Data Processing Addendum

Last updated: October 14, 2026

This Data Processing Addendum ("DPA") is part of the Morevy Terms of Use at morevy.ai/terms-of-use (the "Terms"). It is between Jetti, LLC, operating as Morevy ("Morevy"), and the customer that accepted the Terms ("Customer"). It covers personal data that Morevy handles for Customer. If this DPA and the Terms disagree about personal data, this DPA wins. Capitalized words not defined here have the meaning given in the Terms.

1. Words we use

• Data protection law means every law that applies to the personal data covered by this DPA, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA").

• Personal data means information about an identified or identifiable person that is contained in Customer Data.

• Controller is the party that decides why and how personal data is used. Processor is the party that handles it on the controller's instructions. Sub-processor is a company Morevy uses to help handle personal data.

• Data subject is the person the personal data is about.

• Personal data breach means a confirmed security event that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data that Morevy holds.

• Your Clients are the businesses whose data Customer puts into the Service on their behalf, where Customer is a practice.

• SCCs are the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, as completed in Schedule 3.

• Restricted transfer is a transfer of personal data out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision.

2. Roles

2.1 Customer controls, Morevy processes. For personal data in Customer Data, Customer is the controller and Morevy is the processor. Where Customer is a practice acting for Your Clients, Customer is a processor and Morevy is a sub-processor. Morevy acts only on Customer's documented instructions: the Terms, this DPA, the way Customer configures the Service, and any other reasonable written instruction that fits the Terms. Morevy's processing is limited to what Schedule 1 describes and what is needed to provide the Service.

2.2 Practices and Your Clients. Where Customer uploads data about Your Clients' customers, Customer confirms it has authority from each client to do so and to agree this DPA on the client's behalf. Customer is the only party that gives Morevy instructions, and any client's rights under this DPA run through Customer.

2.3 Morevy as its own controller. Morevy is the controller of account data about Customer's personnel (names, emails, sign-in records, usage logs, billing contacts). That data is covered by the Privacy Policy at morevy.ai/privacy-policy, not this DPA.

2.4 What this DPA does not cover. Data that has been aggregated or de-identified so it no longer identifies anyone; information that is not personal data; and Morevy's own business records.

3. Customer's duties

3.1 Lawful data. Customer is responsible for the lawfulness of the personal data it provides. Customer confirms three things: it has a lawful basis to collect and share the data; its instructions follow data protection law; and it has given data subjects the notices the law requires, including that a processor such as Morevy is used.

3.2 Sensitive data. The Service is not designed for sensitive data. Customer should not upload special categories of data (health, biometric, racial or ethnic origin, political or religious belief, union membership, sexual orientation), government identifiers, or full payment card numbers. The exception is a real need, with safeguards applied first, such as removing or coding those fields.

3.3 CCPA. Where the CCPA applies, Morevy is a "service provider". Morevy will not sell or share personal data, keep or use it for any purpose other than providing the Service, or combine it with personal data from other sources except as the CCPA allows. Morevy will tell Customer if it can no longer meet its CCPA duties.

4. Morevy's duties

4.1 Instructions only. Morevy processes personal data only on Customer's documented instructions, unless the law requires otherwise, in which case Morevy tells Customer first if it is allowed to. If Morevy believes an instruction breaks data protection law, it will say so promptly.

4.2 Confidentiality. Everyone Morevy lets handle personal data is bound by a confidentiality duty.

4.3 Helping with data subject requests. If a person asks to see, correct, delete, restrict, move or object to their data, and Customer cannot act alone, Morevy will give reasonable help. If a request comes to Morevy directly, Morevy forwards it to Customer promptly and does not answer the person itself unless the law requires.

4.4 Helping with authorities and impact assessments. Morevy gives reasonable help with any inquiry from a data protection authority. Where the law requires, it also helps with a data protection impact assessment. Both apply only as far as the help relates to Morevy's processing and Customer cannot get the information another way. Morevy will share its then-current third-party audit reports (for example a SOC 2 report, once obtained) under the confidentiality terms of the Terms.

4.5 Records. Morevy keeps the records of processing that data protection law requires of a processor.

5. Sub-processors

5.1 General authorization. Customer authorizes Morevy to use the sub-processors listed in Annex III, and any others added under this Section.

5.2 The list. The current list is published at trust.morevy.ai and in Annex III. Customer can subscribe to change notices by emailing support@morevy.ai.

5.3 New sub-processors. Morevy will give at least 30 days' notice before a new sub-processor handles personal data. Customer may object in writing within those 30 days on reasonable data-protection grounds. The parties will try in good faith to resolve the objection. If they cannot within 30 days of the objection, Customer may end the affected part of the Service without penalty and receive a refund of prepaid unused fees for it. Silence for 30 days counts as acceptance.

5.4 Sub-processor contracts. Before a sub-processor handles personal data, Morevy puts it under a written contract with data protection duties at least as protective as this DPA. Morevy stays responsible to Customer for its sub-processors' work.

6. AI-specific processing

6.1 AI providers are sub-processors. The Service uses outside AI model providers. They are sub-processors under this DPA. By using the Service, Customer authorizes Morevy to send the parts of Customer Data described in 6.3 to them.

6.2 What AI providers may and may not do. Morevy's contracts with AI providers require them to use Customer Data only to provide the model service to Morevy, to keep it confidential, and to protect it with appropriate security measures. No AI provider may train, fine-tune or improve any model on Customer Data, and Morevy will not do so either, without Customer's written consent.

6.3 What is sent, and how names are protected.

• Anthropic receives the text needed to write an explanation or answer a question: computed figures, period labels, coded category labels and the user's question. Before anything is sent, values that can carry a person's name (customer labels, segment names, filter values) are replaced with opaque codes. The codes are stable within a workspace and the real words are put back on Morevy's servers before anything reaches the screen. If the coding cannot be done, the request is refused rather than sent unprotected.

• TypeSafe receives, for a newly uploaded file, the column headings, the distinct values in a column, and the row count and amount for each value, so the Service can decide what the column means. It does not receive whole files. The values are sent as they appear in the file. A column that holds customer names is refused and never sent, and so is any column whose values look like a customer's name, an email address, an ID number or a date. A person's name that sits inside a plan or charge label can still be sent.

• LangWatch receives a record of each AI call, as sent (that is, after name coding), so Morevy can check quality and investigate errors.

6.4 Retention at AI providers. Morevy does not currently have a zero-data-retention agreement with Anthropic. Anthropic may keep inputs for a short time under its standard API data retention terms before deleting them. Morevy will tell Customer if this changes.

6.5 Workspace separation. Personal data processed for one Customer workspace is not accessible to any other customer. Morevy will tell Customer if it becomes aware of a personal data breach involving cross-workspace access to Customer's personal data.

6.6 Customer's responsibility for inputs. Customer decides what goes into the Service. The security measures in Schedule 2 cover data in Morevy's own systems and in transit. They do not cover what happens inside an AI provider's model while it works on a request; that is covered by the provider's contract with Morevy.

7. Security

7.1 Measures. Morevy maintains technical and organizational measures appropriate to the risk, taking account of the state of the art, the cost, and the nature of the processing. The measures in force today are in Schedule 2.

7.2 Changes. Morevy may change its measures over time, but not in a way that materially lowers the overall level of protection.

7.3 People. Morevy limits access to personal data to people who need it to provide the Service, trains them on their data protection duties, and binds them to confidentiality.

8. Personal data breaches

8.1 Notice. Morevy will tell Customer without undue delay after becoming aware of a personal data breach, and in any case within 72 hours. If Morevy does not yet know everything, it sends what it knows within 72 hours and the rest as it learns it. Notice goes to the workspace owner's email address. A notice is not an admission of fault.

8.2 Content. As far as known: what happened; which categories of data and roughly how many people and records; the likely consequences; what Morevy has done or will do about it; and who to contact at Morevy.

8.3 Help. Morevy will give Customer reasonable cooperation and updates so Customer can meet its own duties to notify authorities and data subjects, and will take reasonable steps to contain, investigate and fix the breach.

8.4 Exceptions. These duties do not apply to a breach caused by Customer or its Users (for example a shared password or a share link sent to the wrong person).

9. Return and deletion

9.1 During the term. Customer can delete files, workspaces and rulings inside the Service at any time, and can export its data at any time.

9.2 At the end. When the Terms end, or on Customer's written request, Morevy will delete all personal data within 30 days. The one exception is data the law requires Morevy to keep; that data stays confidential and is used for no other purpose. Customer should export anything it wants to keep before then.

9.3 Backups. Deleted data may remain in encrypted backups for up to 60 days after deletion. Backup copies are protected by the same measures, are not accessed except to restore service after a failure, and expire on Morevy's normal backup schedule.

10. Audit and information

10.1 Information. On written request, Morevy will provide the information reasonably needed to show it meets this DPA. That includes the current Schedule 2 and, where needed to check a sub-processor, the relevant terms of its sub-processor contract.

10.2 Reports first. Customer agrees that Morevy's then-current third-party reports and certifications (for example a SOC 2 report, once obtained) satisfy any audit request, and Morevy will share them under confidentiality.

10.3 An audit when reports are not enough. Customer may audit Morevy's processing of Customer's personal data if one of three things is true: the reports do not show compliance on a specific point; Morevy has notified Customer of a personal data breach; or a data protection authority requires it. An audit:

• happens at most once a year, with at least four weeks' written notice (shorter in an emergency);

• runs during business hours, without disrupting Morevy's operations or other customers' confidentiality, and may be done remotely;

• may be carried out by an independent auditor who is not a Morevy competitor and who signs a non-disclosure agreement;

• has its scope, timing and duration agreed in advance; and

• is at Customer's cost, including Morevy's reasonable costs for anything beyond a report review.

Customer tells Morevy promptly about anything the audit finds.

10.4 Findings are confidential. Audit findings are confidential to both parties.

11. International transfers

11.1 Where data lives. Morevy stores and processes Customer Data in the United States (Google Cloud, Los Angeles region). Some sub-processors in Annex III may process data in other countries.

11.2 Transfer rules. Morevy will not make a restricted transfer unless one of these applies:

• the destination has an adequacy decision;

• the transfer is covered by the SCCs as completed in Schedule 3;

• another valid transfer mechanism applies; or

• an Article 49 GDPR exception applies.

11.3 EU transfers. For a restricted transfer from the EEA, the parties agree to Module 2 (controller to processor) of the SCCs. Where Customer is itself a processor, they agree to Module 3 (processor to processor). Both are incorporated by reference and completed in Schedule 3. Where the SCCs and this DPA conflict, the SCCs win on that point.

11.4 UK transfers. For a restricted transfer from the United Kingdom, the parties also agree to the UK International Data Transfer Addendum to the SCCs issued by the Information Commissioner's Office, completed as in Schedule 3.

11.5 Swiss transfers. For a restricted transfer from Switzerland, the SCCs apply with the changes the Swiss Federal Data Protection and Information Commissioner requires, including reading "GDPR" as the Swiss Act and "supervisory authority" as the Swiss Commissioner.

11.6 Onward transfers. Morevy ensures any restricted transfer to a sub-processor is covered by an appropriate mechanism.

12. Liability

Each party's liability under this DPA, including its affiliates and every DPA with Your Clients, is subject to the limits in Section 16 of the Terms and counts toward that same single cap. This DPA creates no liability beyond what the Terms allow.

13. Term and changes

This DPA lasts as long as Morevy processes personal data for Customer. Morevy may update this DPA to reflect a change in the law or in the Service, with the same notice the Terms require for a material change.

Schedule 1. Details of processing

Subject. Personal data contained in the billing, customer-activity and related data that Customer uploads to or connects with the Service so Morevy can compute recurring-revenue movement, tie figures back to source rows, and write explanations.

Duration. For the term of the Terms, plus the deletion and backup periods in Section 9.

Nature. Receiving, storing, organizing, analyzing with fixed code, transmitting coded extracts to AI providers for narration, displaying, exporting and deleting.

Purpose. (a) Providing Customer access to and use of the Service; (b) computing figures and producing Outputs from Customer Data; (c) remembering Customer's rulings; (d) technical support; (e) complying with the law.

Types of personal data. Customer decides what is uploaded. Typically: customer or member names and identifiers; email addresses where present in an export; plan, product or membership names; subscription dates and status; charge, refund and credit amounts and dates; and any free-text labels present in the source system. Special categories should not be uploaded (Section 3.2).

Data subjects. Customer's customers, members, subscribers or clients; where Customer is a practice, Your Clients' customers; and Customer's staff whose names appear in source data.

Schedule 2. Technical and organizational security measures

These are the measures in force at the date of this DPA. The trust center at trust.morevy.ai shows current status, monitored continuously by Secureframe.

1. Hosting. All production systems run on Google Cloud Platform (including Firebase), in the Los Angeles region of the United States. Physical security of data centers is Google's responsibility and is certified under its programs. Morevy runs no data centers of its own.

2. Access control. Only named staff with a need can reach production systems, under role-based permissions. Each service runs under its own identity with the least access it needs. Staff access requires a second sign-in factor. Calls between services carry signed identity tokens. Access is removed when a person leaves.

3. Encryption. Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted with AES-256 by Google Cloud's managed encryption. Secrets are held in Google Secret Manager, never in code.

4. Workspace separation. Each workspace's data is stored under its own storage prefix and database paths. Every read and write is checked against the signed-in user's membership of that workspace. A practice account sees only the client workspaces it owns.

5. Name protection for AI calls. Values that can carry a person's name are replaced with codes before any text reaches an AI model, and are restored only on Morevy's servers. If coding fails, the call is refused.

6. Logging and monitoring. Write operations on customer data stores are audit-logged. Application and error logs are kept for 90 days with personal details scrubbed from error reports. Alerts fire on failed requests, errors and unusual patterns.

7. Backups and recovery. The primary database has point-in-time recovery for 7 days and weekly backups kept for 28 days. Backups are encrypted and stored in a separate location. Recovery procedures are documented.

8. Vulnerability management. Dependencies are pinned per service and reviewed when they change; static code analysis (Codacy and Semgrep) runs on every change; a release gate blocks deployment when tests or checks fail. External security researchers can report issues to support@morevy.ai.

9. Change management. Every production change goes through version control, automated tests and a review gate. Development, staging and production are separate environments. Production data is not used for development, except to debug a customer's issue with their permission.

10. Incident response. A written incident response plan covers detection, containment, investigation, notification and remediation, and is reviewed at least yearly.

11. People. Staff and contractors are bound by confidentiality, trained on security and data protection at joining and yearly, and subject to an acceptable-use policy.

12. Third-party assurance. Controls are monitored continuously by Secureframe. A SOC 2 Type I audit is in progress; a Type II report is expected in the first quarter of 2027. Reports will be available under confidentiality once issued.

13. Sub-processor security. Morevy reviews each sub-processor's security before use and requires standards at least as protective as this Schedule.

Schedule 3. Standard Contractual Clauses: selections

The parties incorporate Module 2 (controller to processor) and, where Customer acts as a processor for Your Clients, Module 3 (processor to processor) of the SCCs adopted by Commission Decision (EU) 2021/914. The full text is at eur-lex.europa.eu.

• Clause 7 (docking): does not apply.

• Clause 9(a) (sub-processors): Option 2, general written authorization, with the 30-day notice period in Section 5.3 of this DPA.

• Clause 11(a) (independent dispute body): the optional language does not apply.

• Clause 13 (supervisory authority): the authority of the EU member state where Customer (or its EU representative) is established; failing that, the Irish Data Protection Commission.

• Clause 17 (governing law): the law of Ireland.

• Clause 18(b) (courts): the courts of Ireland.

Annex I, list of parties. Data exporter: Customer, at the address and contact on its account or Order; role: controller (Module 2) or processor (Module 3). Data importer: Jetti, LLC, operating as Morevy, Los Angeles, California, United States, contact support@morevy.ai; role: processor.

Annex I, description of transfer. As set out in Schedule 1. Frequency: continuous, for as long as the Service is used. Retention: as set out in Section 9.

Annex II, security measures. As set out in Schedule 2.

Annex III, sub-processors. As set out below.

UK Addendum. For UK transfers, the International Data Transfer Addendum (version B1.0) issued by the Information Commissioner's Office is incorporated. Table 1: the parties in Annex I. Table 2: the SCCs as completed above. Table 3: Annexes I, II and III above. Table 4: either party may end the Addendum as it provides.

Annex III. Sub-processors

Current at the date of this DPA. The live list is at trust.morevy.ai.

Website tools (Google Analytics and the Google Ads tag, HubSpot, Intercom, Framer, GitBook, Cloudflare) handle website visitor data under the Privacy Policy. They do not receive Customer Data.