Data Processing Agreement

Last updated: January 2026

1. Definitions

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Anima Core, Inc. ("Data Processor") and the customer ("Data Controller") for the AN1 service.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed as part of AN1 service usage.

2. Scope and Integration Modes

2.1 Client-Extracted Mode (infer_z)

In this mode, Data Controller processes all Personal Data locally before sending semantic vectors to the AN1 API. Anima Core acts as a processor only for the 256-dimensional vector representations, which typically do not contain Personal Data.

Data Controller is responsible for ensuring compliance with data protection laws when extracting and transmitting semantic vectors.

2.2 Hosted Extraction Mode (infer_text)

In this mode, Data Controller sends raw text to Anima Core for field extraction and inference. Anima Core acts as a Data Processor for any Personal Data contained in the input text.

Text inputs are processed in-memory and not persisted to disk. Only metadata and prompt previews (first 120 characters) are logged.

3. Data Processor Obligations

Anima Core shall:

• Process Personal Data only on documented instructions from Data Controller
• Implement appropriate technical and organizational security measures
• Ensure confidentiality of personnel processing Personal Data
• Assist Data Controller in responding to data subject requests
• Delete or return Personal Data upon termination of services
• Make available information necessary to demonstrate compliance

4. Sub-Processors

Data Controller authorizes Anima Core to engage the following sub-processors:

• AWS (infrastructure hosting)
• Supabase (database services)
• Stripe (payment processing)
• Resend (email delivery)

Anima Core will notify Data Controller of any changes to sub-processors with 30 days notice.

5. Security Measures

Anima Core implements:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• API key-based authentication with rate limiting
• Audit logging of all data access
• Regular security assessments and penetration testing
• Access controls and least-privilege principles

6. Data Subject Rights

Anima Core will assist Data Controller in fulfilling data subject rights requests (access, rectification, erasure, portability) within 7 business days of receiving such request.

7. Data Breach Notification

Anima Core will notify Data Controller without undue delay (within 48 hours) upon becoming aware of any Personal Data breach.

8. Data Transfers

Personal Data may be transferred to and processed in the United States. Anima Core ensures appropriate safeguards are in place for international data transfers in compliance with applicable laws.

9. Audit Rights

Data Controller may audit Anima Core's compliance with this DPA once per year with 30 days advance notice.

10. Term and Termination

This DPA remains in effect for the duration of the Terms of Service. Upon termination, Anima Core will delete or return all Personal Data within 30 days, except where retention is required by law.

11. Contact for DPA Matters

Data protection inquiries: dpo@animacore.ai