Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the agreement between Common Ninja Ltd., a company incorporated under the laws of the State of Israel (company number 516365541), which provides the SendRaven platform ("Common Ninja", "we", "us"), and the customer using the Services (the "Customer"), namely the SendRaven Terms of Service available at https://sendraven.ai/terms or any other written agreement between the Parties governing the use of the Services (the "Agreement"). It sets out the Parties' obligations regarding Personal Data that Common Ninja Processes on behalf of the Customer. Common Ninja and the Customer are each a "Party" and together the "Parties".

Capitalized terms not defined in this DPA have the meaning given to them in the Agreement. By using the Services, or by signing this DPA, the Customer accepts this DPA, and the person accepting it confirms that they have authority to bind the Customer. If there is a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA prevails. Where the Standard Contractual Clauses apply, they prevail over this DPA to the extent of any conflict.

1. Definitions

1.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where "control" means ownership or control of more than 50% of the voting interests of the entity.

1.2 "CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, and its implementing regulations.

1.3 "Controller", "Processor", "Processing", "Data Subject", "Member State", "Personal Data Breach" and "Supervisory Authority" have the meaning given to them in the GDPR. "Business", "Service Provider", "Consumer", "Sell" and "Share" have the meaning given to them in the CCPA. Where the CCPA applies, "Controller" includes "Business" and "Processor" includes "Service Provider".

1.4 "Customer Data" means the data submitted to, received by or generated in the Services by or for the Customer, including email messages the Customer sends and receives through the Services (their addresses, headers, subjects, bodies and attachments), conversation threads, contacts and their attributes, tags and audience memberships, templates, campaigns and automations, delivery, bounce, complaint, open and click events, and suppression and email preference records.

1.5 "Data Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by Common Ninja or its Sub-processors on behalf of the Customer.

1.6 "Data Protection Laws" means all privacy and data protection laws that apply to the Processing of Personal Data under the Agreement, including, as applicable, the GDPR, the UK GDPR, the FADP, the Israeli Protection of Privacy Law, 5741-1981 and its regulations, and the CCPA.

1.7 "FADP" means the Swiss Federal Act on Data Protection of 25 September 2020, as amended.

1.8 "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).

1.9 "Personal Data" means any information relating to an identified or identifiable natural person, or that is "personal information" under the CCPA, to the extent Common Ninja Processes it on behalf of the Customer under the Agreement.

1.10 "Recipient" means a person to whom the Customer sends email through the Services, or from whom the Customer receives email through them, and any person held as a contact in the Customer's workspace.

1.11 "Security Measures" means the technical and organizational measures described in Schedule 2.

1.12 "Services" means the SendRaven platform and related services Common Ninja provides to the Customer under the Agreement, including the REST API, the MCP server, webhooks, the dashboard and its assistant, sending, receiving and threading of email, contacts, campaigns, automations, and click and open tracking.

1.13 "Sensitive Data" means Personal Data that receives special protection under Data Protection Laws, including special categories of data under Article 9 of the GDPR, data relating to criminal convictions, government identification numbers, financial account or payment card numbers, and account passwords.

1.14 "Standard Contractual Clauses" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in the form published at https://sendraven.ai/scc-c2p (controller to processor) and https://sendraven.ai/scc-p2p (processor to processor), including their Annexes.

1.15 "Sub-processor" means any third party, including an Affiliate of Common Ninja, engaged by Common Ninja to Process Personal Data on behalf of the Customer.

1.16 "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

2. Processing of Personal Data

2.1 Roles of the Parties. For Personal Data Processed on behalf of the Customer, the Customer is the Controller and Common Ninja is the Processor. Where the Customer itself acts as a Processor for another Controller, Common Ninja acts as the Customer's Sub-processor.

2.2 Customer's Responsibilities. The Customer shall comply with Data Protection Laws, and with the laws that govern electronic marketing, in its use of the Services and in its instructions to Common Ninja. The Customer is responsible for having a lawful basis, and any notices and consents required, for the Personal Data it provides to the Services and for each message it sends, including consent to marketing email where the law requires it. The Customer is also responsible for the instructions given by any software or AI agent that uses the Customer's API keys or authorized access to the Services, which Common Ninja treats as the Customer's own instructions.

2.3 Common Ninja's Processing. Common Ninja shall Process Personal Data only on the Customer's documented instructions, which are: (i) to provide, maintain, secure and support the Services in accordance with the Agreement and this DPA; (ii) as initiated by the Customer, its users and the agents it authorizes through the Services; (iii) to create aggregated or de-identified information that no longer identifies any person, the Customer or its users; and (iv) as otherwise agreed in writing. The Agreement and this DPA are the Customer's complete instructions at the time of signing; additional instructions require the Parties' agreement. Common Ninja may also Process Personal Data where required by applicable law, in which case it shall inform the Customer of that requirement before Processing unless the law prohibits it. Common Ninja shall inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws.

2.4 Details of the Processing. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are described in Schedule 1.

2.5 Deliverability, Suppression and Abuse Prevention. Providing the Services includes Processing that keeps email deliverable and protects Recipients, and the Customer instructs Common Ninja to carry it out: recording hard bounces, spam complaints and unsubscribes and refusing further mail to those addresses; honoring each Recipient's email preferences; classifying automated clicks and opens, such as those of security scanners, so they are not counted as a person's; recording the authentication results of received mail; and monitoring sending for abuse of the Services, which may lead Common Ninja to pause or refuse sending under the Agreement. Common Ninja's personnel access the content of messages only where necessary to investigate abuse of the Services or a Data Incident, to answer a support request the Customer makes, or as required by law.

2.6 No Model Training. Common Ninja does not use Personal Data to train, fine-tune or improve AI models made available to other customers, and it configures its AI Sub-processors not to use such data to train their models where that option is available.

2.7 Sensitive Data. The Services are not designed for Sensitive Data. The Customer shall not submit Sensitive Data to the Services, including in the content of messages it sends, without Common Ninja's prior written agreement. Common Ninja has no obligation to review Customer Data to identify Sensitive Data. Common Ninja cannot control what Recipients write in mail they send to the Customer, and the Customer is responsible for how it uses Sensitive Data it receives.

2.8 CCPA. Common Ninja shall not Sell or Share Personal Data; retain, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship between the Parties; or combine it with personal information it receives from other sources, except as permitted by the CCPA. Common Ninja shall notify the Customer if it can no longer meet its obligations under the CCPA.

2.9 Common Ninja as Controller. This DPA does not apply to Personal Data that Common Ninja Processes as a Controller for its own legitimate business purposes, as described in its Privacy Policy at https://sendraven.ai/privacy. These purposes are: managing accounts, billing and the customer relationship; sending service and product communications; securing the Services and preventing fraud and abuse; measuring and improving the Services using usage information; and complying with legal obligations.

3. Data Subject Requests

Common Ninja shall, to the extent legally permitted, promptly notify the Customer of any request it receives from a Data Subject to exercise their rights under Data Protection Laws regarding Personal Data Processed on behalf of the Customer, and shall not respond to the request itself other than to refer the Data Subject to the Customer. A Recipient's request to stop receiving email, made through an unsubscribe link or email preference page the Services provide, is carried out by the Services on the Customer's behalf and is not a request Common Ninja must forward. Taking into account the nature of the Processing, Common Ninja shall assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to such requests. Many requests can be handled directly in the Services, for example by retrieving, editing or deleting a contact through the dashboard or the API.

4. Confidentiality

Common Ninja shall ensure that its personnel authorized to Process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and that access is limited to those who need it to provide the Services.

5. Sub-processors

5.1 Authorization. The Customer gives Common Ninja general authorization to engage Sub-processors. The Sub-processors listed at https://sendraven.ai/sub-processors on the date of this DPA (the "Sub-processor List", which states each Sub-processor's name, processing location and purpose) are authorized.

5.2 Notice of New Sub-processors. Common Ninja shall notify the Customer by email to the owners of the Customer's workspaces, and update the Sub-processor List, at least thirty (30) days before a new Sub-processor begins Processing Personal Data. The Customer may also ask to receive such notices at another address by writing to privacy@sendraven.ai.

5.3 Right to Object. The Customer may object to a new Sub-processor on reasonable grounds relating to data protection by writing to privacy@sendraven.ai within thirty (30) days of the notice. The Parties shall discuss the objection in good faith, and Common Ninja may offer a change to the Services or their configuration that avoids the Sub-processor. If the objection is not resolved within thirty (30) days of its receipt, the Customer may terminate the part of the Services that cannot be provided without the new Sub-processor, by written notice, and Common Ninja shall refund any prepaid fees for the terminated part covering the period after termination. This is the Customer's sole and exclusive remedy for an objection to a Sub-processor.

5.4 Urgent Replacement. Where Common Ninja must replace a Sub-processor urgently to keep the Services secure or available, for example because the existing Sub-processor has failed or ended its service, it may do so with shorter notice. It shall notify the Customer as soon as possible, and Section 5.3 applies from the date of that notice.

5.5 Sub-processor Obligations. Common Ninja shall carry out appropriate due diligence on each Sub-processor, and shall impose on it by written contract data protection obligations that provide at least the same level of protection as this DPA. Common Ninja remains fully responsible to the Customer for the performance of its Sub-processors' obligations.

5.6 Recipients' Mail Systems. Delivering an email requires handing it to the mail servers of its Recipient, and receiving one requires accepting it from the sender's. Those mail systems, and any service the Customer connects to the Services, such as a webhook endpoint it registers, act for the Recipient or for the Customer and are not Common Ninja's Sub-processors.

6. Security and Audits

6.1 Security Measures. Common Ninja shall implement and maintain the Security Measures, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. Common Ninja may update the Security Measures from time to time, provided that updates do not reduce the overall level of protection.

6.2 Assistance. Taking into account the nature of the Processing and the information available to it, Common Ninja shall reasonably assist the Customer with its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with a Supervisory Authority.

6.3 Information. Common Ninja describes its security practices for the Services at https://sendraven.ai/security. On request, and subject to a confidentiality agreement, Common Ninja shall answer reasonable written questions about its Processing of Personal Data and provide the information reasonably necessary to demonstrate compliance with this DPA, no more than once in any twelve (12) month period unless a Data Incident has occurred.

6.4 Audits. Where the information under Section 6.3 is not sufficient to demonstrate compliance with this DPA, or where a Supervisory Authority requires it, the Customer, or an independent auditor bound by confidentiality that is not a competitor of Common Ninja, may audit Common Ninja's compliance with this DPA. The Customer shall give at least thirty (30) days' written notice and agree the scope, timing and method with Common Ninja in advance. Audits shall be carried out by review of documents and remote sessions where that is sufficient, and on site only where it is not. They shall take place during normal business hours without disrupting Common Ninja's operations, and shall not give access to other customers' data or to information subject to confidentiality obligations owed to third parties. The Customer bears its own costs, and shall reimburse Common Ninja's reasonable costs for time spent on the audit beyond one business day, unless the audit reveals a material breach of this DPA by Common Ninja. Audits are limited to once in any twelve (12) month period, unless a Data Incident has occurred or a Supervisory Authority requires otherwise. Audit results are Common Ninja's confidential information and may be used only to assess compliance with this DPA.

7. Data Incidents

7.1 Notice. Common Ninja maintains an incident response plan. It shall notify the Customer of a Data Incident without undue delay, and in any event within seventy-two (72) hours after becoming aware of it, by email to the owners of the Customer's workspaces. Common Ninja becomes aware of a Data Incident when it has a reasonable degree of certainty that one has occurred. Unsuccessful attempts or activities that do not compromise the security of Personal Data, such as pings, port scans, blocked login attempts or denial of service attacks, are not Data Incidents.

7.2 Content of the Notice. The notice shall describe, to the extent then known: the nature of the Data Incident, including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to reduce its possible adverse effects; and a contact point for more information. Where not all of this information is available at once, Common Ninja shall provide it in phases without undue delay.

7.3 Response and Cooperation. Common Ninja shall promptly take reasonable steps to contain, investigate and remedy the Data Incident, and shall provide the Customer with the cooperation and information it reasonably needs to meet its own obligations, including notifying Supervisory Authorities and affected Data Subjects. Nothing in this DPA restricts the Customer from making any notification or disclosure it considers necessary under Data Protection Laws.

7.4 No Admission. Common Ninja's notice of, or response to, a Data Incident is not an acknowledgement of fault or liability. This Section 7 does not apply to incidents caused by the Customer or its users, such as the compromise of a user's own credentials or of an API key, or by the Customer's own configuration of the Services, such as a webhook endpoint it registers, although Common Ninja shall still provide reasonable assistance.

8. Return and Deletion of Personal Data

8.1 During the Agreement. The Customer can delete contacts, templates, campaigns, automations and sending domains in the Services at any time. The Customer may also ask Common Ninja to delete specified Personal Data, a workspace or all of its data by writing to privacy@sendraven.ai. Common Ninja shall delete the requested Personal Data from its production systems within thirty (30) days of the request.

8.2 Received Mail. The raw form of each message received through the Services, including its attachments, is deleted automatically thirty (30) days after it arrives. The record of the message in the Services, including its sender, subject and text, is kept until it is deleted under this Section 8.

8.3 After the Agreement Ends. For thirty (30) days after the Agreement ends, the Customer may export its Customer Data through the API or on request in a commonly used format. Common Ninja shall then delete all Personal Data it Processes on behalf of the Customer from its production systems within thirty (30) days after that export period.

8.4 Backups, Logs and Sub-processors. Deleted Personal Data may remain in encrypted database backups until those backups expire under Common Ninja's backup schedule, and in any event no longer than twelve (12) months, and in security and operational logs for the limited period they are kept. Backups are kept isolated, protected by the Security Measures, and used only to restore the Services after a failure. If a backup is ever restored, Common Ninja shall delete again any Personal Data that had been deleted before the restore. Personal Data held by Sub-processors is deleted in accordance with their retention terms.

8.5 Suppression Records. When the Customer deletes a contact while the Agreement is in force, Common Ninja keeps that address's suppression and email preference records in the Customer's workspace, at the Customer's instruction, so that a later import or send cannot mail a person who unsubscribed, complained or hard-bounced. These records hold the email address and the reason and time of the suppression or preference, and are deleted with the workspace under Sections 8.1 and 8.3. The Customer may ask for a specific record to be deleted.

8.6 Legal Retention and Confirmation. Common Ninja may retain Personal Data where required by applicable law, only for as long as required and subject to this DPA. On request, Common Ninja shall confirm the deletion to the Customer in writing.

9. International Transfers

9.1 Hosting. Common Ninja sends and receives email, and stores received mail, with Amazon Web Services in the United States (Oregon, us-west-2). The Services' applications run on Amazon Web Services in the United States (Virginia, us-east-1), and their database on MongoDB Atlas on Amazon Web Services in the United States (Ohio, us-east-2). Requests to a Customer's click and open tracking hostname are received at the edge region nearest the Recipient, as stated in the Sub-processor List. Common Ninja is established in Israel, which the European Commission and the United Kingdom recognize as providing an adequate level of data protection. Sub-processors process Personal Data in the locations stated in the Sub-processor List. Common Ninja may change hosting locations by updating the Sub-processor List in accordance with Section 5.

9.2 Transfers from the EEA, the United Kingdom and Switzerland. Where Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognized as providing adequate protection, and no other valid transfer mechanism applies (such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, for a Sub-processor certified under it), the Standard Contractual Clauses apply and are incorporated into this DPA: Module Two (controller to processor) where the Customer is a Controller, and Module Three (processor to processor) where the Customer is a Processor. For transfers from the United Kingdom, the Standard Contractual Clauses apply as amended by Annex III thereto (UK Cross Border Transfers), and for transfers from Switzerland, as amended by Annex IV thereto (Swiss Cross Border Transfers). Annex I of the Standard Contractual Clauses is completed by Schedule 1, and Annex II by Schedule 2.

9.3 Government Access. If Common Ninja receives a request from a public authority for access to Personal Data, it shall, unless legally prohibited, notify the Customer, review the legality of the request, challenge it where there are reasonable grounds to do so, and disclose only the minimum information required.

10. Authorized Affiliates

The Customer enters into this DPA for itself and on behalf of its Affiliates that use the Services under the Customer's account and are Controllers of Personal Data Processed under it. The Customer remains responsible for its Affiliates' compliance, and all communication under this DPA takes place between Common Ninja and the Customer.

11. General

11.1 Term. This DPA applies for as long as Common Ninja Processes Personal Data on behalf of the Customer.

11.2 Liability. Each Party's total liability arising out of or related to this DPA and the Standard Contractual Clauses, taken together, is subject to the limitations and exclusions of liability in the Agreement, except to the extent Data Protection Laws or the Standard Contractual Clauses do not permit such limitation. This DPA does not create any separate or additional liability.

11.3 Cost of Assistance. Common Ninja may charge reasonable fees for assistance under Sections 3 and 6.2 that goes beyond the standard features of the Services, unless the assistance is needed because of Common Ninja's breach of this DPA.

11.4 Changes. Common Ninja may update this DPA to reflect changes in Data Protection Laws, in the Services or in its Sub-processors. Updates shall not reduce the protection of Personal Data under this DPA during the Customer's subscription term without the Customer's written consent. Where the Parties have signed this DPA, changes require a written amendment signed by both Parties, except for changes to the Sub-processor List made under Section 5.

11.5 Governing Law. This DPA is governed by the law that governs the Agreement, except where the Standard Contractual Clauses or Data Protection Laws require otherwise.

11.6 Contact. Questions about this DPA or the Processing of Personal Data can be sent to privacy@sendraven.ai. A countersigned copy of this DPA is available on request at the same address.

Schedule 1: Details of the Processing

Subject Matter and Nature

Providing the Services: sending email on the Customer's instructions, including rendering templates, adding unsubscribe links and headers and, where the Customer enables tracking, rewriting links and adding an open pixel on the Customer's own tracking hostname; receiving email addressed to the Customer's domains, parsing it, recording its authentication results and joining it to conversation threads; storing and managing contacts, audiences, segments, tags and email preferences; running campaigns, A/B tests and automations; recording delivery, bounce, complaint, open and click events and classifying automated ones; maintaining suppression lists; delivering webhooks to endpoints the Customer registers; answering the Customer's users through the dashboard assistant; support; and securing and maintaining the Services, including preventing abuse.

Purpose

To provide the Services to the Customer under the Agreement, to follow the Customer's instructions given through the Services, and to comply with applicable law.

Duration

For the term of the Agreement and until deletion under Section 8.

Frequency

Continuous, in line with the Customer's use of the Services.

Categories of Data Subjects

• Recipients of email the Customer sends through the Services, including the Customer's own customers, users, prospects and subscribers
• People who send email to the Customer's domains, including replies to the Customer's messages
• People held as contacts in the Customer's workspace
• People named in the content of messages
• The Customer's users of the Services, such as employees and contractors

Types of Personal Data

• Contact data: email address, name, and any attributes, tags and audience memberships the Customer stores, such as a plan, a signup date or a product activity date
• Message data: sender and recipient addresses and names, subject, headers, message bodies and attachments of email sent and received, conversation threads, and the authentication and spam verdicts of received mail
• Engagement data: delivery, bounce, complaint, open and click events with their times, the link clicked, and the IP address and user agent of the request
• Preference and suppression data: unsubscribes, topic preferences, hard bounces and complaints, with their times
• Account data: name, email address, role and workspace membership of the Customer's users, and the content of their conversations with the dashboard assistant (account data is also Processed by Common Ninja as a Controller, see Section 2.9)
• Technical data: IP address, browser and device information, API request metadata and logs of activity in the Services

Sensitive Data

None intended (see Section 2.7).

Sub-processors

As listed in the Sub-processor List, for the purposes and in the locations stated there.

Schedule 2: Technical and Organizational Measures

Common Ninja may update these measures in accordance with Section 6.1. Common Ninja does not currently hold a SOC 2 or ISO 27001 certification for the Services.

Encryption

• Data in transit to and from the Services is encrypted with TLS, and the database does not accept unencrypted connections
• Received mail is stored in object storage that blocks public access and is encrypted at rest; the database runs on MongoDB Atlas, which encrypts storage at rest
• API keys are stored as one-way hashes, and new API keys and webhook signing secrets are never placed in a URL

Access Control

• Access to production systems is limited to named engineers, follows least privilege, and requires multi-factor authentication
• Access rights are reviewed regularly and removed promptly when a person leaves
• Staff tooling for account health and deliverability excludes message bodies
• In the Services, workspace roles, and API keys limited by scope, by recipient allowlist, by daily volume and by an approval hold, let the Customer control what each user and each agent can do

Application Security

• Separation of Customer Data by workspace in the application, enforced in database queries
• Template values are HTML-escaped on substitution, header values are sanitized, and received HTML is previewed in a sandboxed frame
• Received attachments are served only through the application, scoped to the workspace, and never through shareable links
• Webhook deliveries are signed and made only to public addresses, checked at each attempt
• Suppressions and opt-outs are enforced in the one send path every feature uses

Availability and Backups

• Automated database backups with point-in-time recovery
• Monitoring and alerting on production systems

Incident Response

• A documented incident response plan, including notice to customers under Section 7

Personnel

• Confidentiality obligations for all personnel, security awareness training, and a documented onboarding and offboarding process

Sub-processors

• Due diligence before engagement, written data protection terms, and AI providers configured not to train on Customer Data where that option is available

Deletion

• Deletion of Personal Data under Section 8, including automatic deletion of raw received mail after 30 days