4rth AI Data Processing Addendum
Last updated: October 8, 2026
This Data Processing Addendum ("DPA") forms part of the 4rth Terms of Service between 4rth AI, Inc., a Delaware corporation ("4rth"), and the customer ("Customer"). It applies automatically when Customer accepts the Terms and 4rth processes Customer Personal Data. If this DPA conflicts with the Terms on personal data, this DPA wins.
1. Scope and roles
1.1 Customer Personal Data means personal data that 4rth processes on Customer's behalf through the Service, mainly data about End Users of Customer's Live Apps, stored in Customer's Apps or sent through their AI features.
1.2 Roles. For Customer Personal Data, Customer is the controller (or a processor acting for its own customer) and 4rth is the processor (or subprocessor). For account, billing and usage data about Customer itself, 4rth is an independent controller under its Privacy Policy, and this DPA does not apply.
1.3 Applicable laws include the EU and UK GDPR, the Swiss FADP, the California Consumer Privacy Act and other US state privacy laws, to the extent they apply. Under US state laws, 4rth acts as a "service provider" or "processor" and will not sell or share Customer Personal Data, or use it outside the direct business relationship except as these laws allow.
2. Instructions
2.1 4rth processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. 4rth will tell Customer if it believes an instruction breaks applicable law.
2.2 Customer is responsible for the lawfulness of the data and instructions, including having a legal basis and giving End Users the notices and obtaining the consents required, and for not sending data the Terms prohibit.
2.3 No training on End User data. 4rth does not use Customer Personal Data to train or improve AI models.
3. Confidentiality, security and assistance
3.1 Confidentiality. 4rth ensures that personnel who access Customer Personal Data are bound by confidentiality and access it only as needed to provide the Service.
3.2 Security. 4rth maintains reasonable technical and organizational measures, such as those in Annex 2. 4rth may update them as long as overall protection is not materially reduced. Customer is responsible for the security of its Apps' design, configuration and credentials.
3.3 Breach notice. 4rth will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer Personal Data. The notice will include the information then available. Notice is not an admission of fault.
3.4 Assistance. Taking into account the nature of processing, 4rth will provide reasonable help with data subject requests, data protection impact assessments and regulator consultations. Where requests go beyond the Service's self-service features, 4rth may charge reasonable fees. 4rth will pass on any request it receives directly from an End User to Customer and will not respond itself, unless required by law.
4. Subprocessors
4.1 Authorization. Customer authorizes 4rth to use the subprocessors below. 4rth binds each one to data protection terms at least as protective as this DPA and remains responsible for their performance.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud (Google LLC) | Hosting, databases, file storage, compute | All Customer Personal Data | United States |
| OpenAI, L.L.C. | AI processing for building Apps and AI features in Live Apps | Prompts, inputs and content sent to AI features | United States |
| Anthropic, PBC (Claude) | AI processing for building Apps and AI features in Live Apps | Prompts, inputs and content sent to AI features | United States |
| Groq, Inc. and other inference providers for open-source models | Running open-source AI models for building Apps and AI features in Live Apps | Prompts, inputs and content sent to AI features | United States |
4rth may also run open-source AI models on its own Google Cloud infrastructure; that processing is covered by the Google Cloud entry. Each AI provider processes Customer Personal Data only to return a response to 4rth, under terms that prohibit using it to train their models.
4.2 Changes. 4rth will update the list in this Section 4 when a subprocessor changes. A new subprocessor that is offered as an option does not process Customer Personal Data unless Customer turns it on. Any other change is made by updating this DPA under the notice process in Section 14 of the Terms.
5. International transfers
Customer Personal Data is processed in the United States and may be accessed by our personnel and providers in other countries, including India. For transfers from the EEA, the parties incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with Clause 7 not used, option 2 of Clause 9 (general authorization, notice as in Section 4.2), the optional language in Clause 11 not used, and Irish law and courts in Clauses 17 and 18. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the SCCs apply with references read as the Swiss FADP. Annex 1 and Annex 2 complete the SCC annexes.
6. Deletion and return
While the account is open, Customer can delete data in its Apps through the Service. When the account ends, 4rth will delete Customer Personal Data within 90 days, except copies the law requires 4rth to keep, which remain protected by this DPA. Self-service export is limited to App blueprints. Before the account ends, Customer may ask legal@4rth.ai for a copy of data stored in its Apps, which 4rth will provide in a reasonable format, and may charge reasonable fees for.
7. Audits
4rth will make available information reasonably needed to show compliance with this DPA, including answers to a security questionnaire once a year and any third-party audit reports it holds. If that is not enough, or a regulator requires it, Customer may audit at its own cost, with 30 days' notice, during business hours, no more than once a year, under confidentiality, and in a way that does not compromise other customers' data.
8. Liability and term
Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. This DPA lasts as long as 4rth processes Customer Personal Data.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Data exporter | Customer, as identified in its 4rth account |
| Data importer | 4rth AI, Inc., 4 Palo Alto Square, 3000 El Camino Real, Suite 200, Palo Alto, CA 94306, USA · privacy@4rth.ai |
| Data subjects | End Users of Customer's Apps, and any people whose data Customer puts in its Apps |
| Categories of data | Whatever Customer's Apps collect, typically names, emails, login credentials (hashed), content End Users submit, usage and device data |
| Sensitive data | None permitted unless agreed in writing |
| Frequency | Continuous, for as long as the account is open |
| Nature and purpose | Hosting, storing and serving Customer's Apps, running their actions, and processing AI features, as instructed by Customer |
| Retention | Until Customer deletes it or the account ends, then up to 90 days |
Annex 2: Security measures
- Encryption in transit (TLS) and at rest for databases and file storage.
- Each App's data kept in its own database schema, separated from other customers' Apps.
- Role-based access for staff and multi-factor authentication on cloud accounts where available.
- Passwords for End User accounts stored only as salted hashes.
- Logging and monitoring of production systems.
- Regular backups for disaster recovery.
- Vulnerability management and patching of production systems.
- Vendor review of subprocessors before use.
- An incident response process, including breach notification under Section 3.3.