Data Processing Addendum
Last Updated: September 12, 2026 | Effective Date: September 12, 2026
This Data Processing Addendum (the "DPA") is entered into between Animus Technology Corporation ("Animus" or the "Data Processor"), a Delaware corporation located at 278 Cedar Lane SE #4100, Vienna, VA 22180, and the Customer identified on the applicable Design Partner Agreement (the "Customer" or the "Data Controller"). It is automatically incorporated upon the execution of a Design Partner Agreement referencing the DPA, and no separate execution is required. In the event of a conflict with the Design Partner Agreement, this DPA prevails with respect to the Processing of Personal Data. The DPA Effective Date is the date the Design Partner Agreement is executed or the date the Customer first provides Personal Data, whichever is earlier.
1. Definitions
For the purposes of this DPA, the following terms have the meanings set out below.
"Personal Data" means any information relating to an identified or identifiable natural person that is processed by Animus on behalf of the Customer under this DPA.
"Processing" (and "Process") means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
"Data Controller" (or "Controller") means the Customer, being the entity that determines the purposes and means of the Processing of Personal Data.
"Data Processor" (or "Processor") means Animus, being the entity that Processes Personal Data on behalf of the Data Controller.
"Sub-processor" means any third party engaged by Animus to Process Personal Data on the Customer's behalf.
"Data Subject," "Personal Data Breach," "CDPA," and "CCPA" each have the meaning given to them under applicable data-protection law and are used accordingly in this DPA.
"Field Capture" is the Animus feature, available across mobile and smart glasses, that turns real-world moments (called “field events”) into records, such as daily logs and field status reports, at the project level.
"Context" means the structured, de-identified data analytical output generated by Animus from its processing or analysis of a field event, including classifications, labels, extracted or derived attributes, and statistical representations. Context does not include the underlying photographs, video, audio, transcripts, free-text entries, or other source materials from which it is derived, and does not identify, and cannot reasonably be used to identify, any Data Subject. Context is included within “De-Identified Data” as that term is defined in the Design Partner Agreement.
2. Scope and Purpose of Processing
2.1 Data Subjects.
The Data Subjects whose Personal Data is Processed under this DPA are the Authorized Users of the Animus platform (namely the employees, or internal and external contractors of the Customer). Data Subjects include third-party individuals who are incidentally captured, including subcontractor and trade personnel, delivery drivers, inspectors, and visitors present on the jobsite. The Customer and its Authorized Users are responsible for the privacy of those individuals and for obtaining any consent required from them, as set out in Section 4.
2.2 Categories of Personal Data.
The categories of Personal Data Processed under this DPA include jobsite photographs and any video; voice notes and their transcripts; free-text field entries; usage and session data; project, location, and GPS coordinates; timestamps; device and app metadata; names, employers, and headcounts of trade personnel as recorded in logs; and weather safety, delivery, and equipment records. Field Capture is user-initiated only. Animus does not perform eye-tracking and does not collect biometric data. There is no background or ambient listening, and the feature does not record continuously.
2.3 Purposes.
Animus Processes Personal Data for the following purposes: to provide the Services; to generate analytics and reporting for the Customer's administrators; to maintain the security and integrity of the Services; to develop improvements to the Services; and to fulfill legal obligations in its capacity as processor.
2.4 Duration.
Animus Processes Personal Data for the term of the applicable Design Partner Agreement and thereafter only for so long as is necessary to fulfill its obligations under Section 7 (Retention, Return and Deletion).
2.5 Derived Context.
In providing the Services, Animus analyzes field events to generate Context. Animus does not use Personal Data, including jobsite photographs, video, voice notes, transcripts, or free-text field entries, to train or fine-tune its models. Animus uses Context, and only Context, for that purpose. Animus takes reasonable technical and organizational measures to ensure that Context cannot be associated with any Data Subject, publicly commits to maintain and use Context only in de-identified form, does not attempt to re-identify it, and contractually obligates any recipient of Context to the same commitments. Animus does not permit the Sub-processors listed in Section 5 to use Personal Data or Context to train their own models. Models trained on Context are designed so as not to expose the Customer's Personal Data or confidential project information to any other customer. As between the parties, Context and any models trained on it are the property of Animus, and the Customer retains all rights in the underlying field events and Personal Data.
3. Obligations as Data Processor
3.1 Documented Instructions.
Animus Processes Personal Data only on the Customer's documented instructions, including with respect to any transfer of Personal Data, unless Animus is required to Process Personal Data by applicable law to which it is subject. In such a case, Animus will inform the Customer of that requirement before carrying out the Processing, unless the law prohibits it from doing so on important grounds of public interest. The Design Partner Agreement, this DPA, and the Customer's configuration and use of the Services together constitute the Customer's documented instructions as of the DPA Effective Date. Any additional or changed instruction must be agreed by the parties in writing.
3.2 Confidentiality.
Animus ensures that all personnel authorized to Process Personal Data are bound by appropriate obligations of confidentiality, whether by contract or by statutory duty, and are made aware of the confidential nature of the Personal Data.
3.3 Security Measures.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing, Animus implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Such measures include encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256); access controls granted on a need-to-know basis; regular security assessments; and business-continuity and disaster-recovery planning. These measures are reviewed and updated on a regular basis.
3.4 Sub-processor Management.
The Customer provides Animus with a general authorization to engage Sub-processors, subject to this Section. Animus maintains an up-to-date list of its Sub-processors at www.animus.tech/data_processing_addendum/. Animus will engage each Sub-processor under a written contract that imposes data-protection obligations.
3.5 Data Subject Rights.
Taking into account the nature of the Processing, Animus assists the Customer, by appropriate technical and organizational measures and insofar as this is possible, in fulfilling the Customer's obligation to respond to requests by Data Subjects to exercise their rights of access, rectification, erasure, restriction of Processing, data portability, and objection.
3.6 Data Breach Notification.
Animus notifies the Customer without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification includes, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach. Animus cooperates with the Customer and takes reasonable steps to assist the Customer in meeting the Customer's own breach-notification obligations.
3.7 Data Protection Impact Assessments.
Animus provides reasonable assistance to the Customer with any data-protection or privacy impact assessment that the Customer is required to carry out under applicable data-protection law, and with any consultation with a regulator arising from such an assessment, in each case solely in relation to the Processing of Personal Data by Animus and taking into account the information available to Animus.
3.8 Records of Processing.
Animus maintains records of the Processing activities it carries out on behalf of the Customer, and makes those records available to the relevant Supervisory Authority on request.
4. Customer Obligations as Data Controller
The Customer represents and warrants that it has the authority and all necessary rights and consents to provide the Personal Data to Animus for Processing; that its instructions to Animus comply with applicable data-protection law; that it has provided, and will continue to provide, all notices and obtain all consents required to enable the lawful Processing contemplated by this DPA (including appropriate privacy notices to Authorized Users); and that it will promptly notify Animus of any change to its instructions that affects the Processing. The Customer is solely responsible for the accuracy, quality, and legality of the Personal Data and of the means by which it acquired that Personal Data.
5. Sub-Processors
5.1 Current Sub-processors.
As of the DPA Effective Date, Animus engages the Sub-processors listed below to Process Personal Data.
| Processor | What we use it for | Data involved |
|---|---|---|
| OpenAI | Speech-to-text transcription of field audio, and text embeddings used to retrieve relevant reference material. | Audio recorded in the field, extracted and transcoded to WAV before transmission, and short text passages submitted for embedding. No photos, video frames, or documents are sent to OpenAI. |
| Anthropic | AI inference across most of the pipeline: reading photos and extracted video frames, classifying captures, drafting and filling records and forms, comparing captures against project reference documents, summarizing, and reading uploaded PDFs (drawings, specifications, directories, blank forms) into structured data. | Photos and still frames extracted from captured video, transcripts, notes and other free text, form definitions and inputs, customer-provided reference documents, and associated Context. |
| Meta (Wearables) | Provides the Wearables Device Access Toolkit that lets our app use the camera and microphone on Meta AI glasses for capturing field events. | On-device camera/microphone access for glasses |
| Fly.io | Application hosting and the persistent volume backing the storage server and analysis pipeline. | Everything at rest original photos, video, audio, transcripts, drafted records, manifests, project reference documents. |
| Cloudflare | Workers hosting the office and field web bundles, plus DNS and CDN for the product domains. | Request metadata: IP address, user agent, requested paths. Capture payloads go direct to the backend and do not transit Cloudflare. |
The complete and current list of Sub-processors is maintained at www.animus.tech/data_processing_addendum/ and is updated in accordance with Section 3.4.
6. CDPA and CCPA Compliance
6.1 CDPA.
Where the Virginia Consumer Data Protection Act applies, Animus acts as a processor and the Customer as a controller, and Animus will Process Personal Data only on the Customer's documented instructions, will impose a duty of confidentiality on persons Processing the data, will delete or return Personal Data at the Customer's direction, will make available the information reasonably necessary to demonstrate compliance, and will allow and cooperate with reasonable assessments.
6.2 CCPA.
Where the Customer is a “Business” and Animus is a “Service Provider” within the meaning of the CCPA/CPRA, Animus will not sell or share Personal Data; will not retain, use, or disclose Personal Data for any purpose other than performing the Services or as otherwise permitted by the CCPA; will not retain, use, or disclose Personal Data outside the direct business relationship between the parties; will not combine Personal Data received from the Customer with Personal Data received from any other source, except as permitted by the CCPA; and will notify the Customer if it determines that it can no longer meet its obligations under the CCPA.
For the purposes of this Section 6.2, Context that has been deidentified in accordance with Section 2.5 does not constitute Personal Data or "personal information" under the CCPA, and the restrictions in this Section do not apply to it. Nothing in this Section restricts Animus from retaining or using Personal Data for internal use to build or improve the quality of the Services, as permitted by the CCPA and its implementing regulations, provided that Animus does not use Personal Data to build or modify consumer profiles for use in providing services to another business, and does not correct or augment Personal Data with information acquired from another source.
6.3 Regulatory Fines and Enforcement.
As between the parties, any fine, penalty, or sanction imposed on Animus in its capacity as Data Processor, to the extent arising from Animus's own failure to comply with its obligations under this DPA or under applicable data-protection law, including any such fine, penalty, or sanction under Section 1798.155 of the CCPA as amended by the CPRA, is the responsibility of Animus, and the Customer is not required to indemnify Animus for it. Conversely, any fine, penalty, or sanction imposed on either party to the extent arising from the Customer's instructions, from the Customer's failure to provide the notices or obtain the consents and permissions required under Section 4, or from the Customer's other acts or omissions as Data Controller, is the responsibility of the Customer.
Animus's liability under this Section, and under this DPA generally, is subject to and counts toward the disclaimers, exclusions, and aggregate limitation of liability set forth in the Design Partner Agreement, which apply to this DPA as though fully set forth in it. Fines, penalties, and sanctions of the kind described in this Section are treated as direct damages for the purposes of that limitation. Nothing in this DPA expands either party's liability beyond the limits in the Design Partner Agreement.
7. Retention, Return and Deletion
7.1 Post-Termination Retention.
Upon the expiry or termination of the applicable Design Partner Agreement, Animus retains the Customer's Personal Data in a limited, access-restricted state for a period of ninety (90) days (the "Retention Window") to enable renewal, reactivation, or return of the data and to preserve the continuity of the project record. During the Retention Window, Animus does not Process the Personal Data except as necessary to store it securely, to make it available for return, or as instructed by the Customer. Animus is not required to provide notice prior to deletion at the end of the Retention Window. If the Customer renews or reactivates the Services during the Retention Window, the Retention Window restarts.
7.2 Deletion After the Window.
At the end of the Retention Window, Animus securely deletes or de-identifies the Customer's Personal Data subject to Section 7.5, including copies held by Sub-processors, unless the Customer has renewed or reactivated the Services, or has instructed Animus in writing to return the data or to continue retaining it.
7.3 Return or Deletion on Request.
At any time, upon the Customer's written request, Animus will, at the Customer's election and subject to Section 7.5, either return the Personal Data or securely delete and destroy it, including copies held by Sub-processors, and confirm completion in writing within thirty (30) days of the request. Returned data is provided in a machine-readable format. Where the Customer or applicable law requires return or deletion within a shorter period following termination, Animus will honor that requirement.
7.4 Legally Required Retention.
Animus may retain Personal Data only to the extent, and for so long as, required by applicable law, in which case Animus maintains the confidentiality of the Personal Data and Processes it only as required by that law.
7.5 Scope.
This Section 7 applies to Personal Data. It does not apply to Context that has been deidentified in accordance with Section 2.5, or to any model previously trained on such Context. Neither contains Personal Data nor can be attributed to the Customer or to any Data Subject, and Animus's obligations under this Section are satisfied notwithstanding its continued retention of them.
8. Audit Rights
The Customer may audit Animus's compliance with this DPA upon thirty (30) days' prior written notice, no more than once per calendar year (except where a Personal Data Breach or a regulatory investigation reasonably requires more frequent audits), during Animus's normal business hours, and provided that any third-party auditor is bound by obligations of confidentiality. Any audit beyond the rights granted in this Section 8 requires the parties' prior written agreement as to scope, timing, and fees.
9. Term and Termination
This DPA remains in effect for so long as Animus Processes Personal Data on the Customer's behalf, and it terminates automatically on the later of (a) the expiry or termination of all Design Partner Agreements and (b) the completion of Animus's obligations under Section 7 (Retention, Return and Deletion). Sections 1 (Definitions), 2.5 (Derived Context), 3.2 (Confidentiality), 3.6 (Data Breach Notification), 6 (CDPA and CCPA Compliance), 7 (Retention, Return and Deletion), and 8 (Audit Rights) survive the termination of this DPA to the extent required to give effect to their terms.
10. General Provisions
10.1 Governing Law.
This DPA is governed by the laws of the State of Virginia, except where applicable data-protection law requires otherwise.
10.2 Amendments.
Animus may update this DPA to reflect changes in applicable law or in its Processing operations, upon at least thirty (30) days' prior notice to the Customer of any material change. If the Customer objects to a material change on reasonable data-protection grounds, it may terminate the affected Design Partner Agreement without penalty within thirty (30) days of such notice.
10.3 Severability.
If any provision of this DPA is held to be invalid or unenforceable, that provision is severed and the remaining provisions continue in full force and effect.
10.4 Entire Agreement.
This DPA, together with the applicable Design Partner Agreement, constitutes the entire agreement between the parties with respect to the Processing of Personal Data and supersedes all prior agreements and understandings on that subject.
10.5 Contact.
Questions regarding this DPA may be directed to [email protected]. The current version of this DPA is published at www.animus.tech/data_processing_addendum/.