this schedule.
B4. Reliability and incident handling: risk-appropriate monitoring for operation and security, vulnerability and change management, incident investigation and response, and periodic assessment of safeguard effectiveness. Restore procedures must preserve data integrity, authorization and prior deletion instructions. Testing and bug diagnosis do not permit unrelated product development using customer data.
B5. Personnel and vendors: confidentiality commitments, instructions and necessary training for authorized personnel; due diligence and binding contracts for applicable subprocessors; access limited to the relevant task; maintained evidence of transfer and deletion arrangements.
B6. Backup and residual-copy schedule — Supabase
The configured daily database-backup retention period is 7 days. Point-in-Time Recovery (PITR) is enabled with a rolling 7-day recovery window. The daily-backup retention setting does not mean that a separate daily-backup service runs alongside PITR, and the two periods are not consecutive retention periods.
Following deletion from the live database, pre-deletion recovery points pass outside the rolling 7-day recovery window. The daily-backup period and PITR window are not added together as consecutive retention periods. A recovery window is distinct from the physical purge cycle of every underlying base backup, transaction-log archive or other residual technical copy; no unverified maximum physical-destruction period is represented by that window alone.
Storage scope: database backups contain metadata and references to Storage objects, not the contents of the files themselves. Bleanx does not maintain separate backups of Storage files. Deleted Storage file contents therefore do not remain in these database backups or a separate Bleanx Storage-file backup. Restoring database metadata does not restore the deleted files.
Required controls under Section 11.5: residual copies remain protected against ordinary operational use. Access is restricted to authorized personnel and providers for necessary infrastructure recovery and protection. Before restored data is returned to ordinary processing, Bleanx reapplies prior deletions and applicable restrictions, including affected content, identifiers and Storage references. A restore does not reinstate deleted accounts or Projects, create a user recovery window, or restart an expired retention period. Bleanx remains responsible for arranging the necessary processor actions under Section 11.6; backup retention does not permit prohibited training or product-development use.
Bleanx ensures that residual technical copies are subject to a documented, finite deletion or overwrite cycle limited to the necessary infrastructure-recovery purpose and applicable lawful requirements. It arranges the necessary processor actions, applies the isolation and restore controls above, and supplies the applicable retention period or criteria and deletion information under Section 11.6. The recovery window is not a promise of physical destruction of every underlying copy exactly seven days after a live deletion. Backup locations and transfer safeguards are governed by Schedules C and D. These arrangements do not authorize indefinite retention or postpone required operational deletion.
B7. Purpose-specific retention and rights: Bleanx applies the category-specific retention and deletion rules in Section 7 of the Privacy Policy to financial, technical and provider records, inquiries and attachments, verification records, consent and refusal records, and unfinished invitations. It documents the necessary purpose, lawful basis, scope, end condition and deletion or review arrangements; removes unnecessary copies; and arranges required actions by its processors. Source records, saved Output, summaries and other affected records are considered when implementing erasure, correction or restriction. Independently necessary controller records do not authorize retention of unrelated Covered Personal Data. For data processed on instructions, Section 11 and Applicable Data Protection Law govern any retention exception and take precedence over a broader controller-record criterion.
Schedule C — Service Providers and Authorized Subprocessor Scope
C1. Incorporated register. The applicable version of Service Providers, Bleanx's single public provider register on bleanx.com, forms part of this Schedule. It identifies the providers and services, their respective processing roles, functions and data scope, and processing locations and geographic limits. The register is accessible with this DPA before acceptance and in a form that can be retained. Bleanx records the applicable version and effective date and retains prior versions so that the processing arrangement applicable at a particular time can be established.
C2. Scope of authorization. General written authorization under Section 6 covers only the providers identified in the register as subprocessors, and only their specified processing of Covered Personal Data on the Customer's documented instructions. A provider acting on Bleanx's behalf for Bleanx's independent controller purposes is not thereby a subprocessor under this DPA. An independent recipient is not converted into a subprocessor by inclusion in the register. Where one provider has several roles, each operation retains its separate scope and safeguards.
C3. Contractual and onward-processing safeguards. Bleanx ensures that each entrusted operation is covered by a binding agreement with the correct legal entity, sufficient guarantees, the obligations in Section 6.5, and the applicable transfer mechanism under Section 10 and Schedule D. It maintains the legal identities, relevant contacts, processing locations and contractual versions for the actual processing chain, discloses the information required by law and the applicable instrument, and makes the relevant safeguards available under Sections 9 and 10. Directly engaged providers and providers in their onward chains are distinguished. A provider's general terms or public list do not authorize incompatible processing or undisclosed use of Covered Personal Data.
C4. Changes and preserved rights. Adding or replacing a subprocessor follows the written notice, minimum 14-calendar-day period, objection procedure and safeguards in Section 6 before the affected processing begins. Updating the public register alone does not replace that notice. An inventory-only change does not require rewriting the unchanged rules in the Terms, Privacy Policy and this DPA. However, a register update does not amend those rules, introduce another independent-use exception, authorize a new processing purpose, or replace any longer notice, express acceptance, specific authorization or consent otherwise required. Changes to the contractual or privacy rules follow their own applicable change procedures.
C5. AI, search and administrative boundaries. The no-training restrictions and the limited search-query, payment-data and email-delivery-metadata exceptions remain governed by Section 4 of the Terms and Sections 4.1–4.5 of this DPA. Provider identity or a change in a provider's commercial terms cannot enlarge an exception. Authentication, payment processing, public-site hosting, administrative email delivery, and support processing are qualified separately in the register. Apple Send Consumption Information is not used. Bleanx does not transmit Covered Personal Data through a flow that cannot meet the applicable instructions, lawful-disclosure, permission, contractual and transfer requirements.
Service Providers register: Service Providers 2.0
Schedule D — International Transfer Arrangements
D1. Covered transfer chains and information. Bleanx ensures lawful safeguards for each restricted transfer and relevant onward transfer before it begins. It assesses separately transfers from the Customer to Bleanx, Bleanx's disclosures to infrastructure, AI and other providers, onward processing by their providers, and disclosures to independent recipients. Direct collection from a data subject is not automatically treated as a transfer by another controller or processor. The Customer and Bleanx are identified under Section 1; provider functions, roles and processing geography are identified in Service Providers. Schedule A describes the subject matter, nature, purposes, data categories, data subjects, frequency and duration of instructed processing. Schedule B describes the applicable security, retention and deletion measures.
D2. Binding processing and transfer instruments. Bleanx ensures that the relevant provider processing agreements include or validly incorporate the European Commission's standard contractual clauses where those clauses are the applicable transfer mechanism, together with the UK Addendum and Swiss adaptations where required and eligible. Before relying on an instrument, Bleanx ensures its binding application to the correct parties and actual operations, completes or secures completion of the required selections and annexes, and retains evidence of the applicable versions and acceptance. No separate user-facing DPA signature or additional checkbox is required where the electronic acceptance described in Section 1 validly concludes the relevant arrangement. This does not dispense with a required provider or other party's acceptance.
D3. European Economic Area. A restricted transfer not covered by an applicable adequacy decision uses an eligible Article 46 mechanism. Where Decision (EU) 2021/914 applies, the module follows the actual roles: Module Two for controller-to-processor processing, Module Three for processor-to-subprocessor processing, and a different module only where its conditions fit the actual flow. Mandatory clauses are not altered incompatibly with that Decision. The competent authority, governing law, forum, parties, processing description, security measures and required subprocessor information are determined and recorded under the applicable clauses. The Terms' choice of Delaware law and arbitration does not displace those provisions or data-subject rights.
D4. Eligibility and the Customer-to-Bleanx leg. A provider's processing agreement does not by itself establish a transfer mechanism between the Customer and Bleanx. Bleanx ensures the mechanism required for that leg as well as the onward provider arrangements. Clauses under Decision (EU) 2021/914 are not used outside their legal scope, including where the importer's relevant processing is directly subject to the GDPR and those clauses are not eligible. An applicable alternative Article 46 mechanism, with any required authority approval, is then secured before the affected transfer. Bleanx does not rely on its own certification under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions, and does not treat ordinary service acceptance as an Article 49 derogation.
D5. United Kingdom. Where UK transfer restrictions apply, Bleanx ensures a valid UK International Data Transfer Agreement or the UK Addendum to eligible EU standard contractual clauses, as appropriate to the relevant arrangement. Required tables, parties, selected clauses, information and supplementary protections are completed and binding. EU clauses without the required UK mechanism are not treated as sufficient. Bleanx carries out the assessment required by applicable UK law and maintains evidence of the protection provided.
D6. Switzerland. Where the FADP requires contractual transfer safeguards, Bleanx ensures an eligible recognized mechanism, including recognized standard contractual clauses with the necessary Swiss adaptations. Those adaptations address applicable Swiss statutory references, the competent supervisory authority, covered individuals and enforceable rights, and governing-law and forum requirements as applicable. The corresponding processing information, assessment and supplementary measures cover the actual Swiss-restricted transfer and onward processing; an EU or UK label alone does not satisfy the Swiss requirements.
D7. Assessments, access and supplementary measures. Bleanx documents the transfer assessment required for the selected mechanism, including relevant destination-country laws and practices, actual processing and access arrangements, the parties' ability to fulfil their obligations, and necessary supplementary contractual, technical and organizational measures. Primary hosting regions do not determine every backup, log, onward-processing or remote-access location. Access is limited to authorized persons and necessary tasks, with confidentiality and risk-appropriate safeguards. Where access by a separate recipient constitutes a restricted transfer, the applicable agreement, authorization and transfer safeguards cover that access. Bleanx provides the destination, recipient and safeguard information required by law without implying that personnel access is confined to a single country.
D8. Continued protection and information. Bleanx reviews material changes affecting the protection of a transfer and maintains the required safeguards. If the required protection cannot be ensured, the affected transfer does not begin or is suspended, and the data is lawfully returned, deleted or otherwise protected under the applicable instrument and Section 11. Bleanx provides information and copies of applicable safeguards through support@bleanx.org, subject to proportionate protection of other persons' data, trade secrets and sensitive security details, without concealing the substance of the safeguards. Public-authority requests remain subject to Section 10.7. These arrangements do not enlarge permitted AI context, independent-use exceptions, processing purposes or retention periods.