Effective date: October 28, 2026
This Data Processing Addendum (“DPA”) forms part of the ioLoop Terms of Service or another written agreement between Tvara LLC (“Tvara”) and the customer identified in that agreement (“Customer”) governing Customer’s use of ioLoop (the “Agreement”).
This DPA applies when Tvara processes Customer Personal Data on Customer’s behalf in connection with the Services. By entering into the Agreement, Customer enters into this DPA on behalf of itself and, where required by Applicable Data Protection Law, its authorized affiliates. If there is a conflict concerning the processing of Customer Personal Data, the following order of precedence applies: the applicable Standard Contractual Clauses, this DPA, and then the Agreement.
Capitalized terms not defined in this DPA have the meanings given in the Agreement.
- “Applicable Data Protection Law” means laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (“CCPA”), the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the EU ePrivacy Directive, the United Kingdom GDPR and Data Protection Act 2018 (“UK Data Protection Law”), and the Swiss Federal Act on Data Protection (“Swiss FADP”).
- “Controller” means the entity that determines the purposes and means of processing personal data, including a “business” under the CCPA.
- “Customer Personal Data” means personal data contained in Customer Content that Tvara processes on Customer’s behalf to provide the Services. It does not include personal data for which Tvara determines the purposes and means of processing, such as account administration, billing, security, or direct business-relationship information addressed by the ioLoop Privacy Policy.
- “Data Subject” means an identified or identifiable person to whom Customer Personal Data relates, including a “consumer” under the CCPA.
- “EU SCCs” means the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914, as amended or replaced.
- “Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Tvara.
- “Processor” means an entity that processes personal data on behalf of a Controller, including a “service provider” or “contractor” under the CCPA where applicable.
- “process,” “processing,” “personal data,” and related terms have the meanings given by Applicable Data Protection Law.
- “Subprocessor” means a third party appointed by Tvara to process Customer Personal Data on Customer’s behalf in connection with the Services.
- “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced.
Customer is the Controller of Customer Personal Data or a Processor acting on behalf of another Controller. Tvara is a Processor of Customer Personal Data. Each party will comply with the obligations that apply to it under Applicable Data Protection Law.
Customer is responsible for:
- providing all required notices and obtaining all required rights, permissions, and lawful bases for Tvara to process Customer Personal Data under the Agreement;
- ensuring that its instructions comply with Applicable Data Protection Law;
- configuring and using the Services appropriately for the nature of the Customer Personal Data; and
- responding to Data Subjects and regulators except to the extent this DPA requires Tvara’s assistance.
The subject matter, duration, nature, purpose, types of Customer Personal Data, and categories of Data Subjects are described in Schedule 1.
Tvara will process Customer Personal Data only:
- to provide, secure, maintain, and support the Services;
- as documented in the Agreement, this DPA, Customer’s configuration and use of the Services, and other written instructions agreed by the parties; or
- as required by applicable law, in which case Tvara will inform Customer before processing unless the law prohibits notice on important grounds of public interest.
The Agreement and Customer’s authorized use of the Services constitute Customer’s documented instructions. Tvara will promptly inform Customer if, in Tvara’s opinion, an instruction infringes Applicable Data Protection Law. Tvara may suspend performance of the affected instruction while the parties work in good faith to resolve the issue.
Tvara will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use it for targeted advertising. Tvara will not use Customer Personal Data to train generalized AI models. Customer acknowledges that Customer-selected third-party integrations are not Subprocessors when Tvara transmits Customer Personal Data to them solely at Customer’s direction. Use of an OAuth application registered by Tvara to authenticate a Customer-selected integration does not, by itself, change that classification.
Tvara will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only as necessary for their responsibilities. Tvara will take reasonable steps to ensure that authorized personnel understand relevant privacy and security obligations.
Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the risks to individuals, Tvara will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures currently maintained by Tvara are described in Schedule 2.
Customer is responsible for reviewing the information Tvara makes available about security and independently determining whether the Services meet Customer’s requirements. Customer will use available security controls appropriately, protect account credentials, configure permissions, maintain reasonable security for Customer-controlled systems and integrations, and maintain independent backups appropriate to its needs.
Tvara may update its security measures as technology and the Services evolve, provided the updates do not materially reduce the overall protection of Customer Personal Data during an active subscription.
Tvara will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include information reasonably available to Tvara that Customer needs to meet applicable notification obligations, such as the nature of the breach, likely consequences, affected data and individuals, and measures taken or proposed. Tvara may provide information in phases as it becomes available.
Tvara will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach. Tvara’s notice or response does not constitute an admission of fault or liability. Customer is responsible for determining whether to notify Data Subjects, regulators, or others, and for the content of those notices.
Unsuccessful attempts or events that do not compromise the security of Customer Personal Data—including scans, pings, failed login attempts, denial-of-service attacks, and attacks blocked by security controls—are not Personal Data Breaches under this DPA.
Taking into account the nature of processing, Tvara will provide reasonable assistance through available Service functionality and, where that is insufficient, reasonable additional assistance for Customer to respond to requests to exercise rights under Applicable Data Protection Law.
If Tvara receives a request directly from a Data Subject concerning Customer Personal Data, Tvara will advise the requester to contact Customer and, where reasonably identifiable, notify Customer. Tvara will not independently respond to the substance of the request unless Customer instructs it to do so or applicable law requires it.
Taking into account the nature of processing and information available to Tvara, Tvara will provide reasonable assistance with Customer’s obligations concerning security, breach notifications, data-protection impact assessments, and prior consultations with supervisory authorities. Tvara may charge reasonable fees for assistance that is unusually burdensome or outside standard Service functionality, unless the assistance is required because Tvara breached this DPA.
Customer gives Tvara general written authorization to appoint Subprocessors. Tvara’s current Subprocessor List is available at
https://ioloop.com/sub-processors and forms part of this DPA.
Tvara will:
- enter into a written agreement with each Subprocessor imposing data-protection obligations appropriate to the processing and no less protective in material respects than the obligations imposed on Tvara by this DPA;
- remain responsible to Customer for the Subprocessor’s performance of its data-protection obligations to the extent required by Applicable Data Protection Law; and
- provide at least 15 days’ advance notice before authorizing a new Subprocessor to process Customer Personal Data, ordinarily by email, an account notice, or an update mechanism offered with the Subprocessor List.
Customer may object to a new Subprocessor on reasonable data-protection grounds by emailing
[email protected] within the notice period and explaining the grounds. The parties will work in good faith to identify a commercially reasonable solution. If no solution is reasonably available, Customer may stop using the affected feature or terminate the affected portion of the Services before the Subprocessor begins processing. Unless required by law, termination under this paragraph is Customer’s sole remedy for the objection and does not entitle Customer to a refund for periods before termination.
Tvara may appoint or replace a Subprocessor without advance notice when reasonably necessary to address an emergency, security risk, service outage, legal requirement, or comparable urgent situation. Tvara will provide notice as soon as reasonably practicable afterward.
During the subscription, Customer may use available functionality to access or export Customer Personal Data. Following termination or expiration of the affected Services, Tvara will delete or return Customer Personal Data in accordance with the Agreement and Customer’s written choice, unless applicable law requires retention.
Customer instructs Tvara to delete Customer Personal Data after the applicable account closure, retention, backup-rotation, and wind-down periods. Customer Personal Data may remain in backups until overwritten under Tvara’s normal retention cycle, provided it remains protected and is not restored except for disaster recovery, security, or legal purposes. Tvara may retain information that has been aggregated or de-identified so that it no longer identifies Customer or any Data Subject.
Tvara will make available information reasonably necessary to demonstrate compliance with this DPA. If that information is insufficient, Customer may request an audit no more than once in any 12-month period, except after a confirmed Personal Data Breach affecting Customer Personal Data or when a regulator requires a more frequent audit.
Audits must:
- be limited to systems and records relevant to Customer Personal Data;
- occur during normal business hours with at least 30 days’ advance written notice unless an urgent regulatory requirement prevents it;
- avoid unreasonable disruption and protect other customers’ information and Tvara’s confidential information;
- be performed by Customer or an independent auditor that is not Tvara’s competitor and is bound by confidentiality; and
- use existing reports, certifications, questionnaires, and remote review before an on-site inspection.
Customer will bear its audit costs and reimburse Tvara’s reasonable costs for assistance beyond routine compliance information, unless the audit identifies a material breach by Tvara. The parties will agree on reasonable scope, timing, duration, and security controls before an audit begins. Nothing in this Section limits a competent supervisory authority’s lawful powers.
To the extent the CCPA applies to Customer Personal Data, Tvara acts as a service provider or contractor and agrees that:
- Customer discloses Customer Personal Data to Tvara only for the limited and specified business purposes described in Schedule 1;
- Tvara will not sell or share Customer Personal Data;
- Tvara will not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for a commercial purpose other than the limited and specified purposes in Schedule 1, except as permitted by the CCPA;
- Tvara will not combine Customer Personal Data with personal information received from another person or collected from Tvara’s own interaction with a consumer, except as permitted by the CCPA;
- Tvara will comply with applicable CCPA obligations and provide the same level of privacy protection required of Customer for Customer Personal Data;
- Customer may take reasonable and appropriate steps consistent with Section 11 to help ensure Tvara uses Customer Personal Data consistently with Customer’s CCPA obligations;
- Tvara will notify Customer if it determines it can no longer meet its CCPA obligations; and
- Customer may, after notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.
Each party certifies that it understands and will comply with the restrictions in this Section.
Customer authorizes Tvara and its Subprocessors to process Customer Personal Data in the United States and other countries where they operate, subject to this DPA and Applicable Data Protection Law. Tvara does not commit to a particular data-hosting location unless the parties expressly agree otherwise in writing. Current Subprocessor processing locations are described in the Subprocessor List.
If Customer’s transfer of Customer Personal Data to Tvara requires a legally recognized transfer mechanism:
- for transfers governed by the EU GDPR, the EU SCCs apply as completed in Schedule 3;
- for transfers governed by UK Data Protection Law, the EU SCCs as completed in Schedule 3 apply together with the UK Addendum completed in Schedule 4; and
- for transfers governed by the Swiss FADP, the EU SCCs apply with references to the EU GDPR understood to include the Swiss FADP, references to the European Union and Member State understood to include Switzerland, and the competent supervisory authority and courts determined under the Swiss FADP.
An applicable adequacy decision or other valid transfer mechanism takes precedence over the transfer terms above for as long as it lawfully covers the transfer. Tvara will provide information and reasonable cooperation needed for a legally required transfer assessment. If a transfer mechanism becomes invalid, the parties will cooperate in good faith to implement a valid replacement.
This DPA does not apply when Tvara processes personal data as an independent Controller for its own legitimate purposes, such as managing customer accounts and contacts, processing billing and transactions, securing and improving the Services using service and diagnostic data, communicating with Customer, complying with law, and establishing or defending legal claims. The ioLoop Privacy Policy governs that processing.
Each party’s liability arising from this DPA is subject to the exclusions and limitations of liability in the Agreement to the extent permitted by Applicable Data Protection Law. Nothing in this DPA limits Data Subject rights under the Standard Contractual Clauses or liability that cannot lawfully be limited.
This DPA terminates when Tvara no longer processes Customer Personal Data, except provisions that by their nature must survive. Any amendment to this DPA must be in writing, except Tvara may update it when reasonably necessary to comply with Applicable Data Protection Law or replace an invalid transfer mechanism. Tvara will provide notice of material changes as required by law or the Agreement.
Questions or notices about this DPA should be sent to:
Tvara LLC5480 Sunol Blvd, Ste 2
Pleasanton, CA 94566
Email:
[email protected]Website:
https://ioloop.com Data exporter: Customer and any authorized affiliate covered by this DPA. Customer’s identity, address, contact details, and activities are described in the Agreement or Customer’s ioLoop account. Customer is a Controller or Processor, as applicable.
Data importer: Tvara LLC, at the address stated in Section 16, contactable at
[email protected]. Tvara operates ioLoop and processes Customer Personal Data as a Processor to provide the Services.
The parties are deemed to have signed this Schedule when Customer accepts or signs the Agreement.
Tvara processes Customer Personal Data to provide, host, store, transmit, secure, maintain, and support the Services and Customer Projects. Processing lasts for the term of the Agreement plus the limited deletion, backup, legal-retention, and wind-down periods described in this DPA.
Processing may include collection, receipt, organization, storage, hosting, retrieval, consultation, use, transmission, disclosure to authorized recipients, support access, security monitoring, backup, restoration, alteration at Customer’s direction, restriction, deletion, and return.
The limited and specified business purposes are to:
- provide and operate the Services and Customer Projects;
- host, store, transmit, back up, and restore Customer Content;
- authenticate users and administer Customer-selected permissions;
- execute Customer-selected application, database, workflow, integration, and AI functionality;
- provide technical support at Customer’s request;
- maintain availability, performance, reliability, and security;
- detect, prevent, and investigate fraud, abuse, vulnerabilities, and security incidents;
- enforce usage and resource limits; and
- comply with Customer’s documented instructions and applicable legal obligations.
Data Subjects may include:
- Customer’s employees, contractors, representatives, administrators, authorized users, and collaborators;
- End Users and visitors of Customer Projects;
- Customer’s customers, prospects, suppliers, business partners, and other contacts; and
- other individuals whose personal data Customer or its users submit to the Services.
The types depend on Customer’s choices and may include:
- identity, contact, profile, organization, account, and authentication data;
- IP addresses, device data, log data, activity records, and online identifiers;
- project content, source code, files, images, media, database records, form submissions, and communications;
- transaction, order, subscription, and business records processed by a Customer Project;
- prompts, instructions, conversation content, model responses, tool results, and knowledge sources;
- credentials, tokens, secrets, connection settings, and integration data; and
- any other personal data Customer chooses to include in Customer Content.
Customer controls the data submitted to the Services. Customer must not submit regulated or sensitive data prohibited by the Agreement. Depending on Customer’s lawful use, Customer Personal Data could reveal sensitive information, including credentials, precise location, financial information, or information revealing protected characteristics. Tvara does not intentionally require sensitive data to provide the general Services.
Processing is continuous or occurs as initiated by Customer and its authorized users during the term of the Agreement.
Customer Personal Data is retained for the term of the Agreement and deleted or returned as described in Section 10, subject to applicable backup cycles and legally required retention. Cloudflare AI Gateway logs used for ioLoop-managed AI requests are configured to retain a rolling maximum of the most recent 100,000 requests. Their retention duration therefore varies with request volume and is not based on a fixed period. Tvara has disabled optional API call logging and data sharing in its OpenAI organization, but OpenAI may retain Customer Personal Data in abuse-monitoring logs for up to 30 days, subject to legal and safety exceptions in OpenAI’s applicable terms.
The subject matter, nature, and duration of Subprocessor processing are limited to the services and locations described at
https://ioloop.com/sub-processors, for as long as needed to provide the relevant function.
Tvara’s measures appropriate to the Services and risk include the following, as applicable to the relevant Service component:
- unique accounts and authentication controls for systems containing Customer Personal Data;
- role- or responsibility-based authorization and least-privilege practices;
- processes to grant, review, and revoke personnel access; and
- logging or monitoring of relevant administrative and security activity where appropriate.
- encryption of network communications using industry-standard transport encryption where supported;
- encryption or equivalent protections for stored secrets and credentials where supported;
- logical separation of customer accounts, projects, and permissions;
- controls intended to prevent unauthorized disclosure or alteration; and
- secure handling of backups and stored data appropriate to their sensitivity.
- network, host, and application controls appropriate to the architecture;
- security updates, dependency maintenance, and vulnerability remediation based on risk;
- abuse-prevention, authentication, rate-limiting, and fraud controls where appropriate;
- development and change-management practices designed to reduce security defects; and
- restrictions on production access and use of protected configuration and secrets.
- monitoring and operational processes designed to maintain availability;
- backup and restoration measures appropriate to supported data and systems;
- incident-response and escalation procedures; and
- continuity and recovery planning appropriate to the Services.
- confidentiality obligations for authorized personnel;
- privacy and security awareness appropriate to personnel responsibilities;
- vendor assessment and contractual safeguards appropriate to processing risk;
- processes for responding to security incidents and Data Subject requests; and
- periodic review and adjustment of safeguards in light of changes to systems and risk.
These measures describe Tvara’s general security program and do not guarantee that every measure applies identically to every Service component. They do not create a certification, audit attestation, or compliance representation not expressly stated in the Agreement.
When the EU SCCs apply, they are incorporated by reference and completed as follows:
- Applicable module. Module Two applies when Customer is a Controller and Tvara is a Processor. Module Three applies when Customer is a Processor and Tvara is a subprocessor.
- Clause 7. The optional docking clause applies.
- Clause 9. Option 2, general written authorization, applies. The notice period is 15 days, subject to the urgent-replacement procedure in Section 9 of this DPA.
- Clause 11. The optional independent dispute-resolution language does not apply.
- Clause 13. The competent supervisory authority is determined under Clause 13. If no EU Member State supervisory authority is otherwise competent, the Irish Data Protection Commission will act as the competent supervisory authority to the extent permitted by the EU SCCs.
- Clause 17. Option 1 applies, and the EU SCCs are governed by the law of Ireland.
- Clause 18. The courts of Ireland have jurisdiction.
- Annex I.A. The parties and their roles are described in Schedule 1.
- Annex I.B. The transfer details are described in Schedule 1.
- Annex I.C. The competent supervisory authority is identified in paragraph 5 above.
- Annex II. The technical and organizational measures are described in Schedule 2.
- Annex III. The authorized Subprocessors are listed at https://ioloop.com/sub-processors.
For Module Three, Customer confirms that its Controller has authorized Tvara and Tvara’s Subprocessors as required by Applicable Data Protection Law and Customer’s agreement with that Controller. If Customer cannot provide required Controller information, Customer will provide it to Tvara upon request and remains responsible for its accuracy.
When the UK Addendum applies, it is incorporated by reference and completed as follows:
- Table 1 — Parties: The parties, contact details, and key contacts are identified in the Agreement and Schedule 1. The parties are deemed to sign the UK Addendum when they accept or sign the Agreement.
- Table 2 — Selected SCCs, modules, and clauses: The version of the Approved EU SCCs is the EU SCCs defined in this DPA. The selected module and optional clauses are specified in Schedule 3.
- Table 3 — Appendix information: The parties, processing details, technical and organizational measures, and Subprocessor list are provided in Schedules 1 through 3.
- Table 4 — Ending the Addendum: Neither party may end the UK Addendum solely as a result of the Information Commissioner issuing a revised approved addendum under Section 18 of the UK Addendum.
The parties agree to be bound by the following Alternative Part 2 Mandatory Clauses prescribed by the Information Commissioner:
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.
References in this DPA to the EU SCCs include the EU SCCs as modified by the UK Addendum for restricted transfers governed by UK Data Protection Law.
