Data Processing Agreement

Please click here to view the previous version of this Data Processing Agreement.

Notice of amendment. On August 31, 2026, Napkin AI posted corrections to the AI-provider names, data-retention language, authorized sub-processor list, and selected descriptions of its technical and organizational measures. The changes to Sections 7.1.4 and 7.2 and the related AI-retention note in Annex 2 take effect on September 30, 2026 for customers governed by this online DPA. Separately executed DPAs remain unchanged unless amended in writing. The sub-processor disclosure correction is governed by Section 3.3.

DATA PROCESSOR: Second Layer, Inc. dba Napkin AI, a Delaware corporation, with registered address at 626 Jay Street, Los Altos, CA 94022, USA.

DATA CONTROLLER: The entity or individual (“Customer”) that accepts the Napkin AI Terms of Service or executes an enterprise agreement with Napkin AI.

PREAMBLE

This Data Processing Agreement (“DPA”) forms part of the Napkin AI Terms of Service available at https://www.napkin.ai/terms-conditions/ (the “Agreement”) and sets out the terms on which Napkin AI processes Customer Personal Data on behalf of the Customer. This DPA is effective as of the date Customer creates an account, accepts the Terms of Service, or first accesses the Services, whichever occurs first.

The parties acknowledge that: (a) the Customer acts as a Controller with respect to Customer Personal Data; (b) Napkin AI acts as a Processor with respect to Customer Personal Data; (c) this DPA does not establish a joint controllership arrangement under Article 26 of the GDPR; and (d) each party remains solely responsible for its own compliance obligations.

In the event of any conflict between this DPA and the Agreement, the provisions of this DPA shall prevail with respect to the subject matter hereof.

SECTION 1 – DEFINITIONS

SECTION 2 – SCOPE AND PROCESSING INSTRUCTIONS

2.1 Napkin AI shall Process Customer Personal Data only on the Customer’s documented instructions as set out in this DPA, in Annex 1, and as further specified in the Agreement, except where required to do so by applicable law, in which case Napkin AI shall, to the extent permitted by law, inform the Customer of that legal requirement before Processing.

2.2 The details of the Processing activities, including the subject matter, nature, purpose, categories of Personal Data, and categories of Data Subjects, are set out in Annex 1 to this DPA.

2.3 Napkin AI shall promptly inform the Customer if, in Napkin AI’s opinion, any instruction from the Customer infringes Applicable Data Protection Laws, provided that Napkin AI shall have no obligation to conduct legal analysis on behalf of the Customer.

2.4 This DPA shall remain in effect for the duration of the Agreement and shall terminate automatically upon expiry or termination of the Agreement, subject to the survival provisions set out in Section 11.

SECTION 3 – PROCESSOR OBLIGATIONS

3.1 Confidentiality

3.1.1 Napkin AI shall ensure that all personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, and that access is limited to those personnel who require it to perform the Services.

3.2 Technical and Organizational Measures

3.2.1 Napkin AI shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as further detailed in Annex 3.

3.2.2 Napkin AI may update or modify the technical and organizational measures from time to time provided the updated measures afford at least equivalent protection.

3.3 Sub-Processing

3.3.1 The Customer grants Napkin AI general written authorization to engage the Sub-Processors listed in Annex 2 and at https://www.napkin.ai/sub-processors. Napkin AI shall provide at least ten (10) calendar days' prior notice of any intended addition or replacement of a Sub-Processor by updating the Sub-Processor page at https://www.napkin.ai/sub-processors and, where the Customer has subscribed to notifications, by email to the Customer's registered account address. The Customer may subscribe to Sub-Processor change notifications at https://www.napkin.ai/sub-processors.

3.3.2 The Customer may object to a new or replacement Sub-Processor on reasonable data protection grounds within the ten (10) day notice period by providing written notice to Napkin AI at [email protected]. The parties shall cooperate in good faith to resolve the objection. If the parties cannot resolve the objection within a reasonable timeframe, either party may terminate the affected Services upon written notice.

3.3.3 Napkin AI shall impose on all Sub-Processors data protection obligations that are no less protective than those set out in this DPA by way of written contract. Napkin AI remains liable to the Customer for the performance of each Sub-Processor’s obligations to the extent Napkin AI performs such obligations itself.

3.4 Data Subject Rights

3.4.1 Napkin AI shall, taking into account the nature of the Processing, promptly assist the Customer by appropriate technical and organizational measures to fulfil the Customer’s obligations to respond to Data Subject requests under Applicable Data Protection Laws, including requests for access, rectification, erasure, restriction, portability, and objection.

3.4.2 If Napkin AI receives a request from a Data Subject in respect of Customer Personal Data, Napkin AI shall promptly forward that request to the Customer and shall not respond to such requests directly except as directed in writing by the Customer or as required by law.

3.5 Compliance Assistance

3.5.1 Napkin AI shall reasonably assist the Customer in ensuring compliance with the Customer’s security obligations under Article 32, breach notification obligations under Articles 33 and 34, data protection impact assessment obligations under Article 35, and prior consultation obligations under Article 36 of the GDPR, taking into account the nature of the Processing and the information available to Napkin AI. Napkin AI may charge reasonable, documented fees for compliance assistance that exceed Napkin AI’s ordinary course of business.

3.6 Audit Rights

3.6.1 Napkin AI shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Customer or a qualified third-party auditor appointed by the Customer. The Customer shall provide at least thirty (30) days’ prior written notice of any audit request; audits shall be conducted during normal business hours, no more than once per calendar year, absent a confirmed Personal Data Breach, and the Customer shall bear all costs of such audit.

3.6.2 Napkin AI may satisfy the audit obligations under this Section 3.6 by providing the Customer with a current SOC 2 Type II report or equivalent third-party audit report, subject to the Customer’s written agreement to maintain such report as confidential.

SECTION 4 – CONTROLLER OBLIGATIONS

4.1 The Customer represents and warrants that: (a) it has a valid lawful basis under Applicable Data Protection Laws for Processing each category of Customer Personal Data; (b) it has provided all required privacy notices to Data Subjects and obtained all required consents; and (c) it has the authority to provide Customer Personal Data to Napkin AI for Processing under this DPA.

4.2 The Customer shall be solely responsible for the accuracy, quality, and lawfulness of Customer Personal Data provided to Napkin AI. The Customer shall not submit to the Services any special category personal data (as defined in Article 9 GDPR) or criminal conviction data without first notifying Napkin AI and agreeing in writing on the applicable legal basis and any additional safeguards required. Where the Customer submits personal data belonging to individuals under 18 years of age, the Customer represents and warrants that it has obtained all necessary consents, authorizations, and legal bases required under applicable law (including, where applicable, FERPA and COPPA) and shall be solely responsible for ensuring compliance with any additional safeguards required for the processing of minors’ data.

4.3 The Customer shall implement appropriate technical and organizational measures to secure Customer’s own systems, credentials, and any software integrations used to access the Services.

4.4 The Customer shall promptly notify Napkin AI of any changes to its instructions that may affect the lawfulness of Processing and shall cooperate with Napkin AI in implementing any required changes.

SECTION 5 – INTERNATIONAL DATA TRANSFERS

5.1 EU Standard Contractual Clauses. To the extent that Napkin AI Processes Customer Personal Data originating from the European Economic Area (“EEA”) and transfers such data to the United States or any other country that has not been the subject of an adequacy decision by the European Commission, the parties agree that such transfers are made pursuant to the EU SCCs, which are incorporated into this DPA by reference, and completed as follows:

(a) Module Two (Controller to Processor) of the EU SCCs applies where the Customer is a Controller and Napkin AI is a Processor;

(b) Option 2 of Clause 9 (general written authorization) is selected, with a ten (10) calendar day notice period;

(c) Clause 17 (governing law) – the laws of France shall govern the EU SCCs; and

(d) Clause 18 (choice of forum) – the courts of France shall have jurisdiction.

The information required by Annex I, II, and III of the EU SCCs is set out in Annexes 1, 2, and 3 of this DPA, respectively.

5.2 UK Transfers. To the extent that Napkin AI Processes UK Personal Data and transfers such data outside the United Kingdom, the parties agree that such transfers are governed by the UK IDTA. The UK IDTA is hereby incorporated into this DPA by reference, with: (a) Table 1 completed by reference to the party and transfer details set out in Annex 1; (b) Table 2 selecting the EU SCCs (Module Two, Controller to Processor) as completed in Section 5.1 of this DPA as the Linked Agreement; (c) Table 3 completed by reference to Annexes 1, 2, and 3 of this DPA; and (d) Table 4 selecting that either party may end the UK Addendum in accordance with Section 19 of the UK IDTA. By accepting this DPA, the Customer is deemed to have executed the UK Addendum. The EU SCCs form the Linked Agreement for the purposes of the UK Addendum.

5.3 Transfer Impact Assessment. The Customer acknowledges that Napkin AI, as the data importer, has implemented the technical and organizational measures described in Annex 3 as supplementary measures to address any residual risks identified in connection with the transfer of Customer Personal Data to the United States.

5.4 Mechanism Invalidity. If any transfer mechanism relied upon under this Section 5 becomes invalid, suspended, or otherwise unavailable, the parties shall cooperate in good faith to implement a lawful alternative transfer mechanism without undue delay. Napkin AI may suspend the relevant transfers until such mechanism is in place, without such suspension constituting a breach of this DPA or the Agreement.

5.5 Government Agency Requests. As of the Effective Date of this DPA, Napkin AI (and Second Layer, Inc.) has not received any formal legal requests from any government intelligence or security agency for access to Customer Personal Data. If Napkin AI receives any such request after the Effective Date, Napkin AI shall: (a) to the extent permitted by applicable law, promptly notify the Customer; (b) use commercially reasonable efforts to redirect the relevant law enforcement or government agency to request that data directly from the Customer; and (c) provide the Customer with reasonable notice of any such demand unless legally prohibited from doing so by a court of competent jurisdiction or applicable law.

SECTION 6 – PERSONAL DATA BREACH NOTIFICATION

6.1 Napkin AI shall notify the Customer without undue delay, and in any event within forty-eight (48) hours of becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

6.2 Such notification shall include, to the extent available at the time of notification: (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records affected; (b) the name and contact details of Napkin AI’s Data Protection Officer ([email protected]); (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach.

6.3 Where all required information is not available at the time of initial notification, Napkin AI shall provide such information in phases as it becomes available, without undue further delay.

6.4 Napkin AI’s notification of, or response to, a Personal Data Breach shall not constitute an acknowledgement of fault or liability by Napkin AI with respect to the incident.

6.5 Napkin AI shall maintain records of all confirmed Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial actions taken, and shall make such records available to the Customer upon written request.

SECTION 7 – AI-SPECIFIC PROVISIONS

7.1 AI Model Training

7.1.1 Napkin AI shall not use Customer Personal Data for the purpose of training, retraining, fine-tuning, or otherwise developing any artificial intelligence or machine learning models.

7.1.2 Napkin AI provides Customers with a mechanism to opt out of all non-essential data use. Where the Customer exercises such opt-out (via Account Settings, Teamspace settings), Napkin AI shall process Customer Personal Data solely to deliver the Services and shall not use any Customer interaction data for any purpose beyond service delivery. Opt-out requests will be honoured within two (2) business days.

7.1.3 Where the Customer has not opted out, Napkin AI may use: (a) anonymized and aggregated interaction data, from which all personal identifiers have been removed; and (b) de-identified content data (visual and diagram content from which all personally identifiable information has been removed), solely for the purpose of improving the Services and Napkin AI’s AI models (“Model Improvement Processing”). Such use shall not re-identify any individual or Customer.

7.1.4 Content submitted by users may be processed through third-party AI inference APIs as necessary to provide the Services, subject to the sub-processor agreements in Annex 2 and the data-use and retention terms in Section 7.2.

7.2 AI Sub-Processors

7.2.1 Napkin AI currently uses Google LLC, OpenAI OpCo, LLC, and Anthropic, PBC as AI inference sub-processors. These providers process the portions of Customer prompts and content needed to deliver AI-powered features.

7.2.2 Provider Data Use: Napkin AI uses paid or commercial AI services and does not permit an AI inference sub-processor to use Customer Personal Data to train or improve its general-purpose models or for another independent purpose.

7.2.3 Provider Retention: Operational, safety, and feature-specific retention may apply under a provider’s commercial terms and approved account configuration. Napkin AI configures provider features to minimize retention where an applicable control is available. This may include disabling optional response storage or caching. It does not eliminate provider safety logging or storage that is inherent to a feature selected by the user, such as temporary file handling or search grounding. The current provider-specific summary is maintained at https://www.napkin.ai/sub-processors/.

7.3 EU AI Act Alignment

7.3.1 Napkin AI’s Services do not, as of the Effective Date, deploy AI systems classified as high-risk under Regulation (EU) 2024/1689 (the “EU AI Act”). Napkin AI shall notify the Customer if this position changes and shall work with the Customer to address any resulting compliance obligations.

SECTION 8 – U.S. PRIVACY LAWS (CCPA/CPRA)

8.1 To the extent that Napkin AI Processes Customer Personal Data that is subject to U.S. Privacy Laws, the following provisions apply.

8.2 Service Provider Designation. For purposes of the CCPA/CPRA, Napkin AI is a “service provider” and “contractor” with respect to Customer Personal Data. Napkin AI shall not: (a) sell or share Customer Personal Data (as those terms are defined under CCPA/CPRA); (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in this DPA and the Agreement; or (c) combine Customer Personal Data received from the Customer with personal information received from other sources except as permitted by U.S. Privacy Laws.

8.3 Consumer Requests. Napkin AI shall, upon the Customer’s written request, assist the Customer in fulfilling its obligations to respond to verifiable consumer requests under U.S. Privacy Laws, including requests for access, deletion, correction, and opt-out of sale or sharing, within the timelines required by applicable law.

8.4 Napkin AI shall promptly notify the Customer if Napkin AI determines that it can no longer meet its obligations under applicable U.S. Privacy Laws. Upon such notification, the Customer may direct Napkin AI to take reasonable steps to remediate the issue or terminate the relevant Services.

8.5 Certification. Napkin AI certifies that it understands and will comply with its obligations as a service provider and contractor under the CCPA/CPRA, including the restrictions on use and disclosure of Customer Personal Data set forth in this Section 8.

SECTION 9 – CUSTOMER INDEMNITY

9.1 The Customer shall defend, indemnify, and hold harmless Napkin AI and its parent company, affiliates, officers, directors, employees, agents, and successors (“Napkin AI Indemnified Parties”) from and against any third-party claims, investigations, regulatory proceedings, fines, losses, damages, liabilities, costs, and reasonable legal fees (“Losses”) arising out of or related to:

(a) the Customer’s failure to establish, maintain, or document a lawful basis for Processing Customer Personal Data under Applicable Data Protection Laws;

(b) the Customer’s instructions to Napkin AI that, if followed, would cause Napkin AI to violate Applicable Data Protection Laws;

(c) any breach by the Customer of its representations, warranties, or obligations under this DPA or Applicable Data Protection Laws; or

(d) any claim by a Data Subject arising from the Customer’s acts or omissions in respect of that Data Subject’s Personal Data, where such claim is not attributable to Napkin AI’s failure to perform its obligations under this DPA.

9.2 Napkin AI shall: (a) promptly notify the Customer in writing upon becoming aware of any claim for which indemnification may be sought; (b) grant the Customer sole control of the defense and settlement of such claim (provided that the Customer may not settle any claim that imposes non-monetary obligations on, or admits fault on behalf of, any Napkin AI Indemnified Party without Napkin AI’s prior written consent); and (c) provide reasonable cooperation and assistance to the Customer in the defense of such claim, at the Customer’s expense.

9.3 The indemnification obligations in this Section 9 are subject to the liability limitations set out in Section 10 and do not apply to the extent that any Losses arise from Napkin AI’s own negligence, willful misconduct, or breach of this DPA.

SECTION 10 – LIABILITY

10.1 Each party’s total aggregate liability to the other party under or in connection with this DPA shall be subject to the liability limitations and caps set out in the Agreement. For the avoidance of doubt, the DPA is part of the Agreement for the purposes of any liability cap.

10.2 Neither party shall be liable to the other for any indirect, incidental, special, exemplary, consequential, or punitive damages, including loss of profits, revenue, goodwill, or data, arising out of or in connection with this DPA, even if the party has been advised of the possibility of such damages, regardless of the theory of liability.

10.3 Nothing in this Section 10 shall limit either party’s liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by applicable law.

10.4 The parties acknowledge that neither party shall be obligated to indemnify the other for any administrative fines, penalties, or sanctions imposed directly by a Supervisory Authority on either party in respect of that party’s own compliance failures.

SECTION 11 – TERM AND TERMINATION

11.1 This DPA shall come into effect on the Effective Date and shall remain in force for the duration of the Agreement. This DPA shall terminate automatically upon the expiry or termination of the Agreement.

11.2 Return and Deletion. Upon expiry or termination of the Agreement, Napkin AI shall, at the Customer’s election: (a) return all Customer Personal Data in a structured, commonly used, machine-readable format; or (b) securely delete or destroy all Customer Personal Data. Such return or deletion shall be completed within seven (7) calendar days for data held in active production systems and within thirty (30) calendar days for data held in backup systems and operational logs, unless applicable law requires Napkin AI to retain such data for a longer period.

11.3 Napkin AI shall, upon the Customer’s written request, provide written certification that all Customer Personal Data has been deleted or returned in accordance with this Section 11.2.

11.4 Where fulfilment of a data return or deletion request under Section 11.2 requires manual work exceeding two (2) person-hours, Napkin AI may charge the Customer its reasonable, documented costs at then-current professional services rates, except where such charges are prohibited by Applicable Data Protection Laws.

11.5 The following provisions shall survive termination of this DPA: Section 1 (Definitions), Section 9 (Customer Indemnity), Section 10 (Liability), Section 11.2 to 11.4 (Return and Deletion), and Section 12 (General Provisions).

SECTION 12 – GENERAL PROVISIONS

12.1 Order of Precedence. In the event of any inconsistency between this DPA and the Agreement with respect to data protection matters, this DPA shall prevail. In the event of any inconsistency between this DPA and the EU SCCs, the EU SCCs shall prevail.

12.2 Entire Agreement. This DPA, together with the Agreement and the Annexes hereto, constitutes the entire agreement between the parties with respect to the processing of Customer Personal Data and supersedes all prior or contemporaneous agreements, representations, and understandings relating to the same subject matter.

12.3 Amendments. Napkin AI may update this DPA from time to time. For changes required by applicable law or that expand privacy protections for Customers, updates take effect immediately upon publication at https://www.napkin.ai/data-processing-agreement/. For material changes; defined as changes that (a) add new categories of personal data processed, (b) add new purposes of processing, or (c) materially reduce Customer rights under this DPA, Napkin AI will provide at least thirty (30) days' notice by updating the DPA page at https://www.napkin.ai/data-processing-agreement/ with a summary of the changes and the date they take effect. Enterprise customers with separately executed DPAs will receive direct email notice of material changes. Continued use of the Services after the effective date of any update constitutes acceptance. Sub-processor changes are governed exclusively by Section 3.3.1 and are not subject to this Section 12.3.

12.4 Severability. If any provision of this DPA is held invalid, unlawful, or unenforceable, the remaining provisions shall continue in full force and effect. The parties shall, in good faith, negotiate a replacement provision that is valid, lawful, and enforceable and that achieves, to the greatest extent possible, the original intention of the replaced provision.

12.5 Governing Law. This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of laws provisions. The EU SCCs shall be governed by the laws of France, as set out in Section 5.1.

12.6 Notices. All notices under this DPA shall be in writing. Notices to Napkin AI shall be sent to: Data Protection Officer, Napkin AI (Second Layer, Inc.), 626 Jay Street, Los Altos, CA 94022, [email protected]. Notices to Customer shall be sent to the email address associated with the Customer’s account.

12.7 Acceptance. By creating a Napkin AI account, accepting the Terms of Service, or using the Services, the Customer acknowledges that it has read, understood, and agrees to be bound by this DPA. For enterprise customers with separately executed agreements, this DPA may also be executed in counterparts, including by electronic signature via DocuSign or equivalent platform.

ANNEX 1 – DETAILS OF PROCESSING ACTIVITIES

The following table sets out the details of Processing activities required by Article 28(3) of the GDPR and Clause 1 of the EU SCCs.

ANNEX 2 – AUTHORIZED SUB-PROCESSORS

The following Sub-Processors are authorized by the Customer pursuant to Section 3.3.1 of this DPA. The most current list and change log are maintained at https://www.napkin.ai/sub-processors/.

AI sub-processor note: The providers listed above may not use Customer Personal Data to train or improve their general-purpose models. Operational, safety, and feature-specific retention may still apply as described in Section 7.2 and on the current public sub-processor page.

ANNEX 3 – TECHNICAL AND ORGANIZATIONAL MEASURES

The following technical and organizational measures are implemented by Napkin AI (Second Layer, Inc.) in accordance with Article 32 of the GDPR and Annex II of the EU SCCs.

VERSION HISTORY