Version 1.0 · Effective July 4, 2026
This Data Processing Addendum (the "DPA") forms part of the Terms of Service between Unfairly, Inc. ("Unfairly") and the customer that accepts them ("Customer") and applies where Unfairly processes Personal Data contained in Customer Data on Customer's behalf. For that processing, Customer is the controller (or business) and Unfairly is the processor (or service provider). Where this DPA conflicts with the Terms of Service on the subject of data protection, this DPA controls.
"Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation (2016/679) ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended ("CCPA"). "Personal Data," "processing," "controller," "processor," "data subject," and "personal data breach" have the meanings given in the Data Protection Laws. "Sub-processor" means a third party engaged by Unfairly to process Personal Data. "Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission for the transfer of Personal Data to third countries.
2.1 Unfairly processes Personal Data only on Customer's documented instructions, including as set out in the Terms of Service, this DPA, and Customer's configuration and use of the Service. The subject matter, duration, nature, and purpose of the processing, the types of Personal Data, and the categories of data subjects are described in Annex I.
2.2 Unfairly will inform Customer if, in its opinion, an instruction infringes the Data Protection Laws, unless prohibited from doing so by law.
Unfairly ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations and process Personal Data only as instructed.
Unfairly implements and maintains the technical and organizational measures described in Annex II, designed to protect Personal Data against a personal data breach and appropriate to the risk.
5.1 Customer provides general authorization for Unfairly to engage the Sub-processors listed in Annex III and to engage additional Sub-processors to provide the Service.
5.2 Unfairly imposes data-protection obligations on each Sub-processor that are no less protective than those in this DPA and remains responsible for each Sub-processor's performance.
5.3 Unfairly will give Customer notice of a new Sub-processor before that Sub-processor begins processing Personal Data. If Customer reasonably objects on data-protection grounds, the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected subscription.
Taking into account the nature of the processing, Unfairly will assist Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights. If Unfairly receives such a request directly, it will advise the data subject to submit it to Customer, unless legally required to respond.
Unfairly will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's Personal Data, and will provide information reasonably available to it to assist Customer in meeting its own notification obligations.
Taking into account the nature of the processing and the information available to it, Unfairly will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities.
On termination of the Service, Unfairly will delete or return Personal Data in accordance with Section 7.4 of the Terms of Service, unless retention is required by law.
Unfairly will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or its mandated auditor, on reasonable prior notice, no more than once per year absent a regulatory requirement or a personal data breach, and subject to confidentiality and to reasonable limits on scope and disruption.
Where Unfairly processes Personal Data subject to the GDPR or UK GDPR and transfers it to a country without an adequacy decision, the Standard Contractual Clauses (with the UK Addendum where applicable) are incorporated into this DPA by reference and apply to that transfer, with Customer as data exporter and Unfairly as data importer.
Where Unfairly processes Personal Data subject to the CCPA, it acts as a service provider. Unfairly will not sell or share such Personal Data, will not retain, use, or disclose it except as necessary to perform the Service or as permitted by the CCPA, and will not combine it with Personal Data from other sources except as the CCPA permits. Unfairly certifies that it understands and will comply with these restrictions.
Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.
Parties. Data exporter: Customer. Data importer: Unfairly, Inc.
Subject matter and duration. Provision of the Service for the duration of Customer's subscription.
Nature and purpose. Hosting, storage, indexing, retrieval, and processing of Customer Data to provide the multiplayer AI-context Service, including generating embeddings and in-product AI features.
Types of Personal Data. Personal Data that Customer and its Authorized Users choose to submit to their vaults, and account and usage data such as names, email addresses, and identifiers.
Categories of data subjects. Customer's Authorized Users and any individuals whose Personal Data is contained in Customer Data.
Encryption of Personal Data in transit; access controls and authentication for the Service; role-based access and least-privilege for personnel; logical separation of customer environments; monitoring and error diagnostics; and administrative and organizational measures designed to ensure the ongoing confidentiality, integrity, and availability of the Service.
The current list of Sub-processors is the set of service providers identified in Section 4 of the Privacy Policy, which include providers of hosting and storage, artificial-intelligence processing, payment processing, email delivery, analytics, and error monitoring.
Unfairly, Inc., 455 Market Street, Suite 1940 PMB 875030, San Francisco, CA 94105. Email privacy@unfairly.ai.