Acquiror AI Data Processing Addendum (DPA)

On this page

Version 1.3. Effective date: October 20, 2026. Prepared with AI assistance and not reviewed by a licensed lawyer. Not legal advice.

Reminder: Acquiror AI provides no investment, legal, tax, accounting, lending, or valuation advice; AI Output and all other Output are informational only and must be verified by a qualified person before reliance. See Sections 5, 12, and 14 of the Terms of Service.

This Data Processing Addendum is structured after the Common Paper Data Processing Agreement standard (used under CC BY 4.0), adapted for Acquiror AI. It uses a Cover Page of variable terms followed by Standard Terms and Annexes.

---

Cover Page (Key Terms)

---

Standard Terms

1. Definitions

• "Customer Personal Data" means personal information or personal data that Customer or its Authorized Users submit to the Service and that Provider processes on Customer's behalf, including the data categories in Annex 1. It includes personal information contained in uploaded deal documents, structured deal and financial data, deal-side contact records, and AI prompts and outputs persisted in the Service.
• "Account Data" means personal information that Provider processes for its own purposes to establish and manage the Customer relationship: account registration and user profile data, authentication identifiers, records of acceptance of the Agreement and the documents it incorporates (who accepted which versions, when, and from which network address and client), billing and subscription records, support communications, and product telemetry and audit logs.
• "Service" means the Acquiror AI platform provided under the Agreement.
• "Subprocessor" means a third party engaged by Provider to process Customer Personal Data on Provider's behalf.
• "Tenant AI Provider" means a third-party AI provider (for example Anthropic, OpenAI, or an OpenAI-compatible gateway of Customer's choosing) that Customer configures for use with the Service under Customer's own agreement with that provider, including by supplying Customer's own API key.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, corresponding to a "breach of security safeguards" under PIPEDA and a "confidentiality incident" under Quebec's Law 25.
• "Applicable Data Protection Laws" means the privacy and data protection laws of Canada and the United States applicable to the processing of personal data under the Agreement, including PIPEDA, Quebec's Law 25 (the Act respecting the protection of personal information in the private sector), the Alberta and British Columbia Personal Information Protection Acts, the CCPA as amended by the CPRA, and other US state comprehensive privacy laws. This DPA does not address, and Provider does not claim compliance with, the GDPR or UK GDPR; the Service is offered to customers in Canada and the United States only.
• Terms such as "controller", "processor", "business", "service provider", "sell", and "share" have the meanings given in Applicable Data Protection Laws.
• Capitalized terms used but not defined in this DPA, including "Customer Data", "AI Output", "Output", "Authorized User", and "Umplify Parties", have the meanings given in the Terms of Service.

2. Roles, scope, and duration

2.1 Roles. For Customer Personal Data, Customer is the controller (or business) and Provider is the processor (or service provider) acting on Customer's documented instructions. As between the parties, Customer is responsible for the accuracy, quality, and lawfulness of Customer Personal Data, for the means by which it was acquired, and for having all rights, consents, and notices necessary to submit it to the Service and to instruct the processing described in this DPA.

2.2 Duration. This DPA applies for the term of the Agreement and until Provider has deleted Customer Personal Data in accordance with Section 10.

2.3 Provider as controller. Provider is an independent controller of Account Data, which it processes to provide, secure, support, bill for, and improve the Service and to comply with law, as described in the Acquiror AI Privacy Policy. Account Data is not processed for targeted advertising and is not sold or shared.

3. Processing instructions

3.1 Provider will process Customer Personal Data only (a) to provide, maintain, secure, and support the Service under the Agreement, (b) as documented in this DPA, including Annex 1, and (c) per Customer's other documented instructions, where technically feasible and agreed. Provider will inform Customer if, in its opinion, an instruction violates Applicable Data Protection Laws (Provider is not obligated to monitor Customer's compliance).

3.2 Customer-directed disclosures. The following are instructions from Customer, not disclosures by Provider for its own purposes:

• (a) sharing among Customer's Authorized Users per the roles and permissions Customer configures;
• (b) transmission of prompts and content to a Tenant AI Provider that Customer has configured (Section 7);
• (c) exposure of deal data through the Service's MCP (Model Context Protocol) server to external AI clients or assistants that Customer connects and authenticates. Customer controls which clients it connects, and data retrieved by such a client is disclosed at Customer's direction to a recipient of Customer's choosing. Provider is not responsible for the handling of data by external clients Customer connects;
• (d) Customer-initiated data exports.

3.3 Provider may process Customer Personal Data where required by law, in which case Provider will notify Customer of the requirement before processing unless the law prohibits it.

4. Confidentiality of personnel

Provider ensures that personnel authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and access Customer Personal Data only as needed to perform their roles.

5. Security

5.1 Provider implements and maintains the technical and organizational measures described in Annex 2, and appropriate measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the sensitivity of the data.

5.2 Provider may update the measures in Annex 2 from time to time, provided the updates do not materially reduce the overall protection of Customer Personal Data.

6. Subprocessors

6.1 General authorization. Customer grants Provider general authorization to engage Subprocessors, subject to this Section. The current Subprocessor list, including each Subprocessor's function and processing region, is published at the location stated on the Cover Page. Provider has accepted each Subprocessor's standard data processing terms (for Microsoft, the Microsoft Products and Services Data Protection Addendum; for Stripe, the Stripe Data Processing Agreement), has assessed them as providing protection appropriate to the data, and remains responsible to Customer for its Subprocessors' performance. Those standard terms differ from this DPA in their notice periods, timelines, and mechanics, and Provider's commitments to Customer in this DPA are Provider's own, not flow-downs of its Subprocessors' terms.

6.2 Notice of changes. Provider will give Customer at least 30 days' advance notice before a new Subprocessor processes Customer Personal Data, by email to Customer's account administrators, and will update the published Subprocessor list at the same time.

6.3 Objection right. Customer may object in writing to a new Subprocessor within 30 days of notice, on reasonable data-protection grounds. The parties will confer in good faith to resolve the objection (for example through configuration changes or additional safeguards). If the objection cannot be resolved within a reasonable period, Customer may terminate the affected portion of the Service on written notice and receive a pro-rata refund of prepaid fees for the terminated portion covering the period after the termination date.

6.4 Not Subprocessors. Tenant AI Providers (Section 7), external AI clients Customer connects via the MCP server (Section 3.2(c)), and other services Customer elects to integrate with the Service are engaged by Customer, act on Customer's behalf, and are not Subprocessors of Provider.

7. Tenant AI Providers

7.1 If Customer configures a Tenant AI Provider (including by supplying its own API key), Customer instructs Provider to transmit prompts, document content, and related context to that provider and to return its outputs into the Service. The Tenant AI Provider processes such data as Customer's own processor under Customer's agreement with that provider. Provider transmits each request on Customer's instruction, does not control the Tenant AI Provider's processing, and is not responsible for the Tenant AI Provider's privacy or security practices, processing locations, retention, or outputs; Provider stores and logs the exchange in the Service as the Privacy Policy describes (question-and-answer history, drafts and analysis records, the 24-hour response cache, and operational logs).

7.2 Customer is responsible for ensuring that its use of a Tenant AI Provider complies with Applicable Data Protection Laws, including any cross-border transfer assessment the Customer must perform for its own processors.

7.3 Key handling. Customer-supplied AI API keys are handled as described in Annex 2 (accepted once at the API boundary, stored only in Provider's cloud secret store in Canada, never persisted in the relational database, excluded from application logging by design, and removable from use by Customer at any time; Provider deletes the stored secret on Customer's request).

7.4 Document-embedding (indexing) processing remains on Provider's platform AI Subprocessor (Microsoft) even when a Tenant AI Provider is configured for chat features.

8. Assistance

8.1 Data subject requests. Taking into account the nature of the processing, Provider will assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligations to respond to requests from individuals exercising rights under Applicable Data Protection Laws (access, correction, deletion, portability, and analogous rights). The Service's self-service export and data management features are the primary mechanism; Provider will provide reasonable additional assistance on request. If Provider receives a request directly from an individual concerning Customer Personal Data, Provider will not respond substantively (except to direct the individual to Customer) unless legally required, and will promptly notify Customer where lawful.

8.2 Assessments. Provider will provide reasonable assistance with Customer's data protection impact assessments, privacy impact assessments, and cross-border transfer assessments (including assessments under Quebec Law 25 section 17) relating to the Service, by making available the information in this DPA, the Subprocessor list, Annexes 1 and 2, and the audit materials in Section 11.

9. Personal Data Breach

9.1 Provider will notify Customer without undue delay, and in any case within 72 hours of confirming a Personal Data Breach affecting Customer Personal Data. For this Section, Provider "confirms" a Personal Data Breach when, following its initial investigation, it has established that the incident occurred and affected Customer Personal Data. This 72-hour commitment is a contractual undertaking to Customer; statutory notification duties to regulators and individuals remain governed by Applicable Data Protection Laws. Where Customer is an enterprise subject to Quebec's Law 25, Provider will in addition notify Customer's person in charge of the protection of personal information without delay of any violation, or attempted violation, of the confidentiality obligations in this DPA concerning Customer Personal Data that Provider detects, to the extent section 18.3 of that Act requires of Provider, whether or not the event has been confirmed as a Personal Data Breach. Provider's ability to detect attempts is limited to the monitoring described in Annex 2.

9.2 The notice will include, to the extent then known (and supplemented as information becomes available): the nature of the breach, the categories and approximate volume of data and individuals affected, the likely consequences, the measures taken or proposed to address the breach and mitigate harm, and a contact point.

9.3 Provider will take reasonable steps to contain and remediate the breach and will provide reasonable cooperation and assistance with Customer's own notification obligations, including its obligations under PIPEDA (real risk of significant harm reporting to the OPC and individuals), Quebec Law 25 (Commission d'accès à l'information and individuals where there is a risk of serious injury), and US state breach notification laws.

9.4 Provider maintains an internal register of incidents affecting personal information, retained for at least 5 years from the date Provider becomes aware of each incident (the Quebec retention standard, applied globally), and will make relevant register entries available to Customer on reasonable request where they concern Customer Personal Data.

9.5 Provider's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

10. Deletion and return

10.1 During the term. Customer's administrators can export Customer Data at any time while the subscription is active through the Service's self-service export (structured deal, financial, contact, and user-roster data, the records of acceptance of the Agreement, and original uploaded documents that completed upload; the export does not include question-and-answer history, ratings and feedback, AI usage counters, the AI response cache, the MCP prompt audit record, or payment-processor event payloads, which Provider will provide within 30 days of a written request where they concern Customer). Deletion capabilities during the term are as provided in the Service (documents, deals, contacts, tasks, and memo notes can be deleted by Authorized Users; deleting a deal removes its files and search entries and archives its structured records; removing a User severs that User's access). For deletions the Service does not support self-service, including deletion of a whole tenant, of an archived deal's structured records, or of a removed User's record, Provider will action Customer's verified written deletion instructions within 60 days, the same period as the Privacy Policy's deletion-on-request window.

10.2 After termination. For 60 days after termination or expiration of the Agreement, Provider will on request provide Customer with an export of its data in the same form as the Service's self-service export (the "export window"). Within 90 days after the end of the export window, Provider will delete Customer Personal Data from active systems, except where retention is required by law (in which case Provider will isolate and protect the retained data and delete it when the requirement ends). Data in database backups is purged in the ordinary course of the backup retention cycle following deletion from active systems; database backups are retained for 7 days, and deleted files are recoverable from file storage for up to 37 days, as described in the Retention Schedule.

10.3 Aggregated or de-identified data that does not identify Customer or any individual, and audit records Provider is required to keep, are not subject to deletion under this Section.

11. Audits

11.1 Reports-based. Provider supports Customer's audit rights primarily through documentation: (a) Microsoft's third-party audit reports and certifications for the Microsoft cloud infrastructure the Service runs on, available through the Microsoft Trust Center (Provider itself holds no such certification); (b) Provider's own written descriptions and attestations of its security measures (Annex 2 and the Subprocessor list); and (c) responses to security questionnaires.

11.2 Questionnaire. No more than once per 12-month period, Customer may submit a reasonable written security questionnaire, which Provider will answer within a reasonable time.

11.3 No on-site audits. On-site or remote technical inspections of Provider's or its Subprocessors' systems are not offered at this time. If Applicable Data Protection Laws require an audit beyond Sections 11.1 and 11.2, including the verifications that section 18.3 of Quebec's Law 25 entitles a Customer's person in charge of the protection of personal information to conduct, the parties will agree on scope, timing, confidentiality, and costs in advance, and the audit will be conducted with minimal disruption, no more than once per year, by an auditor bound to confidentiality.

12. Cross-border processing (Canada and United States)

12.1 Locations. Customer Personal Data is stored at rest in Microsoft's cloud in Canada, with database backup copies held in Canada, except for the abuse-monitoring sample described below. Processing of AI feature requests through Provider's platform AI Subprocessor (Microsoft) currently occurs in the United States or, under Microsoft's global deployment tier, in other Microsoft regions worldwide; this AI processing takes place outside Canada. Microsoft's abuse-monitoring process may also hold a sample of flagged prompts and outputs for review in the United States geography of Provider's AI resource, under Microsoft's published terms. The web application is served to browsers from the United States; transactional email is sent through Microsoft's email service whose data location is the United States; sign-in is provided by a global Microsoft identity service that is not pinned to one region; payment processing occurs on Stripe's infrastructure in the United States. Details per vendor are on the Subprocessor list. Provider will update the Subprocessor list if processing locations change, subject to Section 6.

12.2 Transparency. Customer acknowledges that personal data processed in the United States or another foreign jurisdiction is subject to the laws of that jurisdiction and may be accessible to authorities there under lawful access regimes. If Provider receives a legally binding demand from a public authority for Customer Personal Data, it will, unless legally prohibited, promptly notify Customer and direct the authority to Customer, and will disclose only what it is legally compelled to disclose.

12.3 Quebec Law 25. For personal information communicated outside Quebec, Provider commits to conducting and maintaining the assessment required by Law 25 section 17 (considering sensitivity, purposes, safeguards, and the legal framework of the destination jurisdiction). Provider's agreements with its Subprocessors are their standard data processing terms, which Provider's assessment takes into account; Provider does not negotiate bespoke terms with Microsoft or Stripe. Provider will provide reasonable assistance for Customer's own section 17 assessment (Section 8.2).

12.4 US state law service provider terms. To the extent US state privacy laws apply to Customer Personal Data, Provider acts as a "service provider" or "processor" and: (a) will not sell Customer Personal Data or share it for cross-context behavioral advertising; (b) will not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA and the Agreement, or as otherwise permitted by those laws; (c) will not retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties; (d) will not combine Customer Personal Data with personal information it receives from other sources, except as permitted for service providers; (e) will comply with applicable obligations under those laws and provide the same level of privacy protection as required of Customer; (f) grants Customer the right to take reasonable and appropriate steps under this DPA to ensure Provider's use of Customer Personal Data is consistent with Customer's obligations, and to stop and remediate unauthorized use on notice; and (g) will notify Customer if it determines it can no longer meet its obligations under those laws. Provider certifies that it understands and will comply with the restrictions in this Section 12.4.

13. Liability

Each party's liability arising out of or related to this DPA, including liability arising from a Personal Data Breach, from a Subprocessor's acts or omissions, or from any failure of the measures in Annex 2, is subject to the limitations of liability, exclusions, caps, time limit for claims, and release set out in Sections 12 and 14 of the Agreement (the Terms of Service), and liability under this DPA and the Agreement is aggregated under a single cap structure, not additive. Nothing in this DPA creates liability for AI Output that the Agreement excludes, and the Customer indemnity in Section 13.2 of the Agreement applies to Customer Personal Data, including personal information of third parties that Customer submits without the rights, consents, or notices required of it.

14. Order of precedence and general

14.1 This DPA is incorporated into and forms part of the Agreement. For the subject matter of data protection, this DPA prevails over any conflicting term of the Agreement.

14.2 If any provision of this DPA is held invalid, the remainder remains in effect, and the parties will replace the invalid provision with a valid one that most closely reflects its intent.

14.3 Provider may update this DPA to reflect changes in law or in the Service, following the notice and versioning commitments in the Agreement; material reductions in Customer's protections require Customer's agreement.

---

Annex 1: Description of Processing

Subject matter. Provision of the Acquiror AI deal management and acquisition analysis platform, including document management, financial analysis modules, AI-assisted features, exports, and support.

Duration. The term of the Agreement plus the export and deletion periods in Section 10.

Nature and purposes. Hosting and storage; organization and structuring of deal and financial data; document ingestion, text extraction, and search indexing; retrieval-augmented AI question answering, extraction, analysis narratives, and drafting; transmission to Tenant AI Providers and MCP clients at Customer's direction; transactional email; export; backup; security monitoring and audit logging; support.

Categories of data subjects.

• Customer's personnel and Authorized Users (employees, contractors, advisors)
• Deal-side contacts recorded by Customer (brokers, sellers, advisors, lenders, other transaction participants)
• Individuals appearing in uploaded documents and financial data concerning target companies (for example owners, officers, employees, customers, suppliers of a target business)

Categories of Customer Personal Data.

• User identity and profile data (names, business contact details, roles, directory identifiers, time zone, preferences)
• Deal-side contact records and interaction notes (names, roles, emails, phone numbers, companies, meeting and correspondence notes)
• Uploaded deal documents and their extracted text and search index entries (documents may contain any personal information the Customer's source materials contain, including compensation or ownership information about target-company individuals)
• Structured deal and financial analysis data referencing individuals (for example customer concentration or key-person entries)
• AI prompts, AI outputs, Q&A history with citations, AI-generated drafts, decision records, and memo notes
• Support communications and in-product feedback

Sensitive data. The Service does not request sensitive personal information. Customers control the content of uploaded documents, which may incidentally contain financial information about identifiable individuals connected to a target business.

Frequency. Continuous, for the duration of the subscription.

---

Annex 2: Security Measures

Provider maintains the following technical and organizational measures for the Service. These reflect the current state of the platform.

1. Encryption in transit. TLS/HTTPS for all connections to the Service and between Service components and Subprocessors.
2. Encryption at rest. Platform-managed encryption at rest for relational data and for documents, queues, and table records, provided by Microsoft's cloud.
3. Authentication. User authentication through Microsoft's identity service with signed bearer tokens; no passwords are stored by Provider. Every request that reads or writes Customer Data, including MCP requests, requires an authenticated, authorized token. The only endpoints that do not require a user token are a health check that returns no data, the MCP sign-in endpoints (discovery metadata, client registration, and the sign-in and token relays to Microsoft's identity service), the AI persona image, a signature-verified payment webhook, and two operations endpoints protected by their own keys (one synchronizes plan definitions with the payment processor; one re-queues a failed search-index cleanup and can address any tenant's cleanup record). Time-limited storage links (15 minutes, read-only for downloads, write-only for uploads) are issued only to an authenticated user or to a connected MCP client acting for one.
4. Tenant isolation. The Service is multi-tenant with logical isolation: every data access path is scoped by tenant identifier, enforced in the application and data access layers.
5. Secrets management, including Customer AI keys. Customer-supplied AI API keys and the payment webhook signing secret are held in Provider's cloud secret store (a dedicated secret-management service in Canada) and read at call time by the application's managed identity. Customer-supplied AI API keys are accepted once at the API boundary, written to the secret store, and discarded from the request path; they are never persisted in the relational database and excluded from application logging by design. The database stores only a reference to the secret. Customer can remove a key from use at any time by replacing it or returning to the platform provider, and Provider deletes the stored secret on request. Provider's own platform credentials (database, storage, search, AI, email, and payment-processor keys) are held in the application's protected configuration on Microsoft's cloud, which is readable only by the deployment identity and by Provider's administrators.
6. Access control. Role-based access control within the Service (a fixed set of tenant roles, Administrator and Member, with member capability levels that Customer's administrators assign). Infrastructure access uses a managed identity for the secret store and platform credentials for the other services. Provider personnel access to production data is limited to what is needed for operation and support; today that access is by Provider's administrators through Microsoft's cloud administration tools and Provider's own operations tooling, under the confidentiality obligations in Section 4. Provider does not keep a per-person log of such access (see item 7).
7. Audit logging. Append-only application-level audit logs for subscription changes (recording the acting system, administrator role, or payment processor, and the time), valuation events, stage transitions, and data exports (recording the exporting user and the time), plus infrastructure logs retained for 30 days. The Service does not log sign-in events of its own (Microsoft's identity service keeps sign-in logs under its own retention) and does not keep a separate audit trail of Provider personnel access.
8. Monitoring. Application performance monitoring, error tracking, and operational alerting through Microsoft's cloud monitoring service, with logs held in Canada (log retention 30 days).
9. Backups and recoverability. Automated database backups with point-in-time restore, retained for 7 days, with backup copies held in Canada. Document storage has soft-delete (7 days) and versioning (prior versions kept for 30 days); deleted secrets in the secret store are recoverable for 7 days.
10. Data residency. Core data at rest in Microsoft's cloud in Canada (Toronto, Ontario); platform AI processing occurs outside Canada, and Microsoft's abuse-monitoring process may hold a sample of flagged prompts and outputs in the United States, as described in Section 12.1 and the Subprocessor list.
11. Prompt content. Prompts sent to AI providers contain the document text, retrieved passages, and structured data that a feature requires, and, for scanned pages and uploaded images that carry no text layer, the page image itself, which is sent to the AI provider (the platform provider or, where configured, the Tenant AI Provider) for text recognition and is not stored by Provider as an image. Provider does not apply automated removal of personal identifiers from prompts. Retrieved document content is delimited and flagged to the model as untrusted data to resist prompt injection.
12. Rate limiting and abuse controls. Per-user AI request rate limits, per-tenant AI usage quotas and daily and monthly token and cost caps, upload size and type limits, and input validation. There is no general request rate limit on the Service beyond the AI features.
13. Vulnerability and change management. Every change to the Service is made through a reviewed pull request; automated build and test workflows run on pull requests to the main branch and again on the release pipeline before deployment. Changes touching authentication, tenant scoping, data migrations, or financial calculations receive an additional security-focused review before merge under Provider's development process. Third-party dependencies are upgraded by Provider on a periodic manual cadence; automated static analysis of the source code is available to Provider and run on demand rather than on every change. Deployment to the customer-facing environment is a manual step triggered by a tagged release. Provider holds no third-party security certification of its own, has not commissioned an independent penetration test, and does not run automated malware scanning on uploaded files; the certifications and audit reports covering the underlying Microsoft cloud infrastructure are available through the Microsoft Trust Center.

---

Annex 3: Subprocessors

The current list of Subprocessors, including each vendor's function and processing region, is published at https://acquiror.ai/legal/subprocessors. As of the effective date, Provider's Subprocessors are Microsoft (cloud hosting, database and document storage, background job queues, search indexing, secret storage, monitoring and backups, all in Canada; sign-in, a global service not pinned to one region; delivery of the web application to browsers and transactional email, United States; platform AI processing, United States today or other Microsoft regions worldwide under the global deployment tier) and Stripe (billing and payment processing, United States). Tenant AI Providers and Customer-connected MCP clients are not Subprocessors (Sections 6.4 and 7).

---

(c) 2026 Umplify Technologies Inc. All rights reserved.