Data Processing Addendum

This Data Processing Addendum ("DPA") applies where RedHold LLC, a Virginia limited liability company operating as Diagrams.so ("we", the "Processor"), processes personal data on behalf of a business customer ("Customer") in the course of providing the Services, typically personal data contained in prompts, diagram content, and files submitted through the web app, the API, the MCP server, or the SDKs. It addresses the GDPR and UK GDPR and includes CCPA service-provider terms (Section 12).

Processor contact: RedHold LLC, 8401 Mayland Dr, STE S, Richmond, VA 23294, USA. Privacy contact: privacy@diagrams.so.

1. Incorporation

1.1 This DPA is automatically incorporated into and forms part of the Terms of Service for every Customer whose use of the Services involves our processing of personal data on the Customer's behalf. No signature is required. It takes effect on the later of the date the Customer first agrees to the Terms and the date the Customer first submits personal data for processing.

1.2 Customers whose procurement or regulators require a signed copy may request one at privacy@diagrams.so. The signed version is this same document and changes neither party's rights.

1.3 "Agreement" means the Terms of Service together with this DPA. On data-protection matters this DPA controls; on everything else the Terms control.

2. Definitions and roles

2.1 "Data Protection Laws" means the laws applicable to the processing of Personal Data under the Agreement, including the GDPR, the UK GDPR, and the CCPA. "Personal Data", "Controller", "Processor", "Sub-processor", "Data Subject", and "process" have the meanings given in those laws. "Customer Content" means prompts, diagram content, files, and other Inputs the Customer submits, and the Outputs generated for the Customer.

2.2 For Personal Data contained in Customer Content, the Customer is the Controller (or a Processor for its own controllers) and we are the Processor (or Sub-processor). For account, billing, website, gallery, and analytics data we process for our own purposes, we are an independent Controller, and the Privacy Policy governs rather than this DPA.

3. Scope and instructions

3.1 We process Customer Personal Data only: (a) to provide, maintain, secure, and support the Services under the Agreement; (b) as documented in Annex I; and (c) on the Customer's documented lawful instructions, which include the Customer's configuration and use of the Services and the API. The Agreement and this DPA are the Customer's complete instructions; anything further requires written agreement.

3.2 We will inform the Customer if, in our opinion, an instruction infringes Data Protection Laws, and we may pause the affected processing.

3.3 Customer responsibilities. The Customer warrants that it has a lawful basis and any required notices or consents for the Customer Content it submits, and that it will not submit special-category data, criminal-offence data, government identification numbers, protected health information, or payment-card data. The Services are not designed for such data, and it is out of scope absent our prior written agreement.

3.4 Free plan note. Diagrams created on the Free plan are public at creation and cannot be made private. The Free plan is unsuitable for processing personal data on behalf of others; Customers relying on this DPA should use a paid plan and keep relevant diagrams private.

4. Confidentiality and security

4.1 Personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide the Services.

4.2 We implement and maintain the technical and organizational measures described in Annex II, appropriate to the risk. Measures may evolve, and we will not materially reduce the overall level of protection during the term.

5. Sub-processors

5.1 The Customer gives general authorization for us to engage the Sub-processors listed in Annex III, which is maintained at diagrams.so/policy/subprocessors, under written terms no less protective than this DPA.

5.2 We remain responsible for our Sub-processors' performance. We give at least 30 days' advance notice of new or replacement Sub-processors, by a dated update to the subprocessor page and by email to the Customer's account address. The Customer may object on reasonable data-protection grounds within the notice period; if we cannot resolve the objection in good faith, the Customer's remedy is to terminate the affected Services.

6. Data subject requests

Taking into account the nature of the processing, we will assist the Customer, insofar as reasonably possible, in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection). The self-service tools in the product and API (editing, deletion, and export of diagram content) satisfy this where available; anything beyond them is handled via privacy@diagrams.so. If a Data Subject contacts us directly, we will direct them to the Customer unless the law prevents it.

7. Personal data breach

We will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data breach affecting Customer Personal Data, with the information reasonably available to us so the Customer can meet its own notification obligations, and we will take reasonable steps to mitigate and remediate. Notice goes to the Customer's account email and is not an admission of fault.

8. Impact assessments

We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required and relevant to the processing under this DPA, using the information available to us.

9. International transfers

9.1 We are a US company and processing occurs in the United States.

9.2 Several of our Sub-processors hold active EU-US Data Privacy Framework certifications (with the UK extension and Swiss adaptation), which provide a lawful transfer basis where held.

9.3 To the extent a transfer of EU Personal Data to us or our Sub-processors is not covered by an adequacy decision, the parties incorporate by reference the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914: Module Two where the Customer is a Controller, Module Three where the Customer acts as a Processor for its own controllers. The SCC annexes are completed by Annexes I, II, and III of this DPA; the docking clause is included; general authorization for sub-processing applies with the Section 5.2 notice period; and the governing law and forum for the SCCs are Ireland.

9.4 For UK Personal Data, the SCCs apply as amended by the UK International Data Transfer Addendum; for Swiss data, with the standard Swiss adaptations.

10. Deletion and return

10.1 During the term, the Customer can delete individual diagrams (including their version history) through the product and API. Deletion in the Services removes content from availability, including public copies, and residual copies may persist in the database and encrypted backups until purged on their ordinary cycle.

10.2 On termination or expiry, we will, at the Customer's written choice, return Customer Content (export via the API and product is available during the term and a reasonable wind-down window) or delete Customer Personal Data, beginning within 30 days of the request and completing within a commercially reasonable period, unless the law requires retention. Backup copies are protected by this DPA until purged.

10.3 We may retain the minimal records we process as an independent Controller (billing and ledger records, security and abuse logs, and a one-way hash of the account email used for abuse prevention), as described in the Privacy Policy and permitted by law.

11. Audit

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, normally satisfied by providing our then-current security documentation and completing a reasonable security questionnaire. On-site inspection is available only with reasonable notice, at the Customer's expense, at most once per year absent a breach or a regulator's requirement. We do not currently hold third-party certifications such as SOC 2 or ISO 27001.

12. CCPA service-provider terms

For Personal Information subject to the CCPA, we act as a Service Provider. We will not: sell or share the Personal Information; retain, use, or disclose it other than to provide the Services or as the CCPA permits; retain, use, or disclose it outside our direct business relationship with the Customer; or combine it with Personal Information from other sources except as the CCPA permits. We will notify the Customer if we can no longer meet these obligations, and the Customer may take reasonable steps to stop and remediate unauthorized use. We certify that we understand and will comply with these restrictions.

13. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, and this DPA does not create liability beyond what Data Protection Laws permit. This DPA remains in effect for as long as we process Customer Personal Data under the Agreement, and Section 10 survives until deletion or return is complete.

---

Annex I: Details of processing

• Subject matter: provision of the Diagrams.so Services: AI-assisted generation, editing, review, export, and storage of diagrams, via the web app, public API, MCP server, and SDKs.
• Duration: the term of the Agreement plus the deletion and return period in Section 10.
• Nature and purpose: receiving Customer Content; transmitting it to the AI Sub-processors in Annex III to generate Outputs; storing diagrams and version history; usage metering and billing; security, rate limiting, and abuse prevention; support.
• Categories of Personal Data: any Personal Data the Customer chooses to include in Customer Content (for example names, email addresses, job titles, or system identifiers appearing in prompts or diagrams), plus authorized-user account data (name, email), API key metadata, and technical usage data (IP address, client information, request logs) processed to secure and operate the Services. The Services do not require Personal Data in Customer Content.
• Special categories: none; excluded under Section 3.3.
• Data Subjects: the Customer's authorized users, and individuals the Customer references in Customer Content.
• Frequency: continuous, at the Customer's initiative, for the duration of the Agreement.

Annex II: Technical and organizational measures

• Encryption in transit for all product, API, and Sub-processor traffic; HTTPS only.
• Encryption at rest for databases, object storage, and backups; customer-supplied provider keys are additionally encrypted at the application layer.
• Access control and tenant isolation: every object access is scoped to its owner; least-privilege internal access.
• API key security: keys are shown once at creation and stored only as salted, keyed hashes; secrets are held in a managed secrets service; keys carry per-route scopes and a per-account cap; key endpoints disable response caching.
• Key lifecycle and audit: immediate owner-initiated revocation, administrative revocation for abuse response, and an audit trail of key events including actor and IP.
• Abuse and availability controls: per-key and per-IP rate limits, idempotency support with replay protection, billable operations that fail closed if metering is unavailable, spending bounded by the prepaid Credit balance, and anomaly alerting on unusual consumption.
• Resilience: automated encrypted backups with defined recovery objectives.
• Assurance: pre-release security review, periodic testing of the public surface, and a documented incident-response process.

Annex III: Approved Sub-processors

The authoritative, current list, including a dated changelog, is published at diagrams.so/policy/subprocessors. The published page controls.