Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller") and Reality Inc., a Delaware corporation doing business as Scam.ai ("Processor," "we") and applies where we process personal data on the Controller's behalf in providing the Services. On matters of data protection, this DPA controls over the parties' agreement; on all other matters, including limitations of liability and fees, the Master Services Agreement or applicable order controls.

Subject matter and duration: processing of personal data for the term of the Services. Nature and purpose: analysis of submitted media and documents to produce detection results and to provide, secure, and support the Services. Categories of data subjects and personal data: as determined and submitted by the Controller. The Controller is responsible for the lawfulness of the data it submits and its instructions.

We process personal data only on the Controller's documented instructions (including as configured in the product) and as necessary to provide the Services, prevent abuse, and comply with law, and will inform the Controller if we believe an instruction infringes applicable law. We ensure that personnel authorized to process personal data are bound by confidentiality obligations.

We implement and maintain appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and accidental loss, destruction, or damage, taking into account the state of the art, costs, and the risks. We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, with the information reasonably available to us.

The Controller provides general authorization for us to engage subprocessors listed on the Subprocessors page. We impose data-protection obligations on subprocessors no less protective than this DPA and remain responsible for their performance. We will give notice of the addition or replacement of a subprocessor and a reasonable opportunity to object on legitimate data-protection grounds.

Taking into account the nature of the processing, we will assist the Controller with appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests and to fulfill the Controller's obligations regarding security, breach notification, and data-protection impact assessments.

On termination of the Services, we will, at the Controller's choice, delete or return personal data and delete existing copies, unless retention is required by law. We will make available information reasonably necessary to demonstrate compliance and allow for audits, limited to once per twelve (12) months (or following a breach), on reasonable prior notice, during business hours, subject to confidentiality, at the Controller's expense, and conducted so as not to disrupt operations.

Where we transfer personal data across borders, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum, which are incorporated by reference where applicable. A signable DPA incorporating these clauses is available on request through the contact form.

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Master Services Agreement or applicable order.