# Data Processing Agreement Star and Starspace, by Mainstar Inc. Version 1.0, effective 20 October 2026. This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mainstar Inc. ("Mainstar", "we") and the business customer that accepts them ("Customer", "you"). It applies automatically when a business customer accepts the Terms; no separate signature is needed. Words such as controller, processor, personal data, processing, data subject and personal data breach have the meaning given in the GDPR, and the equivalent terms in the UK GDPR, the Swiss Federal Act on Data Protection (FADP) and U.S. state privacy laws ("Data Protection Law"). ## 1. Roles and scope - "Customer Data" means all personal data Mainstar processes on Customer's behalf in providing Star and Starspace (the "Service"), including submitted content and personal data in recordings, transcripts, outputs and service metadata generated through its use. - Customer is the controller (or a processor acting for its own controller) of Customer Data. Mainstar is its processor (or sub-processor). Details are in Annex 1. - **U.S. state laws.** For processing on Customer's behalf, Mainstar is a service provider or processor. For that processing it does not sell or share Customer Data, use or keep it outside the purposes in this DPA or the direct business relationship with Customer, or combine it with other data except as the law permits. Mainstar tells Customer if it can no longer meet these duties and lets Customer take reasonable steps to stop and remedy unauthorised use. - **Mainstar's own uses.** For account administration, billing, security of the Service and its own evaluation, improvement and training, Mainstar acts as an independent controller under the Privacy Policy, section 4, subject to a lawful basis, required notices, retention limits and transfer safeguards. This DPA and its processor clauses do not themselves authorise that use. As of the effective date, no model has been trained on customer content; some test sets contain de-identified lines from customer conversations, which may still be personal data. Anyone may object at legal@mainstar.ai. An Enterprise opt-out in Customer's agreement excludes Customer Data and related usage data, past and future, from all later training and evaluation, including reuse of existing test sets. ## 2. Instructions Mainstar processes Customer Data only on Customer's documented instructions: the Terms, this DPA and Customer's use and configuration of the Service. Mainstar tells Customer if it believes an instruction breaks Data Protection Law. For processing under the GDPR, Mainstar departs from instructions only where Union or Member State law to which it is subject requires it (for UK or Swiss processing, UK or Swiss law), and tells Customer first unless that law forbids it on important grounds of public interest. Requests from other public authorities are handled under Data Protection Law and, where applicable, Clause 15 of the SCCs. ## 3. Customer responsibilities Customer is responsible for the lawfulness of Customer Data and its instructions, for giving notices and getting any consents required, including for recordings, and for what it and its users choose to share or upload and with whom. ## 4. Confidentiality and security - Everyone Mainstar authorises to process Customer Data is bound by confidentiality. - Mainstar implements the technical and organisational measures required by GDPR and UK GDPR Article 32 and FADP Article 8, including those in Annex 2, and regularly tests and evaluates their effectiveness. It may update them, provided the overall level of protection does not decrease. ## 5. Sub-processors - Customer gives general authorisation to the sub-processors listed at [trust.mainstar.ai/subprocessors](https://trust.mainstar.ai/subprocessors/). - Mainstar gives at least 30 days' notice of any addition or replacement, naming the provider, what it does and where, by updating that list and e-mailing Customer's account address. - Customer may object on reasonable data-protection grounds within those 30 days at legal@mainstar.ai. Mainstar then works in good faith to resolve it, and does not let the disputed provider process Customer's data until the objection is resolved or Customer has had a reasonable chance to end the affected Service and get its data returned or deleted. If Customer ends it, Mainstar refunds prepaid fees for the unused period. - Mainstar imposes data-protection terms on each sub-processor that protect Customer Data at least as well as this DPA, and remains responsible for its sub-processors' performance. ## 6. Assistance Taking into account the nature of the processing, Mainstar helps Customer, by appropriate measures, to respond to data subject requests, and with security, breach notification, data protection impact assessments and prior consultations. Customer can export and delete its content in its space, or by e-mailing legal@mainstar.ai. Mainstar promptly tells Customer of any data subject request about processing on Customer's behalf and does not answer it substantively except on Customer's instructions or where the law requires. Mainstar handles requests about its own uses (section 1) itself. ## 7. Personal data breaches Mainstar notifies Customer of a personal data breach affecting Customer Data without undue delay and within 72 hours after becoming aware of it. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, and the measures taken or proposed; Mainstar adds details as they become available. Notice is not an admission of fault. ## 8. Deletion or return Customer can export its content in its space or by e-mailing legal@mainstar.ai at any time, or ask within 30 days after the Service ends for Mainstar to return Customer Data; Mainstar does so within 30 days of the request. Mainstar deletes active copies of Customer Data within 30 days after return or, without a return request, within 30 days after the Service ends (or earlier on request). Backup copies are access-restricted, used only for recovery, and deleted within 90 days after active deletion (older monthly copies may be kept longer until the change in Annex 2 is complete); any restore reapplies deletions. Mainstar keeps Customer Data longer only where Union or Member State law (or, for UK or Swiss processing, UK or Swiss law) requires it, and then protects it under this DPA. On request, Mainstar confirms deletion in writing. Return does not cover data already deleted on Customer's instruction. ## 9. Audits Mainstar makes available the information needed to show compliance with this DPA, and Customer first relies on that documentation and Mainstar's written answers. Where these are not enough, Mainstar allows and contributes to audits, including inspections, by Customer or an auditor it appoints, under appropriate confidentiality and without access to other customers' data. Routine audits take place at most once a year on 30 days' notice. These limits do not restrict audits reasonably needed after a breach, on signs of non-compliance, or when the law or a supervisory authority requires them; notice then reflects the urgency. Audits minimise disruption, and Customer bears its own costs. ## 10. International transfers - Customer Data is hosted in the Netherlands. Mainstar and some sub-processors are in the United States and other countries, as listed at [trust.mainstar.ai/subprocessors](https://trust.mainstar.ai/subprocessors/). - **EEA.** For transfers to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module 2 where Customer is a controller, Module 3 where Customer is a processor. Customer is the data exporter and Mainstar the data importer. Clause 7 does not apply. Under Clause 9, option 2 applies with the notice in section 5. The optional language in Clause 11 does not apply. Under Clauses 17 and 18, the law and courts of Ireland apply. - **SCC Annexes.** Annex I.A: Customer's legal name, address and contact person are those Customer gives at sign-up or in its account, and Mainstar's are under Contact below; Customer acts as controller or processor and Mainstar as processor or sub-processor; Customer's acceptance of the Terms, as recorded by Mainstar, is its signature and date. Annex I.B is Annex 1 of this DPA and Annex II is Annex 2. Annex I.C: the supervisory authority determined under Clause 13; where an exporter is not established in the EU and has no EU representative, the authority of the Member State where the relevant data subjects are located. - **United Kingdom.** For restricted transfers from the UK, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022), with its Mandatory Clauses as revised under its section 18, is incorporated. Table 1 uses the Annex I.A particulars above; Table 2 the SCCs and selections in this section; Table 3 Annexes 1 and 2; in Table 4 both parties may end it as its section 19 allows. For UK transfers the Addendum prevails over conflicting terms. - **Switzerland.** For transfers governed only by the FADP, references to the GDPR mean the FADP; where both apply, they include the FADP without displacing the GDPR. The Swiss Federal Data Protection and Information Commissioner is competent for FADP matters, and data subjects in Switzerland may bring claims in the courts of their habitual residence in Switzerland. - **Adequacy.** Transfers may instead rely on a valid adequacy decision, including the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, while the recipient holds active certification covering the data. Otherwise the SCCs or UK Addendum apply. - Modules 2 and 3 cover only processing on Customer's behalf. Mainstar's own uses (section 1) need their own transfer basis; where none is in place, those uses are limited to anonymous data. - If there is a conflict between the SCCs and this DPA or the Terms, the SCCs prevail. ## 11. Liability, term and law - Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow those limits. - This DPA lasts as long as Mainstar processes Customer Data. - This DPA is governed by the laws of the State of Delaware, United States, except where the SCCs or Data Protection Law require another law or forum. - If this DPA and the Terms conflict on data protection, this DPA prevails. ## Annex 1. Details of processing - **Data subjects:** Customer's users; people Customer's users talk to or about, including clients, contacts and participants in recordings. - **Categories of data:** names, contact and professional details; voice recordings and transcripts; messages, files, notes, tasks and contact records; outputs; usage data linked to users. - **Sensitive data:** none agreed. Customer must not submit special-category data (GDPR and UK GDPR Article 9) or criminal-offence data (Article 10) unless Mainstar has agreed in writing to the categories and extra safeguards and Customer meets every legal condition, including consent where required. - **Nature and purpose:** hosting, storing, transcribing, analysing and generating content to provide the Service and support, as Customer instructs. - **Frequency:** continuous while Customer uses the Service. - **Duration and retention:** for the term of the Service, then as in section 8. - **Sub-processor transfers:** as listed at [trust.mainstar.ai/subprocessors](https://trust.mainstar.ai/subprocessors/), for the same purposes and duration. ## Annex 2. Technical and organisational measures - **Hosting:** servers with Worldstream in the Netherlands. - **Encryption:** connections encrypted in transit; uploaded files encrypted on disk by the application; conversations, notes and other records protected by access controls but not separately encrypted on disk; backups held by our storage provider encrypted before they leave our servers; other backups kept only on our own servers. - **Access control:** passwords stored only as one-way hashes; each person's data kept separate; server access only over an authenticated private network; keys held in a password manager. - **Logging:** secrets filtered out of logs; logs kept only as long as needed for security and troubleshooting. - **Backups and resilience:** five-minute change copies for 7 days, nightly copies for 90 days, monthly copies moving to the same 90-day limit; until that change is complete, older monthly copies may be kept longer. - **People:** access limited to those who run, secure and improve the Service, bound by confidentiality. - **Incidents:** breach handling and notice as in section 7. ## Contact Mainstar Inc., 2261 Market Street STE 64609, San Francisco, CA 94114, United States. E-mail legal@mainstar.ai. Version 1.0 (dpa-public-v1.0), effective 20 October 2026. The English text is the binding version.