Data Processing Agreement

1. Parties

This DPA is entered into between:

• Data Controller ("Customer"): the legal entity or individual that has accepted the Siren Terms of Service.
• Data Processor ("Siren" or "we"): Siren Ai, Inc., a Delaware corporation, the operator of the Siren service at mysiren.ai and related subdomains.

Where a Customer is itself a processor acting on behalf of a third-party controller, Customer represents that it has the authority to execute this DPA on behalf of that upstream controller, or will obtain a separate countersigned DPA from us naming that controller directly.

2. Processing scope

Subject matter

Siren processes personal data to deliver its marketing-team service: receiving Customer briefs, generating marketing assets via language models, storing and surfacing approved assets via Brand Memory, and dispatching content to connected social-media accounts at Customer's explicit direction.

Categories of data subjects

• Customer's workspace members (employees, contractors, invited users).
• End-customers or audiences referenced in Customer briefs, where Customer includes personal data (names, demographic attributes, contact details) in a brief or Brand DNA input.

Categories of personal data

• Account identifiers: name, email address, role.
• Usage data: session timestamps, features accessed, asset generations triggered.
• Brief content: free-text descriptions, brand guidelines, uploaded assets — which may contain personal data if Customer includes it.
• Connected-account OAuth tokens: access tokens and refresh tokens for social-media accounts connected by Customer.
• Billing data: passed to Stripe (our payment processor); we retain only the Stripe Customer ID and subscription status.

Nature and purpose

Processing is performed to: (a) authenticate workspace members; (b) generate and store marketing assets per Customer's instructions; (c) run quality scoring; (d) surface Brand Memory embeddings; (e) dispatch assets via connected accounts at Customer's explicit instruction; (f) maintain audit logs and backups required to operate the service.

Duration

Processing continues for the term of Customer's subscription plus any post-termination retention period described in Section 11.

3. Customer obligations

Customer represents and warrants that:

• It has a lawful basis (consent, legitimate interest, contract, or other applicable ground) for the personal data it submits to Siren for processing.
• It has provided appropriate privacy notices to data subjects whose personal data it submits to Siren.
• It will not submit to Siren any special-category personal data (health, racial origin, religious belief, biometric identifiers, etc.) or data relating to children under 13 (or 16 in EEA-member states) unless it has obtained all legally required consents and notified us in writing at [email protected].
• Where Customer's brief references real individuals (names, likenesses, personal details), Customer holds the right to process and publish content referencing those individuals, and has obtained any legally required consent.

4. Siren obligations

Siren, as processor, will:

• Process personal data only on Customer's documented instructions (including those given via the Siren dashboard and API), except where required to do otherwise by applicable law — in which case we will inform Customer unless prohibited.
• Ensure that personnel authorized to process Customer's personal data are subject to confidentiality obligations no less stringent than those in Section 11 of the Terms of Service.
• Implement and maintain the technical and organizational security measures described in Section 6.
• Assist Customer — to the extent technically practicable — in responding to data subject rights requests that Customer is unable to fulfill without our assistance.
• Notify Customer of any personal data breach affecting Customer's data in accordance with Section 8.
• At Customer's election on termination, delete or return Customer's personal data in accordance with Section 11.
• Provide Customer with information reasonably necessary to demonstrate compliance with this DPA, subject to Section 10.

5. Sub-processors

Customer grants a general authorization for Siren to engage sub-processors to fulfill its obligations. The current list of approved sub-processors is maintained at mysiren.ai/subprocessors, including each sub-processor's name, purpose, data category, and location.

We will notify existing customers at least 14 days before adding or replacing a sub-processor by updating the subprocessors page and sending an email to the workspace owner's address on file. If Customer objects to a new sub-processor on reasonable grounds, it may notify us at [email protected] within 14 days of the notice; we will work with Customer in good faith to find a resolution. If no resolution is possible, Customer may terminate its subscription and receive a prorated refund of prepaid, unused fees.

We impose data-protection obligations on each sub-processor that are equivalent to those in this DPA, via written contract.

6. Security measures

We implement and maintain technical and organizational measures appropriate to the risks presented by the processing. Current measures include:

Encryption

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 (or equivalent) at the storage layer (Contabo VPS disk encryption, Cloudflare R2 server-side encryption).
• OAuth tokens (connected-account credentials) are encrypted at rest using application-layer encryption before storage.

Access controls

• Production systems require multi-factor authentication for human operator access.
• Access to production data is restricted to personnel with a documented need; access grants are reviewed when roles change.
• Customer workspace data is logically isolated: database queries and storage paths are scoped to workspace IDs, preventing cross-tenant data leakage.

Infrastructure

• Application and database hosting is on the Sage VPS (Contabo), located in the EU.
• Regular automated backups are taken; backup integrity is tested periodically.
• Network-layer DDoS protection and firewall rules are maintained via Cloudflare in front of all public endpoints.

Incident response

• We maintain an incident-response procedure covering detection, containment, eradication, and recovery. Incidents are documented and reviewed post-resolution.

Vendor security

• Sub-processors are selected based on, among other factors, their security posture and their own data-protection commitments (OpenRouter, Cloudflare, Contabo, Resend, and Stripe all publish security or compliance documentation).

These measures are reviewed and updated at least annually or after any significant change to the service architecture. Customers may request a summary of our current security posture at [email protected].

7. Data subject rights

Where a data subject exercises a right under GDPR (Articles 15–22), the UK GDPR, CCPA, or comparable law — and that right concerns personal data processed by Siren on Customer's behalf — the following applies:

Requests directed to Customer

Data subjects should direct rights requests to Customer (the controller). Customer is responsible for responding within applicable deadlines. Siren will, on Customer's request, provide the technical assistance reasonably necessary for Customer to respond (e.g., exporting a specific user's workspace data, verifying what data fields exist).

Requests directed to Siren

If a data subject contacts Siren directly with a rights request relating to data Siren holds as processor on Customer's behalf, we will promptly forward the request to Customer and await Customer's instructions before taking action (except where applicable law requires us to act without delay).

Deletion

Workspace-level deletion (triggered from workspace settings or via our data-deletion API) will purge Customer's personal data from active systems within 30 days and from backup rotation within 90 days. Individual data-subject records can be deleted by Customer via the workspace settings UI or by request to [email protected].

Portability

Workspace data (briefs, generated assets, Brand DNA config) can be exported via the workspace settings export function in JSON format. Connected-account tokens are not included in exports (Customer's account on the connected platform controls those).

8. Breach notification

In the event of a personal data breach affecting Customer's data, Siren will:

• Notify Customer within 72 hours of becoming aware of the breach (or as soon as practicable where 72 hours is not feasible, with an explanation of the delay).
• Provide, to the extent then known: a description of the nature of the breach (categories and approximate number of data subjects and records affected); the name and contact details of our data protection contact; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects.
• Cooperate with Customer in any notification Customer is obliged to make to supervisory authorities or affected data subjects.

Breach notifications should be sent to Customer's workspace owner email on file. Customer may designate an alternate security contact at [email protected].

Notification of a breach does not constitute an admission of fault or liability.

9. Cross-border transfers

Siren's primary hosting (Contabo Sage VPS) is located in the EU. The following transfers of personal data outside the EEA or UK may occur when Siren routes data to sub-processors:

Links to each sub-processor's DPA and transfer mechanism documentation are available on the Subprocessors page. Where we rely on SCCs as the transfer mechanism, copies are available on request at [email protected].

10. Audit rights

Customer may request an audit of Siren's compliance with this DPA no more than once per 12-month period, provided Customer gives at least 30 days' written notice and the audit is conducted in a manner that does not disrupt Siren's operations or expose third-party confidential data.

Where Customer's regulatory requirements necessitate an audit more frequently or with shorter notice, Customer should notify us at [email protected] to discuss a mutually acceptable arrangement.

As an alternative to an on-site audit, we will provide: (a) a self-assessment questionnaire response; (b) relevant third-party certifications or audit reports held by Siren or our sub-processors (e.g., Cloudflare SOC 2 Type II, Stripe PCI-DSS); (c) a summary of the most recent internal security review.

Customer bears its own costs of any audit. Any audit findings shared with Siren are treated as confidential.

11. Retention and deletion

Active subscription

We retain Customer's personal data for the duration of the subscription, plus a 30-day grace period after cancellation or termination during which Customer may export or request data. After the grace period, personal data in active systems is deleted.

Backup rotation

Encrypted backups are retained for up to 90 days. Personal data in terminated workspaces is scrubbed from backup rotation within that window.

Legal hold

We may retain data beyond these periods if required by applicable law, a regulatory order, or a litigation hold — in which case we will inform Customer unless prohibited.

Return vs. deletion

On request submitted before the 30-day grace period expires, we will provide a machine-readable export (JSON) of workspace data. After confirmation of export receipt, or at the close of the grace period, Customer data is deleted from active systems. We do not offer physical return of storage media.

12. Term and termination

This DPA takes effect when Customer accepts the Siren Terms of Service and remains in force for the duration of Customer's subscription. It terminates automatically on the final deletion of Customer's personal data from Siren's systems (as described in Section 11), unless terminated earlier by mutual written agreement.

Termination of the DPA does not release either party from obligations that arose before termination — including obligations relating to data that was processed before the effective termination date.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Siren Terms of Service (Section 14), unless applicable law — including GDPR Article 82 — imposes non-waivable liability on Siren as processor or Customer as controller.

Where both parties are found liable for a personal data breach, liability is apportioned to reflect each party's respective responsibility for the damage, consistent with GDPR Article 82(5).

14. Governing law

This DPA is governed by the same law as the Siren Terms of Service, as set out in Section 16 of those Terms.

Where Customer is established in the EEA or UK and processes personal data of data subjects in those territories, the parties agree that any supervisory authority investigations or orders by the relevant lead supervisory authority take precedence over conflicting provisions of this DPA to the extent required by law.

15. Contact

Data protection enquiries and DPA requests: [email protected]

Security incidents and breach notifications: [email protected]

Data subject rights requests directed to Siren: [email protected]

To request a countersigned DPA or an audit summary, email [email protected] with the subject line "DPA request — [your company name]". Allow 10 business days for a response.