Data Processing Addendum
Data Processing Addendum
Effective date: July 2, 2026. This Data Processing Addendum ("DPA") forms part of the Monocrat Terms of Service when Monocrat processes personal data in Customer Content for a business customer and no signed DPA states otherwise.
1. Parties And Roles
Customer is the controller, business, or equivalent role for personal data in Customer Content. Vanka Inc. is the processor, service provider, or equivalent role when processing Customer Content on Customer's behalf. Monocrat may act as an independent controller for account administration, billing, security, legal, tax, abuse-prevention, service analytics, and business operations.
Customer-authorized providers such as Google Workspace, Stripe, Square, Shopify, Plaid, Moov, and similar services may process data under their own terms with Customer. Monocrat's role depends on the specific workflow, authorization, and provider relationship.
2. Processing Details
| Subject matter | Business operations automation, source-backed review workflows, billing, support, account controls, and related product functionality. |
|---|---|
| Duration | The term of Customer's use of Monocrat plus retention needed for legal, billing, tax, accounting, security, audit, dispute, incident, abuse-prevention, and backup purposes. |
| Data subjects | Customer's owners, operators, employees, contractors, vendors, customers, prospects, partners, support contacts, and other people appearing in authorized business records. |
| Data categories | Identity, contact, business communications, documents, invoices, receipts, contracts, calendar metadata, support records, payment evidence, usage metadata, billing metadata, source refs, audit events, prompts, outputs, and connected-source metadata. |
| Sensitive categories | Monocrat is not intended for protected health information, consumer credit reports, children's data, government identification numbers, payment card numbers, or special-category data unless expressly agreed in writing. |
3. Customer Instructions
Monocrat will process Customer Content only to provide, secure, support, maintain, and improve the service; comply with Customer's documented instructions; comply with law; enforce the Terms; and protect the service, Customer, Monocrat, providers, and others. The Terms, this DPA, product settings, authenticated source connections, support/legal requests, and approved order forms are Customer's documented instructions.
Monocrat may decline or suspend an instruction if it reasonably believes the instruction violates law, provider requirements, security controls, tenant isolation, source policy, privacy commitments, or high-stakes action gates.
4. Confidentiality
Monocrat personnel and contractors with access to Customer Content are bound by confidentiality obligations. Access is limited to personnel and systems with a need to know for service operation, support, security, legal, billing, or approved incident response.
5. Security Measures
Monocrat uses administrative, technical, and organizational safeguards designed to protect Customer Content, including tenant isolation, access controls, encryption in transit, encryption at rest where supported by the relevant service, secret management, audit logging, source-health checks, vulnerability handling, restricted support access, and action gates for sensitive workflows. Additional posture details are described on the Security page.
6. Subprocessors
Customer authorizes Monocrat to use subprocessors listed at Subprocessors. Monocrat remains responsible for subprocessors' performance of subprocessed obligations under this DPA, subject to the Terms.
Monocrat may update subprocessors as the service changes. We will update the subprocessor page or provide another reasonable notice for material additions. Customer may object to a new subprocessor by contacting privacy@monocrat.ai within 15 days of notice. If the parties cannot resolve the objection, Customer may stop using the affected feature or terminate the affected service as provided in the Terms.
7. Google API Data
Monocrat's use and transfer of Google API data is intended to comply with the Google API Services User Data Policy, including Limited Use. Google API data is used to provide user-facing Monocrat functionality, maintain source health, secure accounts, support customer-authorized workflows, and comply with law or security obligations. Google API data is not sold, used for advertising, or used for generalized AI model training.
8. AI Provider Processing
Monocrat may process Customer Content through approved AI providers, cloud AI platforms, model gateways, embedding systems, and batch processing paths to provide the service. Monocrat uses provider routing controls, source-policy checks, tenant-isolation commitments, data-use commitments, and high-stakes action gates before enabling a provider or route for a data class. See AI & Provider Processing.
9. Assistance
Taking into account the nature of processing and information available to Monocrat, we will provide reasonable assistance for Customer's data subject requests, security obligations, impact assessments, and regulator inquiries related to Customer Content. Some requests may require support or legal review, source-provider handoff, redaction, manifesting, or fresh owner reauthentication.
10. Security Incidents
Monocrat will notify Customer without undue delay after confirming a security incident involving Customer Content, unless law enforcement, legal process, or security needs require delay. Notice may include known incident facts, affected data categories, mitigation steps, and recommended customer actions.
11. Deletion And Return
Account deletion, legal erasure, legal access/export, data access/export, source disconnect, retention exceptions, and no-bulk-export limitations are described in Account & Data Controls. Confirmed account deletion and legally valid erasure requests delete in-scope tenant-private Monocrat data from live serving systems within 30 days, subject to retained categories such as backups, logs, billing/tax/dispute records, legal holds, security records, provider records, and other retention exceptions.
12. Audits
On reasonable written request, Monocrat will provide available security, privacy, subprocessor, and data-control information reasonably needed to verify compliance with this DPA. Any additional audit, questionnaire, or evidence request must be scoped, confidentiality-protected, and not compromise another customer's data, security controls, secrets, internal prompts, provider COGS, or Monocrat confidential information.
13. International Transfers
Monocrat is operated from the United States and primarily designed for United States business customers. If transfer mechanisms such as standard contractual clauses, a UK addendum, or other international data transfer terms are required for Customer's use, contact legal@monocrat.ai before using the affected service with regulated or cross-border personal data.
14. Conflicts
If this DPA conflicts with the Terms, this DPA controls only for processor or service-provider obligations involving Customer Content. The Terms control all other issues, including fees, suspension, liability, acceptable use, and product access.