Data Processing Addendum

This Data Processing Addendum (DPA) covers the personal information in the content your team stores in KoalaFix: what we may do with it, how we protect it, and the promises data protection laws require between you and us. It's part of the Terms for every customer on every plan, with no signature needed. Our own handling of account, billing and usage information is explained in the Privacy Policy, and the companies we use are listed on the Subprocessors page. The "In short" lines are summaries only; the full text is what counts.

1 · About this DPA

In short: this DPA is part of your contract with us and applies whenever we handle personal information in your Customer Content. Where they apply, the SCCs come first, then this DPA.

1.1 Parties

This DPA is between KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia ("we", "us", "our") and the Customer that has agreed to the Terms ("you").

1.2 How it binds

When you accept the Terms, you accept this DPA, including the SCCs and the UK Addendum where Schedule 4 applies them. No signature is needed. If you'd like a countersigned copy, email support@koalafix.com. A signed copy records this DPA; it doesn't change it.

1.3 When it applies

On every plan (Basic, Premium including the Trial, and Enterprise), from when you accept the Terms until we've deleted all Customer Personal Data under section 14, even if the Terms end first.

1.4 If documents conflict

This order applies: (a) the SCCs, the UK Addendum and the Swiss amendments, where they apply; (b) this DPA, for anything about processing Customer Personal Data; (c) the rest of the Terms. An Enterprise Order Form can vary this DPA in writing, and where it does, the Order Form applies. Nothing can override the SCCs where they apply, or reduce the protection that Data Protection Laws require.

1.5 Related companies and other people

If your related companies' personal information is in your Space, you accept this DPA for them and deal with us on their behalf; they can also join the SCCs under the docking clause (Schedule 4). Only you and we have rights under this DPA, apart from the rights the SCCs give the people whose information is transferred.

1.6 Changes

We change this DPA only as "Changes to these Terms" in the Terms of Service allows, including at least 30 days' notice of changes that reduce your rights. Section 9.5 covers changes to the official transfer clauses.

2 · Words we use

In short: words defined in the Terms of Service mean the same here. This section adds the words this DPA needs.

2.1 Words from the Terms

Words defined in the Terms of Service, such as Service, your people, Admin, Space, agent, check-in, team memory, hidden memory, Order Form and Terms, mean the same here. These four set the scope of this DPA:

• Customer Content: everything your people and agents send to or store in the Service (memory, check-ins, prompts sent as search questions, settings text, team map entries, files and messages you send us for support), plus everything we derive from it to run the Service (embeddings, search results, judge findings, summaries).
• Account Data: information about your people's accounts and your organisation: names, email addresses, sign-in details, roles, billing contacts, billing records and support contact details.
• Usage Data: technical information about how the Service is used: timings, counts, error codes, which AI client family connected, IP addresses and security logs. It never includes the text of Customer Content.
• Subprocessor: a company we use that processes Customer Content or Account Data for us.

2.2 Words for this DPA

• personal information: information about an identified or reasonably identifiable person. It includes "personal data" under the GDPR; we say "personal information" throughout.
• Customer Personal Data: personal information in Customer Content that we process for you. It doesn't include Account Data or Usage Data (section 3.3).
• Data Protection Laws: every privacy and personal information law that applies to processing Customer Personal Data. Where they apply, these include:
  • the EU General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR);
  • the UK GDPR and the Data Protection Act 2018 (UK), as amended (including by the Data (Use and Access) Act 2025);
  • the Swiss Federal Act on Data Protection of 25 September 2020 (FADP);
  • the California Consumer Privacy Act, as amended, and its regulations (CCPA), and other US states' comprehensive privacy laws, such as Virginia's, Colorado's and Connecticut's (together with the CCPA, US State Privacy Laws);
  • the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs);
  • New Zealand's Privacy Act 2020; and
  • any other law about personal information that applies.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Subprocessors, whether or not a law requires anyone to report it. Unsuccessful attempts that don't compromise security, such as blocked sign-in attempts, pings and port scans, aren't Security Incidents.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as completed in Schedule 4.
• UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner, as completed in Schedule 4.
• Restricted Transfer: a transfer of Customer Personal Data (including an onward transfer or remote access) that the GDPR, UK GDPR or FADP allows only with a safeguard such as the SCCs.
• Regulator: a body that enforces a Data Protection Law, such as an EU supervisory authority, the UK Information Commissioner (or its successor), the Swiss Federal Data Protection and Information Commissioner (FDPIC), the Office of the Australian Information Commissioner (OAIC), New Zealand's Privacy Commissioner or the California Privacy Protection Agency.
• controller, processor, service provider, sell, share and processing have the meanings Data Protection Laws give them.

3 · Roles and scope

In short: you decide what goes into KoalaFix and why, and we process it only for you. For our own records, such as accounts and billing, we're a separate controller under our Privacy Policy.

3.1 Your role

You're the controller of Customer Personal Data, or a processor acting for your own customer. If you're a processor, you confirm that your controller has authorised your instructions, our appointment and our Subprocessors, and you're our only point of contact.

3.2 Our role

For Customer Personal Data, we're your processor (or sub-processor) under the GDPR, UK GDPR and FADP; your service provider under the CCPA and your processor under other US State Privacy Laws; your agent under section 11 of New Zealand's Privacy Act 2020; and, under Australian law, a service provider handling it only for you (section 17).

3.3 Our own information

We're an independent controller, not your processor, for Account Data, Usage Data and personal information from our website, marketing, billing, support contacts and security logs. The Privacy Policy covers these; this DPA doesn't. We may use Usage Data, and aggregated, de-identified statistics built from it, to run, secure and improve the Service, but we never build those statistics from the text of Customer Content.

3.4 Scope

Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, and the kinds of personal information and people involved. This DPA covers hidden memory on the Basic plan for as long as we store it.

3.5 Outside this DPA

Memory and check-ins that KoalaFix returns to your people's agents go to whichever AI provider each person uses, under your arrangements with that provider. Those providers aren't our Subprocessors, and this DPA doesn't cover them. Nor does it cover Google when your people choose Sign in with Google, or a database you own under Schedule 5.

4 · Your instructions

In short: we process Customer Personal Data only on your instructions, which are the Terms, this DPA and the way you set up and use KoalaFix.

4.1 Only on your instructions

We process Customer Personal Data only on your documented instructions, including about transfers, unless a law we're subject to requires otherwise. If it does, we'll tell you first, unless that law forbids it on important grounds of public interest. For laws outside the EU, the UK and Switzerland, section 9.7 also applies.

4.2 What they are

Your instructions are: (a) the Terms, including this DPA and any Order Form; (b) your use and configuration of the Service, including what your people and agents send, save, search, change and delete, and the settings your Admins choose; and (c) other written instructions from an Admin that we agree are consistent with the Terms.

4.3 Unlawful instructions

We'll tell you promptly if we think an instruction breaks Data Protection Laws, and we may decline it. We don't have to check every instruction or give legal advice, and you're responsible for your instructions being lawful.

4.4 If we can't comply

If we can't follow an instruction, we'll tell you promptly. You may then suspend the affected processing or end the affected Service, and we'll refund prepaid fees for the rest of the paid period, pro rata.

5 · Your responsibilities

In short: you decide what personal information goes into your Space, so you need a lawful basis for it and must give people the notices the law requires.

5.1 Lawful basis and notices

You're responsible for the accuracy and lawfulness of Customer Personal Data, and for having any lawful basis, notice and consent that Data Protection Laws require for our processing under this DPA. In particular:

• (a) Your people. Give your people any notice, and get any consent, that the law requires for what "Telling your people" in the Terms of Service describes, including under workplace surveillance laws.
• (b) People named in memory, such as clients or other contacts. Give them any notice they need, for example under Article 14 of the GDPR or information privacy principle 3A of New Zealand's Privacy Act 2020. We don't contact them for you.

5.2 Prohibited content

Don't put into KoalaFix anything listed in "What not to put in KoalaFix" in the Acceptable Use Policy, such as secrets, payment card data, government identifiers, sensitive information or information about children, unless an Order Form allows it. Our write guard refuses text that looks like an API key or token, but it won't catch everything.

5.3 Your agents and access

Your agents act for you. You choose which AI clients connect and what access and tokens they get. Set them up to leave out personal information they don't need and to treat memory as information, not instructions. Keep accounts and tokens secure, and remove people and revoke tokens when they no longer need access. Tell us promptly at support@koalafix.com about any Security Incident or misuse you become aware of.

6 · Confidentiality of our people

In short: only KoalaFix people who need to can access Customer Content, only for set reasons, and they must keep it confidential.

Everyone we authorise to process Customer Personal Data, including our founders, employees and contractors, is bound by a written or statutory duty of confidentiality that continues after they leave. Only named KoalaFix founders and staff with a need can access Customer Content, and only: (a) to give support you ask for, with your permission; (b) to investigate a security incident, abuse or a breach of the Terms; (c) to keep the Service running (for example, restoring from a backup); or (d) to comply with the law. We log that access, and remove people's access when they no longer need it.

7 · Security

In short: we protect Customer Personal Data with the measures in Schedule 2, and we won't change them in a way that lowers protection.

We implement and maintain technical and organisational measures that protect Customer Personal Data against Security Incidents and keep it confidential, intact and available, at a level appropriate to the risk. We take into account the state of the art, implementation costs, the nature, scope, context and purposes of the processing, and the risks to people. Our measures include those in Schedule 2. We may update them, but we won't lower the overall protection of Customer Personal Data. You're responsible for the security choices within your control (section 5.3).

8 · Subprocessors

In short: you authorise the Subprocessors on our Subprocessors page. We give 30 days' notice of changes, and if we can't resolve your objection, you can leave with a pro-rata refund.

8.1 Authorisation

You give us general written authorisation to use Subprocessors, including those listed on the Subprocessors page (https://koalafix.com/subprocessors) when you accept the Terms. That page forms part of Schedule 3.

8.2 Our contracts with them

Before a Subprocessor processes Customer Personal Data, we put in place a written contract that requires it to protect that information at least as well as this DPA does, as far as relevant to its service. The contract covers confidentiality, security, help with requests and incidents, deletion or return, and information and audits. It includes the restrictions in section 16 where US State Privacy Laws apply (11 CCR §7051(b)), and the safeguard shown in Schedule 3 for Restricted Transfers. We check each Subprocessor's security and privacy commitments before we use it, and again when its terms or our use of it change.

8.3 We stay responsible

We remain fully responsible to you for each Subprocessor's performance of its obligations, as if its acts and omissions were our own, subject to section 18.

8.4 Notice of changes

At least 30 days before a new Subprocessor starts processing Customer Content or Account Data, or an existing one starts doing something materially different with it or processing it in a new country, we'll update the Subprocessors page and email your Admins and anyone subscribed there. The notice says who the Subprocessor is, what it will do, what data it will handle and where.

8.5 Objecting

You may object by emailing support@koalafix.com within 30 days after our notice. Please give your reasons, so we can try to address them. We'll work with you in good faith to resolve your objection, for example by not using that Subprocessor for your Customer Personal Data or by turning off the feature it supports for your Space, and until then we won't use it for your Customer Personal Data unless that's technically impossible, in which case we'll tell you. If we can't resolve your objection within 30 days after you make it, you may end the affected Service by written notice, and we'll refund prepaid fees for the rest of the paid period, pro rata.

8.6 Emergencies

If we must replace a Subprocessor urgently for reasons outside our reasonable control (for example, it stops providing its service or has a security problem), we'll tell you as soon as we can, and section 8.5 applies from that notice.

8.7 Copies and the wider chain

On request, we'll give you a copy of, or a link to, the data protection terms in our contract with a Subprocessor (with commercial details removed), and tell you where to find that Subprocessor's own list of the companies it uses.

9 · Where we process data and international transfers

In short: we store Customer Content in Australia, and some processing happens elsewhere, as the Subprocessors page lists. The SCCs cover transfers from the EU, UK and Switzerland. We try to redirect government requests for your data to you, and challenge those we have reasonable grounds to consider unlawful.

9.1 Where your data is

We store Customer Content (memory, check-ins, the team map, embeddings and the logs in our database) in Microsoft Azure's Australia East region (New South Wales, Australia). Files and messages you send us for support are kept in our support mailbox. Backups are geo-redundant, with the second copy also in Australia. Azure OpenAI creates embeddings in Australia East. Customer Content is processed outside Australia only as the Subprocessors page lists, in particular:

• (a) if the AI judge is on, by an Azure OpenAI Global deployment, which means Microsoft may process the text in any region where it runs the model;
• (b) once we turn on Cloudflare's proxy, in transit through its global network; and
• (c) in invitation emails, which carry the invitee's name and email address and are sent through Brevo in the EU.

9.2 Moving regions

We plan to open US and EU hosting when there's demand. We'll tell your Admins before we move your Space's Customer Content to another region, and section 8 applies to any new Subprocessor or country involved.

9.3 Transfers to us

Australia has no adequacy decision from the European Commission, the United Kingdom or Switzerland. For Restricted Transfers from you to us, the SCCs, the UK Addendum and the Swiss amendments apply as completed in Schedule 4. They're incorporated by reference, and each of us is treated as having signed them when you accept the Terms.

9.4 Onward transfers

We transfer Customer Personal Data onward only to Subprocessors authorised under section 8, or as section 9.7 allows. For a Restricted Transfer, the recipient must be bound by the SCCs (or their UK or Swiss equivalent), be covered by an adequacy decision, or provide another valid safeguard, such as certification under the EU–US Data Privacy Framework. If a safeguard we rely on stops being valid, we'll rely on another (usually the SCCs in our contract with that Subprocessor) or take other steps to keep the transfer lawful, and we'll tell you if we can't.

9.5 New clauses

If new or revised transfer clauses or mechanisms are adopted for the EU, the UK or Switzerland (including clauses designed for importers already subject to the GDPR), or a Regulator or court decides that a mechanism in Schedule 4 is no longer valid, we may adopt the replacement. We'll update Schedule 4 consistently with its current choices and give you at least 30 days' notice, or less if the law requires the change sooner. If no valid mechanism is available, we'll work with you on a lawful alternative. If there isn't one, either of us may end the affected Service, and we'll refund prepaid fees for the rest of the paid period, pro rata.

9.6 Transfer assessments

The Security Practices page and the Subprocessors page say where your data lives. On request, we'll give you the further information you reasonably need to assess transfers, including under Clause 14 of the SCCs. As at the date of this DPA, we have no reason to believe that the laws that apply to us, including Australian law, prevent us from meeting our obligations under this DPA or the SCCs. We'll tell you promptly if that changes.

9.7 Government requests

If a government authority, court or law-enforcement body of any country asks us to disclose Customer Personal Data, or we become aware that one has accessed it directly, we'll:

• (a) try to redirect the request to you;
• (b) tell you promptly, and before we disclose anything where we can, unless the law forbids it; if it does, we'll use our best efforts to have that prohibition lifted so we can tell you as much as possible, as soon as possible;
• (c) challenge the request where, after careful assessment, we conclude there are reasonable grounds to consider it unlawful, including by seeking interim measures to suspend its effects;
• (d) disclose only the minimum that the request, reasonably interpreted, requires;
• (e) keep a record of each request, our assessment and our response, and share it with you where the law allows; and
• (f) tell you on request how many requests we've received about your data, where the law allows.

We haven't built any "back door" for government access to Customer Personal Data, and we won't do so voluntarily.

10 · Helping with people's requests

In short: you can handle most requests with KoalaFix's own tools, and we'll help with the rest.

10.1 Tools you can use

Admins can export the Space's memory in JSON, and delete individual memory or the whole Space. Your people can correct memory they're allowed to write, and delete their own accounts. For hidden memory on the Basic plan, including when someone asks you for their information, see section 14.4.

10.2 Requests made to us

If someone contacts us directly about Customer Personal Data, we'll pass the request to you promptly. We won't respond to it ourselves, except to say we've passed it on, unless you authorise us or the law requires us to.

10.3 Our help

Taking into account the nature of the processing, we'll help you, through appropriate technical and organisational measures and as far as possible, to respond to people exercising their rights under Data Protection Laws. These include rights to access, correct, delete, restrict, object to and port their information, and the CCPA rights to know, delete and correct. We'll also give you the information you reasonably need to handle complaints about the processing, including within the time limits of the UK's data protection complaint rules.

11 · Security Incidents

In short: if a Security Incident affects your Customer Content, we'll tell you without undue delay and within 72 hours of becoming aware, give you the details you need for your own notices, and keep you updated.

11.1 Notice

We'll tell your Admins by email about a Security Incident without undue delay, and in any case within 72 hours after we become aware of it. We become aware when we have a reasonable degree of certainty that a Security Incident has happened, and we investigate suspected incidents promptly. Under "Security" in the Terms of Service, section 11 also applies to a breach of security that affects Customer Content that isn't personal information.

11.2 What we tell you

We'll include as much of the following as we know, and give you the rest in stages as we learn it, without further undue delay:

• (a) our identity and contact details, and a contact for the incident;
• (b) a description of what happened, when it happened and when we found it, including, where possible, the categories and approximate number of people and records affected;
• (c) the kinds of personal information involved;
• (d) the likely consequences;
• (e) what we've done or propose to do to deal with it and reduce its possible harm;
• (f) the steps we recommend that you, and the people affected, take in response; and
• (g) any other organisation we know is affected, with its contact details if we have them.

This covers what Article 33(3) of the GDPR requires and what a statement under section 26WK of Australia's Privacy Act 1988 needs.

11.3 Our response

We'll promptly take reasonable steps to contain and investigate the Security Incident and reduce its effects. We'll keep you informed of material developments, give you the information and help you reasonably need for your own investigation and notifications, and keep a record of the incident.

11.4 Who notifies

You decide whether to notify Regulators, the people affected and anyone else, and you do so, unless we agree otherwise in writing. We won't notify them about a Security Incident affecting your Customer Personal Data without consulting you, unless the law requires us to, and then we'll tell you first where the law allows. Section 17 covers Australian and New Zealand breach notices.

11.5 Not an admission

Our notice of, or response to, a Security Incident isn't an admission of fault or liability.

12 · Assessments and consultations

In short: we give you the information and help you need for privacy assessments, consultations with Regulators, and US risk assessments and audits.

Given the nature of the processing and the information we have, we'll give you reasonable help with:

• data protection impact assessments and similar assessments that Data Protection Laws require for your use of the Service;
• consulting a Regulator before processing, where an assessment shows you need to;
• risk assessments and cybersecurity audits under the CCPA regulations (section 16.3); and
• data protection assessments under other US State Privacy Laws.

Schedules 1 and 2, the Subprocessors page and the Security Practices page are a starting point, and we'll answer reasonable follow-up questions.

13 · Audits and information

In short: we answer reasonable security questionnaires and will share summaries of independent reports once we have them. You can also audit us once a year, at your cost, on 30 days' notice, starting remotely.

13.1 Information

On request, we'll make available the information reasonably necessary to show that we comply with this DPA and Data Protection Laws, including answers to a reasonable security and privacy questionnaire.

13.2 Independent reports

We don't yet hold SOC 2, ISO 27001 or any other independent certification, and we haven't yet had an independent penetration test. "What we haven't done yet" on the Security Practices page is kept up to date. Once we have independent reports, we'll share summaries of them on request, under confidentiality.

13.3 Your audit right

You, or an independent auditor you appoint who is bound by confidentiality and isn't our competitor, may audit our compliance with this DPA:

• (a) at most once in any 12 months, unless a Security Incident has affected your Customer Personal Data, a Regulator requires it, or Data Protection Laws (including the SCCs) give you a further right;
• (b) on at least 30 days' written notice, with a proposed scope that we'll agree with you in good faith;
• (c) remotely first, through documents, written answers and video calls, and on site only if a remote audit can't reasonably answer your questions, during business hours and without unreasonable disruption;
• (d) at your cost; and
• (e) without access to other customers' data, or to information that would put the security of the Service or our Subprocessors at risk.

You'll keep the results confidential and share them with us. If an audit finds that we've breached this DPA, we'll fix it promptly at our own cost.

13.4 Subprocessors, Regulators and the SCCs

You can't audit our Subprocessors directly, but we'll pass on the audit reports and certifications they make available to us, where their terms allow. We'll cooperate with any Regulator that has authority over the processing. Where the SCCs apply, this section describes how we'll meet Clause 8.9, without limiting it.

14 · Returning and deleting data

In short: you can export at any time (on Basic, hidden memory isn't included). If you delete your Space, or we close a Basic Space nobody has used for 24 months (after 30 days' notice), we remove it straight away. If the Service ends another way, you get 30 days to export, and then we delete your data. Backup copies are gone within 7 days after that.

14.1 Export

Admins can export the Space's memory from the dashboard at any time, in a structured, commonly used, machine-readable format (JSON). On the Basic plan, this export leaves out hidden memory and shows how much there is. It doesn't include private-lane memory; section 14.3 covers the full export.

14.2 Deleting as you go

When memory or a Space is deleted, we remove it from the live Service straight away, and from backups as they expire, within 7 days. A deleted Space can't be restored, so export anything you want to keep first. If no one in a Basic Space signs in or uses KoalaFix for 24 months, we'll email its Admins and close the Space 30 days later, unless someone uses it in the meantime; we then delete its content as we do when a Space is deleted. When a person deletes their account, their private-lane memory is deleted. Team memory they wrote stays with the Space, shown as written by "a former member", unless they choose "Also delete what I wrote".

14.3 When the Service ends

Cancelling a paid plan doesn't end the Service: your Space moves to the Basic plan and we don't delete anything (see "Cancelling" in the Plans & Billing Terms). If the Service ends for any reason other than you deleting your Space or us closing an inactive Basic Space (section 14.2):

• (a) you have 30 days after the end date to export your Customer Content, and an Admin can ask us at support@koalafix.com for a full export, including private-lane memory (on the Basic plan, hidden memory isn't included, as section 14.4 explains);
• (b) when those 30 days end, we delete your Customer Content, including Customer Personal Data, from the live Service, so it's gone within 30 days after the Service ends; and
• (c) it leaves our backups as they expire, within 7 days after that.

If you ask us to delete it sooner, we will. If you're switching to another provider, "Switching and taking your data with you" in the Terms of Service also applies: we keep your data available for retrieval for at least 30 days after the transition period, then delete it as this section describes. On request, we'll confirm deletion in writing.

14.4 Hidden memory

On the Basic plan, we keep hidden memory for 12 months from the day it becomes hidden, then permanently delete it with its embeddings. Upgrading within those 12 months brings it back (see "Hidden memory on the Basic plan" in the Plans & Billing Terms).

Hidden memory is still your Customer Content, and our promises about it still apply. On the Basic plan, the only way to get hidden memory back is to upgrade to Premium within 12 months of it becoming hidden. It isn't included in any export, including when you leave KoalaFix or move to another provider, unless a law requires us to provide it. Admins can still delete hidden memory, or the whole Space, at any time without upgrading. If you need personal information in hidden memory to respond to a request from an individual, tell us at support@koalafix.com and we'll help as the law requires.

14.5 What we may keep

We keep Customer Content, including Customer Personal Data, longer in only two cases. First, where a law we're subject to requires it: we then keep only what that law requires, for as long as it requires and only for that purpose, and this DPA keeps protecting it. Second, as a small deletion record (a tombstone) that holds no memory text and stops a deletion being undone by accident.

14.6 Bring your own database

Schedule 5 explains return and deletion where your Space's memory is in your own database.

15 · AI processing and no secondary use

In short: we use Azure OpenAI only to run KoalaFix for you. We don't train AI models on your Customer Content unless you opt in, and we don't let our AI providers train on it.

15.1 Our promise

We don't use your Customer Content to train AI models, and we don't let our AI providers train on it. We don't use it to improve KoalaFix for other customers, or for any purpose other than providing the Service to you, unless you opt in. In this promise, "providing the Service to you" includes securing and supporting it and complying with the law. Any opt-in will be separate, made by an Admin, described in plain terms, and possible to withdraw at any time. Accepting the Terms, or a change to them, is never an opt-in.

15.2 Embeddings and search questions

So that agents can search memory by meaning, we send the text of memory, and of each search question, to Azure OpenAI to create embeddings (lists of numbers that represent meaning), using a deployment in Australia East. We store embeddings with the memory in Australia, and delete them with it. We use the question to find matching memory, and keep it in the search log for 30 days. If a question an agent asks finds nothing twice in 14 days, KoalaFix may record it as a "gap" in your Space, visible to your team and assigned to an Admin, so someone can add the missing memory. Gaps are kept until an Admin closes them, or for 90 days. Questions our hooks send automatically from people's prompts are never recorded as gaps.

15.3 The AI judge

If the AI judge is on for your Space, it sends new or changed memory, with similar memory from the same Space, to an Azure OpenAI model that suggests clean-ups, such as merging duplicates. The judge uses a Global deployment, which means Microsoft may process that text in any region where it runs the model. We store the judge's suggestions in Australia. The judge only suggests: it doesn't change or delete memory by itself. On the Basic plan, it runs within a small daily allowance and never sees hidden memory.

15.4 Microsoft

Under our agreement with Microsoft, Microsoft doesn't use the text we send to Azure OpenAI to train its models. Microsoft's abuse monitoring may store flagged text in Australia (the geography of our Azure resource) for review by authorised Microsoft staff.

15.5 No combining

We don't combine Customer Personal Data with personal information from other sources or other customers, or use it outside our relationship with you, except as needed to provide the Service to you (for example, showing which of your people wrote a memory) or as section 16 allows.

15.6 Not for decisions about people

KoalaFix isn't designed to monitor individuals, or to make or support decisions about people that have legal or similarly significant effects, such as employment decisions. You must not use it that way.

16 · US state privacy laws

In short: under US State Privacy Laws, we're your service provider or processor. We don't sell or share Customer Personal Data, and we use it only for the business purposes in Schedule 1.

16.1 Our role

Where the CCPA applies, we're your service provider, and you disclose Customer Personal Data to us only for the limited and specified business purposes in Schedule 1, Part F. Under other US State Privacy Laws, we're your processor.

16.2 CCPA terms

For Customer Personal Data that the CCPA covers:

• (a) we won't sell or share it;
• (b) we won't retain, use or disclose it for any purpose other than those business purposes, except as the CCPA and its regulations allow service providers to (for example, to comply with the law or to detect security incidents);
• (c) we won't retain, use or disclose it for any commercial purpose other than those business purposes, unless the CCPA expressly allows it;
• (d) we won't retain, use or disclose it outside our direct business relationship with you, or combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with consumers, except as section 15.5 describes or the CCPA expressly allows;
• (e) we'll comply with the CCPA's applicable obligations and give it the same level of privacy protection that the CCPA requires of businesses, including reasonable security (Schedule 2) and help with consumer requests (section 10);
• (f) you may take reasonable and appropriate steps to make sure we use it consistently with your CCPA obligations, including through section 13, at least once every 12 months;
• (g) we'll tell you if we decide we can no longer meet our obligations under the CCPA;
• (h) on notice, you may take reasonable and appropriate steps to stop and remediate any unauthorised use of it, including by directing us to stop processing it; and
• (i) you'll tell us about any consumer request under the CCPA that we must comply with, and give us the information we need to comply; we'll then comply and help you respond.

We certify that we understand these restrictions and will comply with them. Our contracts with Subprocessors that process this data include them (11 CCR §7051(b)).

16.3 Risk assessments and audits

On request, we'll give you the information you reasonably need to conduct your risk assessments (11 CCR §§7151–7153) and cybersecurity audits (11 CCR §7123) under the CCPA regulations.

16.4 Other states

Where Virginia's, Colorado's, Connecticut's or another state's comprehensive privacy law applies, we'll also:

• (a) follow your instructions (section 4), with the nature and purpose of the processing, the types of data and the duration as set out in Schedule 1;
• (b) make sure each person who processes the data is subject to a duty of confidentiality (section 6);
• (c) use Subprocessors only under written contracts that pass on our obligations, after giving you notice and a chance to object (section 8);
• (d) at your direction, delete or return the data at the end of the Service, unless the law requires us to keep it (section 14);
• (e) make available the information in our possession that you need to show compliance (section 13);
• (f) allow and cooperate with reasonable assessments by you or your designated assessor, or arrange an independent assessment and give you the report on request (section 13); and
• (g) help you meet your obligations for security, breach notification, data protection assessments and consumer requests (sections 7, 10, 11 and 12).

16.5 No targeted advertising

We don't use Customer Personal Data for targeted or cross-context behavioural advertising, or to build profiles of people.

17 · Australia and New Zealand

In short: we handle Customer Personal Data in line with the Australian Privacy Principles, help you with notifiable data breaches, and in New Zealand we hold it only as your agent.

17.1 Australian Privacy Principles

We handle Customer Personal Data in line with the APPs, as far as they apply to a service provider acting on your instructions. In particular, we:

• (a) use and disclose it only to provide the Service to you (APP 6);
• (b) before a Subprocessor outside Australia receives it, take reasonable steps, through a binding contract, to make sure that Subprocessor doesn't breach the APPs in relation to it, and list each Subprocessor's country or region on the Subprocessors page (APP 8);
• (c) take reasonable technical and organisational steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1 and Schedule 2); and
• (d) destroy it, or make sure it no longer identifies anyone, when it's no longer needed under this DPA (APP 11.2 and section 14).

17.2 Notifiable data breaches

If a Security Incident might be an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth), we'll give you the details in section 11.2, which cover what a statement under section 26WK needs, and help you finish your assessment quickly. If both of us must deal with the same breach, we'll agree which of us assesses and notifies it, so that one assessment and one notification cover us both (sections 26WJ and 26WM). Unless we agree otherwise, you notify, with our help.

17.3 New Zealand

Where New Zealand's Privacy Act 2020 applies, we hold Customer Personal Data only as your agent, for the purpose of storing and processing it for you, and we don't use or disclose it for our own purposes (section 11 of that Act). If a Security Incident might be a notifiable privacy breach (one likely to cause serious harm), we'll give you the information you need to assess it and to notify the Privacy Commissioner and the people affected as soon as practicable.

17.4 Other laws

If another privacy law requires extra contract terms for your use of the Service, such as Brazil's standard contractual clauses, ask us and we'll work with you to add them.

18 · Liability

In short: the liability limits in the Terms apply to this DPA, but not to liability to the people whose information is transferred, or where the SCCs or the law don't allow them.

Each party's liability arising out of or relating to this DPA is subject to the exclusions and cap in "Liability" in the Terms of Service, and counts towards the same cap. That cap and those exclusions don't apply to liability to the people whose information is transferred (including under Clause 12 of the SCCs and the UK Addendum), and don't limit any liability that the SCCs, Data Protection Laws or any other law don't allow to be limited.

19 · Term

In short: this DPA lasts as long as we process Customer Personal Data for you.

This DPA starts when you accept the Terms and ends when we've deleted all Customer Personal Data under section 14, even if the Terms end earlier. Parts that by their nature should continue after that, such as confidentiality and liability, continue.

20 · Governing law

In short: this DPA follows the governing law and dispute terms in the Terms of Service, except the SCCs and the UK Addendum, which follow their own choices.

This DPA is governed by the law that governs the Terms, and disputes about it are resolved as "Disputes" in the Terms of Service sets out. The SCCs are governed by the law of Ireland, with disputes going to the courts of Ireland (Schedule 4). The UK Addendum is governed by the law of England and Wales, with disputes going to the courts of England and Wales, as its Mandatory Clauses provide. Swiss transfers follow Schedule 4, Part C. Disputes under the SCCs or the UK Addendum aren't subject to arbitration, and nothing in the Terms limits anyone's right under them to bring a claim in the courts they allow or to complain to a Regulator. Data Protection Laws that apply whatever law the parties choose still apply.

21 · Contact

• Privacy questions, help with requests about personal information in hidden memory, Subprocessor objections, audit requests and countersigned copies: support@koalafix.com
• Security Incidents and security reports: support@koalafix.com
• Exports: support@koalafix.com
• Legal notices: support@koalafix.com
• Post: KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia
• EU representative: none appointed
• UK representative: none appointed

We send notices under this DPA to your Admins by email.

22 · Change log

Schedule 1 · Processing details (SCC Annex I.B)

In short: whose personal information is in your Space, what kinds, what we do with it, why, and for how long.

A. People the personal information is about. Your people (Admins, Members and Viewers, including employees, contractors and invitees), and people mentioned in memory, check-ins or support requests, such as colleagues, former members, clients, suppliers and other contacts.

B. Kinds of personal information.

• Names, work email addresses (including an invitee's address until they accept), roles or departments, areas and projects on the team map.
• The content of notes, decisions, facts, handoffs and check-ins, which may include personal information about the author or people mentioned, such as who decided what.
• Search questions: up to the first 2,000 characters of each non-trivial prompt your people send their agents.
• Authorship and history: which person or agent wrote, confirmed, changed or retired memory and when; edit history; and when a check-in was last active and its outcome.
• The search log (questions asked and results returned) and read receipts (which memory was shown to whom).
• Gaps: questions an agent asked that found nothing, recorded in your Space so someone can add the missing memory (section 15.2).
• Identifiers that link Customer Content to your people, their agents and your Space.
• Files and messages you send us for support, which we use only to resolve your request.
• Data derived from the above: embeddings, search results, judge findings and summaries.

Connection records, security logs and other Usage Data aren't Customer Personal Data. We handle them as a controller under the Privacy Policy.

C. Sensitive information. Not intended. "What not to put in KoalaFix" in the Acceptable Use Policy prohibits health, biometric and other sensitive information and information about children, but some may appear incidentally, for example if someone notes why a teammate is away. Safeguards: that prohibition; purpose limits and no training (section 15); access limited to the Space's members, with the private lane described below; KoalaFix staff access only as section 6 allows, with that access logged; encryption in transit and at rest; Admin tools to delete memory; and no onward transfer beyond the Subprocessors in Schedule 3. Private-lane memory is visible in KoalaFix only to the person who saved it. It's still part of your Space, so it's included if you ask for a full export, for example when you leave KoalaFix (on the Basic plan, hidden memory isn't included).

D. Frequency. Continuous, while you use the Service.

E. Nature of the processing. Receiving, hosting and storing Customer Content; creating embeddings; searching by meaning and by keyword; recording gaps (questions that found nothing) so your team can add the missing memory; sending relevant memory, team news and check-ins to your people's AI clients; recording check-ins; keeping edit history and allowing undo; running the AI judge, where it's on; applying plan rules, such as hiding memory on the Basic plan and deleting it 12 months later; access control; backups and restores; export; deletion; support; and security monitoring.

F. Purposes (the specific business purposes). We process Customer Personal Data only to provide the Service to you under the Terms, which means only:

1. storing and organising your team memory, check-ins and team map in your Space;
2. creating embeddings so your people's agents can search memory by meaning;
3. answering searches, and sending relevant memory, team news and check-in details to your people's AI clients;
4. showing what teammates' agents are working on;
5. running the AI judge, where it's on, to suggest clean-ups;
6. showing who wrote what and when, keeping edit history, and letting you undo changes and delete memory;
7. applying your plan's rules and published limits;
8. keeping the Service running, including backups and restores;
9. securing the Service and your data, including detecting, investigating and preventing Security Incidents and abuse;
10. giving support you ask for;
11. exporting and deleting data when you ask; and
12. complying with the law.

G. How long we keep it. For the term of this DPA (section 19), as follows:

On the Basic plan, memory that isn't hidden is kept as it is on Premium, unless we close the Space for inactivity (section 14.2). When the Service ends, section 14.3 applies. For Account Data and Usage Data, including connection records, see "How long we keep it" in the Privacy Policy.

H. Transfers to Subprocessors. Schedule 3 lists each Subprocessor, what it does and where. Each processes Customer Personal Data only to provide its part of the Service, for the term of this DPA.

Schedule 2 · Technical and organisational measures (SCC Annex II)

In short: the specific measures we use to protect Customer Personal Data. The Security Practices page describes the same measures in more detail, and lists what we haven't done yet.

Encryption

• TLS for data in transit to and from our website, dashboard and MCP server (with HSTS), and between our application and its database.
• Microsoft encrypts data at rest in Azure Database for PostgreSQL, including backups, with AES-256 and service-managed keys.
• API and connection token secrets are stored only as hashes. Supabase stores password hashes, not passwords.

Access control

• Sign-in through Supabase: email and password (at least 8 characters, with email confirmation and reset by email), or Sign in with Google.
• Roles: Admins, Members (read and write) and Viewers (read only).
• Private-lane memory is visible in KoalaFix only to the person who saved it. It's still part of your Space, so it's included if you ask for a full export, for example when you leave KoalaFix (on the Basic plan, hidden memory isn't included).
• Every request is checked against the person's membership of the Space.
• Dashboard sessions use Secure, HttpOnly, SameSite=Strict cookies, expire after 12 hours, and are protected against cross-site request forgery.
• API and connection tokens can be revoked and set to expire (after up to 365 days), and are compared in constant time. A token can't have wider permissions than the credential used to create it, and revoking or expiring a token also ends the tokens created from it.
• The application connects to the database with a role that can only read and write rows, not change the schema.
• The database is reachable only through private networking.
• Rate limits on requests, tool calls and writes for each person and each Space, and on repeated failed sign-in attempts from the same address. The request, tool-call and write limits are published in "Fair use and limits" in the Plans & Billing Terms.

KoalaFix staff access

• Only named KoalaFix founders and staff with a need can access Customer Content, only for the reasons in section 6, and we log that access.
• Everyone with access is bound by confidentiality, and we remove access when it's no longer needed.
• Our people use multi-factor authentication for administrative access to our cloud accounts.
• Production secrets are kept in a managed secret store, available only to the services that need them.

Keeping customers apart

• All Spaces share one database. Checks in our application limit each request to the Spaces the person belongs to; we don't use a separate database for each customer.
• Short-lived caches of search questions are kept separate for each customer.
• We don't copy Customer Content into development or test environments.

Protecting agents and content

• A write guard refuses text that looks like an API key or token, such as KoalaFix and sk- style keys.
• The hooks label memory as information from teammates, not instructions, and KoalaFix shows who wrote each memory and when, with edit history.

Secure development

• Code review on every change, including a security-focused review, assisted by AI tools, before and after it's merged.
• Automated secret scanning (gitleaks), licence checks and dependency audits.

Logging and monitoring

• Security logs, kept for up to 90 days.
• Automatic alerts when the application, database or background jobs fail.
• Records of KoalaFix staff access to Customer Content.

Backups and resilience

• Rolling 7-day point-in-time backups with a geo-redundant copy, and no other copies of production data.
• We test restoring from backup.
• If KoalaFix is unavailable, the hooks let your agents keep working.

Incident response

• A written incident response plan for the Service that says who does what, with support@koalafix.com for reports.
• Notice to you as section 11 describes.

Deletion

• Admin tools to delete memory and Spaces, and self-service account deletion.
• Automatic deletion of the search log, read receipts and gaps after the periods in Schedule 1, and of hidden memory 12 months after it's hidden.
• Backups expire within 7 days.

Subprocessors and physical security

• Checks before use, written contracts, transfer safeguards, a published list and 30 days' notice of changes (section 8).
• We don't run our own data centres. Our Subprocessors secure the facilities they run.

Help with people's requests

• Export in JSON, deletion tools, and help with requests about hidden memory (sections 10 and 14.4).

Schedule 3 · Subprocessors (SCC Annex III)

In short: the companies we use, as listed on our Subprocessors page.

The Subprocessors page (https://koalafix.com/subprocessors) forms part of this Schedule and is updated under section 8. Below is a copy of its tables as at the date of this version; if the page and this copy differ, the page applies. Each Subprocessor's privacy contact is available on request. Transfer safeguards are as set out in each Subprocessor's data protection terms.

Registered addresses

• Microsoft Corporation: One Microsoft Way, Redmond, WA 98052, United States
• Cloudflare, Inc.: 101 Townsend Street, San Francisco, CA 94107, United States
• Supabase Pte Ltd: 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
• Sendinblue SAS (Brevo): 9-17 rue Salneuve, 75017 Paris, France
• Stripe Payments Australia Pty Ltd: 1 Sussex Street, Barangaroo NSW 2000, Australia

Not our Subprocessors: your people's AI clients and the model providers behind them (such as Claude Code, Codex, Cursor and Gemini CLI); Google, when your people choose Sign in with Google; GitHub, which distributes the KoalaFix plugin; and, on the Enterprise plan, the provider of a database you own under Schedule 5.

Schedule 4 · Transfer mechanisms

In short: how the EU SCCs, the UK Addendum and the Swiss amendments apply to transfers of Customer Personal Data to us in Australia, and which options we've chosen.

This Schedule applies to Restricted Transfers of Customer Personal Data from you to us. Australia has no adequacy decision from the European Commission, the United Kingdom or Switzerland.

Part A · EU Standard Contractual Clauses

The SCCs (Decision (EU) 2021/914) are incorporated by reference, with you as data exporter and KoalaFix as data importer, and completed as follows:

Annex I.A: list of parties

• Data exporter: you, the Customer, with the name, address and contact details in your account, billing details or Order Form; your Admins are the contacts. Activities relevant to the transfer: using the Service under the Terms. Role: controller (Module 2) or processor (Module 3).
• Data importer: KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia. Contact: support@koalafix.com. EU representative: none appointed. Activities relevant to the transfer: providing the Service under the Terms. Role: processor (Module 2) or sub-processor (Module 3).
• Signature and date: each of us is treated as having signed on the date you accept the Terms.

Part B · UK Addendum

For Restricted Transfers that the UK GDPR covers, the UK Addendum (version B1.0) is incorporated by reference and completed as follows:

Part 2 of the UK Addendum is the Mandatory Clauses of the Approved Addendum, being template Addendum B1.0 issued by the Information Commissioner and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses.

Part C · Swiss transfers

For Restricted Transfers that the FADP covers, the SCCs in Part A apply with these changes:

• (a) references to the GDPR are read as references to the FADP, so far as the transfer is subject to it;
• (b) the FDPIC is the competent supervisory authority under Clause 13 for transfers subject to the FADP, alongside the authority in Part A where a transfer is also subject to the GDPR;
• (c) "Member State" in Clause 18(c) is not read so as to stop people in Switzerland from bringing claims where they usually live, in Switzerland;
• (d) the governing law and courts stay as in Part A (Ireland), without limiting point (c); and
• (e) the SCCs protect information about legal entities only where, and for as long as, Swiss law requires (the revised FADP, in force since 1 September 2023, protects only individuals).

Part D · Future changes

Section 9.5 explains how we replace these mechanisms if the official clauses change or stop being valid.

Schedule 5 · Enterprise: bring your own database

In short: if your Space's memory lives in a database you own, some things still pass through or stay with us. This Schedule explains what, and who is responsible for what.

This Schedule applies if your Order Form includes the bring-your-own-database option, under which your Space's memory lives in a Postgres database you own, and our hosted service connects to it. Your Order Form sets out where the database is and how we connect to it.

5.1 What stays in your database

Your Space's memory and the records that go with it, such as check-ins, the team map, edit history and embeddings.

5.2 What still passes through or stays with us

• (a) Requests. Your people's agents and the dashboard still connect to our hosted service, which reads from and writes to your database for each request, holding content only briefly in memory while it does.
• (b) AI processing. To create embeddings and, if it's on, to run the AI judge, we still send text to Azure OpenAI as section 15 describes.
• (c) Connection credentials. We hold the credentials our service uses to connect to your database, and we store them encrypted.
• (d) Logs. Our server and security logs (Usage Data), which don't contain the text of Customer Content.
• (e) Sign-in and support. Your people's sign-in data stays in Supabase (Account Data), and we hold anything you send us for support.

5.3 Who is responsible for what

You're responsible for your database: where it's hosted, its security (network access, encryption, patching and access control), its backups, availability and capacity, and the providers you use for it, which aren't our Subprocessors. Give our service only the access it needs. We're responsible for the security of our hosted service and of the credentials we hold (Schedule 2), for our Subprocessors, and for deleting what we hold under section 14.

5.4 Security Incidents

Section 11 applies to incidents involving our service, our Subprocessors or the credentials we hold. If we become aware of a security problem in your database, we'll tell you promptly. Otherwise, incidents in your database are yours to handle and to decide whether to notify.

5.5 When the Service ends

We stop connecting to your database. Within 30 days after the Service ends, we delete the credentials and anything else we hold for your Space, and those copies leave our backups within 7 days after that. The data in your database stays with you, to keep or delete. We don't keep backups of your database.