This Data Processing Addendum ("DPA") forms part of the Aptos Labs Terms of Use, currently available at aptoslabs.com/terms (the "Terms"), between Matonee Inc. d/b/a Aptos Labs ("Aptos") and the Platform that makes Aptos' AI Services available to its users ("Customer"), or of a separate written agreement that incorporates it, and applies to the extent Aptos Processes Personal Data on Customer's behalf in providing the AI Services. A separately signed data processing agreement governs instead of this DPA. This DPA prevails over the Terms with respect to the Processing of Personal Data.

1. DEFINITIONS

Capitalized terms used but not defined in this DPA have the meanings given in the Terms, including "AI Services," "Inference," "Inputs," "Outputs," "Model," "Platform" and "Usage Data." In this DPA:

"Data Protection Laws" means all laws applicable to the Processing of Customer Personal Data under this DPA, including, as applicable, the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other U.S. state privacy laws.
“Customer Personal Data" means Personal Data contained in Inference Data that Aptos or its Sub-processors Process on behalf of Customer’s End Users in providing the AI Services. Customer Personal Data does not include Usage Data or Personal Data relating to Customer's own personnel that Aptos Processes to manage its relationship with Customer.
"End User" means a user of the Platform who accesses a Model through the Platform.
"Inference Data" means Inputs that End Users submit to a Model through the Platform, related request metadata, and the Outputs returned, but excludes Usage Data.
"Personal Data," "Processing," "Controller," "Processor," "Data Subject," "Personal Data Breach" and "Supervisory Authority" have the meanings given in Data Protection Laws, including their CCPA equivalents.
"SCCs" means the standard contractual clauses in European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the UK Information Commissioner's International Data Transfer Addendum to the SCCs (version B1.0).
"Sub-processor" means a third party engaged by Aptos to Process Customer Personal Data in providing the AI Services.
"TEE" means a trusted execution environment in which Aptos operates a Model.

2. ROLES

Customer is a Processor acting on behalf of its users or their Controllers (or a Controller where it determines the purposes and means of Processing for its own account), and Aptos is Customer's Sub-processor (or Processor). Customer is Aptos' sole point of contact, warrants that it has the authority and instructions from its users and their Controllers needed to engage Aptos on these terms, and is responsible for any notice to or consent from its users that Data Protection Laws require. Aptos Processes Usage Data and Personal Data relating to Customer's personnel as an independent Controller under its Privacy Policy, outside this DPA.

3. PROCESSING

3.1 Instructions. Aptos shall Process Customer Personal Data only on documented instructions from Customer, which consist of the Terms, this DPA, any applicable separate written agreement, and the requests that Customer routes to Models through the AI Services on behalf of End Users, unless otherwise required by applicable law. Aptos is not responsible for independently determining whether Customer's or an End User's instructions comply with Data Protection Laws. If Aptos reasonably believes an instruction infringes Data Protection Laws, Aptos will inform Customer, unless prohibited by law, and may suspend the affected Processing until Customer modifies or confirms the instruction.

3.2 Confidential Inference. Aptos operates the Models it hosts inside TEEs. Customer Personal Data is encrypted in transit to the TEE, is decrypted and Processed only inside it, and is not accessible in plaintext to Aptos, the Infrastructure Provider or their personnel; Aptos receives only Usage Data. Customer Personal Data is Processed only in encrypted memory inside the TEE for the duration of the request, is not written to persistent storage, and is not retained in retrievable form and is not available for return. Aptos does not log, monitor, review or screen the content of Inputs or Outputs. Customer acknowledges that, as a result, Aptos cannot identify, retrieve, correct, export or delete particular Inference Data or the Personal Data of particular Data Subjects, and may be unable to determine which Data Subjects or records are affected by a Personal Data Breach at that layer. Aptos' commitments in this Section apply only to Processing performed by Aptos and its Sub-processors; Customer is solely responsible for the logging, storage, retention, training and other Processing of Inference Data at the Platform layer, and nothing in this DPA is a representation about such Processing.

3.3 No Training. Aptos will not use Customer Personal Data to train, fine-tune, evaluate, benchmark or otherwise develop or improve any Model or other artificial-intelligence or machine-learning system, and will not permit any Sub-processor to do so. This Section does not restrict Aptos' use of Usage Data or data described in Section 2.

3.4 CCPA and U.S. State Laws. Where the CCPA or another U.S. state privacy law applies, Aptos acts as a service provider, contractor or processor; will not sell or share Customer Personal Data, retain, use or disclose it other than to provide the AI Services, or combine it with other Personal Data, except as those laws permit; will provide the level of privacy protection they require; and will notify Customer if it can no longer meet its obligations under them. Customer may take reasonable steps to confirm compliance and remediate unauthorized use.

4. SUB-PROCESSORS

Customer provides a general authorization for Aptos to engage Sub-processors, including the Sub-processors identified in Schedule 2, as such may be updated from time to time. Aptos will use commercially reasonable efforts to give Customer at least fifteen (15) days’ notice by email to Customer’s designated contact before adding or replacing a Sub-processor, during which Customer may object on reasonable data-protection grounds; if the objection is not resolved within thirty (30) days, either party may terminate the AI Services as they relate to Customer. Schedule 2 identifies the services each Sub-processor provides and its Processing location.

5. SECURITY

Aptos will maintain the measures in Schedule 3 and will not materially reduce the overall security of the AI Services. Customer is responsible for assessing whether those measures are appropriate for the Personal Data its users submit.

6. INTERNATIONAL TRANSFERS

6.1 Customer authorizes Processing in the locations identified in Schedule 2. Where Processing involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the SCCs are incorporated into this DPA and deemed executed, with Module Three applying where Customer is a Processor and Module Two where Customer is a Controller; Customer as data exporter and Aptos as data importer; Clauses 7 and 11(a) not used; Clause 9(a) Option 2 with the notice period in Section 4; Clause 13 by reference to Customer's EU establishment or representative, failing which the Irish Data Protection Commission; Clauses 17 and 18 the law and courts of Ireland; and Annexes I to III completed by the Annexes below. For UK transfers the SCCs apply as modified by the UK Addendum, with its Tables completed by reference to the foregoing. For Swiss transfers the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as competent authority. If Aptos becomes certified under the EU-U.S. Data Privacy Framework, that framework may be relied on in place of the SCCs for covered transfers. The SCCs prevail over this DPA in the event of a conflict.

6.2 If Aptos receives a legally binding request from a public authority for Customer Personal Data, Aptos will notify Customer unless legally prohibited, and will disclose only the minimum data in its possession required by the request.

7. PERSONAL DATA BREACH

Aptos will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide such information reasonably available to Aptos regarding the nature of the breach, the affected systems, routes and time period, the likely consequences, the measures taken or proposed, and a point of contact for further information. Notification is not an admission of fault. Customer is responsible for notifying Supervisory Authorities, Data Subjects and its users.

8. ASSISTANCE

Aptos will provide reasonable assistance with Data Subject requests and with Customer's security, breach-notification and impact-assessment obligations under Data Protection Laws. Because Aptos does not retain or have access to Customer Personal Data, that assistance consists of confirming the posture in Section 3.2 and providing this DPA, Schedule 3 and other information reasonably available to Aptos. Aptos will refer any Data Subject who contacts it directly to Customer. Customer will reimburse Aptos' reasonable costs for assistance beyond this.

9. AUDIT

On written request, no more than once in any twelve (12) months (except where required by Data Protection Laws or a Supervisory Authority, or following a Personal Data Breach), Aptos will provide information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied through completed security questionnaires, policy summaries, audit reports or certifications where available, or other relevant documentation reasonably available to Aptos. If that is not reasonably sufficient and Data Protection Laws require it, Customer may, on at least thirty (30) days' notice through an independent auditor bound by confidentiality, inspect Aptos’ compliance with this DPA under a mutually agreed scope, excluding Sub-processor facilities and other customers' data, at Customer's expense, including Aptos' reasonable costs and personnel time at its then-current rates. Customer will provide Aptos with a written summary of any findings, which are Aptos' confidential information.

10. DELETION

Customer Personal Data is not persisted or retained in retrievable form and is not available for return; any ephemeral in-memory KV cache state inside a TEE is volatile and automatically evicted in the ordinary course of memory rotation or enclave restart. Aptos will cease Processing it when Customer stops routing requests to Aptos-hosted Models or the Terms terminate, and will confirm in writing that it holds none if requested.

11. LIABILITY

Each party’s liability under this DPA shall be subject to the limitations of liability in the Agreement. Aptos shall not be liable for indirect, incidental, or consequential damages, and shall only be liable for direct damages arising from breach of this DPA. Neither party is responsible for fines imposed on the other for its own violation of Data Protection Laws. This Section does not limit Data Subjects' rights under the SCCs or Data Protection Laws.

12. GENERAL

This DPA applies for as long as Aptos Processes Customer Personal Data on Customer's behalf. Aptos may update it to reflect changes in Data Protection Laws, the AI Services, Aptos' data processing practices, or upon a merger, acquisition or similar transaction, consistent with the amendment provisions of the Terms. The governing law and dispute resolution provisions of the Terms apply, except that the SCCs and UK Addendum are governed as set out in Section 6 and prevail over this DPA in the event of a conflict.

SCHEDULE 1: DETAILS OF PROCESSING

Subject matter, nature and purpose: The provision of inference against Models hosted or operated by Aptos, accessed by End Users through the Platform.

Duration: For as long as Customer routes requests to Aptos-hosted Models.

Data Subjects: Determined by Customer and its End Users.

Categories of Personal Data: Determined by Customer and its End Users. Restricted Data (as defined in the Terms) is not authorized.

Frequency of Transfer: Continuous, for as long as End Users route requests to Models through the Platform.

SCHEDULE 2: SUB-PROCESSORS

Hashforest Technology LLC (Phala Cloud) — Confidential computing (TEE) GPU infrastructure on which Aptos-hosted Models run — United States; European Union.
Google LLC (Google Cloud) — Infrastructure hosting — United States; European Union.

SCHEDULE 3: TECHNICAL AND ORGANIZATIONAL MEASURES

End-to-end encryptionHardware-isolated execution environments (e.g., SGX, TDX, GPU Confidential Computing)
Access control using least-privilege principles
Security monitoring and alerting
Request and response content is never logged; Aptos logs Usage Data only
Regular penetration testing and vulnerability assessments
Incident response procedures and breach reporting within 72 hours

ANNEXES I–III TO THE SCCs

Annex I.A (Parties). Data exporter: Customer, as identified in the Terms or the separate written agreement under which it accepted this DPA; role: Processor (or Controller, as applicable); contact: Customer's designated contact. Data importer: Matonee Inc. d/b/a Aptos Labs, 2100 Geng Road, Suite 210, Palo Alto, California 94303, United States; role: Sub-processor (or Processor, as applicable); contact: terms@aptoslabs.com. The parties are deemed to have signed this Annex by entering into the Terms and this DPA. Annex I.B (Description of transfer): Schedule 1. Annex I.C (Competent supervisory authority): as set out in Section 6.1. Annex II (Security measures): Schedule 3. Annex III (Sub-processors): Schedule 2.