Data Processing Addendum
Version 1.0 · Updated 19 October 2026 · Effective 16 October 2026
This Data Processing Addendum (the “DPA”) forms part of the agreement between Forward AI Labs, Inc. (“MiraDay”, “we”, “us”) and the Customer identified in that agreement. It governs the processing of Customer Personal Data by MiraDay on the Customer’s behalf in providing MiraDay, a global talent intelligence platform.
The “Agreement” means the MiraDay Terms of Service accepted by the Customer. This DPA applies to the relevant Customer and Workspace covered by the Agreement. Acceptance of the Agreement also constitutes acceptance of this DPA, its Annexes and the applicable transfer terms completed below. No separate checkbox or acceptance process is required by this DPA. The person accepting for an organization must have authority to bind it. An invited member does not accept the organization’s DPA on its behalf merely by joining its Workspace.
1. Definitions
Capitalized terms not defined here have the meanings given in the Agreement.
Term
Meaning
Customer Personal Data
Personal Data that MiraDay processes on the Customer’s behalf to provide the Services, including Personal Data in Customer Content, Workspace Data and Outputs, and in service-generated records processed for that purpose. This includes F2D Data saved in a Workspace to the extent MiraDay subsequently hosts or processes that copy on the Customer’s instructions. It excludes processing for MiraDay’s separate controller purposes described in Section 2.3
Data Protection Law
The privacy, data protection and electronic communications laws applicable to the relevant processing under the Agreement, including, where applicable, the EU GDPR, the UK GDPR, the UK Data Protection Act 2018 and applicable implementing or amending legislation
EU GDPR
Regulation (EU) 2016/679, as applicable and amended
UK GDPR
The GDPR as it forms part of UK law, as applicable and amended
Personal Data, processing, controller, processor, data subject, supervisory authority
The meanings given in applicable Data Protection Law
Documented Instructions
The instructions described in Section 3.1, recorded in a form that can be retained
Personal Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed
Subprocessor
A processor engaged by MiraDay to process Customer Personal Data on the Customer’s behalf; it does not include MiraDay personnel acting under its authority
EU SCCs
The standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, completed with the applicable module, selections and Appendix information in Section 10 and the Annexes
UK Addendum
The ICO’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, template B.1.0, in force from 21 March 2022, as revised under its mandatory clauses
Restricted Transfer
A transfer of Personal Data for which applicable Data Protection Law requires a transfer safeguard because the destination or recipient is not covered by an applicable adequacy decision or regulation
2. Scope, Roles and Application
2.1 Controller and Processor. For the processing covered by this DPA, the Customer is the controller and MiraDay is its processor. The Customer determines the Recruiting Purposes, as described in Section 5.2 of the Agreement, for which it uses Customer Personal Data, including research supporting its recruiting activities within that scope. The subject matter, duration, nature, purposes, data categories and data subject categories are set out in Annex 1. The Customer has the rights and obligations stated in this DPA and Data Protection Law.
The Services covered by this DPA do not support the Customer acting as a processor for another controller, including under an Enterprise Plan. This does not prevent MiraDay from engaging Subprocessors under Section 5. A search firm may use the Services as a controller for a specific client engagement within the permitted scope of the Agreement.
2.2 Personal and Organization Workspaces. The individual is the Customer for their Personal Workspace; the organization is the Customer for its Organization Workspace. These Workspaces and their Channels are separate. Email connections and the Extension are associated with the user’s account, while content brought into the Services through their use is held in the relevant Channel’s Workspace. An account-level connection does not authorize disclosure between Workspaces or give an Organization Administrator access to Personal Workspace content. Instructions for an Organization Workspace must come from a person authorized by that Customer.
2.3 Separate Controller Activities. This DPA does not govern MiraDay’s independent operation of F2D (Fast to Data), its recruiting data infrastructure, its receipt of eligible Contributed Fields for that operation, or its delivery of F2D Data under the Data Sharing Addendum (the “DSA”). MiraDay’s controller processing of account administration, billing and other distinct activities is described in the Privacy Policy. Security and service records remain within this DPA to the extent they are processed on the Customer’s behalf; their label as a log or usage record does not by itself exclude them.
2.4 Contributions and Copies. Customer-instructed extraction and handling of eligible fields before contribution remain subject to this DPA. MiraDay’s independent F2D processing of a contributed copy is subject to the DSA. The Customer’s original Workspace copy remains subject to this DPA. If MiraDay determines an independent F2D purpose before a record is written into F2D, that activity must satisfy the DSA and Data Protection Law from that point; database location alone does not determine the legal role. Contribution does not convert an entire Workspace or all subsequent processing into controller processing.
2.5 F2D Data Saved in a Workspace. The DSA continues to govern the source, delivery and permitted use of F2D Data. This DPA governs MiraDay’s subsequent hosting or other processing of the Customer’s saved copy on its instructions. The obligations apply to their respective activities and may therefore apply to different processing of the same information.
3. Processing Instructions and Data Use
3.1 Documented Instructions. The Customer instructs MiraDay to process Customer Personal Data to provide the Services described in the Agreement and Annex 1, as configured and used by its authorized persons, and to comply with additional lawful instructions agreed in writing through support@miraday.ai or privacy@miraday.ai. Instructions may be recorded through authorized Service operations, tasks, configurations or written communications. An AI-generated action is not, by itself, a new Customer instruction. Sensitive Extension actions require the confirmation described in the Agreement.
3.2 Limits and Unlawful Instructions. MiraDay will process Customer Personal Data only on Documented Instructions, including for transfers, unless EU, Member State or UK law applicable to MiraDay requires other processing. MiraDay will inform the Customer of that legal requirement before processing unless the law prohibits notification on important grounds of public interest. MiraDay will immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law. It may suspend the affected instruction while the parties resolve the issue and will not implement an unlawful instruction. Government access requests are also subject to Section 10.5 and any applicable transfer terms.
3.3 Customer Responsibilities. The Customer is responsible for a lawful basis for its processing and disclosures, required notices, authorized collection and use of sources, lawful recruiting decisions, and the lawfulness of its instructions. Consent is required only where applicable law requires it; this DPA does not designate consent as the sole lawful basis. The Customer will provide the information and cooperation reasonably necessary for MiraDay to fulfil its obligations. These responsibilities do not remove MiraDay’s own obligations as a processor or its separate obligations as a controller.
3.4 AI Processing and No Model Training. MiraDay may use approved AI providers and models to process Customer Personal Data for instructed service functions, such as matching, summarization and generating Outputs. MiraDay will not use data from Customers or their Authorized Users to train, fine-tune or improve its own AI models or any third party’s AI models. The restriction includes Customer Content, Workspace Data, connected-account data, usage data, Outputs containing or derived from Customer data, eligible fields after contribution to F2D, and aggregated, de-identified, anonymized or other derived versions. Necessary service inference does not authorize training. Troubleshooting, task validation and support remain limited to the relevant Customer’s service function and lawful instructions; they do not authorize reuse of Customer task content in a general evaluation library or for unrelated product improvement. Model-provider contracts must impose the applicable no-training restriction and agreed input/output retention limits. MiraDay will maintain relevant retention information separately from the public List of Subprocessors and provide information reasonably necessary for the Customer’s compliance under Section 9, subject to appropriate protection of confidential information.
3.5 Sensitive and Excessive Data. The Services do not require special category data, criminal offence data or data about children for ordinary recruiting use. The Customer must not intentionally submit such data contrary to the Agreement or use the Services to infer those categories. Customer-controlled content is processed only on lawful Documented Instructions and in accordance with applicable Data Protection Law. Accidental inclusion does not authorize contribution to F2D, sensitive inference or model training.
3.6 Connected Services. The Customer is responsible for authorizing access to connected accounts and directing use in the relevant Workspace. MiraDay will respect connected-account data-use restrictions and exclude connected-account data and its derivatives from F2D contribution. Switching Workspaces or ending membership does not itself disconnect an account-level connection or stop an already initiated task in its original Channel. This does not permit further access following revocation of third-party authorization or remove lawful access restrictions or deletion instructions. A Connector is not automatically a Subprocessor: the parties will identify whether its provider processes for MiraDay, receives data on the Customer’s instructions, or acts as an independent controller. MiraDay remains responsible for providers it engages under Section 5.
4. Confidentiality and Security
4.1 Authorized Personnel. MiraDay will ensure that persons authorized to process Customer Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access will be limited to authorized persons who need it to provide, protect or support the Services.
4.2 Technical and Organizational Measures. Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing and risks to individuals, MiraDay will implement and maintain appropriate measures required by Data Protection Law, including Article 32 of the EU GDPR and UK GDPR where applicable. The agreed measures are in Annex 2. MiraDay may update them to address changes in technology, risk or the Services, without reducing their overall level of protection during the applicable subscription period. A material reduction or change to agreed obligations is subject to the Agreement’s change procedure and applicable law.
4.3 Customer Controls. The Customer will protect its credentials, devices and connected accounts; manage its authorized membership; and use the available security controls appropriately. MiraDay’s obligations to protect the platform and enforce Workspace isolation remain in place. Account-level connections do not imply that all connection settings, logs or controls are separately configurable by Workspace.
5. Subprocessors
5.1 General Written Authorization. The Customer generally authorizes MiraDay to engage the Subprocessors identified in Annex 3 to process Customer Personal Data for the stated services. An affiliate is not automatically authorized: if it processes as a separate entity on MiraDay’s behalf it must be listed and covered by these requirements. Persons under MiraDay’s direct authority are governed by Section 4.1.
5.2 List and Advance Notice. MiraDay will maintain a dated List of Subprocessors identifying each provider, its stated location, processing function, website and contact details, as set out in Annex 3. Actual processing and access locations, relevant retention terms and transfer safeguards will be maintained in the applicable processing, contract or transfer records and provided where required under this DPA or Data Protection Law. Corporate or contact locations in the public list do not identify all processing locations. MiraDay will notify the Customer at its registered contact email of an intended addition or replacement at least 30 calendar days before the new Subprocessor begins processing the affected Customer Personal Data. The notice will identify the proposed change and provide information reasonably necessary to assess it. Posting a revised list alone does not replace the required advance notice.
5.3 Objections and Resolution. The Customer may object before the notified change takes effect on reasonable data protection grounds and will explain those grounds promptly. MiraDay will discuss the objection, provide relevant information and seek a reasonable resolution, such as additional safeguards or an available alternative. MiraDay will not send the Customer’s affected data to the proposed Subprocessor while a timely objection remains unresolved. If no reasonable resolution is available, either party may terminate the affected service, with a refund of prepaid subscription fees for unused subscription days under the Agreement. This does not restrict other rights or remedies under the Agreement, Data Protection Law or applicable transfer terms.
5.4 Equivalent Obligations and Responsibility. Before permitting processing, MiraDay will enter into a written agreement with each Subprocessor imposing data protection obligations that provide an equivalent level of protection to this DPA, including appropriate security, confidentiality, instructions, rights assistance, breach cooperation, deletion and applicable transfer safeguards. MiraDay remains responsible to the Customer for its Subprocessors’ performance of those obligations as required by Data Protection Law.
5.5 Urgent Circumstances. An urgent security or continuity need does not waive the Customer’s authorization, notice or objection rights. MiraDay will give as much advance notice as practicable and comply with the agreed notice period and applicable transfer terms. Where a shorter period is needed, MiraDay must obtain the Customer’s written agreement or use an already authorized provider; otherwise it will suspend the affected processing rather than make an unauthorized change.
6. Return and Deletion
6.1 During the Services. MiraDay will implement lawful Customer instructions to export, correct, restrict or delete Customer Personal Data without undue delay through available functionality, the Privacy Center, the Privacy Request page, or support@miraday.ai or privacy@miraday.ai, taking account of the scope and urgency of the instruction and any applicable legal deadline. Retained backup copies are handled under Section 6.4. Deleting selected content does not require closure of an entire account or Workspace. Where necessary, MiraDay will verify that the requesting person is authorized to give instructions for the relevant Customer and Workspace. Requests received from data subjects are handled under Section 7.
6.2 End of Processing and Customer Choice. At the end of the relevant processing services, MiraDay will, at the Customer’s choice, return or delete Customer Personal Data and delete remaining copies, unless applicable EU, Member State or UK law requires storage. The Customer may choose return, deletion, or return followed by deletion, and may submit that instruction through the Privacy Center, the Privacy Request page or privacy@miraday.ai. Instructions remain subject to the authority verification in Section 6.1. Return and deletion, including Subprocessor copies and protected backups, must be completed no later than 90 calendar days after those processing services end. The 30-day export window in the Agreement is included within that 90-day maximum and is not followed by an additional 90-day period.
The export window remains available unless the Customer instructs earlier deletion or access or transfer must be restricted by law or to prevent an identified security risk. MiraDay will seek a lawful, secure alternative for return where ordinary access is restricted. An earlier lawful deletion instruction must be implemented without undue delay, and earlier deadlines imposed by law or applicable transfer terms prevail. The 90-day maximum is not permission to delay a required rights action.
6.3 Subscription and Workspace Events. Cancelling a paid Plan, downgrading to a supported Free Plan, leaving an organization, closing a Workspace and deleting a user account are distinct events. An individual user may delete their own account in Settings by following the confirmation steps shown in the Services; support@miraday.ai is available for assistance. Continued provision of an active Personal Workspace or other ongoing processing service does not end merely because a paid subscription is cancelled or organization membership ends. An individual account action does not, by itself, instruct deletion of the organization’s Workspace. The Customer responsible for that Workspace determines its lawful instructions.
6.4 Backups and Required Retention. Copies remaining in routine backups will be put beyond ordinary use and protected under this DPA pending deletion or overwrite. For an instruction during ongoing services, backup removal will occur on the scheduled cycle and no later than 90 calendar days after the lawful deletion instruction. At the end of the relevant processing services, Section 6.2’s 90-day maximum applies to backup copies as well as active systems and Subprocessors. Any earlier legally required deadline prevails. If a backup is restored, MiraDay will reapply deletion and restriction instructions before returning restored data to ordinary use. Data whose storage is legally required will be identified, limited to the required purpose and period, and deleted when that requirement ends. Retention does not authorize recruiting use, contribution or training.
6.5 Subprocessors and Confirmation. MiraDay will require Subprocessors to apply the corresponding return and deletion obligations. On request, MiraDay will provide written confirmation describing deletion from active systems, the scope checked, any backups awaiting expiry, and any legally retained copies and restrictions. It will not certify complete deletion while retained copies remain. Where the EU SCCs or UK Addendum require certification, MiraDay will provide the certification they require.
6.6 Separate Controller Copies. Deletion of a Workspace copy does not automatically delete a lawfully contributed F2D copy held by MiraDay as an independent controller. That copy remains subject to the DSA, applicable retention limits and data subject rights. Information about this independent processing is available in the Personal Information Notice; related rights requests may be submitted through the Privacy Center, the Privacy Request page or privacy@miraday.ai. This distinction does not permit MiraDay to relabel processor copies to avoid deletion or preserve unlawfully contributed data.
7. Data Subject Requests
7.1 Requests Received by MiraDay. Individuals may submit privacy requests through the Privacy Center, the Privacy Request page or privacy@miraday.ai. If MiraDay receives a request concerning processing on the Customer’s behalf, it will notify the relevant Customer without undue delay and provide the request and available information needed to handle it. MiraDay will not substantively respond on the Customer’s behalf unless authorized by the Customer or required by law. It may acknowledge the request and direct the person to the relevant Customer without disclosing another Customer’s data.
7.2 Assistance. Taking account of the nature of processing, MiraDay will assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling applicable data subject rights. This includes locating relevant data, providing accessible copies, correction, erasure, restriction, portability where applicable, and available information about AI processing needed for a lawful response. Assistance will be provided in time to allow the Customer to comply with its applicable deadlines; these deadlines are not extended by the Agreement’s ordinary notice provisions.
7.3 Responsibility and Verification. The Customer decides the response to requests for which it is the controller and performs proportionate identity verification. MiraDay will provide necessary support without requiring excessive additional identification data. Requests involving MiraDay’s F2D copy or other independent controller processing will be handled by MiraDay under the DSA or Privacy Policy, as applicable. A request affecting multiple copies will be coordinated without transferring another Workspace’s content.
8. Personal Data Breach Notification
8.1 Notification. MiraDay will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. It will not delay the initial notice until an investigation is complete. Notification will be sent to the Customer’s registered contact and designated privacy or incident contact in Annex 1. If delivery fails, MiraDay will promptly use another available verified contact or Service communication channel and record its efforts. A next-working-day deemed-receipt provision does not postpone these duties.
8.2 Information and Updates. To the extent available, notices will describe the nature of the breach, affected data and data subject categories and approximate numbers, likely consequences, measures taken or proposed, and a contact for further information. Where information is not yet available, MiraDay will provide it in phases without undue further delay. It will preserve relevant evidence, investigate, contain and remediate the breach and cooperate reasonably with the Customer.
8.3 External Notification. The Customer determines notifications required of it as controller. MiraDay will provide information and assistance needed for those notifications. MiraDay will not identify the Customer in a public breach communication or notify its data subjects on its behalf without authorization, unless required by law. This does not restrict MiraDay’s direct legal duties. Notification or cooperation does not by itself establish liability.
9. Assistance, Information and Audits
9.1 Compliance Assistance. Taking account of the nature of processing and information available to MiraDay, it will assist the Customer with applicable security, breach notification, DPIA and prior-consultation obligations, including Articles 32–36 of the EU GDPR and UK GDPR where applicable. Assistance includes relevant information about AI inputs, Outputs, limitations and safeguards available to MiraDay. The Customer remains responsible for its own assessment and decisions; MiraDay remains responsible for its own compliance.
9.2 Information and Records. MiraDay will make available information necessary to demonstrate compliance with this DPA and applicable Article 28 obligations. Relevant security and provider information may be requested from privacy@miraday.ai; those materials do not replace this DPA or its applicable Annexes. This may include relevant policies, security descriptions, the Subprocessor list and any available current independent audit report or appropriate summary. Confidentiality safeguards may apply, but the existence of a report or certification is not a condition for the Customer’s statutory audit rights. MiraDay will keep the processing records required of it by Data Protection Law.
9.3 Audits and Inspections. MiraDay will allow and contribute to audits, including inspections, by the Customer or an independent auditor it appoints, where required to demonstrate compliance. The parties will first consider whether available information addresses the issue and agree reasonable scope, notice, timing, confidentiality and security arrangements that avoid unnecessary disruption and exposure of other Customers’ data. Such arrangements will not prevent necessary audits following a material incident, reasonable evidence of non-compliance, or a supervisory authority’s requirement. MiraDay may require an auditor to avoid conflicts of interest and accept reasonable confidentiality terms; it will not use those requirements to obstruct a necessary audit.
9.4 Costs. Ordinary information and cooperation necessary to demonstrate compliance will not depend on an additional purchase. Reasonable costs for unusual, Customer-specific work may be agreed in advance, provided they do not prevent fulfilment of statutory obligations. The Customer will not bear MiraDay’s remediation costs for MiraDay’s non-compliance. Neither party may delay legally required assistance while a cost discussion remains unresolved.
10. International Transfers
10.1 Locations and Lawful Mechanisms. MiraDay will process Customer Personal Data only in the locations disclosed in Annex 1 and the completed processing and transfer records identified in that Annex, subject to Documented Instructions and lawful transfer arrangements. Storage, backups and remote support or administrative access are included. Annex 3 identifies authorized Subprocessors; unless a hosting region is expressly stated, the corporate or contact locations listed there do not identify every processing or access location. The Agreement does not establish worldwide transfer authorization without applicable safeguards. Before a Restricted Transfer begins, the relevant parties will identify the flow, applicable mechanism, parties, roles, locations and any required assessments and supplementary measures.
10.2 EU SCC Incorporation. For a Restricted Transfer from the Customer as controller to MiraDay as processor that falls within the scope of Decision (EU) 2021/914 and is not covered by another lawful mechanism identified in Annex 1, the parties incorporate the EU SCCs by reference, including their unmodified mandatory text and Module Two, with the selections and Appendix information below. The official text is available in Decision (EU) 2021/914. The parties agree to be bound by that text as completed here. This is the international-transfer instrument, not Decision (EU) 2021/915 on controller–processor clauses.
The 2021/914 EU SCCs are not relied on as a transfer mechanism where the relevant importer processing falls outside their permitted scope, including where that processing is already directly subject to the EU GDPR and the instrument does not cover that situation. An applicable lawful mechanism must be established before the transfer. Contractual safeguards alone do not establish a transfer mechanism outside its legal scope.
10.3 UK Addendum Incorporation. For a Restricted Transfer subject to UK GDPR for which the parties use the EU SCCs with the UK Addendum, the UK Addendum forms part of this DPA, subject to completion of Tables 1–4 below and the identified applicable transfer record before reliance on that mechanism. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses, are incorporated by reference. The ICO official template identifies those clauses. For the UK transfer, its required amendments, hierarchy, ICO oversight and UK court rights apply.
10.4 Assessments and Supplementary Measures. The parties will complete the assessments required for the relevant transfer, including the EU SCC Clause 14 assessment and applicable UK transfer risk assessment or data protection test. MiraDay will provide reasonably necessary information about its processing, access requests and safeguards. If adequate protection cannot be ensured, the affected transfer must not begin or continue. Onward transfers by MiraDay require their own valid basis and compliance with the applicable EU SCCs or UK Addendum; this DPA does not itself execute Module Three with MiraDay’s Subprocessors.
10.5 Government Access Requests. Subject to applicable law and transfer terms, MiraDay will review a governmental demand for Customer Personal Data for legality and scope, notify the Customer and data subjects where required and lawful, seek permission to give notice where prohibited, and challenge requests where there are reasonable grounds to consider them unlawful. It will seek interim relief where appropriate, disclose only the minimum lawfully required, document its assessment and response, and provide information as required by the applicable transfer terms. This paragraph does not narrow the obligations in EU SCC Clause 15.
10.6 Inability to Comply. MiraDay will promptly notify the Customer if it cannot comply with this DPA or the applicable transfer safeguards. The parties will suspend affected transfers or processing as required, seek lawful remediation, and exercise termination, return or deletion rights required by the EU SCCs, UK Addendum or Data Protection Law if compliance cannot be restored. Ordinary cure periods and unrestricted export provisions in the Agreement do not override these requirements.
The applicable party details, including actual addresses, transfer description, competent supervisory authority and measures, must be completed in an identified record incorporated into these clauses and available to the parties before reliance on them. Acceptance of this standard form does not replace that completion.
EU SCC Selections and Appendix Information , Customer to MiraDay
SCC item
Agreed completion
Transfer identification
DPA transfer: Customer controller to MiraDay processor, as described in Annex 1; applies only where Section 10.2 is triggered
Module
Module Two (controller to processor); other modules do not apply to this Customer–MiraDay transfer
Clause 7
Optional docking clause included. Any additional party must join in the manner required by that clause and be identified in the updated Appendix; affiliates are not automatically parties
Clause 9(a)
Option 2: general written authorization. Prior notice: 30 calendar days, as Section 5.2 provides. The current authorized list is Annex 3
Clause 11(a)
The optional independent dispute-resolution arrangement is not included. Other Clause 11 rights remain applicable
Clause 13 / Annex I.C
The competent supervisory authority is determined under Clause 13 and must be identified with its contact details in the applicable completed transfer record before reliance on the SCCs
Clause 17
Option 1: law of Ireland
Clause 18(b)
Courts of Ireland. The data subject’s additional court rights under Clause 18 remain unaffected
Annex I.A , parties
Annex 1, Part A; exporter Customer/controller; importer MiraDay/processor. Legal entities, contacts, relevant activities and execution details must be completed
Annex I.B , transfer
Annex 1, Parts B and C, including actual locations, frequency, retention and Subprocessor activities
Annex II , measures
Annex 2, measures applicable to MiraDay as importer and the stated processing. Any necessary provider- or transfer-specific supplementary measures are recorded in Annex 1, Part C or the relevant supplementary record; Annex 3 identifies the authorized providers
Annex III
Not completed as a prior-specific-authorization annex because Clause 9(a) uses general authorization. Annex 3 remains the required current authorized Subprocessor list
Signature and date
The binding recorded acceptance of the Agreement incorporating this DPA constitutes execution of these SCCs and Annex I.A, where valid under applicable law; actual acceptance date and identity/authority are retained in the contract record. A separately signed version may instead record both parties’ signatures
UK Addendum , Part 1 Tables
Table 1 , Parties
Item
Exporter
Importer
Legal name
Customer identified in Annex 1, Part A and the Agreement’s contracting record
Forward AI Labs, Inc.
Trading name
As recorded in Annex 1, Part A
MiraDay
Main address
Customer address recorded in Annex 1, Part A
710 Lakeway Drive, Suite 200, Sunnyvale, California 94085, United States
Official registration details, if applicable
As recorded in Annex 1, Part A
The applicable registration details of Forward AI Labs, Inc., as identified in the binding contracting or completed transfer record
Key contact
Customer privacy/incident contact in Annex 1, Part A
Privacy contact: privacy@miraday.ai (privacy and incident contact)
Start date and execution
Date the parties enter into the Agreement incorporating this DPA, unless a later UK-transfer date is recorded in Annex 1; contract record identifies Customer and authorized signatory
Same date and execution basis; separate signatures if used in Annex 1
Table 2 , Selected SCCs, Modules and Selected Clauses
Item
Completion
Addendum EU SCCs
EU SCCs in Decision (EU) 2021/914, incorporated under Section 10.2 and identified by DPA Version 1.0, with the Appendix information below
Module and Clause 7
Module Two; docking clause included
Clause 11 option
Not included
Clause 9(a) authorization and period
General authorization, Option 2; 30 calendar days, as Section 5.2 provides
Module Four combination question
Not applicable; Module Four is not used
Table 3 , Appendix Information
Appendix item
Location of the completed information
Annex I.A , parties
Annex 1, Part A and Table 1 above
Annex I.B , transfer description
Annex 1, Parts B and C
Annex II , measures
Annex 2, with any necessary provider- or transfer-specific supplementary measures in Annex 1, Part C or the relevant supplementary record
Annex III , Subprocessors
General authorization applies; Annex 3 supplies the current authorized list; no prior-specific-authorization Annex III is selected
Table 4 , Ending this Addendum when the Approved Addendum Changes
Both the Importer and the Exporter are selected as parties that may end the UK Addendum under Section 19 of its Mandatory Clauses. That right applies only on the conditions in Section 19; it is not a general right to end a transfer at will. Part 2 is incorporated under Section 10.3.
11. Liability, Duration and General Terms
11.1 Precedence. For processing on the Customer’s behalf, this DPA and its Annexes prevail over inconsistent provisions of the Agreement or DSA. For independent controller sharing, the DSA governs its own activities. Neither addendum displaces the other for a separate processing activity or copy. Applicable EU SCCs and the UK Addendum prevail over conflicting contract provisions in the hierarchy they require; mandatory Data Protection Law remains applicable. A negotiated signed DPA replaces a published version only to the extent it validly addresses the same subject matter without impairing mandatory protections.
11.2 Liability and Data Subject Rights. Commercial allocation of liability between the parties follows Sections 11 and 12 of the Agreement, including the general cap in Section 12.3 and its applicable exceptions, except to the extent inconsistent with Data Protection Law, the EU SCCs or the UK Addendum. This DPA creates no separate monetary cap. No disclaimer, cap, exclusive remedy, indemnity, forum rule or third-party-rights exclusion restricts rights or liabilities protected by those instruments, including data subjects’ enforceable rights and judicial remedies. Early beta status does not reduce the obligations in this DPA.
11.3 Duration. This DPA begins with the Agreement’s incorporation of it and remains applicable for as long as MiraDay or a Subprocessor retains Customer Personal Data, including during export, deletion, protected backups and lawful retention. Termination of access does not end these protections. Applicable transfer terms survive as they require.
11.4 Notices and Changes. Privacy and rights requests may be submitted through the Privacy Center or the Privacy Request page. Privacy, rights and incident communications to MiraDay should be sent to privacy@miraday.ai; general support and Agreement notices to support@miraday.ai. Customer contacts are in Annex 1. Each party will keep them current. Urgent notices follow Sections 7, 8 and 10, rather than ordinary deemed-receipt timing. Changes follow the Agreement’s applicable notice and acceptance procedures and cannot retroactively authorize a new purpose, transfer or use that required prior legal conditions. The English version controls, subject to mandatory law and the applicable transfer instruments.
Annex 1 , Details of Processing
The parties use this common template together with customer-specific contracting records and the completed standard transfer profile applicable to the actual processing. Registration, order, billing or other binding contract records linked to the relevant Customer/account or Workspace identify the actual contracting party, country, contacts, representative authority where applicable, and accepted Agreement version/date. Those identified records and the profile’s identifier, version and assessment date supply the relevant Annex 1 and, where applicable, SCC/UK Addendum information and form part of that completion. They must contain all required facts, be retrievable by the relevant parties, and match the actual flow. A shared profile may be reused only within its assessed scope. Material differences in entities, countries, recipients, purposes or safeguards require an appropriate updated profile or agreed customer-specific supplement before the affected transfer; record updates do not amend mandatory clauses or replace required binding acceptance.
Part A , Parties and Execution
Item
Customer
MiraDay
Legal identity
Actual individual Customer for the Personal Workspace, or organizational Customer for the Organization Workspace, identified in the linked registration, order or binding contract record; an invited member or payer is not automatically that legal party
Forward AI Labs, Inc.
Role
Controller
Processor
Relevant activities
Recruiting and management of the relevant Workspace and authorized tasks
Provision and support of instructed Service functions
Privacy and incident contact
Customer-designated contact and email in the linked record, or the verified registered contracting contact where valid for that purpose
privacy@miraday.ai (privacy and incident contact)
Date and signature
Recorded binding acceptance of the incorporating Agreement by the Customer or authorized representative; date/signatory identified in that record, or a separately executed agreement where applicable
Acceptance of the same Agreement by MiraDay, or a separately executed agreement where applicable
Part B , Processing and Transfer Description
Item
Description
Subject matter
Personal Data processed on the Customer’s behalf in the relevant Workspace and instructed Service functions
Nature
Collection on instructions, receipt, organization, hosting, retrieval, search, instructed matching and ranking, summarization, generation of Outputs, authorized recruiting communications, instructed export/disclosure, support, protection, correction, restriction, return and deletion
Purposes
Provide the Customer’s recruiting search, candidate management, collaboration and content functions, including talent, company, labour-market and compensation research supporting its Recruiting Purposes, through Agent Teams, Channels, Contacts, Files, Skills, supported email Connectors and the Extension; provide related support and security on its behalf
Data subjects
Candidates, applicants and other professionals; Customer staff, contractors and Authorized Users; referees, hiring contacts and other persons whose data is lawfully included in Customer Content or instructed communications
Data categories
Candidate identity, contact and professional profile data; CV and employment/education information; Customer notes and evaluations; relevant email content, addresses and metadata; Channel messages, prompts, task instructions, Files, Customer Skills and generated Outputs; voice input, uploaded audio and transcriptions where used; task-execution inputs and results, file-editing content and instructions and research queries; Extension captures and task/action records; relevant tracing, diagnostic, analytics and service-generated records containing Personal Data where necessary for the instructed functions. Only functions actually enabled and used apply
Sensitive data
Not intended, requested or required. Incidental special category or criminal offence information is handled under Section 3.5, restricted to necessary lawful handling and excluded from contribution, training and sensitive inference. No biometric identification or sensitive-characteristic inference is authorized
Frequency
Ongoing as the Customer and its Authorized Users submit data, run authorized tasks or use enabled features; event-based transfer and access according to actual use
Duration
For the relevant processing service, followed by return/deletion under Section 6; protected retained copies remain subject to this DPA until removed
End-of-service export
30 days following termination where the Agreement provides this right, subject to earlier Customer deletion instructions and Section 6.2 safeguards
Active-system deletion
Without undue delay on lawful instructions; at the end of processing, within 90 calendar days of that end, inclusive of the 30-day export window. Earlier legal or transfer-term deadlines prevail (Section 6)
Backup removal
Beyond ordinary use pending scheduled removal; no later than 90 calendar days after a lawful deletion instruction during ongoing services, or 90 calendar days after the relevant processing services end. Includes Subprocessor copies; earlier required deadlines prevail (Section 6.4)
Extension capture and action-log retention
Temporary page/screenshot captures only while necessary for authorized extraction and task completion, then promptly removed unless the Customer deliberately saves them as Customer Content. Activity logs only for documented, necessary service, security and accountability purposes, subject to lawful instructions and legal retention; not a separate contribution staging area
Connected-data and AI-provider retention
Processing limited to enabled connected functions; provider-specific input/output retention in the relevant provider contract and retention record, with necessary information available under Section 9. Disconnection revokes future access; treatment of already saved Customer content follows lawful instructions and agreed retention rules
Primary storage
Application infrastructure: AWS, United States, Northern Virginia (us-east-1). Other applicable storage components, actual recipients and locations must be identified in the relevant processing and transfer records before the affected processing or Restricted Transfer begins
Backups, logs and recovery locations
Applicable Langfuse Cloud US tracing/diagnostics: United States, Oregon (us-west-2). Locations of other relevant backup, logging and recovery components must be identified in the applicable processing and transfer records; the application region does not establish the location of every copy
Support, administration and remote access
Access is subject to Documented Instructions and the applicable security and transfer safeguards. Actual access countries, entities and restrictions must be identified in the relevant processing and transfer records before the affected access begins
Transfer mechanism
For each Restricted Transfer, identify adequacy or applicable safeguard and assessment in Part C. Mere acceptance of this DPA is not an adequacy or certification claim
Supervisory authority
EU SCC authority determined and identified under Section 10, where applicable; UK Addendum: ICO
Part C , Actual Transfer and Subprocessing Record
Use the rows below to identify each applicable standard processing destination or remote-access flow. Complete the common facts, mechanism and assessment in a dated, versioned standard transfer profile, then link each relevant Customer’s identity, country, agreement acceptance and applicable variations through its contracting record. A customer-specific supplement is required where the actual arrangement falls outside that profile. New candidate records within the same covered arrangement do not require a new public addendum. Essential information and required safeguards must be complete before the affected transfer; a generic reference alone does not authorize it.
Flow/activity
Exporter / role
Importer / role
Countries, including access
Data/purpose
Mechanism and scope
Assessment/supplementary measures
Record date
Customer to MiraDay for instructed Services
Customer identified in Part A and its linked record / controller
MiraDay entity identified in Part A / processor
Actual Customer and MiraDay locations, including access, identified in the matched profile and customer-specific record
Part B, as applicable to the enabled Services
Valid mechanism and scope identified in the completed matched profile; Module Two/UK Addendum only where Section 10 applies
Required assessment and supplementary measures identified by profile/version; customer-specific differences recorded before transfer
Profile assessment/update date and date matched to the Customer’s record
MiraDay to listed Subprocessors
MiraDay entity in Part A / processor
Each actual Annex 3 entity / Subprocessor
Actual destination/access locations in Part B and the applicable provider profile, not inferred from corporate addresses
Applicable listed function and Part B
Valid onward mechanism identified in the completed provider profile; any necessary provider execution remains separate
Applicable provider assessment and supplementary measures, identified by version and actual scope
Provider-profile assessment/update date
Annex 2 , Technical and Organizational Measures
Version 1.0 , applicable to the processing in Annex 1. The common MiraDay measures below apply when MiraDay processes Customer Personal Data on the Customer’s behalf using the relevant service components. Capitalized terms have the meanings given in this DPA and the Agreement. This description supplements the obligations in Section 4.2. Customer instructions, model-use limits, return and deletion, rights assistance and breach notification remain governed by Sections 3–9. Updates follow Section 4.2; the Annex does not limit those obligations.
1. Access Control and Authentication
MiraDay uses role-based access controls to restrict access to production environments, administrative functions and Personal Data. Employees use individual identities for AWS single sign-on; production databases are accessed through authorised AWS identities and network paths. The read-only replica is configured as publicly accessible, but its security group restricts inbound sources to fixed IPv4 addresses and a designated security group. The MiraDay administration console and primary integration service share a deployment environment and use permission separation. Authing provides employee authentication using an account password and SMS verification code. The employee system is integrated to disable an employee’s Authing identity upon termination. Designated personnel manage production access.
2. Authorisation and Privileged Access
Production data and administrative privileges are limited to personnel who require them for their duties. Manual employee access to Customer task data is limited to authorised internal personnel and approved by a super administrator. AWS production resources use AWS IAM Identity Center permission sets and group-based assignments. Administrators can disable or adjust identities and permissions when personnel leave or change roles.
3. Transmission Security
MiraDay uses TLS to protect network transmissions between clients and services. Production databases and caches hosted on AWS, and object storage, use the cloud provider’s at-rest encryption capabilities. E2B sandboxes use the hosting platform’s default at-rest encryption and TLS transmission protection. Cloudflare R2 buckets are private and configured to prohibit public access, and use the provider’s at-rest encryption capability.
4. Data Separation and Processing Controls
MiraDay separates task data by user or Customer data scope. Sandboxes are reused at user level during task execution; multiple tasks of the same user may share one E2B sandbox. Processing of Customer task data, including necessary evaluation and retesting, remains subject to the Customer’s lawful instructions and the purpose and no-training restrictions in the Agreement and the applicable DPA or DSA. This schedule does not authorize reuse of Customer task content in a general evaluation library or for unrelated product improvement.
5. Input, Change and Audit Logging
MiraDay records some system activity and operational events through application and cloud-platform logs. GitHub main-branch settings require pull requests, review by at least one team member, re-approval after the latest push and successful CI checks. Production releases or deployments are expected to be reviewed by someone other than the code submitter, but there is no fixed process. AWS CloudTrail Event History and CloudWatch logs provide event records for limited periods. Logging scope, retention and review vary by system, and auditable records are not available for every access to Customer data.
6. Availability, Backup and Recovery
The AWS production RDS primary has automated backups retained for seven days; the read-only replica’s own backup-retention setting is zero. The production Redis replication group has a seven-day snapshot retention period. The databases and snapshots use the cloud provider’s encryption capabilities.
7. Data Retention and Deletion
MiraDay provides an application function for deleting an individual user and corresponding application data on authorized instructions. Deletion and retention may depend on the service component and manual action. The applicable return, deletion, restriction, backup and retention obligations, including timelines and confirmation requirements, remain those in the Agreement and the relevant DPA or DSA. An individual application deletion function is not confirmation that every component or copy has been deleted.
8. Secure Development and Vulnerability Management
MiraDay uses code review and CI checks to support change management. GitHub requires pull requests and review for the main branch and runs lint, test, build and security-audit workflows. The semantic-versioning and release bot has configured bypass capability. Dependabot security updates are enabled.
9. Incident Response and Personnel
Designated personnel handle security or privacy issues received through the support email. Employee identities are authenticated through Authing and disabled upon termination through the employee-system integration; access removal and log review in other systems still depend on administrator action.
Annex 3 , List of Subprocessors
List version: 1.0 · Updated 15 October 2026. The providers below are generally authorized under Section 5 for the relevant service functions. Applicability depends on the functions, models and routes used; listing does not mean every provider processes every Customer’s data. Providers may support the Services directly or through other service providers, including model requests routed through Vercel AI Gateway.
Locations identify corporate or published contact locations unless a hosting region is expressly stated; they do not identify every processing or access location. Retention, no-training restrictions and transfer safeguards remain governed by this DPA, the applicable provider contracts and processing or transfer records. The list version is not a provider-contract signature date or a statement that a new authorization became effective on that date.
Sub-Processor
Location
Description of Processing
Website & Contact Details
Alibaba Cloud
Singapore (international privacy contact)
AI model inference through Vercel AI Gateway, including processing model inputs and responses.
Alibaba Cloud DPO_Intl@alibabacloud.com International contact: Alibaba Cloud (Singapore) Private Limited, 51 Bras Basah Road, #03-06 Lazada One, Singapore 189554
Amazon Web Services, Inc. (AWS)
United States; application infrastructure hosting in N. Virginia, us-east-1
Cloud infrastructure, managed databases, caching, and backup services; AI model inference through Vercel AI Gateway using Amazon Bedrock.
AWS 410 Terry Avenue North, Seattle, WA 98109-5210, USA
Anthropic, PBC / Anthropic Ireland, Limited (Anthropic)
United States / Ireland
Generative AI model inference through Vercel AI Gateway, including processing model inputs and responses.
Anthropic privacy@anthropic.com U.S.: 548 Market St, PMB 90375, San Francisco, CA 94104, USA Ireland: 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland
Baseten Labs, Inc. (Baseten)
United States
AI model inference through Vercel AI Gateway, including processing model inputs and responses.
Baseten privacy@baseten.co 560 Davis Street, Suite 250, San Francisco, CA 94111, USA
Cloudflare, Inc. (Cloudflare)
United States
Content delivery, network security, request proxying, and object storage for uploaded and generated task files.
Cloudflare dpo@cloudflare.com 101 Townsend St., San Francisco, CA 94107, USA
Sampark, Inc. d/b/a Composio (Composio)
United States
Connected-application integration, tool execution, and attachment transfer when customers use connected services.
Composio support@composio.dev 2 Bryant Street, Suite 220, San Francisco, CA 94105, USA
DigitalOcean, LLC (DigitalOcean)
United States
AI model inference through Vercel AI Gateway, including processing model inputs and responses.
DigitalOcean privacy@digitalocean.com 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA
FoundryLabs, Inc. (E2B)
United States
Hosted code execution and sandbox environments, including task inputs, files, and execution results.
E2B hello@e2b.dev (privacy) support@e2b.dev (support)
Eleven Labs Inc. (ElevenLabs)
United States
Speech-to-text and audio transcription for voice input and uploaded audio files.
ElevenLabs legal@elevenlabs.io 169 Madison Ave #2484, New York, NY 10016, USA
Exa Labs Inc. (Exa)
United States
Web search, information retrieval, and query processing.
Exa privacy@exa.ai 430 Shotwell Street, San Francisco, CA 94110, USA
Google LLC (Google Cloud / Vertex AI)
United States
AI model inference through Vercel AI Gateway, including conversation compaction and processing model inputs and responses.
Google Cloud Privacy contact 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Langfuse GmbH (Langfuse)
Data hosting: United States (Oregon, us-west-2) Company location: Germany
AI tracing, diagnostics, and observability through Langfuse Cloud US, according to collection settings.
Langfuse privacy@clickhouse.com Oranienburgerstraße 91, 10178 Berlin, Germany
Microsoft Corporation (Microsoft Azure)
United States
AI model inference through Vercel AI Gateway using Azure OpenAI, including processing model inputs and responses.
Microsoft Azure Privacy contact One Microsoft Way, Redmond, WA 98052, USA
AutoInfra, Inc. (Morph)
United States
AI-assisted file editing through Vercel AI Gateway, including processing file content and editing instructions.
OpenAI OpCo, LLC / OpenAI Ireland Ltd. (OpenAI)
United States / Ireland
Generative AI model inference through Vercel AI Gateway, including processing model inputs and responses.
OpenAI privacy@openai.com U.S.: 1455 Third Street, San Francisco, CA 94158, USA Ireland: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
PostHog, Inc. (PostHog)
United States
Product analytics and session replay where enabled, according to collection settings.
PostHog privacy@posthog.com 2261 Market St., #4008, San Francisco, CA 94114, USA
Resend (Plus Five Five, Inc.)
United States
Transactional email and notification delivery.
Resend privacy@resend.com 2261 Market Street #5039, San Francisco, CA 94114, USA
Functional Software, Inc. d/b/a Sentry (Sentry)
United States
Application error, performance, and operational monitoring, according to collection settings.
Sentry compliance@sentry.io 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Upstash, Inc. (Upstash)
United States
Managed Redis caching of application database query results, which may contain customer personal data.
Vercel Inc. (Vercel)
United States
AI Gateway for model inference request routing and response delivery.
Vercel privacy@vercel.com 440 N Barranca Avenue #4133, Covina, CA 91723, USA
A current copy may be requested from privacy@miraday.ai. Updates and notice history are subject to Section 5; publishing an updated page alone does not replace its required advance notice. Customer-selected connected services and independent controllers are classified by their actual role rather than automatically included as Subprocessors.