ClaroFlow Data Processing Agreement

Effective Date: February 18, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between:

Digify Platforms, Inc.
2248 Broadway #1516
New York, NY 10024
United States
("Processor")

and

Customer ("Controller").

---

1. Scope

This DPA applies where Processor processes Personal Data on behalf of Controller in connection with ClaroFlow.

Controller determines the purposes and means of processing. Processor processes Personal Data solely to provide the Service.

2. Nature and Purpose of Processing

Processing activities include:

• Ingestion of uploaded documents
• Extraction and structuring of data
• Storage and routing of structured information
• Technical support and security monitoring

3. Categories of Data Subjects

May include:

• Employees
• Contractors
• Vendors
• Customers
• Tenants (property management use case)
• Drivers (logistics use case)

4. Categories of Personal Data

May include:

• Names
• Email addresses
• Addresses
• Financial information
• Invoice data
• Business contact information

Controller determines what Personal Data is uploaded.

5. Processor Obligations

Processor shall:

• Process data only on documented instructions
• Maintain confidentiality
• Implement appropriate technical and organizational safeguards
• Assist Controller with GDPR rights requests
• Notify Controller of personal data breaches without undue delay

6. Subprocessors

Processor may engage subprocessors for:

• Hosting
• Cloud infrastructure
• Payment processing
• Analytics

Processor ensures subprocessors are bound by written agreements with equivalent data protection obligations.

See the Subprocessor List below for details.

7. International Transfers

Where data is transferred outside the EEA:

• Standard Contractual Clauses (SCCs) apply
• Appropriate safeguards are implemented

8. Security Measures

Processor maintains:

• Encryption in transit
• Access controls
• Infrastructure monitoring
• Logical segregation of customer environments

9. Data Retention and Deletion

Upon termination, Processor will:

• Delete or return Customer Personal Data upon request
• Retain backups only as required for legal or security purposes

10. Audit Rights

Upon reasonable notice, Controller may request documentation demonstrating compliance.

---

ClaroFlow Subprocessor List

ClaroFlow uses the following categories of subprocessors:

Infrastructure Providers

• Cloud hosting provider (e.g., AWS, Azure, or similar)
• CDN services

Payment Processing

• Payment processor (e.g., Stripe)

Analytics

• Analytics platform for usage insights

Email Delivery

• Transactional email provider

AI / Machine Learning Services

• AI model providers for document extraction and structuring

All subprocessors are subject to contractual data protection obligations.

Customers may contact support@getclaroflow.com for updates to the current subprocessor list.