Data Processing Agreement

Effective November 4, 2026. Part of the Terms of Service; no signature is needed. If your firm needs a countersigned copy, email contact@kolophi.ai.

1. Parties and roles

This agreement is between the customer named in your subscription ("you") and Esketit LLC, doing business as Kolophi ("we"). For the personal information in your records in Kolophi ("customer personal data"), you decide why and how it is processed, and we process it only on your behalf: you are the controller, or the business, and we are your processor, or service provider, in the terms of the laws that use those words.

2. What we process, and why

• Purpose. Providing Kolophi to you under the Terms: copying records from the systems you connect, classifying, describing and screening them, letting your people review, hold, research and destroy them, and supporting you.
• Data. Whatever your records contain, which can include names, contact details, employment, financial, health and other sensitive information about your clients, staff and others named in them; and your users' names, work email addresses and activity in Kolophi.
• People. Your clients, staff, users, and anyone named in your records.
• Duration. While your subscription lasts, until your install is destroyed under section 9.

3. Your instructions

We process customer personal data only on your documented instructions. The Terms, this agreement and your use of Kolophi's settings, such as the sources and areas you approve and the clients you mark "no AI", are your instructions. If we believe an instruction breaks the law, we'll tell you. We process it otherwise only where the law requires, and then we'll tell you first where the law allows.

4. Service provider terms

We won't sell or share customer personal data, as those words are used in the California Consumer Privacy Act; retain, use or disclose it for any purpose other than providing Kolophi to you, including any commercial purpose of our own; retain, use or disclose it outside our direct business relationship with you; or combine it with personal information we receive from anyone else, except as the law permits. We won't use it to train AI models, and our subprocessors don't either. We'll tell you if we can no longer meet these obligations.

5. Confidentiality

Only Kolophi staff who need access to provide or support the service may access customer personal data, and each is bound to keep it confidential.

6. Security

We keep the measures in our security overview, or measures at least as protective, including: a separate server, disk and identities for each customer; read-only access to your systems; encryption in transit and at rest; sign-in limited to people your administrators add; roles and ethical walls; an append-only, hash-chained audit log; and daily backups kept for 30 days.

7. Subprocessors

You authorize the subprocessors on our subprocessors page. We bind each to data protection terms at least as protective as these, and we're responsible for their work. We'll email your administrators at least 30 days before adding or replacing a subprocessor that would receive customer personal data. If you object on reasonable data protection grounds and we can't resolve it, you may cancel before the change, and we'll refund any fees paid for the time after it.

8. Helping you

• People's requests. Kolophi lets your people find, export, correct and destroy records. If someone asks us directly about their information in your records, we'll pass the request to you and won't answer it ourselves unless you tell us to.
• Breaches. If we confirm a breach of security that leads to the loss or unauthorized disclosure of, or access to, customer personal data, we'll tell your administrators within 72 hours, with what we know of its nature, the data affected and what we're doing, and keep you informed as we learn more.
• Assessments. We'll give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator about Kolophi.

9. When the subscription ends

When your subscription ends at your request, we destroy all customer personal data at once, including every backup, confirm with each provider that each item is gone, and send you a certificate of destruction signed with Kolophi's key, as the Terms describe. If it ends because a payment failed, we first keep it, with its server stopped, for 30 days. We keep no copy afterwards, except the record of what we destroyed and the certificate, which contain nothing from your records. Export what you want to keep before it ends.

10. Audits

We'll answer your reasonable written questions about how we meet this agreement, including security questionnaires, and make our security overview and subprocessor list available. Where a regulator requires it, or after a breach that affected your data, we'll also cooperate with an audit by you or an independent auditor bound by confidentiality, at a reasonable time and at your cost.

11. Where data is processed

We and our subprocessors process customer personal data in the United States. If a law requires a transfer mechanism for data coming from elsewhere, such as the EU Standard Contractual Clauses, contact us before connecting such data and we'll put one in place.

12. Health information

Kolophi isn't offered under a HIPAA business associate agreement. If your firm is a covered entity or business associate for records you'd connect, contact us first.

13. General

If this agreement and the Terms conflict about customer personal data, this agreement governs. The Terms' limits on liability apply to this agreement. Illinois law governs it.