Business Data Processing Addendum

Version 29 October 2026. This Addendum forms part of an accepted Avori agreement when a business or organization (“Customer”) supplies personal information for Avori to process on its behalf. Avori is DREAM TUESDAY LLC, Washington State, United States; privacy and contractual contact: hello@getavori.com. Customer is identified by its accepted agreement and organization billing/account record; its designated administrator is its ordinary contact. Acceptance of the applicable agreement also accepts this Addendum within its scope. Any required international-transfer instrument must be completed separately before the affected transfer.

1 Scope roles and instructions

“Customer Personal Data” is personal information in work content processed on Customer’s behalf. Customer is controller or, where acting for another controller, processor; Avori is its processor or subprocessor. Each party separately determines its lawful independent processing of its own account, billing, security and legal records as described in the Privacy Notice. Avori does not gain an independent advertising or generalized-model-training purpose in Customer Personal Data through this Addendum.

Avori processes only documented lawful instructions consisting of the agreement, this Addendum, Customer’s authorized settings and users’ authorized requests, including enabled agents and automations. Customer ensures its instructions, collection, notices, lawful bases and permissions comply with law and, where relevant, its controller’s agreement. Avori will tell Customer if it believes an instruction infringes applicable data-protection law and may suspend the affected processing pending resolution. If law requires other processing, Avori will notify Customer beforehand unless legally prohibited. Neither party’s duties are eliminated by the other’s instructions.

2 Processing schedule

Subject matter and purpose: providing an AI work environment for authorized conversations, file and knowledge processing, agent configuration and execution, connected-service tasks, routines and approved automation, Projects and sites, collaboration, retrieval, notification and saved results. Nature: receiving, organizing, storing, accessing, retrieving, transmitting, generating and transforming content, executing authorized operations, displaying, exporting and deleting. Automated analysis and inference can occur within a requested task. No independent advertising, sale or generalized AI training is instructed.

Duration: while the applicable service is provided and thereafter only for agreed return/deletion, controlled backup or recovery lifecycle, or a specific legal retention duty. Frequency: continuous hosting of saved content, with transfers and task processing when users or authorized automations invoke features. Customer may stop future task access or disconnect a service through available controls; this does not reverse a completed disclosure.

People: Customer’s users and personnel; contractors; clients, prospective clients and customers; suppliers and business contacts; and other individuals whose information Customer lawfully includes. Data: names, business and personal contact information, account and workspace identifiers, communications, document and media content, connected records, task context, permitted browser observations, generated results and related metadata. Data can include incidental sensitive information supplied by Customer, including health, financial or location details; this is not authorization to supply regulated information requiring an unagreed control or BAA. Customer must minimize sensitive data and obtain required explicit permissions. There is no instructed biometric identification or autonomous high-impact eligibility decision.

3 Confidentiality security and personnel

Avori ensures persons authorized to process Customer Personal Data are bound to confidentiality and receive access appropriate to their duties. It maintains technical and organizational measures appropriate to risk, considering the nature and sensitivity of data, purpose, state of the art and implementation cost. The security schedule below describes the baseline; measures can evolve without materially reducing overall protection. Customer is responsible for its own account administration, lawful sharing and device security. Customer’s responsibilities do not excuse an Avori security failure.

Avori assists Customer, considering processing and information available, with legally required security assessments, data-protection impact assessments and prior consultation. Ordinary assistance is included; exceptional bespoke work may carry reasonable pre-agreed costs where lawful, never as a condition for a mandatory obligation or remedy for Avori’s breach. No certification, uptime SLA, particular recovery objective or absolute security guarantee is created.

4 Subprocessors and chosen services

Customer generally authorizes the categories of subprocessors in the schedule below only as needed for enabled functions and subject to an adequate written processor contract. Avori remains responsible for its subprocessors’ performance of the obligations delegated to them. Before a new or replacement subprocessor receives Customer Personal Data, Avori provides its identity, function and relevant processing location to the designated administrator with at least 30 days’ notice, except a necessary urgent replacement, which is notified as soon as practicable with appropriate safeguards.

Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith to offer an alternative or avoid the affected processing. If none is reasonably available, Customer can terminate the affected part before transfer and receive unused prepaid fees for it. Customer cannot use an objection unrelated to data protection to obtain unrelated services without charge.

A third-party service Customer independently chooses to connect or fund is not automatically Avori’s subprocessor for all its processing. Its actual role and contract govern. Avori will not route restricted organizational data to a consumer account merely because Customer clicked a general acceptance control; applicable instructions, provider permissions, lawful transfer terms and Limited Use restrictions must all be satisfied. Customer’s connection authorization is not a substitute for Avori’s obligations where Avori is the processor.

5 Individual requests legal demands and incidents

Avori assists Customer through available controls and reasonable cooperation in responding to individual rights requests. If a request concerns processing controlled by Customer, Avori promptly refers it to Customer unless law requires another response. Avori will not disclose another person’s work solely because a requester knows an account email. Requests must preserve authentication, confidentiality and other individuals’ rights.

On becoming aware of a personal-data breach affecting Customer Personal Data, Avori notifies Customer without undue delay at its designated contact. Available information will describe the nature, affected categories and approximate scale where known, likely consequences, mitigation and a contact for follow-up. Information may be provided in phases as investigation proceeds. Avori will take reasonable containment and remediation measures and cooperate with Customer’s lawful notices and investigation. Notification is not an admission of fault. The controller’s statutory regulator deadlines are not replaced by an unconditional promise that every event is reported within 72 hours. Neither party may delay a notice that law requires.

Avori assesses legal demands, limits disclosure to what is required, and notifies Customer where permitted. It does not voluntarily give authorities unrestricted access to Customer Personal Data. Applicable transfer-clause obligations take precedence, including required assessment and challenge of disproportionate demands.

6 Return deletion and records

On Customer’s request during the service, or on its termination, Avori makes Customer Personal Data available through supported export/download methods or reasonable assistance. Customer should export before account closure. Following termination and the instructed return or deletion, Avori deletes or returns Customer Personal Data and existing copies as required by applicable law, unless a specified legal obligation requires retention. It identifies retained categories and purpose on request and restricts them to that purpose.

Backup and protected recovery copies can remain until their controlled lifecycle permits deletion, isolated from ordinary use and protected by this Addendum. They are not retained for new commercial use; a restore must reapply applicable deletion instructions. Customer can request information sufficient to assess the actual cycle before supplying data with a special deletion deadline. Independent third-party copies, Customer’s own exports, other controllers’ records and lawful shared work may have separate obligations. Avori will not treat a backup exception as indefinite permission to retain active data.

7 Assurance and audits

Avori makes available information reasonably necessary to demonstrate these obligations. Customer may first review available security descriptions, relevant independent evidence and answers to reasonable questions. Where insufficient or law requires, Avori permits an audit by Customer or an independent auditor bound to confidentiality, with reasonable notice, business-hour access and safeguards for other customers and system security. Ordinarily one audit per year is sufficient; a material incident, substantiated noncompliance or competent regulator request can justify more. No clause prevents a regulator’s lawful powers or mandatory audit rights.

Customer bears its ordinary audit costs unless an audit establishes material Avori noncompliance, in which case Avori bears its reasonable remediation and agreed incremental audit costs. The parties agree scope and safe methods without using approval to obstruct a necessary audit. Audits must not include uncontrolled penetration testing, access to another customer’s data or extraction of secrets. Avori maintains processing records and cooperates with competent supervisory authorities as law requires.

8 US service provider obligations

To the extent applicable US privacy law treats Avori as a service provider, contractor or processor, Avori will not sell or share Customer Personal Data for targeted or cross-context advertising; retain, use or disclose it outside the specified business purposes and direct relationship except as law permits; combine it with other personal information except for a legally permitted purpose; or use it to build unrelated consumer profiles. Avori understands and will comply with the applicable restrictions, provide the required level of protection and notify Customer if unable to do so. Customer can take reasonable steps to confirm compliant use, stop unauthorized use and require remediation. These terms do not transform Customer’s chosen independent third party into a contracted service provider.

9 International transfers and priority

Customer authorizes processing in the United States and other locations specifically disclosed for its enabled routes only where applicable transfer requirements are satisfied. If EEA, UK or Swiss restricted transfers require standard clauses, an adequacy mechanism or another safeguard, the parties must establish the applicable valid instrument and complete its required particulars before the transfer. A customer instruction or this Addendum alone is not a transfer safeguard. Avori will provide reasonable assistance with transfer assessments and supplementary measures. It will not represent that a US hosting location, a privacy-policy link or a consent checkbox alone makes a transfer lawful.

An applicable executed transfer instrument controls over inconsistent agreement language, including third-party rights, authority powers and liability rules. Liability under this Addendum follows the Terms only to the extent applicable law and that instrument permit. Obligations survive for retained Customer Personal Data. Other agreement provisions remain in effect.

Security schedule

Access and separation: authenticated access, authorization scoped to the acting person, organization and resource, protected connection state and least-privilege access to operational systems. Sharing and publication are explicit product permissions; private account credentials are not part of a public template. Customer administrators manage their available roles. Access is reviewed when account or organization permissions change.

Transmission and storage: HTTPS for public service transmission; encrypted hosted storage; protected credential and subscription authorization state; controlled backup and recovery storage. These are transport/storage safeguards, not a claim of universal end-to-end encryption or that customer-published content is confidential. Local devices and independent providers require their own protections.

Reliability and incident handling: access and operational records, error monitoring, versioned releases, backup/recovery mechanisms, investigation and remediation procedures, and controlled changes. Saved work and task receipts support recovery; no fixed recovery-time objective or verified restoration drill is asserted by this schedule. Vulnerabilities can be reported to hello@getavori.com. Personnel access is limited to legitimate duties and confidentiality obligations. Deletion and access revocation are handled through authenticated workflows and appropriate cleanup.

Provider schedule and route qualification

Potential operational providers are AWS for hosted infrastructure; OpenAI, Anthropic, Google, Meta, Moonshot AI and xAI for available model routes; Groq for dictation; Composio for brokered connectors; Resend for email; and relevant Apple, Firebase or browser services for push delivery. Stripe handles payment processing in its applicable role. Customer-selected connected services and personal subscription accounts have the role described above. Data categories are those needed for the selected function from the processing schedule; requests are feature-dependent rather than a continuous feed to every provider.

For the subprocessor identities, functions, processing locations and contractual safeguards applicable to your enabled services, contact hello@getavori.com. Avori provides this information before the affected processing begins and gives notice of changes as described above. Processing that requires an unavailable contractual safeguard must not begin.