Data Processing Agreement

Effective November 9, 2026

This Data Processing Agreement (the "DPA") is between Velocinator LLC, a New Mexico limited liability company doing business as evolveAB ("Evolve"), and the customer that has accepted the Evolve Terms of Service at /legal/terms ("Customer").

The DPA forms part of the Terms and of any Order Form under them (together, the "Agreement"). It is incorporated by reference and takes effect when Customer accepts the Terms, without a separate signature. Customer may request a countersigned copy at legal@evolveab.com.

#1. Definitions

1.1 Capitalised terms not defined here have the meanings given in the Terms.

1.2 The following terms have the meanings given to them in the applicable Data Protection Law: "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority". The CCPA terms "business", "service provider", "sell", "share" and "business purpose" have the meanings given in the CCPA.

1.3 In this DPA:

(a) "Customer Personal Data" means personal data in Customer Data that Evolve processes on Customer's behalf in providing the Service.

(b) "Data Protection Law" means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement. These include:

Regulation (EU) 2016/679 (the "GDPR");
the GDPR as it forms part of UK law, and the UK Data Protection Act 2018 (together, the "UK GDPR");
the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP");
the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations (the "CCPA");
other US state privacy laws, to the extent they apply.

(c) "Restricted Transfer" means a transfer of Customer Personal Data from the EEA, the UK or Switzerland to a country that is not recognised as providing an adequate level of protection.

(d) "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

(e) "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0), as amended from time to time.

(f) "Sub-processor" means any third party that Evolve engages to process Customer Personal Data.

#2. Roles and scope

2.1 Roles. For Customer Personal Data, Customer is the controller (or a processor acting for its own customers), and Evolve is a processor (or a sub-processor). Under the CCPA, Customer is the business and Evolve is a service provider.

2.2 Evolve as an independent controller. Evolve acts as an independent controller for a limited set of personal data that it processes for its own legitimate business purposes. These purposes are:

managing the customer relationship and billing;
securing the Service and preventing abuse;
complying with law.

In each case the processing is described in the Privacy Policy at /legal/privacy. Evolve processes that data only as needed for those purposes and in line with Data Protection Law.

2.3 Visitor Data is out of scope. The Service is built so that Visitor Data stays in a database that Customer controls. This includes visitor identifiers and cookies, raw events, exposures, page views, and visitors' IP addresses, user agents, referrers and event property values. Evolve does not connect to that database, and Evolve does not receive Visitor Data. Customer is solely responsible for Visitor Data, including:

its security and retention;
notices and consents for the cookies the SDK sets;
responding to visitors' requests.

2.4 Data minimisation by Customer. Customer will not include personal data in goal definitions or filters, region identifiers, schemas, props or control copy, except personal data already published on the Customer Application. Customer will not send special categories of personal data to the Service.

2.5 Details of processing. Annex I describes the subject matter, nature, purpose and duration of the processing, and the categories of personal data and data subjects. Processing lasts for the term of the Agreement plus the deletion period in Section 11.

#3. Customer instructions

3.1 Evolve will process Customer Personal Data only on Customer's documented instructions. Customer instructs Evolve to process Customer Personal Data:

(a) to provide, secure and support the Service under the Agreement;

(b) as initiated by Authorized Users through the Service, including approving AI Output and configuring autopilot; and

3.2 Evolve may process Customer Personal Data otherwise if the law requires it. In that case Evolve will inform Customer before processing, unless the law prohibits this on important grounds of public interest.

3.3 Evolve will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Law. Evolve may then suspend the affected processing until the instruction is confirmed or changed.

3.4 Customer is responsible for the lawfulness of its instructions and for having a lawful basis for the processing.

#4. Evolve personnel

4.1 Evolve ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, and accesses that data only as needed to perform the Agreement.

4.2 Support access. Evolve personnel may access Customer's account through the Service's support-access function to provide support. Each access:

requires a stated reason;
is time-limited;
is read-only unless a separate, reasoned authorisation to make changes is recorded;
is logged and visible to Customer in its audit log.

#5. Security

5.1 Evolve will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 GDPR. These include the measures in Annex II.

5.2 Evolve may update those measures, as long as the update does not materially reduce the overall level of protection.

#6. Sub-processors

6.1 General authorisation. Customer gives Evolve a general authorisation to engage Sub-processors. The Sub-processors listed at /legal/subprocessors on the effective date of the Agreement are approved.

6.2 Sub-processor obligations. Before a Sub-processor processes Customer Personal Data, Evolve will impose on it, by written contract, data protection obligations that are no less protective than those in this DPA. Evolve remains fully liable to Customer for each Sub-processor's performance of those obligations.

6.3 Notice of changes. Evolve will give at least 30 days' notice before adding or replacing a Sub-processor. Notice is given by updating /legal/subprocessors and by emailing Customer's account Admins and anyone who has subscribed to updates as described on that page.

6.4 Objection. Customer may object to a new Sub-processor on reasonable grounds relating to data protection, by notice to legal@evolveab.com within the 30-day notice period. The parties will discuss Customer's concerns in good faith. If Evolve cannot reasonably accommodate the objection, for example by not using the Sub-processor for Customer, Customer may terminate the affected Services by written notice before the change takes effect. Evolve will refund any prepaid Fees for the unused period. No penalty or termination fee applies.

6.5 Emergency replacement. If Evolve must replace a Sub-processor urgently for security or continuity reasons, it will give notice as soon as practicable, and Section 6.4 applies from the date of that notice.

#7. Data subject rights

7.1 Evolve will promptly forward to Customer any request it receives from a data subject about Customer Personal Data. Evolve will not respond to the request itself, except to direct the data subject to Customer, unless Customer authorises it.

7.2 Taking into account the nature of the processing, Evolve will assist Customer through appropriate technical and organisational measures in responding to data subject requests. Much of this is possible directly through the Service, for example by updating or removing members. Where Customer cannot fulfil a request itself, Evolve will provide reasonable assistance within 10 business days of Customer's request.

7.3 Requests from visitors to a Customer Application concern Visitor Data. Customer answers these from its own database, which Evolve does not hold.

#8. Assistance with compliance

Taking into account the nature of the processing and the information available to it, Evolve will give Customer reasonable assistance with:

(a) data protection impact assessments;

(b) prior consultations with supervisory authorities; and

Evolve may charge reasonable costs for assistance that goes beyond making available the information in this DPA, the Documentation and Evolve's standard security materials.

#9. Personal data breaches

9.1 Notice. Evolve will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 Content of notice. The notice will describe, to the extent then known:

the nature of the breach, including the categories and approximate numbers of data subjects and records concerned;
its likely consequences;
the measures taken or proposed to address it;
a contact point for more information.

Evolve will provide further information in phases as it becomes available.

9.3 Response. Evolve will promptly take reasonable steps to contain, investigate and mitigate the breach, and will keep Customer informed.

9.4 Customer's role. Customer is responsible for any notifications to supervisory authorities and data subjects that the law requires of a controller. Evolve will not notify those parties of a breach of Customer Personal Data on Customer's behalf without Customer's consent, unless the law requires it.

9.5 No admission. Notice of a breach is not an admission of fault or liability.

#10. Audits

10.1 Information. Evolve will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA and Article 28 GDPR. This includes:

this DPA;
Annex II;
the Documentation, including https://app.evolveab.com/privacy;
answers to reasonable security questionnaires;
any third-party audit reports or certifications Evolve holds from time to time.

10.2 On-site or remote audits. If that information is not reasonably sufficient to demonstrate compliance, Customer may audit Evolve's compliance with this DPA, either itself or through an independent auditor bound by confidentiality, under these conditions:

(a) no more than once in any 12-month period, except after a personal data breach or where a supervisory authority requires it;

(b) on at least 30 days' written notice, with a proposed scope agreed in advance;

(c) during normal business hours, without unreasonably disrupting Evolve's operations or compromising the security or confidentiality of other customers' data;

(d) at Customer's cost.

10.3 Results. Customer will give Evolve a copy of any audit report. The report is Evolve's Confidential Information.

10.4 SCCs. This Section 10 is how the parties agree to carry out the audits described in Clause 8.9 of the SCCs.

#11. Deletion and return

11.1 Site deletion. When Customer deletes a site in the Service, the site stops at once, and the Customer Application serves its control content. All of the site's data in the Service is permanently deleted within 7 days. Evolve keeps a minimal deletion record (site identifier, requester, time, number of records removed) as evidence.

11.2 End of the Agreement. When the Agreement ends, Customer may export Customer Data as described in the Terms. Within 30 days after the Agreement ends, Evolve will delete Customer Personal Data from its production systems and certify the deletion on request. Data in backups is deleted when the backups expire under Evolve's backup rotation, and remains protected by this DPA until then.

11.3 Retention required by law. Evolve may keep Customer Personal Data where the law requires it. In that case the data remains protected by this DPA, and Evolve processes it only for the purpose that requires retention.

11.4 Visitor Data. Visitor Data remains under Customer's control in its own database at all times.

#12. International transfers

12.1 Location. Evolve and its Sub-processors process Customer Personal Data in the United States. Evolve will make any Restricted Transfer only in compliance with Data Protection Law.

12.2 EEA transfers. For Restricted Transfers from the EEA, the SCCs are incorporated into this DPA by reference and apply as follows:

(a) Module Two (controller to processor) applies where Customer is a controller. Module Three (processor to processor) applies where Customer is a processor.

(b) Clause 7 (docking clause) applies.

(d) In Clause 11, the optional language does not apply.

(e) In Clause 13, the competent supervisory authority is:

the authority of the EU Member State where Customer is established; or
if Customer is not established in the EU, the authority of the Member State where its EU representative is appointed; or
if Customer has no EU representative, the authority of the Member State where the data subjects concerned are mainly located.

(f) In Clause 17, Option 1 applies, and the SCCs are governed by the law of Ireland.

(g) In Clause 18(b), disputes are resolved by the courts of Ireland.

(h) Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

12.3 UK transfers. For Restricted Transfers from the UK, the SCCs apply as set out in Section 12.2, amended by the UK Addendum, which is incorporated by reference.

(a) Table 1 is completed with the parties' details in Annex I.

(b) Table 2 refers to the modules and options selected in Section 12.2.

(d) In Table 4, neither party may end the UK Addendum under its Section 19.

12.4 Swiss transfers. For Restricted Transfers from Switzerland, the SCCs apply as set out in Section 12.2, with these changes:

(a) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP;

(b) references to the GDPR are read as references to the FADP where the FADP applies;

(c) "Member State" in Clause 18(c) is not read so as to exclude data subjects in Switzerland from suing in their place of habitual residence;

(d) the governing law and forum in Section 12.2 remain unchanged.

12.5 Onward transfers. Where a Sub-processor receives Customer Personal Data in a Restricted Transfer, Evolve ensures that the transfer is covered by the SCCs (Module Three, where applicable), the UK Addendum, or another valid transfer mechanism.

12.6 Transfer impact. Evolve has assessed the laws of the United States as they apply to the processing under this DPA. In reaching its view, Evolve took into account the limited personal data involved (business contact and account data, not Visitor Data) and the measures in Annex II.

12.7 Government requests. If a public authority requests access to Customer Personal Data, Evolve will:

challenge the request where it has reasonable grounds to do so;
disclose only the minimum data required;
notify Customer of the request unless the law prohibits it.

12.8 Precedence of the SCCs. If there is a conflict between this DPA and the SCCs or the UK Addendum, the SCCs and the UK Addendum prevail.

#13. CCPA service-provider terms

13.1 To the extent the CCPA applies, Evolve will not:

(a) sell or share Customer Personal Data;

(b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, which are providing, securing and supporting the Service, or as the CCPA otherwise permits;

(d) combine Customer Personal Data with personal information it receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits a service provider to do.

13.2 Evolve will comply with the CCPA obligations that apply to it as a service provider. It will provide the same level of privacy protection as the CCPA requires of businesses.

13.3 Evolve will notify Customer if it determines that it can no longer meet its obligations under the CCPA.

13.4 Customer may take reasonable and appropriate steps to ensure that Evolve uses Customer Personal Data consistently with Customer's CCPA obligations. On notice, Customer may take reasonable steps to stop and remediate any unauthorised use.

13.5 Evolve will engage Sub-processors that receive Customer Personal Data only under a written contract that imposes these same restrictions.

13.6 Evolve certifies that it understands and will comply with the restrictions in this Section 13.

#14. AI processing

14.1 The AI Features send model inputs to the AI model providers listed at /legal/subprocessors, routed through Vercel's AI Gateway. Model inputs are drawn from region schemas, control copy, public page text, brand profiles and aggregate statistics.

14.2 The Service does not send Visitor Data or Authorized Users' account details to AI providers.

14.3 Evolve does not use Customer Data, model inputs or AI Output to train or fine-tune AI models, and does not authorise its AI providers to do so.

#15. Liability and precedence

15.1 Each party's liability under this DPA is subject to the exclusions and limits in the Terms. This does not limit a party's liability to data subjects under the SCCs or any liability that cannot be limited by law.

15.2 If there is a conflict between this DPA and the rest of the Agreement on matters concerning personal data, this DPA prevails. Section 12.8 governs conflicts with the SCCs.

15.3 This DPA ends when Evolve no longer processes Customer Personal Data.

#16. Changes

Evolve may update this DPA:

to reflect changes in Data Protection Law or a supervisory authority's guidance; or
to add safeguards.

Evolve will give at least 30 days' notice of any update that is not required by law and that materially reduces Customer's protections. Customer may then terminate under Section 27 of the Terms. An update does not reduce the protections of a DPA countersigned by both parties during the Subscription Term it covers, unless Customer agrees.

#Annex I: Description of processing and transfer

#A. Parties

Data exporter

Name: the Customer named in the Order Form or account.
Address and contact person: as set out in the Order Form or the account details of Customer's Admins.
Activities: use of the Service to run experiments on Customer Applications.
Role: controller (Module Two) or processor (Module Three).
Signature and date: acceptance of the Terms, which constitutes signature of this DPA and the SCCs.

Data importer

Name: Velocinator LLC.
Address: 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA.
Contact for data protection: legal@evolveab.com.
Activities: providing the Service under the Agreement.
Role: processor (Module Two) or sub-processor (Module Three).
Signature and date: Evolve's publication of and agreement to this DPA, effective on Customer's acceptance of the Terms.

#B. Description of transfer

Categories of data subjects

Customer's Authorized Users and invitees, such as employees, contractors and agents of Customer and its Affiliates.
Individuals whose personal data appears in public control copy or public page text of a Customer Application, to the extent any does.

Categories of personal data

Account data: name, email address, organisation membership and role, invitations.
GitHub profile data: public profile information and email address, only for users who choose GitHub sign-in.
Session data: sign-in times, and the IP address and user agent of sign-in sessions.
Activity data: audit and change records, including support-access records.
Feedback: feedback and support content that Authorized Users submit.
Request metadata: IP addresses of Customer's servers that call the API, in short-lived hosting request logs.

Sensitive data

None. Customer will not send special categories of personal data.

Frequency of transfer

Continuous, for the duration of the Agreement.

Nature of processing

Collecting, storing, organising and transmitting data.
Computing statistics over aggregate data.
Sending sign-in and invitation emails.
Generating content suggestions using AI models over non-personal inputs.
Deleting data.

Purpose of processing

To provide, secure and support the Service under the Agreement.

Retention

For the term of the Agreement, then deleted as described in Section 11. Site data is deleted within 7 days of site deletion.

Transfers to Sub-processors

Sub-processors process data for the subject matter, nature and duration described above, as set out at /legal/subprocessors.

#C. Competent supervisory authority

As determined under Section 12.2(e), or under Section 12.4 for transfers from Switzerland. For transfers from the UK, it is the Information Commissioner's Office.

#Annex II: Technical and organisational measures

1. Data minimisation by design

Visitor-level data stays in Customer's own database. The Service never connects to that database. It sends signed aggregate requests to the Customer Application, which runs the counting query itself and returns only totals (counts, sums and histograms) in which no row describes a single visitor. Database credentials stay in Customer's environment.

2. Encryption in transit

All traffic to and from the Service uses TLS.

3. Protection of secrets

Customer secret keys, webhook secrets and single-use invitation links are stored only in hashed or encrypted form.

4. Integrity of configuration

Experiment configuration bundles are signed with Ed25519, and the SDK verifies the signature before using a bundle. Bundles expire if they cannot be refreshed, after which the SDK serves control content.

5. Authenticated server-to-server requests

Aggregate requests and sync webhooks from the Service to Customer Applications are signed with HMAC.

6. Tenant isolation

All data is scoped to the owning organisation and site. Isolation is enforced in application code and covered by automated tests.

7. Abuse protection

Rate limits are keyed on hashed values, not raw IP addresses.

8. Access control

Access to production systems is granted on a least-privilege basis to personnel who need it. Customer-side roles (such as Admin) control who can invite members, change settings and delete sites.

9. Support access controls

Support access to a customer account:

requires a stated reason;
is read-only by default;
needs a separate, reasoned authorisation to make changes;
expires automatically;
is recorded in Customer's audit log.

10. Audit logging

Changes to experiments, variants, AI proposals and sites are recorded with the actor and time, and are visible to Customer.

11. Deletion

Self-service site deletion stops processing at once and removes the site's data within 7 days. A deletion record is kept as evidence.

12. Sub-processor management

Sub-processors are bound by written data protection terms (see Annex III).

#Annex III: Sub-processors

The authorised Sub-processors, their purposes and their locations are listed at /legal/subprocessors. That list, as updated under Section 6, forms this Annex III.