Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between SEM NEURA TECNOLOGIA DA INFORMACAO LTDA (“Maestrio”, “Processor”, “we”, “us”) and the Customer (“Controller”, “you”) identified in the Maestrio account or order form.

This DPA is incorporated into and governed by the Agreement. It supplements the Maestrio Terms of Service (“Agreement”) and governs Maestrio’s processing of personal data on the Customer’s behalf in connection with the Maestrio feedback collection and agent automation service (“Service”). In the event of a conflict between this DPA and the Agreement, this DPA takes precedence with respect to data protection matters.

Customer accepts this DPA by checking the acceptance box at account registration. The acceptance record stores the DPA version and server timestamp. No separate signed document is required for the standard Brazil-focused Service unless Customer requests a negotiated enterprise DPA. The effective date of this DPA is the date of acceptance.

This standard DPA is written for processing governed by Brazilian law. If a Customer instructs Maestrio to process data subject to EU/UK GDPR or another jurisdiction with additional requirements, the parties must agree the required addendum before that processing begins.

Terms used in this DPA have the meanings set out below. Capitalized terms not defined here have the meanings given in the Agreement.

• Controller — the natural or legal person who determines the purposes and means of processing personal data. In this DPA, the Customer is the Controller.
• Processor — the natural or legal person who processes personal data on behalf of the Controller. In this DPA, Maestrio is the Processor.
• Personal Data — any information relating to an identified or identifiable natural person (“data subject”), as defined in applicable data protection law (including GDPR Art. 4(1)).
• Processing — any operation or set of operations performed on personal data, including collection, storage, use, analysis, transmission, and deletion.
• Data Subject — the individual whose personal data is processed; here, end users of the Customer’s software products who interact with the Maestrio widget.
• Supervisory Authority — an independent public authority responsible for monitoring compliance with data protection law in a given jurisdiction.
• SCCs (Standard Contractual Clauses) — the clauses adopted by the European Commission under Decision 2021/914 for transfers of personal data from the EU/EEA to third countries.
• Sub-processor — any third-party processor engaged by Maestrio to process personal data in connection with the Service.
• Personal Data Breach — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council.
• UK GDPR — UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018.
• CCPA/CPRA — California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.) as amended by the California Privacy Rights Act.
• LGPD — Lei Geral de Proteção de Dados (Federal Law No. 13,709/2018), Brazil’s general data protection law.

Maestrio processes personal data on behalf of the Customer only:

• on documented instructions from the Customer (including instructions transmitted via the Maestrio API and dashboard), and in accordance with this DPA;
• for the purpose of providing the Maestrio feedback collection and agent automation Service as described in the Agreement;
• for the duration of the Customer’s active account, unless the Customer instructs otherwise or the Agreement is terminated.

The subject matter, nature, purpose, duration, categories of data subjects, and categories of personal data processed are described in Schedule 1 to this DPA.

If Maestrio is required by applicable law to process personal data for a purpose other than the Customer’s documented instructions, Maestrio will inform the Customer of that requirement before processing (unless prohibited by law on grounds of public interest).

By entering into this DPA, the Customer represents and warrants that it:

1. has a valid lawful basis under applicable data protection law to submit end-user personal data to the Maestrio Service (e.g. consent, legitimate interests, or performance of a contract with the end user);
2. has informed its end users, through a publicly accessible privacy notice, that their feedback data is processed by Maestrio as a sub-processor, and has identified Maestrio’s role and the categories of data processed;
3. will not submit special-category personal data as defined in GDPR Art. 9 (including health, racial or ethnic origin, religious beliefs, biometric or genetic data, sexual orientation, or trade union membership) or health data regulated by HIPAA, without first entering into a separate written agreement with Maestrio covering such data;
4. will not submit personal data of children under the age of 18 (or the lower applicable age of digital consent in the relevant jurisdiction, if higher) without first obtaining verifiable parental consent and notifying Maestrio in writing;
5. ensures its privacy policy discloses Maestrio as a sub-processor of end-user feedback data and links to this DPA or a summary of it.

Maestrio will:

1. process personal data only on the Customer’s documented instructions, unless required by applicable law to do otherwise;
2. ensure that all persons authorized to process personal data on Maestrio’s behalf are subject to binding confidentiality obligations;
3. implement and maintain appropriate technical and organizational measures to protect personal data, as further described in Schedule 2;
4. engage sub-processors only in accordance with Section 5 of this DPA;
5. assist the Customer, taking into account the nature of the processing, by appropriate technical and organizational measures, to fulfill the Customer’s obligation to respond to data subject requests for access, erasure, portability, rectification, and restriction of processing under applicable law;
6. notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data Breach affecting the Customer’s personal data. The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach;
7. assist the Customer in conducting Data Protection Impact Assessments (DPIAs) where required by GDPR Art. 35 or equivalent provisions of applicable law;
8. upon the Customer’s written request or upon termination of the Agreement, delete or return all personal data processed on the Customer’s behalf within 90 days, and delete existing copies unless applicable law requires retention;
9. provide the Customer with all information necessary to demonstrate compliance with Maestrio’s obligations under this DPA, including:
   • upon written request, Maestrio will share summaries of any third-party security assessments or audit reports that are available at the time of the request. Maestrio does not currently hold a SOC 2 certification. Maestrio will notify Customers if and when such certification is obtained; and
   • the right to conduct or commission an independent audit of Maestrio’s data processing facilities, no more than once per 12-month period, upon at least 30 days’ prior written notice, at the Customer’s expense, subject to mutual agreement on timing and scope.

By entering into this DPA, the Customer grants Maestrio general written authorization to engage the sub-processors listed at maestrio.ai/legal/subprocessors.

Maestrio will provide the Customer with at least 30 days’ prior written notice (by email to the address registered on the Customer’s account) before adding or replacing a sub-processor.

The Customer may object to a new or replacement sub-processor within 30 days of receiving such notice, by sending written notice to [email protected]. The objection must state reasonable grounds related to data protection. Maestrio will use reasonable efforts to make available a change in the Service that avoids reliance on the objected-to sub-processor. If no such change is commercially practicable, the Customer’s sole remedy is to terminate the affected portion of the Service for convenience upon written notice.

Maestrio imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for the acts and omissions of its sub-processors to the same extent Maestrio would be liable if performing the services directly.

Note: Customer-activated optional integrations (such as the Linear ticket sync) that are enabled by the Customer directly are not covered by this DPA’s sub-processor notice procedure, as the Customer controls whether and when these integrations are activated.

Personal data submitted to the Service may be transferred to and processed in the United States, including on Railway infrastructure and Cloudflare’s global edge network. The standard Service is operated for Brazilian customers and uses the safeguards required by applicable Brazilian law.

Brazilian data subjects. Transfers of personal data of Brazilian data subjects to the United States are conducted on the basis of necessity for the performance of a contract between the Customer and their end users (LGPD Art. 33(V)), together with the safeguards required by applicable Brazilian law.

If a Customer later instructs Maestrio to process data subject to EU/UK GDPR, the parties must agree the required transfer mechanism and additional terms before that processing begins. Those terms are not part of this standard Brazil-focused DPA.

Maestrio uses AI inference providers — currently including Anthropic and OpenRouter — to power the analysis and automation features of the Service. The following commitments apply to all AI processing under this DPA:

• No training on Customer data. Neither Maestrio nor any of its AI inference providers uses Customer personal data (including feedback content, code, end-user properties, or DOM snapshots) to train, fine-tune, improve, or evaluate any AI model. This commitment binds Maestrio’s AI sub-processors under the terms of their respective agreements with Maestrio.
• Inference only. Sub-processors used for AI inference, including Anthropic, are subject to API terms prohibiting use of Customer data for model training. For OpenRouter, which routes to multiple underlying providers, data handling may vary; Maestrio selects configurations consistent with the no-retention/no-training commitment and will update this DPA if that changes. Customer data and end-user personal data are transmitted to AI APIs solely for the purpose of generating a response during a single API call.
• Sub-processor notice. Anthropic and OpenRouter are listed as sub-processors at maestrio.ai/legal/subprocessors. Changes to AI inference providers are subject to the 30-day notice procedure in Section 5.

Maestrio will implement and maintain technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures currently in place are described in Schedule 2.

Maestrio will notify the Customer of a Personal Data Breach within 72 hours of becoming aware, as described in Section 4(f). Maestrio will not be obligated to notify the Customer under this section to the extent a breach affects only anonymized or pseudonymized data that cannot reasonably be associated with any data subject.

For purposes of the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.) as amended by the CPRA, Maestrio acts as a service provider when processing personal information on behalf of the Customer.

Maestrio will not:

• sell or share (as defined in the CCPA/CPRA) the Customer’s personal information;
• retain, use, or disclose personal information for any commercial purpose other than providing the Service as specified in the Agreement and this DPA;
• retain, use, or disclose personal information outside of the direct business relationship between Maestrio and the Customer; or
• combine the Customer’s personal information with personal information received from or on behalf of other sources, except (a) to provide the Service to Customer, (b) for security and integrity purposes, (c) for fraud prevention and detection, or (d) as required by law.

Maestrio certifies that it understands these restrictions and will comply with them. Maestrio will assist the Customer in responding to consumer requests received under the CCPA/CPRA to the extent those requests relate to personal information processed by Maestrio on the Customer’s behalf.

For purposes of the Lei Geral de Proteção de Dados (Federal Law No. 13,709/2018), Maestrio acts as an operator (operador) when processing personal data of Brazilian data subjects on behalf of the Customer (the controller / controlador).

Maestrio processes such personal data only on the Customer’s documented instructions and in accordance with the terms of this DPA. Maestrio will assist the Customer in responding to requests from Brazilian data subjects exercising their rights under LGPD Art. 18, including all rights under LGPD Art. 18(I)–18(IX): (I) confirmation of processing, (II) access to data, (III) correction of inaccurate data, (IV) anonymization/blocking/deletion of unnecessary data, (V) data portability (upon ANPD regulation), (VI) deletion of data processed with consent, (VII) information on entities with which data was shared, (VIII) information on consequences of not consenting, and (IX) revocation of consent.

Maestrio will cooperate with the Customer and, where required, with the Autoridade Nacional de Proteção de Dados (ANPD), to the extent necessary for compliance with the LGPD.

This DPA enters into force upon the Customer’s acceptance (as described in the Preamble) and remains in force for as long as the Agreement is in effect, unless terminated earlier by mutual written agreement.

Upon expiry or termination of the Agreement, Maestrio will delete or return all personal data processed under this DPA in accordance with Section 4(h), and will cease all processing of such data, except to the extent applicable law requires continued retention.

Sections 1, 4(e), 4(f), 9, 10, 11, and 12 of this DPA, and all Schedules, survive termination of the Agreement to the extent necessary to give effect to their terms. Maestrio’s and each authorized person’s confidentiality obligations survive termination indefinitely.

Each party’s liability to the other under or in connection with this DPA is subject to the limitations and exclusions set out in the Agreement, to the maximum extent permitted by applicable law.

Notwithstanding the foregoing, neither party may limit its liability:

• to data subjects exercising rights that cannot lawfully be limited under applicable data protection law;
• for losses arising from gross negligence, wilful misconduct, fraud, or any other type of liability that cannot lawfully be limited or excluded.

Nothing in this DPA limits liability where applicable data protection law prohibits that limitation. Where both parties are liable for damage caused by a data breach, liability will be apportioned according to their respective share of responsibility.

The measures below reflect Maestrio’s practices as of the date of this DPA. Maestrio may update these measures over time provided the overall level of protection is not materially reduced.