Data Processing Addendum

Effective: November 4, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Supreme Mind AI, Inc. (“Supreme Mind,” “we,” “us”) and the customer firm or organization that has signed a pilot agreement, client contract or order form with us, or that uses the Service through an integration such as an MCP connector (the “Firm”). It applies to Supreme Mind’s processing of Firm Data on the Firm’s behalf. If a signed agreement between the Firm and Supreme Mind contains its own data processing terms, those signed terms prevail over this DPA where they conflict.

1. Definitions

• “Service” means the Supreme Mind platform, application, API and MCP server, as described in our Terms of Service.
• “Firm Data” means all data, including personal data, that the Firm or its authorized users submit to the Service or that the Service generates from it, including matter facts, uploaded documents, generated briefs and analyses (“Matter Content”), and account data of the Firm’s users.
• “Personal data” means any information relating to an identified or identifiable natural person, as defined by applicable data protection law.
• “Data Protection Laws” means all data protection and privacy laws that apply to the processing of Firm Data under the agreement, including the California Consumer Privacy Act as amended (“CCPA”) and, where applicable, the EU and UK General Data Protection Regulation.
• “Subprocessor” means any third party that Supreme Mind engages to process Firm Data.
• “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Firm Data.

2. Roles

The Firm is the controller (and, under the CCPA, the business) of Firm Data. Supreme Mind is the processor (and, under the CCPA, the service provider) and processes Firm Data only on the Firm’s behalf. The Firm is responsible for having a lawful basis to submit Firm Data to the Service, including the right to use any material produced under a protective order in the way the order permits.

3. Details of processing

• Subject matter and purpose: providing the Service to the Firm: screening matters, preparing expert briefs and analyses, cross-examination practice, report preparation, and the account, security, support and billing functions that go with them.
• Nature of processing: storage, retrieval, analysis by AI models, generation of outputs, transmission to the Firm’s users and connected applications, and deletion.
• Duration: for the term of the agreement, and afterwards only as long as section 10 allows.
• Categories of data subjects: the Firm’s authorized users; and persons named in Matter Content, such as parties, witnesses, experts, counsel and other individuals who appear in case documents.
• Categories of personal data: user names, business email addresses, roles and usage data; and any personal data contained in Matter Content, which the Firm determines. The Service is not designed for special categories of personal data, and the Firm should submit such data only where the matter requires it.

4. Supreme Mind’s obligations

• Instructions. We process Firm Data only on the Firm’s documented instructions, which are the agreement, this DPA and the Firm’s use of the Service. We will tell the Firm if we believe an instruction breaks Data Protection Laws.
• No training. Firm Data is never used to train, fine-tune or improve any AI model, ours or anyone else’s.
• Zero data retention. AI model processing runs under zero data retention terms with the model provider and with the backup route: prompts and completions are not stored by the provider.
• No selling or sharing. We do not sell or share Firm Data (as those terms are defined in the CCPA), do not use it for any purpose other than providing the Service, and do not combine it with data from other customers or sources, except as the CCPA permits for service providers.
• Isolation. Firm Data is kept separate per firm. Matter Content is never written to application logs; audit records hold metadata only.
• Confidentiality of personnel. Anyone at Supreme Mind with access to Firm Data is bound by confidentiality obligations and accesses it only as needed to provide the Service or support the Firm.

5. Location of processing

Supreme Mind processes and stores Firm Data in the United States only: application hosting and compute, the database and the document store run in US regions, and AI model processing runs with US inference. We will not move Firm Data outside the United States without the Firm’s prior written consent. Where Data Protection Laws require a transfer mechanism for personal data that reaches us from outside the United States, the parties will rely on the Standard Contractual Clauses or another lawful mechanism, which we will sign on request.

6. Subprocessors

The Firm authorizes the subprocessors listed in section 4 of our Privacy Policy. Those that process Matter Content are Anthropic (AI model processing, zero data retention, US inference), Amazon Web Services (backup AI model processing through Amazon Bedrock, in US regions, on the same no-retention terms), Vercel (hosting and compute) and Neon (database). Each subprocessor is bound by written terms that protect Firm Data at least as strictly as this DPA, and we remain responsible for their performance.

We will give at least 30 days’ notice before adding or replacing a subprocessor that processes Matter Content. The Firm may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Firm may end the affected part of the Service and receive a pro-rata refund of fees paid in advance for it.

7. Security

We maintain the technical and organizational measures described on our Security page, including: encryption in transit (TLS) and at rest; per-firm isolation; authentication of every request, with OAuth 2.1 and PKCE for connectors and single sign-on available by agreement; metadata-only audit records; an append-only log of every document access, exportable by the Firm; and deletion that removes data rather than hiding it. We review these measures regularly and will not reduce the overall level of protection during the term. SOC 2 Type II is in progress; we will share the report once it is issued.

8. Security incidents

We will notify the Firm without undue delay, and in any case within 72 hours of confirming a Security Incident affecting Firm Data. The notice will say what we know, what we do not yet know, the data and users affected where known, and what we are doing about it, and we will keep the Firm updated. We will cooperate with the Firm’s own investigation and any notice it must give.

9. Legal requests and data subject rights

• Subpoenas and government requests. If we receive a subpoena, court order or government request for Firm Data, we will notify the Firm before responding, unless the law forbids it, so that the Firm can assert privilege or seek a protective order, and we will disclose only what we are legally required to.
• Requests from individuals. If a data subject contacts us about Firm Data, we will refer them to the Firm, and we will help the Firm, through the Service’s export and deletion functions or otherwise, to answer requests to access, correct or delete personal data.
• Assessments. We will provide reasonable information the Firm needs for data protection impact assessments or consultations with a regulator about the Service.

10. Return and deletion

• During the term, the Firm can export or delete its matters at any time. A deleted matter is hidden at once and permanently deleted, including stored documents, after a 30-day recovery window. Individual documents delete immediately.
• When the agreement ends, we will, at the Firm’s choice, return Firm Data in a standard format and then delete it, or delete it, within 30 days, and confirm the deletion in writing on request. Backups that cannot be selectively deleted expire on their normal cycle and are not restored except to recover the Service.
• If Supreme Mind stops operating, the continuity commitments on our Security page apply: at least 60 days’ notice, an export of the Firm’s data on request, and deletion afterwards.

11. Audits

We will answer the Firm’s reasonable security questionnaires and provide the documentation needed to show compliance with this DPA. Once a year, or after a Security Incident, the Firm or an independent auditor bound by confidentiality may audit our compliance with this DPA on 30 days’ written notice, during business hours and in a way that does not expose other customers’ data. Where a current independent audit report (such as a SOC 2 report) covers the question, we may provide that report instead.

12. General

• This DPA lasts as long as Supreme Mind processes Firm Data. Limitations of liability in the agreement apply to this DPA.
• If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Firm Data. A DPA signed by both parties prevails over this published version.
• We may update this DPA to reflect changes in law or in the Service. We will not reduce the protection it gives Firm Data during a Firm’s current term without the Firm’s consent, and we will give notice of material changes.
• A countersigned copy is available on request.

13. Contact

Supreme Mind AI, Inc. Data protection and security questions: richard@suprememind.ai.

This DPA is provided for general information and does not constitute legal advice.