Version 1.0 · Effective February 1, 2026 · All legal documents

Mylo Prime — Data Processing Addendum

Version: 1.0 Effective Date: February 1, 2026 Last Updated: August 2, 2026 — removed a drafting note from the on-site audit threshold in Section 11.2. The threshold itself (US$50,000) is unchanged.

This Data Processing Addendum (the “DPA”) is entered into by and between Mylo Prime LLC, a Utah limited liability company (“Mylo Prime,” “Processor,” or “we”), and the customer identified in the applicable Underlying Agreement (defined below) (“Customer,” “Controller,” or “you”), and forms part of the Terms of Service, any Master Subscription Agreement, and any Order Form between the parties (collectively, the “Underlying Agreement”).

This DPA reflects the parties’ agreement on the processing of Personal Data when Mylo Prime processes Personal Data on Customer’s behalf in connection with the Mylo Prime services (the “Service”). To the extent of any conflict between this DPA and the Underlying Agreement, this DPA controls with respect to the processing of Personal Data.

This DPA is automatically applicable to any Customer that processes Personal Data subject to GDPR, the UK GDPR, the Swiss FADP, the CCPA/CPRA, the UCPA, the VCDPA, the CPA, the CTDPA, the TDPSA, or any other Applicable Privacy Law (defined below). Customers under a clickwrap-only Underlying Agreement accept this DPA by accepting the Underlying Agreement; Customers under an MSA accept this DPA by signing the MSA, which incorporates this DPA by reference.

1. Definitions

Capitalized terms not defined here have the meanings given in the Underlying Agreement.

• “Applicable Privacy Law” means any law, statute, regulation, or binding governmental order regarding the privacy, protection, or processing of Personal Data that applies to a party’s processing of Customer Personal Data, including, as applicable, GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, UCPA, VCDPA, CPA, CTDPA, TDPSA, OCPA, MTCDPA, ICDPA, TICDPA, INCDPA, NHCDPA, DEPDPA, NJDPA, FDBR, MDPA, and other comparable U.S. state and non-U.S. laws.
• “CCPA/CPRA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
• “Controller,” “Processor,” “Sub-processor,” “Data Subject,” “Personal Data,” “Processing” (and “Process”), and “Special Categories of Personal Data” have the meanings given in GDPR. “Service Provider,” “Business,” “Sale,” “Share,” and “Personal Information” have the meanings given in the CCPA/CPRA.
• “Customer Personal Data” means Personal Data within Customer Data that Mylo Prime Processes on Customer’s behalf in providing the Service.
• “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into the law of the United Kingdom by the Data Protection Act 2018 and applicable amendments. “Swiss FADP” means the Swiss Federal Act on Data Protection.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission in Decision 2021/914/EU of 4 June 2021, in their applicable Module form, as amended or replaced from time to time.
• “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office under section 119A of the Data Protection Act 2018.

2. Subject Matter and Roles

2.1 Roles

With respect to Customer Personal Data: (a) Customer is the Controller (or Business or comparable role under the applicable law), or a Processor acting on behalf of a third-party Controller; (b) Mylo Prime is a Processor (or Service Provider, Contractor, or comparable role); and (c) any Mylo Prime Sub-processor is a Sub-processor.

2.2 Subject matter, duration, nature, and purpose

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Annex 1 (Description of Processing).

2.3 Customer responsibilities

Customer represents and warrants that: (a) it has provided all notices and obtained all consents, authorizations, and rights required under Applicable Privacy Law to enable Mylo Prime’s lawful Processing of Customer Personal Data; (b) Customer’s instructions to Mylo Prime are lawful; (c) Customer has the right to transfer or grant access to Customer Personal Data to Mylo Prime and its Sub-processors; (d) Customer is responsible for the accuracy, quality, and legality of Customer Personal Data; and (e) Customer will not require Mylo Prime to Process any Personal Data in violation of Applicable Privacy Law.

3. Customer Instructions

3.1 Instructions

Mylo Prime will Process Customer Personal Data only in accordance with Customer’s documented instructions. The Underlying Agreement, this DPA (including Annex 1), Customer’s lawful and reasonable use of the Service, and any documented written direction Customer provides through Mylo Prime’s standard interfaces, support channels, or written communications, together constitute Customer’s complete and final instructions.

3.2 Permitted purposes

Without limiting Section 3.1, Customer instructs Mylo Prime to Process Customer Personal Data to: (a) provide, maintain, secure, and support the Service; (b) prevent, detect, and address fraud, security incidents, and abuse; (c) comply with legal obligations; (d) generate Service Data, telemetry, and aggregated and de-identified statistics that do not reasonably identify any individual; and (e) take any other action requested by Customer through the Service.

3.3 Unlawful instructions

Mylo Prime will inform Customer if, in Mylo Prime’s reasonable opinion, an instruction violates Applicable Privacy Law, in which case Mylo Prime may decline to follow the instruction until it is corrected.

3.4 No sale or sharing; no targeted advertising

Mylo Prime will not (a) Sell or Share Customer Personal Data within the meaning of the CCPA/CPRA or any other Applicable Privacy Law; (b) retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than performing the Service or the limited additional purposes permitted by Applicable Privacy Law; (c) combine Customer Personal Data with Personal Data Mylo Prime receives from or on behalf of any other person, or that Mylo Prime collects from its own interactions with Data Subjects, except to perform a business purpose permitted under the CCPA/CPRA; or (d) use Customer Personal Data to engage in cross-context behavioral advertising or targeted advertising. Mylo Prime certifies that it understands and will comply with the restrictions in this Section 3.4.

3.5 No training on Customer Personal Data

Mylo Prime will not use Customer Personal Data to train, fine-tune, or improve its or any third party’s foundation artificial-intelligence models, except with Customer’s separate, express, written consent. Service Data, anonymized telemetry, and aggregated and de-identified statistics generated by Mylo Prime are not Customer Personal Data and may be used by Mylo Prime for any lawful purpose.

4. Confidentiality of Personnel

Mylo Prime will ensure that personnel authorized to Process Customer Personal Data: (a) are subject to written confidentiality obligations or statutory duties of confidentiality at least as protective as this DPA; (b) are trained on the protection of Personal Data; and (c) access Customer Personal Data only on a need-to-know basis.

5. Security

5.1 Security measures

Mylo Prime will implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk of the Processing, including the measures described in Annex 2 (Technical and Organizational Measures).

5.2 Updates

Mylo Prime may update its security measures from time to time, provided the updates do not materially diminish the protection of Customer Personal Data.

5.3 Customer responsibilities

Customer is responsible for: (a) maintaining the security of its credentials, devices, and integrations; (b) configuring its account security settings (including SSO, MFA, role-based access, audit logging, retention) consistent with its risk profile; and (c) deciding whether the Service is appropriate for the categories of Personal Data Customer chooses to submit.

6. Sub-processors

6.1 General authorization

Customer grants Mylo Prime a general written authorization to engage Sub-processors to Process Customer Personal Data, subject to the conditions in this Section 6.

6.2 Current Sub-processor list

The current list of Mylo Prime’s Sub-processors is published at /legal/subprocessors (the “Sub-processor List”).

6.3 New Sub-processor notice

Mylo Prime will provide at least fifteen (15) days’ advance notice of new Sub-processors via the Sub-processor List or by email to Customer’s designated contact.

6.4 Objection right

Customer may object in writing to a new Sub-processor on reasonable Personal Data protection grounds within fifteen (15) days of notice. The parties will negotiate in good faith for a reasonable solution. If no resolution is reached within thirty (30) days, Customer may, as its sole and exclusive remedy, terminate the affected portion of the Service for convenience and receive a pro-rata refund of prepaid, unused fees.

6.5 Sub-processor obligations

Mylo Prime will impose on each Sub-processor data-protection obligations no less protective than those in this DPA. Mylo Prime remains liable to Customer for the acts and omissions of its Sub-processors with respect to Customer Personal Data to the same extent Mylo Prime would be liable if performing the Sub-processor’s services directly under this DPA.

7. Data Subject Rights

7.1 Assistance

Mylo Prime will, taking into account the nature of the Processing, provide reasonable assistance through appropriate technical and organizational measures, insofar as possible, to enable Customer to fulfill its obligations to respond to Data Subject requests under Applicable Privacy Law (including rights of access, rectification, deletion, restriction, portability, opt-out of sale or sharing, opt-out of targeted advertising, opt-out of profiling, and limitation of use of sensitive Personal Data).

7.2 Data Subject requests received by Mylo Prime

If Mylo Prime receives a request directly from a Data Subject regarding Customer Personal Data, Mylo Prime will, where legally permitted, promptly forward the request to Customer and not respond except to acknowledge receipt and direct the Data Subject to Customer.

7.3 Costs

Customer is responsible for any third-party costs Mylo Prime incurs in providing assistance under this Section 7 to the extent the assistance exceeds the standard functionality of the Service.

8. Personal Data Breach

8.1 Notification

Mylo Prime will notify Customer of a confirmed Personal Data Breach affecting Customer Personal Data without undue delay and in any event within seventy-two (72) hours of confirmation. Notice will be sent to the Customer contact identified for security notices, or, if none, to the primary administrator of Customer’s account.

8.2 Information provided

The notice will include, to the extent then known: (a) the nature of the Personal Data Breach, including the categories and approximate number of affected Data Subjects and Customer Personal Data records; (b) the likely consequences; (c) the measures taken or proposed to address the breach and mitigate adverse effects; and (d) a contact for further information.

8.3 Cooperation

Mylo Prime will cooperate reasonably with Customer in investigating and remediating the Personal Data Breach and assisting Customer with any required notifications under Applicable Privacy Law.

8.4 No admission

Mylo Prime’s notice or cooperation under this Section 8 is not an acknowledgment of fault or liability.

9. Data Protection Impact Assessments and Prior Consultation

Mylo Prime will provide reasonable assistance to Customer with any data-protection impact assessment, consultation with a supervisory authority, or transfer-impact assessment that Customer is required to perform under Applicable Privacy Law and that relates to the Service. The assistance is limited to information reasonably available to Mylo Prime.

10. International Data Transfers

10.1 Transfer mechanisms

To the extent Mylo Prime Processes Customer Personal Data subject to GDPR, UK GDPR, or Swiss FADP and the Processing involves a transfer of such Personal Data to a country that is not the subject of an adequacy decision, the parties agree that the SCCs (with the UK Addendum and Swiss amendments where applicable) are incorporated into this DPA by reference and apply, with the following selections:

• Module 2 (Controller-to-Processor) where Customer is the Controller and Mylo Prime is the Processor.
• Module 3 (Processor-to-Processor) where Customer is itself a Processor and Mylo Prime is a Sub-processor.
• Optional Clause 7 (Docking) does not apply.
• Clause 9 (Sub-processors): Option 2 (general written authorization) applies, with the notice period in Section 6.3 of this DPA.
• Clause 11 (Redress): the optional language is not selected.
• Clause 17 (Governing law): the law of Ireland applies.
• Clause 18 (Choice of forum and jurisdiction): the courts of Ireland apply.
• Annex I to the SCCs is populated by Annex 1 of this DPA.
• Annex II to the SCCs is populated by Annex 2 of this DPA.
• Annex III to the SCCs is populated by the Sub-processor List (Annex 3).

10.2 UK Addendum

Where the UK GDPR applies, Part 1 of the UK Addendum is populated by Annex 1 of this DPA, the SCCs identified above apply as the Approved EU SCCs, and either party may end the UK Addendum as set out in Section 19.

10.3 Swiss FADP

Where the Swiss FADP applies, the SCCs apply with the modifications described in the Swiss Federal Data Protection and Information Commissioner’s guidance, including (a) “supervisory authority” includes the FDPIC, (b) references to “Member State” do not preclude Data Subjects in Switzerland from exercising their rights, and (c) references to “GDPR” include the FADP.

10.4 Additional safeguards

Mylo Prime will implement supplementary measures (including encryption in transit and at rest, access controls, and challenge of overbroad government requests) to support the integrity of cross-border transfers under applicable European supervisory-authority guidance.

11. Audits

11.1 Information rights

Mylo Prime will make available to Customer information necessary to demonstrate compliance with this DPA, including: (a) Mylo Prime’s most recent third-party audit reports (e.g., SOC 2 Type II, ISO 27001 if and when obtained), under NDA; (b) responses to a reasonable security questionnaire, no more than once per year unless required by Applicable Privacy Law or following a Personal Data Breach; and (c) a description of Mylo Prime’s security program (Annex 2).

11.2 On-site audits

On-site audits are limited to Customers under an executed Master Subscription Agreement with annual fees exceeding US$50,000 and may be conducted no more than once per twelve (12) months, on at least sixty (60) days’ written notice, during normal business hours, by a mutually-agreed independent third-party auditor (excluding Mylo Prime competitors), at Customer’s sole expense, subject to confidentiality obligations no less protective than this DPA, and provided the audit does not disrupt Mylo Prime’s operations or compromise the confidentiality of other customers. Customer will provide Mylo Prime a copy of any audit report and treat it as Mylo Prime’s Confidential Information.

11.3 Regulator audits

Sections 11.1 and 11.2 are without prejudice to the rights of supervisory authorities under Applicable Privacy Law.

12. Deletion or Return

On termination or expiration of the Underlying Agreement, Mylo Prime will, in accordance with Section 13.6 of the Terms of Service, make Customer Data available to Customer for export for thirty (30) days, after which Mylo Prime will delete or return Customer Personal Data, except as Mylo Prime is required to retain it by law or for legitimate backup, audit, or dispute-defense purposes. Backup copies will be deleted in the ordinary course of backup rotation. Mylo Prime will, on written request, provide a written confirmation of deletion.

13. CCPA/CPRA-Specific Terms

13.1 Service-Provider status

The parties acknowledge that Mylo Prime is a “Service Provider” or “Contractor” under the CCPA/CPRA with respect to Personal Information within Customer Personal Data, and that Mylo Prime is receiving such Personal Information solely to perform a Business purpose for Customer.

13.2 Service-Provider obligations

Mylo Prime certifies that it understands and will comply with the restrictions in Section 3.4. Mylo Prime: (a) will not Sell or Share Personal Information; (b) will not retain, use, or disclose Personal Information for any purpose other than the specific purpose of performing the Service for Customer (including the limited business purposes permitted under Cal. Civ. Code §1798.140(e) and §1798.145), or as otherwise permitted by the CCPA/CPRA; (c) will not retain, use, or disclose Personal Information outside of the direct business relationship between Customer and Mylo Prime; (d) will not combine Personal Information with Personal Information that Mylo Prime receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA/CPRA; (e) will, on Customer’s reasonable and written notice of unauthorized use of Personal Information, take reasonable and appropriate steps to stop and remediate the unauthorized use; and (f) will provide Customer the same level of privacy protection as required by the CCPA/CPRA.

13.3 Auditing rights under CCPA

Customer has the right, on reasonable written notice, to take reasonable and appropriate steps consistent with Section 11 to ensure that Mylo Prime uses Personal Information in a manner consistent with Customer’s obligations under the CCPA/CPRA.

13.4 De-identified data

If Mylo Prime receives or generates de-identified data, Mylo Prime: (a) will take reasonable measures to ensure the data cannot be associated with a consumer or household; (b) publicly commits to maintain and use the data in de-identified form and not to attempt to re-identify the data, except as permitted by Cal. Civ. Code §1798.140(h)(3) for testing the effectiveness of de-identification; and (c) will contractually obligate any recipients to comply with Cal. Civ. Code §1798.140(h).

14. Other US State Laws

Mylo Prime acts as a “Processor” or comparable role under the UCPA, VCDPA, CPA, CTDPA, TDPSA, OCPA, MTCDPA, ICDPA, TICDPA, INCDPA, NHCDPA, DEPDPA, NJDPA, FDBR, MDPA, and other comparable U.S. state laws. With respect to any such law, Mylo Prime: (a) will adhere to Customer’s instructions; (b) will assist Customer in meeting its obligations under the applicable law, including responding to Data Subject rights requests, providing information necessary to conduct and document data-protection assessments, and providing notice of and assistance with Personal Data Breaches; (c) will impose flow-down obligations on Sub-processors; (d) will, on Customer’s request, make available information reasonably necessary to demonstrate Mylo Prime’s compliance with the applicable law; and (e) will engage a qualified and independent assessor to conduct an annual assessment of Mylo Prime’s policies and practices when required by Applicable Privacy Law.

15. Liability and Order of Precedence

The parties’ liability under this DPA is governed by the limitations in the Underlying Agreement (including Section 15 of the Terms of Service and Section 11 of the Beta Addendum, as applicable). To the extent of any conflict, this DPA controls with respect to Personal Data; the Underlying Agreement controls otherwise. To the extent of any conflict between this DPA and the SCCs as to a transfer governed by the SCCs, the SCCs control.

16. Term, Amendment, and Termination

16.1 Term

This DPA enters into effect on the effective date of the Underlying Agreement and continues until the earlier of (a) termination of the Underlying Agreement, (b) deletion or return of all Customer Personal Data per Section 12, and (c) compliance with all surviving obligations.

16.2 Amendment

Mylo Prime may amend this DPA from time to time as required by Applicable Privacy Law or to reflect new transfer mechanisms, on notice to Customer. Customer’s continued use of the Service after the effective date constitutes acceptance.

16.3 Survival

Sections 4, 5, 7-9, 11, 12, 13, 14, 15, and 16.3 of this DPA survive termination.

17. Governing Law and Dispute Resolution

This DPA is governed by, and disputes are resolved under, the governing-law and dispute-resolution provisions of the Terms of Service, except that, with respect to the SCCs, the governing law and forum identified in Section 10.1 control.

Annex 1 — Description of Processing

A. List of Parties

Data Exporter (Controller): the Customer identified in the Underlying Agreement.

• Contact: as provided in Customer’s account.
• Activities relevant to the data transferred: receipt of services from Mylo Prime, including AI-assisted document processing, communications, calendaring, transcription, billing, and matter management.
• Role: Controller (or, if applicable, Processor on behalf of a third-party Controller).

Data Importer (Processor): Mylo Prime LLC.

• Address: 320 W 500 S, Suite 200, Bountiful, UT 84010, USA.
• Contact: [email protected]; 801-693-9999.
• Activities: provision of the Service.
• Role: Processor.

Competent Supervisory Authority: the Irish Data Protection Commission (in respect of EU-origin data); the UK Information Commissioner’s Office (in respect of UK-origin data); the Swiss Federal Data Protection and Information Commissioner (in respect of Swiss-origin data).

B. Description of Transfer

Categories of Data Subjects:

• Customer’s Authorized Users (employees, contractors, or partners).
• Customer’s clients, prospects, and contacts whose Personal Data Customer submits to the Service.
• Other individuals whose Personal Data appears in Customer Data (e.g., parties to a matter, witnesses, opposing counsel, court personnel, vendors).

Categories of Personal Data:

• Identifiers and contact data (name, email, phone, address, organization, role).
• Account credentials.
• Communications content (emails, messages, chat, call recordings, transcripts).
• Document content (pleadings, contracts, billing, correspondence, exhibits, notes).
• Calendar and matter data (events, deadlines, parties, status).
• Financial-account information limited to that necessary for billing or trust transactions.
• Audit and usage logs.
• Other Personal Data within Customer Data submitted by Customer.

Special Categories of Personal Data: Customer determines, in its sole discretion, whether to submit Special Categories of Personal Data (such as health, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, genetic or biometric data, sexual orientation, criminal-history data, or children’s data). The Service is not designed as a primary repository for Special Categories, and submission of such data is at Customer’s risk and subject to additional protections Customer may negotiate. Voice recordings and voiceprints generated by the deposition / transcription features may be Special Categories under Illinois BIPA, Texas CUBI, the Washington Biometric Privacy Act, and similar laws.

Frequency of Transfer: continuous.

Nature of Processing: receipt, hosting, storage, retrieval, organization, structuring, retrieval, transmission, transcription, summarization, classification, analysis, generation of derivative content (Outputs), display, deletion, and similar operations.

Purpose of Processing: to provide, maintain, secure, support, and improve the Service for Customer; to comply with Customer’s instructions; to comply with law; to detect and prevent fraud, abuse, and security incidents; to generate Service Data and aggregated/de-identified statistics.

Retention: as set forth in the Underlying Agreement, the Privacy Policy, and Customer’s account configuration. After termination, Customer Personal Data is retained for the export window described in Section 12 and then deleted, subject to legally required retention or backup rotation.

Onward Transfers / Sub-processors: see Annex 3.

Annex 2 — Technical and Organizational Measures

Mylo Prime maintains the following technical and organizational measures (the “TOMs”), updated from time to time without material diminution.

Governance and policy

• Written information-security policy reviewed at least annually.
• Designated security lead responsible for the program.
• Personnel onboarding includes security and privacy training; refreshers at least annually.
• Background checks on personnel with access to Customer Personal Data, where permitted by law.
• Acceptable-use, password, mobile-device, and incident-response policies.

Access control

• Identity-and-access management with role-based access control (RBAC) and least-privilege principles.
• Multi-factor authentication required for administrative access.
• Single sign-on supported for Authorized Users.
• Session timeouts and account-lockout thresholds.
• Periodic access reviews; prompt revocation on personnel change.

Encryption

• TLS 1.2+ for data in transit.
• AES-256 (or equivalent) for data at rest in primary storage and backups.
• Secrets stored in dedicated secret-management systems (e.g., GCP Secret Manager).

Network and infrastructure security

• Cloud infrastructure (Google Cloud Platform) configured to vendor-recommended baselines.
• Segmented networks; restricted ingress/egress; service accounts with minimum privileges.
• DDoS protection and rate-limiting at the edge.
• Web-application firewall; regular vulnerability scanning.
• Hardened images and reproducible builds.

Application security

• Secure-software-development lifecycle including code review and automated dependency-vulnerability scanning.
• Periodic penetration testing by qualified third parties.
• Coordinated vulnerability-disclosure / bug-bounty program.
• Logging and monitoring with anomaly detection.

Data security

• Logical separation of customer data with row-level security and tenant identifiers enforced at the database layer.
• Audit logging of access to Customer Personal Data with retention sufficient for forensic review.
• No-training routing for AI sub-processors, where supported.
• Data minimization in prompts; redaction of obvious PII patterns where practicable; contractual no-training and limited-retention terms with AI sub-processors.

Backup, disaster recovery, business continuity

• Automated, encrypted backups with offline copies.
• Documented disaster-recovery plan with annual tabletop exercises.
• Recovery objectives: RTO 24 hours / RPO 24 hours for production data, subject to refinement by service tier.

Sub-processor management

• Documented vendor-risk-management process including due diligence, contractual data-protection obligations, and periodic review.
• Sub-processor list maintained at /legal/subprocessors with change notifications.

Incident response

• Documented incident-response plan with defined roles and escalation paths.
• 24/7 on-call rotation for security incidents.
• Post-incident reviews with corrective actions tracked to closure.

Physical security

• Production processing occurs in physically secure data centers operated by Google Cloud Platform, which maintains industry-standard physical-security controls (24/7 staffing, biometric access, surveillance, environmental controls).
• Mylo Prime does not operate its own data centers.

Personnel

• Personnel are bound by written confidentiality obligations.
• Disciplinary process for security policy violations.

Compliance and assurance

• Mylo Prime is working toward SOC 2 Type II attestation. The current attestation status is published on the Trust page.
• Periodic internal reviews against a documented control framework.

Annex 3 — Sub-processors

Mylo Prime’s current Sub-processors are published at /legal/subprocessors, including: name, function, data categories, location of processing, and notes on transfer mechanisms and AI training/retention posture.

Contact: Mylo Prime LLC, 320 W 500 S, Suite 200, Bountiful, UT 84010, [email protected], 801-693-9999. Registered Agent for Service of Process: Hepworth Legal, 320 W 500 S, Suite 200, Bountiful, UT 84010.