Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into, and forms part of, the Terms of Service between Buildaether Inc. (“Aether,” “we”) and the firm using the Aether service (“you,” “your firm”). It applies automatically, without a separate signature, wherever your firm's use of Aether involves personal data. If your procurement process requires a countersigned copy, contact us and we’ll provide one.

• Controller — your firm, which decides what data is connected to Aether and why.
• Processor — Buildaether Inc., which processes it on your firm's instructions to provide the service.
• Personal data — any information relating to an identified or identifiable person that appears in content your firm connects.
• Sub-processor — a third party we engage to process personal data on our behalf, listed in section 6.
• Data subject — a person whose personal data is processed — typically your firm's own staff, and people named or referenced in the engagement content you connect.

Your firm is the controller of personal data processed through Aether. We act as your processor, and process personal data only on your documented instructions — which, in practice, means what your firm connects and configures (which sources are linked, which engagement they're bound to, what your firm's retention settings say) rather than instructions we solicit separately for each action.

Subject matter: the engagement content your firm connects to Aether — documents, email, calendar entries, and the drafts and extracted facts Aether generates from them.

Duration: for as long as your firm's agreement with us is in effect, and after that, for as long as your firm's own retention settings say — see section 13.

Nature and purpose: attributing content to the right engagement, extracting facts from it, and drafting work product for your firm's own review, as described in our Privacy Policy.

Data subjects are typically your firm's own staff, and people named or referenced in the business communications your firm connects — which can include your clients' personnel. Categories of personal data are ordinarily limited to names, email addresses, and whatever appears in the body of connected business communications; we don't ask your firm to categorize this specially before connecting a source.

Each sub-processor below is bound to confidentiality and data-protection obligations materially as protective as this DPA.

Google (Drive, Gmail, Calendar) isn’t listed here because it isn’t ours to sub-process through — it’s your firm's own Google Workspace, connected under your own admin's authorisation. See our Privacy Policy for the full description.

Row-level security enforced in Postgres on every table that holds firm data, tested to confirm one firm cannot read another firm's rows. Encryption in transit and at rest, per our infrastructure providers’ own standard practice. Access to a given firm's data is scoped to what a signed-in session or a background job for that firm actually needs.

We’ll update the table in section 6 before a new sub-processor goes live, and tell your firm's administrator directly for a material change. If your firm has a reasonable data-protection objection, contact us and we’ll work through it before that sub-processor touches your firm's data.

Buildaether Inc. is an Ontario, Canada entity. Our infrastructure providers may process and store data outside Canada, under that provider’s own standard contractual protections.

We’ll help your firm respond to an access, correction, or deletion request from one of its own clients or staff — either through the retention and deletion controls already in your firm's Settings, or by contacting us directly.

If we become aware of a breach affecting your firm's personal data, we’ll notify your firm's administrator without undue delay, and no later than 72 hours after becoming aware, with what we know at the time and updates as our investigation continues.

Once a year, on reasonable written notice, we’ll provide your firm a written summary of our security practices and complete a reasonable security questionnaire. The destruction log (Settings → Retention & deletion) is available to your firm as ongoing, self-serve evidence at any time. We don’t currently offer on-site audits.

Governed by the retention and destruction controls already in the product: a per-engagement retention clock your firm sets from its own contract terms, legal hold, destruction confirmed by an owner or admin rather than automatic, and an exportable log of what was destroyed and when — described fully in our Privacy Policy. On termination of your firm's agreement with us, those same settings keep governing until your firm's data is destroyed or exported.

Liability arising under this DPA is governed by the Limitation of Liability section of our Terms of Service.

Where this DPA and the Terms of Service conflict on a data-protection matter, this DPA governs. Both are governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario.

If your firm wants a starting point for telling its own clients that Aether is in use on their engagement, here’s the template we give every firm — plain, factual, no marketing language. Bracketed fields are your firm's own.

We use Aether, a delivery-management tool, on this engagement.

Aether reads the documents, email and (where you’ve agreed) meeting notes tied to this project so we can keep status reports, risk tracking and follow-ups current without re-typing what’s already in the record. Specifically:

• It is scoped to this engagement. It cannot see, and does not compare against, any other client’s work.
• Every draft it produces is reviewed by [firm name] before it reaches you. Nothing goes out unreviewed.
• The underlying AI providers Aether uses do not use this engagement’s content to train their models, under their standard commercial terms.
• When this engagement closes, its documents are destroyed on the schedule set in our engagement terms with you.
• If you’d like to see exactly what’s stored, or want it removed sooner, contact [firm contact].

Questions about this DPA, or to request a countersigned copy: admin@buildaether.com.