Data Processing Addendum

Between: itligt, a registered DBA in West Jordan, Utah, operating the Solvgent platform ("Service Provider", "Solvgent"), and the Customer entity identified in the underlying Solvgent subscription, order form, or pilot agreement ("Business", "Customer"). Each a "Party" and together the "Parties".

This Data Processing Addendum ("DPA") forms part of the Solvgent Terms of Service (the "Main Agreement") between the Parties and governs Solvgent's processing of personal information on behalf of the Customer in connection with the Solvgent service (the "Service"). If there is any conflict between this DPA and the Main Agreement with respect to the processing of personal information, this DPA controls.

1. Subject Matter, Roles, and Definitions

1.1 Subject Matter. This DPA sets out the rights and obligations of the Parties when Solvgent processes personal information on behalf of the Customer in the course of providing the Service.

1.2 Roles. The Customer is the business (or controller) of personal information submitted to the Service. Solvgent is the service provider (or processor). For Solvgent's own collection of Customer account, billing, and usage data, Solvgent acts as a business; this DPA does not apply to that processing.

1.3 Definitions. Capitalized terms not defined herein have the meaning given in the Main Agreement or in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other US state consumer privacy laws (collectively, "Privacy Laws"). "Sell," "share," "consumer," "business purpose," and "service provider" have the meanings given under Privacy Laws.

2. Duration

This DPA is effective from the Effective Date and remains in force for as long as Solvgent processes personal information on behalf of the Customer. It is coterminous with the Main Agreement and terminates automatically upon termination of the Main Agreement, subject to the deletion and return obligations in Section 11.

3. Scope and Details of Processing

3.1 Subject Matter of Processing. Solvgent processes personal information to provide the Service to the Customer, including AI-assisted content generation, storage of each brand's Brand Brain (voice guidance, knowledge and lessons) within the Customer's account, scheduling and publishing to Third-Party Platforms, analytics rendering, and related operations.

3.2 Duration of Processing. For the term of the Main Agreement and, with respect to deletion or return of personal information, the period described in Section 11.

3.3 Nature and Purpose of Processing. Storage and hosting of Customer Content; AI inference (text, image, and video generation) using sub-processed model providers; approval workflow, scheduling, and publishing; analytics aggregation; backup and disaster-recovery copies; security monitoring and abuse prevention. These are the specified business purposes for which Solvgent processes personal information.

3.4 Types of Personal Information. Names, usernames, handles, email addresses; brand voice samples that may incidentally contain personal information; audience metrics with platform identifiers; comments, replies, and inbox content where the Customer enables those integrations; photographs, videos, or audio uploaded for repurposing. The Customer determines what categories of personal information it submits. Solvgent does not represent the Service as suitable for processing health, biometric, or other sensitive personal information.

3.5 Categories of Consumers. Customer's personnel and authorized users; Customer's end clients and their personnel (for agency-tier Customers); audience members and followers of brands managed via the Service; individuals depicted in Customer-uploaded media; authors of comments, replies, or direct messages ingested via Third-Party Platform integrations.

4. Service Provider Obligations

4.1 Documented Instructions and Business Purposes. Solvgent will process personal information only for the business purposes in Section 3 and on documented instructions from the Customer. The Main Agreement, this DPA, Service configuration made by the Customer, and explicit support tickets constitute the Customer's documented instructions. If Solvgent believes an instruction violates Privacy Laws, it will inform the Customer promptly.

4.2 No Sale or Sharing. Solvgent will not sell or share personal information that it processes on behalf of the Customer.

4.3 Restrictions on Use. Solvgent will not retain, use, or disclose personal information (a) for any purpose other than the business purposes specified in this DPA, (b) for any commercial purpose other than providing the Service, or (c) outside the direct business relationship between Solvgent and the Customer. Solvgent will not combine personal information it receives from the Customer with personal information it receives from or collects for other persons, except as Privacy Laws permit. Solvgent will not use Customer Content to train AI models.

4.4 Compliance and Certification. Solvgent will comply with the obligations that apply to it as a service provider under Privacy Laws and will provide the same level of privacy protection that Privacy Laws require of the Customer. Solvgent certifies that it understands the restrictions in this DPA and will comply with them. Solvgent will notify the Customer if it determines that it can no longer meet its obligations under Privacy Laws.

4.5 Customer Remediation Rights. The Customer may take reasonable and appropriate steps to ensure that Solvgent uses personal information consistently with the Customer's obligations under Privacy Laws, and to stop and remediate any unauthorized use.

4.6 Confidentiality. Solvgent ensures personnel authorized to process personal information are bound by appropriate written confidentiality obligations or are under a statutory duty of confidentiality.

4.7 Security Measures. Solvgent implements the technical and organizational measures in Annex II below, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing.

4.8 Sub-processor Authorization. Customer grants Solvgent general written authorization to engage sub-processors. The current list is published at solvgent.com/legal/sub-processors. Solvgent will notify Customer at least 30 days in advance of any intended addition or replacement. Customer may object on reasonable data-protection grounds within 30 days. Solvgent requires each sub-processor to meet obligations at least as protective as this DPA and remains responsible for their performance.

4.9 Consumer Requests. Solvgent will assist the Customer, using appropriate technical and organizational measures and insofar as possible, in responding to consumer requests to know, access, correct, delete, or opt out. Solvgent will not respond to a consumer request on the Customer's behalf except to confirm receipt or direct the consumer to the Customer, unless the Customer instructs otherwise.

4.10 Other Assistance. Solvgent will assist the Customer with security, breach notification, and data protection assessments where Privacy Laws require them, taking into account the information available to Solvgent.

4.11 Personal Information Breach Notification. Solvgent will notify the Customer without undue delay and in any event within seventy-two (72) hours after becoming aware of a breach of security affecting the Customer's personal information, with the information available at the time of notification.

4.12 Records. Solvgent makes available information necessary to demonstrate its compliance with this DPA and Privacy Laws, and contributes to audits on the terms in Section 5.

5. Audits

5.1 Standard Reporting. Solvgent provides on request: a summary of its technical and organizational measures (Annex II); summary results of audits, penetration tests, or certifications it has obtained (SOC 2 when available); and responses to a customer security questionnaire of reasonable length (for example, CAIQ-Lite).

5.2 On-site Audits. Where standard reporting is insufficient for a Customer's documented compliance need, the Customer may request an on-site or remote audit not more than once per twelve (12) months at Customer's expense, on reasonable notice of at least 30 days, during business hours, subject to confidentiality. The auditor must not be a competitor of Solvgent.

6. Data Location

Solvgent operates from the United States. Some sub-processors store or process personal information outside the United States. The locations of each sub-processor are listed at solvgent.com/legal/sub-processors.

7. Liability and Indemnity

7.1 Allocation of Liability. Each Party's liability under this DPA is subject to the limitations and exclusions in the Main Agreement, except where such a limitation is not permitted by mandatory law.

7.2 Indemnity. Each Party indemnifies the other against losses arising from regulatory fines or third-party claims to the extent caused by the indemnifying Party's breach of this DPA, subject to the procedural conditions in the Main Agreement.

8. Confidentiality of Personal Information

Solvgent treats all personal information processed on behalf of the Customer as Customer Confidential Information under the Main Agreement.

9. Order of Precedence

Highest to lowest: (a) this DPA; (b) the Main Agreement; (c) any order form or pilot agreement; (d) the Documentation.

10. Governing Law

This DPA is governed by the laws of the State of Utah, USA, without regard to its conflict-of-laws rules. Nothing in this DPA limits any protections that Privacy Laws give to consumers.

11. Deletion and Return of Personal Information

Upon termination of the Main Agreement or upon written request by the Customer:

• Solvgent makes available to the Customer for ninety (90) days the ability to export Customer Content from the Service or, on request, by email.
• Within 90 days of termination, Solvgent deletes or returns all personal information and deletes copies, except where retention is required by law or permitted by Privacy Laws.
• Backups containing residual copies are deleted in the 30-day backup-rotation cycle. Backup data is not actively accessed during that window.
• On Customer's written request, Solvgent provides written confirmation of deletion.

12. Notices and Contact

Solvgent (Service Provider): privacy [at] solvgent [dot] com. Customer (Business): the primary contact in the Account.

13. Miscellaneous

13.1 Severability. If any provision is held unenforceable, the remaining provisions remain in effect.

13.2 Amendment. Material changes will be communicated by email at least 30 days in advance.

13.3 Counterparts. Clickwrap acceptance, signed counterparts, or electronic signature all have equal legal effect.

Annex I: Description of the Processing

I.A: List of Parties

Business (Customer): the Customer entity identified in the Account, order form, or pilot agreement. Service Provider (Solvgent): itligt, a registered DBA in West Jordan, Utah, operating Solvgent. Contact: privacy [at] solvgent [dot] com.

I.B: Description of Processing

• Categories of consumers: as listed in Section 3.5.
• Categories of personal information: as listed in Section 3.4.
• Sensitive personal information: none required by Solvgent.
• Frequency: continuous, during the term of the Main Agreement.
• Nature: SaaS hosting, AI inference, scheduling and publishing, analytics, security monitoring.
• Business purpose: to provide the Solvgent Service.
• Retention: as set out in Section 11.

Annex II: Technical and Organizational Measures

Solvgent maintains the following measures to protect personal information. We may change them, provided no change reduces the overall level of protection.

1. Access control

• Every application request is scoped to the Customer's organization and checked against the user's role.
• Role-based permissions separate submitting content for review from approving it.
• Optional two-factor authentication for user accounts.
• Production access limited to personnel who need it.

2. Encryption and secrets

• Encryption in transit (HTTPS) for the website, application and APIs.
• Passwords and client review-link tokens stored as hashes.
• Secrets kept in protected configuration, not in source code.

3. Network and application security

• Edge DDoS protection and bot mitigation through Cloudflare.
• Rate limits on public endpoints such as client review links.
• Webhook signatures verified for payment and email providers.

4. Separation of customer data

• Customer data is separated by organization at the application layer.
• Each brand's Brand Brain (voice guidance, knowledge, lessons) is used only for that brand.

5. Sub-processor management

• Sub-processors are listed publicly and bound by contractual data-protection obligations.
• Changes are notified as described in this Addendum.

6. Personnel

• Confidentiality obligations for personnel and contractors with access to personal information.

7. Incident response

• Security incidents affecting personal information are investigated, and Customer is notified without undue delay and as required by applicable law.

8. Backups

• Regular backups with rolling retention (see the Privacy Policy).

Annex III: List of Sub-processors

Maintained and updated at solvgent.com/legal/sub-processors. The current list as of the Effective Date is included by reference and is identical to the version at that URL on that date.

Acknowledged and accepted by the Customer through acceptance of the Solvgent Terms of Service or signature of an order form referring to this DPA.