https://www.xilos.ai/assets/DPA-BjgGf3VQ.js

1import{j as e}from"./index-D-AFl6v8.js";import{L as s}from"./index-p0e6FDhm.js";import"./index-BZruhSgt.js";import"./Container-Bhrvg2OW.js";import"./styled-C-2iXfty.js";import"./useThemeProps-DgQP1pEg.js";import"./Link-DQbJ92mW.js";const c=()=>e.jsxs(s,{title:"Data Processing Agreement",lastUpdated:"July 1, 2026",children:[e.jsx("p",{children:`This Data Processing Agreement ("DPA") forms part of the Terms of Service and is entered into by and between Mill Pond Research Inc. ("Processor," "Mill Pond," "we," or "us"), a Delaware corporation, and the entity that has subscribed to the Xilos Max plan ("Customer," "you," or "Controller"). This DPA reflects the parties' agreement with respect to the processing of Customer Personal Data under the GDPR, CCPA, and other applicable data protection laws.`}),e.jsx("h2",{children:"1. Definitions"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:'"Personal Data"'})," — any information relating to an identified or identifiable natural person, as defined by the GDPR."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Customer Personal Data"'})," — Personal Data processed by Processor on behalf of Customer through the Service."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Controller"'})," — the entity that determines the purposes and means of processing Personal Data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Processor"'})," — the entity that processes Personal Data on behalf of the Controller."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Subprocessor"'})," — a third party engaged by Processor to process Customer Personal Data."]}),e.jsxs("li",{children:[e.jsx("strong",{children:'"Standard Contractual Clauses"'})," — the standard data protection clauses adopted by the European Commission for international transfers."]})]}),e.jsx("h2",{children:"2. Roles and Scope"}),e.jsxs("p",{children:["Customer acts as the Controller and Mill Pond acts as the Processor. Mill Pond processes Customer Personal Data only on documented instructions from Customer, as described in the ",e.jsx("a",{href:"/legal/terms",children:"Terms of Service"})," ","and this DPA. The scope, duration, nature, and purpose of processing, the types of Personal Data, and categories of data subjects are described in",e.jsx("strong",{children:" Schedule 1"})," below."]}),e.jsx("h2",{children:"3. Processor Obligations"}),e.jsx("p",{children:"Mill Pond shall:"}),e.jsxs("ul",{children:[e.jsx("li",{children:"Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers of data outside the EEA or UK, unless required by law."}),e.jsx("li",{children:"Ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations."}),e.jsx("li",{children:"Implement appropriate technical and organizational security measures (see Section 5)."}),e.jsx("li",{children:"Assist Customer in responding to data subject rights requests."}),e.jsx("li",{children:"Assist Customer in meeting obligations under Articles 32–36 of the GDPR (security, breach notification, DPIAs, prior consultation)."}),e.jsx("li",{children:"Delete or return all Customer Personal Data after the end of the services, at Customer's choice, unless retention is required by law."}),e.jsx("li",{children:"Make available information necessary to demonstrate compliance with this DPA and allow for audits."})]}),e.jsx("h2",{children:"4. Subprocessors"}),e.jsx("p",{children:"Customer grants Mill Pond general authorization to engage subprocessors, provided that Mill Pond enters into a written agreement with each subprocessor imposing data protection obligations equivalent to those in this DPA. Mill Pond remains liable for the acts and omissions of its subprocessors as if they were Mill Pond's own."}),e.jsx("h3",{children:"4.1 Current Subprocessors"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Stripe"})," — payment processing (Stripe, Inc.)"]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Neon"})," — PostgreSQL database hosting (Neon, Inc.)"]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Vercel"})," — web application hosting (Vercel, Inc.)"]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Railway"})," — API backend hosting (Railway Corp.)"]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Resend"})," — transactional email delivery (Resend, Inc.)"]})]}),e.jsx("h3",{children:"4.2 Subprocessor Changes"}),e.jsx("p",{children:"Mill Pond will notify Customer of any addition or replacement of a subprocessor at least 30 days in advance. Customer may object to a new subprocessor by notifying Mill Pond in writing within that period. If Mill Pond cannot reasonably accommodate the objection, Customer may suspend or terminate the affected portion of the Service."}),e.jsx("h2",{children:"5. Security Measures"}),e.jsx("p",{children:"Mill Pond implements the following technical and organizational measures:"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Encryption"})," — TLS in transit; AES-256 encryption at rest for API keys, provider credentials, and database storage."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Access controls"})," — role-based access, principle of least privilege, multi-factor authentication for administrative access."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"PII detection"})," — Presidio-based PII detection runs locally; detected PII is not transmitted to external services."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Network security"})," — firewalls, VPC isolation, and regular vulnerability scanning."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Data segregation"})," — logical separation of Customer data at the database and application layers."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Logging and monitoring"})," — audit logs for access to Customer Personal Data, with alerting on anomalous activity."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Incident response"})," — documented incident response plan with defined roles, escalation, and remediation procedures."]})]}),e.jsx("h2",{children:"6. Personal Data Breach"}),e.jsx("p",{children:"Mill Pond will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Mill Pond will cooperate with Customer in fulfilling any breach notification obligations to data subjects and regulators."}),e.jsx("h2",{children:"7. Data Subject Rights"}),e.jsx("p",{children:"Mill Pond will assist Customer in fulfilling its obligations to respond to data subject requests (access, rectification, erasure, restriction, portability, and objection). If Mill Pond receives a request directly from a data subject, it will forward the request to Customer and not respond directly, except as required by law."}),e.jsx("h2",{children:"8. Data Return and Deletion"}),e.jsx("p",{children:"Upon termination of the Service, Mill Pond will, at Customer's choice, return or delete all Customer Personal Data within 30 days, except where retention is required by applicable law. Mill Pond will provide written confirmation of deleti

1on upon request."}),e.jsx("h2",{children:"9. Audit Rights"}),e.jsx("p",{children:"Mill Pond will make available to Customer, upon reasonable notice and no more than once per year, information necessary to demonstrate compliance with this DPA. Customer may conduct an audit or instruct an independent auditor to do so, provided such audit does not unreasonably interfere with Mill Pond's operations. Any audit is at Customer's expense unless it reveals material non-compliance."}),e.jsx("h2",{children:"10. International Transfers"}),e.jsx("p",{children:"Mill Pond may transfer Customer Personal Data outside the EEA, UK, or Switzerland. For such transfers, the parties agree to the Standard Contractual Clauses as adopted by the European Commission, which are incorporated by reference. Mill Pond has implemented supplementary measures (encryption, access controls) to provide an appropriate level of protection."}),e.jsx("h2",{children:"11. CCPA Alignment"}),e.jsx("p",{children:'To the extent the California Consumer Privacy Act (CCPA) applies, Mill Pond acts as a "service provider" to Customer. Mill Pond will not use, disclose, or sell Customer Personal Data for any purpose other than providing the Service, will not retain or use the data outside the business relationship, and will certify compliance with CCPA upon request.'}),e.jsx("h2",{children:"12. Governing Law"}),e.jsx("p",{children:"This DPA is governed by the laws of the State of Delaware, without regard to its conflict of law principles, and is subject to the dispute resolution provisions of the Terms of Service."}),e.jsx("h2",{children:"13. Contact"}),e.jsxs("p",{children:["For questions about this DPA, contact us at"," ",e.jsx("a",{href:"mailto:[email protected]",children:"[email protected]"}),"."]}),e.jsx("h2",{children:"Schedule 1 — Processing Details"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Subject matter:"})," Provision of the Xilos AI routing and governance platform."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Duration:"})," Term of the Customer's Max subscription."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Nature and purpose:"})," Routing AI queries to LLM providers, caching, PII detection, usage analytics."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Types of Personal Data:"})," Queries that may contain personal information submitted by end users; usage metadata; account contact information."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Categories of data subjects:"})," Customer's end users, administrators, and authorized personnel."]})]})]});export{c as default};