This Data Processing Addendum ("DPA") is entered into between Alcony, Inc., a Wyoming corporation ("Processor"), and Customer Legal Name ("Controller"), and forms part of the agreement between the parties dated Date (the "Agreement"). This DPA applies to the extent Alcony processes Personal Data on behalf of Customer in the course of providing the Services. Capitalized terms not defined here have the meaning given in the Agreement or applicable Data Protection Laws.
1. Definitions
"Data Protection Laws" means all applicable laws relating to data protection and privacy, including, as applicable, the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended ("CCPA"), and equivalent laws.
"Personal Data," "Processing," "Controller," "Processor," and "Data Subject" have the meanings given under Data Protection Laws.
"Customer Data" means all data or other information submitted through the Services by or for Customer, including Personal Data contained therein.
"Task Content" means the substantive content of a question, prediction, or uploaded document submitted to an AI Feature for processing, as distinguished from Personal Data that directly identifies a Data Subject (e.g., account identity or contact information). This distinction is described further in Annex 1 and reflects an architectural property of the Services, not merely a contractual characterization.
"Sub-processor" means any third party engaged by Alcony to process Personal Data in connection with the Services.
2. Roles of the Parties
2.1 The parties agree that, with regard to the Processing of Personal Data, Customer is the Controller (or Processor acting on behalf of a Controller, as applicable) and Alcony is the Processor (or Sub-processor).
3. Processing Instructions
3.1 Alcony will Process Personal Data only in accordance with Customer's documented instructions, as set out in the Agreement and this DPA, unless required otherwise by applicable law, in which case Alcony will inform Customer prior to Processing, unless legally prohibited from doing so.
3.2 Alcony will not sell Personal Data or use it for any purpose other than to provide, maintain, and improve the Services, and will not use Personal Data to train AI or machine learning models for any purpose other than for Customer, except with Customer's prior written consent. This Section does not restrict Alcony's use of aggregated data that has been de-identified so that it is no longer Personal Data, as permitted by the Agreement.
3.3 Data minimization by design. Alcony's architecture is designed so that data sent to AI subprocessors in connection with generating predictions or processing documents is scoped to Task Content relevant to the specific task, rather than Customer's or a Data Subject's full identity or profile, as further described in Annex 1. Alcony will maintain this data-flow design as a technical and organizational measure supporting this DPA's data minimization commitments.
4. Confidentiality of Personnel
4.1 Alcony will ensure that personnel authorized to Process Personal Data are subject to a duty of confidentiality and have received appropriate training on data protection.
5. Security Measures
5.1 Alcony will implement and maintain appropriate technical and organizational measures designed to protect Personal Data, as described in Annex 2 (Security Measures) and Section 5 (Security Controls) of the Service Description.
6. Sub-processors
6.1 Customer authorizes Alcony to engage the Sub-processors listed in Annex 3 (Sub-processor List), which Alcony will keep current and make available to Customer.
6.2 Alcony will impose data protection terms on Sub-processors that are no less protective than this DPA, and will remain liable for Sub-processors' performance.
6.3 Alcony will provide at least 30 days' notice before engaging a new Sub-processor that will Process Personal Data, during which Customer may object on reasonable data-protection grounds. If the parties cannot resolve Customer's objection, Customer may terminate the portion of the Services that cannot be provided without the new Sub-processor.
7. Data Subject Rights
7.1 Alcony will provide reasonable assistance to Customer, at Customer's expense for anything beyond a de minimis effort, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws, and will promptly forward to Customer any such request received directly from a Data Subject, without responding to it directly except to redirect the Data Subject to Customer.
8. Personal Data Breach Notification
8.1 Alcony will notify Customer without undue delay after becoming aware of any confirmed unauthorized access to, or acquisition, use, or disclosure of, Personal Data (a "Personal Data Breach"), and will provide information reasonably requested by Customer to meet its own notification obligations, including the categories and approximate number of Data Subjects and Personal Data records concerned, likely consequences, and remediation steps taken or proposed.
9. Data Protection Impact Assessments
9.1 Alcony will provide reasonable cooperation to Customer in connection with any data protection impact assessment or prior consultation with a supervisory authority that Customer reasonably determines is required.
10. International Data Transfers
10.1 Where the Processing involves a transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country not deemed to provide an adequate level of protection, the parties agree that the transfer will be subject to the Standard Contractual Clauses (or the UK International Data Transfer Addendum, as applicable), incorporated by reference and attached as Annex 4.
11. Audit Rights
11.1 Upon reasonable prior written notice, and no more than once per year (unless required by a supervisory authority or following a Personal Data Breach), Alcony will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant third-party audit reports (e.g., SOC 2, once obtained), and will allow for and contribute to audits conducted by Customer or an independent auditor mutually agreed by the parties, at Customer's expense, subject to confidentiality obligations.
12. Return or Deletion of Personal Data
12.1 Customer may request an export of Personal Data at any time during the term of the Agreement or following its termination. Upon the earlier of (a) Customer's written request, or (b) 30 days following termination or expiration of the Agreement, Alcony will, at Customer's election, delete or return all Personal Data, and delete existing copies, within 30 days, unless applicable law requires retention.
13. Liability
13.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set forth in the Agreement.
14. Scope Exclusion
14.1 This DPA does not apply to Alcony's optional, separately opt-in Kalshi Feature (governed by the Consumer Terms of Service and the separately executed Kalshi Trading Supplement), which is a business-to-consumer feature not exposed through the Services covered by this Agreement.
Annex 1 — Details of Processing
| Category | Details |
|---|---|
| Subject matter | Provision of the Services described in the Order Form(s) or statement of work between the parties. |
| Duration | Duration of the Agreement, plus any post-termination retention period described in Section 12. |
| Nature and purpose | Hosting, storage, and processing of Customer Data to provide, secure, and support the Services, including generating AI Analyst predictions, Aggregate Scores, Landscapes, Calibration Scores, and Posture Recommendations from Task Content. |
| Categories of Data Subjects | Customer's employees, contractors, and/or authorized end users who use the Services. |
| Categories of Personal Data | Account and contact details (name, email, authentication identifiers); billing contact information; usage and prediction-history data associated with an account. Separately, Task Content (question text, predictions, and document excerpts submitted for AI processing) may incidentally contain Personal Data where a Data Subject's own submission includes it, as described in Section 1 and Section 3.3. |
| Special categories of data | None anticipated. Customer should not submit special-category data as Task Content unless separately agreed in writing. |
Annex 2 — Security Measures
See Section 5 (Security Controls) of the Service Description, summarized below:
Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
Role-based access control and least-privilege administrative access, with SSO support if requested.
Logical tenant isolation; logging and monitoring of production systems.
Data-flow scoping that limits what reaches AI Sub-processors to Task Content relevant to the specific prediction or document-processing task (see Annex 1 and Section 3.3).
Documented incident response plan and breach notification procedures.
Encrypted backups with defined retention
Future Planned Measures: restoration testing, vulnerability scanning and independent penetration testing.
Annex 3 — Sub-processor List
See the standalone Subprocessor List document, incorporated by reference and updated from time to time; a summary is provided below:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting (Lightsail compute), managed PostgreSQL database, and object storage (S3) for uploaded documents | United States |
| Resend | Transactional email delivery (password resets, verification, and notifications) | United States |
| OpenAI, L.L.C. | AI model inference for document analysis and AI Analyst agent runs (accessed via API) | United States |
| Modal Labs, Inc. | GPU hosting for Alcony's proprietary fine-tuned forecasting models | United States |
| Tavily AI | Web search for Automated updates, only for questions where a user turns them on. Tavily's terms allow Tavily and its AI providers to use the search queries to train and improve AI models. | United States |
| Firebase (Google LLC) | Authentication (email/password, Google and Apple OAuth sign-in) | United States |
Annex 4 — International Data Transfer Mechanism
Pending final copy