Data Processing Addendum (draft)

1. Roles

You decide what Customer Personal Data goes into Kleos and why, so you are the controller of it (or, where you handle it for your own client, a processor, and we are your subprocessor). We are the processor: we process it only to provide Kleos to you, on your documented instructions. Your use of Kleos's features, and these terms, are those instructions. If we think an instruction breaks data protection law we will tell you.

2. What we process

• Subject matter and purpose: running Kleos for your workspace: a service that researches your market, plans and drafts your content (posts, articles, newsletters and images), publishes what you approve and tracks how search engines and AI assistants see your business.
• Duration: while your workspace exists, and afterwards only for the deletion periods in section 7.
• Whose data: your subscribers and the people your content mentions, your team members, and anyone else whose details you add (for example contacts you keep for outreach).
• Kinds of data: names, business email addresses, job titles and the other details you enter or that appear in the content, sources and settings of your workspace.
• We do not intentionally process special categories of data, and you should not put them into the service.

3. What we do

• Process Customer Personal Data only as described above, and not sell it, share it for advertising, or use it to train AI models.
• Keep it confidential, and limit access to the people who need it to run and support the service.
• Keep it secure: encryption in transit, encryption of stored access tokens and secrets, separate workspaces, role-based access and audit logging, as the Privacy Policy describes.
• Help you answer requests from people about their data, and help you meet your own data protection duties, as far as reasonably possible given what we hold.
• Tell you without undue delay after we become aware of a breach of security that affects your Customer Personal Data, with what we know.

4. Subprocessors

You agree that we may use these subprocessors. Each processes data only on our instructions and for the purpose shown, and we use only providers that accept data processing terms.

• Render: The workspace database and application servers: all workspace content and account data, in the United States.
• Cloudflare: Private file storage (R2) for generated and uploaded images, audio and video, and the network in front of the service.
• Stripe: Billing contact details (email, name, address for tax) and payment details, which are entered with Stripe, not with us.
• Resend: Recipients' email addresses and the content of the emails we send (sign-in links, notices, summaries, export links).
• Anthropic: The text Kleos needs to research and write: business facts, buyer descriptions, source material you add and drafts.
• OpenAI: Text for writing, image prompts, narration scripts and AI-assistant visibility questions, and the images and audio produced.
• DataForSEO: Search terms and the questions tracked for AI-visibility checks, not personal data.
• Exa: Your business's domain and research queries, not personal data.

Platforms you choose to connect (LinkedIn, Meta, Google, X, your website or email tool and the like) are not our subprocessors: they receive data because you asked Kleos to publish or read on your behalf, under their own terms, and you can disconnect them at any time.

We will update this list before we add a provider that handles Customer Personal Data. If you object to a new provider on reasonable data protection grounds, tell us at clio@new-odyssey.com; we will work with you, and if we cannot resolve it you may end your subscription.

5. Where data is processed

Our service runs on servers in the United States, and some providers may process data in other countries. If you are in the European Economic Area, the United Kingdom or Switzerland and the law requires a transfer mechanism (for example the EU standard contractual clauses), we will agree the mechanism with you before this addendum is final.

6. Requests, audits and information

Anything you need to answer a request from a person about their data, you can do yourself in Kleos (edit or delete it) or ask us at clio@new-odyssey.com. On reasonable request we will give you the information we hold that shows we meet this addendum, such as this page and our security summary. We do not offer on-site audits of our hosting providers.

7. Return and deletion

You can export everything in your workspace at any time, even after a subscription ends: workspace owners and admins use Your data in Kleos to download a ZIP of JSON, Markdown and CSV files.

When a workspace owner deletes the workspace it is locked at once, connected accounts are disconnected and billing stops. For 30 days the owner can restore it. After that we delete everything the workspace held, including files in storage, and keep only what the law and our accounting require: invoices and payment records, and a minimal activity log with personal details removed. Backups held by our hosting provider expire on its standard schedule. A person can also delete their own account at any time.

8. Governing law and order of documents

We will specify here the US state whose law governs this addendum and where disputes are heard. Until we do, this addendum is governed by the laws of the place where New Odyssey is established, without regard to conflict-of-laws rules, and its courts decide any dispute. If this addendum conflicts with the Terms of Service about the processing of Customer Personal Data, this addendum applies.

9. Status of this draft

This is a draft. It has not been reviewed by a lawyer, it has not been signed by either side, and it may change. To ask for a signed copy, or to tell us what your organization needs, email clio@new-odyssey.com.