Data Processing Agreement

Effective date: July 10, 2026

This Data Processing Agreement ("DPA") is entered into between the customer identified in the applicable account registration or order form ("Customer") and LeonAI LTD, registered at Avraham Pachornik 17, Ness Ziona, Israel, company registration number 516916954 ("LeonAI"), and forms part of the Terms of Service or other agreement governing Customer's use of the LeonAI Links service (the "Agreement").

This DPA is automatically incorporated into the Agreement, without signature, for every Customer whose use of the Service involves the processing of personal data subject to the GDPR, the UK GDPR, the Swiss FADP, or the CCPA. A countersigned execution copy is available to Enterprise customers on request at care@leonai.io.

1. Definitions

• "GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law by the Data Protection Act 2018; "FADP" means the Swiss Federal Act on Data Protection; "CCPA" means the California Consumer Privacy Act as amended by the CPRA, Cal. Civ. Code § 1798.100 et seq.
• "Customer Personal Data" means personal data processed by LeonAI on behalf of Customer in providing the Service, as described in Annex I — principally end-user click and analytics data and end-user data on link-in-bio pages.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
• "Subprocessor" means a third party engaged by LeonAI to process Customer Personal Data.
• "Controller," "processor," "data subject," "personal data," "processing," and "personal data breach" have the meanings in the GDPR. For CCPA purposes, "Customer" is a "business," LeonAI is a "service provider," and "Customer Personal Data" includes "personal information."

2. Roles and Scope

2.1 Processor role. For Customer Personal Data — end-user click events (timestamp, truncated IP-derived coarse geolocation, device, browser, operating system, referrer, UTM parameters), QR scan events, and end-user data collected through Customer's link-in-bio pages — Customer is the controller (or a processor acting for another controller) and LeonAI is the processor.

2.2 Independent controller role. LeonAI is an independent controller, and this DPA does not apply, for: (a) Customer account and billing data; (b) processing necessary for security, fraud, and abuse prevention across the Service (including link scanning); and (c) aggregated or de-identified service-improvement data. That processing is described in the Privacy Policy.

2.3 Duration. This DPA applies for as long as LeonAI processes Customer Personal Data under the Agreement.

3. Processing on Documented Instructions

LeonAI shall process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law to which LeonAI is subject (in which case LeonAI will inform Customer of that legal requirement before processing, unless the law prohibits it). The Agreement, this DPA, and Customer's configuration of the Service through the dashboard and API constitute Customer's complete documented instructions. Additional instructions require mutual written agreement. LeonAI shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

4. Confidentiality

LeonAI ensures that all persons authorized to process Customer Personal Data are bound by contractual or statutory obligations of confidentiality and receive appropriate data protection training.

5. Security (Article 32)

LeonAI shall implement and maintain the technical and organizational measures described in Annex II, which Customer agrees provide a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. LeonAI may update Annex II from time to time, provided the updates do not materially reduce the overall level of protection.

6. Subprocessing

6.1 General authorization. Customer grants LeonAI general written authorization to engage the Subprocessors listed in Annex III (also maintained at leonai.io/legal/subprocessors).

6.2 Changes. LeonAI will give Customer at least 30 days' advance notice of any intended addition or replacement of a Subprocessor (via the subprocessors page and, for subscribed customers, email).

6.3 Objection. Customer may object within the notice period on reasonable, documented data-protection grounds. The parties will discuss in good faith; if no resolution is reached before the change takes effect, Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees for the terminated portion.

6.4 Flow-down and liability. LeonAI imposes on each Subprocessor, by written contract, data protection obligations materially equivalent to those in this DPA, and remains fully liable to Customer for the performance of each Subprocessor's obligations.

7. Assistance with Data Subject Requests

Taking into account the nature of the processing, LeonAI shall assist Customer, by appropriate technical and organizational measures, in fulfilling Customer's obligation to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). Self-service tools satisfy this obligation in the first instance: link and analytics deletion via the dashboard and API, and export via GET /api/v1/users/me/export and the analytics API. If LeonAI receives a request directly from a data subject that identifies Customer as the controller, LeonAI will promptly forward it to Customer and will not respond substantively except to direct the data subject to Customer, unless required by law.

8. Assistance with Articles 32–36; Personal Data Breach

8.1 Breach notification. LeonAI shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will include, to the extent known: the nature of the breach, categories and approximate numbers of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. LeonAI will provide updates as information develops and will document all breaches. LeonAI's notification is not an acknowledgment of fault.

8.2 DPIAs and consultation. LeonAI shall provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities under Articles 35–36, insofar as they relate to processing under this DPA and the information is available to LeonAI.

9. Deletion or Return

Upon termination or expiry of the Agreement, Customer may export Customer Personal Data for 30 days using the self-service tools. Thereafter, LeonAI shall delete Customer Personal Data within 90 days, and purge it from encrypted backups within the 35-day backup rotation that follows, unless retention is required by law (in which case the data remains protected under this DPA and is isolated from further processing). LeonAI will confirm deletion in writing on request.

10. Audits

10.1 Audit reports first. LeonAI shall make available information reasonably necessary to demonstrate compliance with Article 28, including its security documentation, annual penetration-test summaries, and SOC 2 Type II reports if and when available (a report is planned; no date is committed), under confidentiality obligations. The parties agree these materials satisfy Customer's audit rights in the first instance.

10.2 On-site audits. Where audit reports are insufficient to demonstrate compliance, or where required by a supervisory authority or applicable law, Customer (or an independent auditor that is not a competitor of LeonAI, bound by confidentiality) may conduct an audit of LeonAI's relevant processing operations: no more than once in any 12-month period, on at least 30 days' written notice, during business hours, without disrupting operations, and at Customer's expense. On-site audit rights beyond regulatory requirements are available to Enterprise customers. Audits do not extend to other customers' data or to Subprocessor facilities (for which LeonAI will exercise its own audit rights on request).

11. International Transfers

11.1 Location. The Service is hosted on Cloudflare's global network. Request handling is performed at the Cloudflare data centre nearest the visitor, which may be inside or outside the EEA; persistent storage is held in the primary region Cloudflare designates as Eastern Europe (EEUR). Customer instructs LeonAI to process Customer Personal Data on that basis and at the Subprocessor locations in Annex III.

11.2 SCCs. LeonAI is established in Israel, which benefits from a European Commission adequacy decision (Commission Decision 2011/61/EU), so a transfer of Customer Personal Data from the EEA to LeonAI is not, on that basis, a restricted transfer. The following applies to the extent any transfer nonetheless is a restricted transfer — including onward transfers to subprocessors outside an adequate country.In that case the parties incorporate the SCCs by reference: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. The following selections apply: Clause 7 (docking) is included; Clause 9(a) Option 2 (general written authorization, 30 days' notice); Clause 11 optional redress language is not included; Clause 13 competent supervisory authority per Annex I.C; Clause 17: law of Ireland; Clause 18: courts of Ireland. Annexes I and II of the SCCs are completed by Annexes I and II of this DPA; Annex III lists Subprocessors.

11.3 UK and Switzerland. For restricted transfers from the UK, the UK Addendum applies, with Table 2 referencing the SCCs as incorporated above and Tables 1 and 3 completed by this DPA's annexes. For transfers from Switzerland, the SCCs apply as adapted by the Swiss FDPIC guidance ("member state" read to include Switzerland; the FDPIC as competent authority; data subjects in Switzerland able to sue in Switzerland).

11.4 Alternative mechanisms. If a Subprocessor is certified under the EU-U.S. Data Privacy Framework or a successor adequacy mechanism, transfers to it may rely on that mechanism instead; if any relied-upon mechanism is invalidated, the parties will cooperate promptly to implement a lawful alternative.

12. CCPA Service Provider Terms

To the extent Customer Personal Data includes personal information of California residents, LeonAI, as a service provider: (a) shall not sell or share the personal information; (b) shall not retain, use, or disclose it for any purpose other than performing the Service under the Agreement (including the business purposes in Annex I) or as otherwise permitted by the CCPA; (c) shall not retain, use, or disclose it outside the direct business relationship with Customer; (d) shall not combine it with personal information received from other sources except as permitted by CCPA regulations; (e) certifies that it understands and will comply with these restrictions; (f) shall notify Customer if it determines it can no longer meet its CCPA obligations, in which case Customer may take reasonable and appropriate steps to stop and remediate unauthorized use; and (g) grants Customer the rights to take such steps as provided in the CCPA.

13. Liability, Precedence, and Governing Law

Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, except where prohibited by applicable data protection law; nothing limits either party's liability to data subjects under Chapter VIII GDPR. In case of conflict, the order of precedence is: (1) the SCCs and UK Addendum; (2) this DPA; (3) the Agreement. This DPA is governed by the law governing the Agreement (the laws of the State of Israel), except as the SCCs require otherwise.

---

Annex I — Description of Processing (SCC Annex I)

A. List of Parties

B. Description of Transfer

C. Competent Supervisory Authority

The supervisory authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the authority determined under Clause 13 SCCs — that is, the supervisory authority of the member state in which the Customer's EU representative is established, or in which the data subjects whose data is transferred are located. This is determined per Customer rather than fixed here, because it follows the Customer's own establishment.

Annex II — Technical and Organizational Measures (SCC Annex II)

1. Encryption: TLS 1.2+ for all data in transit (including redirects); AES-256 at rest for databases, caches, and backups; passwords hashed with adaptive algorithms; API keys stored as SHA-256 hashes.
2. Access control: Least-privilege IAM; production access limited to named engineers with SSO and MFA; quarterly access reviews; RBAC and scoped API keys for customers; short-lived JWT sessions.
3. Key and secret management: Cloudflare Workers secrets, encrypted at rest and not readable back; no secrets in code or build artifacts.
4. Network security: Native service bindings rather than public endpoints; Cloudflare DDoS protection and WAF; CDN edge; rate limiting on all endpoints.
5. Logging and monitoring: Centralized logging, metrics, tracing; Sentry error monitoring with data scrubbing; immutable audit logs of exports, deletions, and permission changes.
6. Vulnerability management: Dependabot, Trivy, CodeQL, npm audit in CI; annual third-party penetration test; responsible disclosure program with defined remediation targets.
7. Secure development: Mandatory code review, strict typing, parameterized queries, CSP and CSRF defenses, CI quality gates, blue-green deployment.
8. Resilience and recovery: Daily encrypted backups (35-day retention), point-in-time recovery, regional HA for datastores, RTO 4h / RPO 1h targets, monthly restore tests.
9. Data minimization and pseudonymization: Full IPs used transiently for coarse geolocation, then truncated; no precise geolocation; monthly-partitioned event storage enabling automated retention enforcement.
10. Personnel: Confidentiality agreements, security and privacy training, background checks where lawful, documented offboarding.
11. Incident response: Documented severity-based process, on-call rotation, 72-hour customer breach notification, post-incident review.
12. Physical security: Inherited from Cloudflare data centres (ISO 27001, SOC 2 Type II certified).
13. Subprocessor management: Due diligence before onboarding, written DPAs with flow-down obligations, annual review.

Annex III — Authorized Subprocessors

The current list, including any Enterprise-specific arrangements, is maintained at links.leonai.io/legal/subprocessors.