Data Processing Addendum
Last Updated: October 23, 2026
This Data Processing Addendum (“DPA”) is entered into between New Vintage Labs, Inc., a Delaware corporation (“New Vintage,” “Provider,” “we,” “us,” or “our”), and the customer identified in the Agreement (“Customer”) and forms part of the Agreement. This DPA applies to Provider’s Processing of Customer Personal Data on Customer’s behalf in connection with the Services.
This DPA becomes effective on the date Customer accepts or enters into the Agreement, accepts this DPA through a clickwrap or other legally valid electronic process, or, for an Enterprise or other separately negotiated transaction, executes this DPA (the “DPA Effective Date”). Capitalized terms used but not defined in this DPA have the meanings given in the Terms of Service, Acceptable Use Policy, Privacy Policy, or applicable Platform Agreement, as the context requires. If there is a conflict concerning the Processing of Customer Personal Data, this DPA controls over the Agreement. An applicable Security Exhibit or service-level agreement controls only for its stated subject matter.
1. Definitions
“Applicable Data Protection Law” means any U.S. federal, state, or local law applicable to Provider’s Processing of Customer Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and regulations issued under it (“CCPA”), and other applicable U.S. comprehensive privacy laws.
“Business,” “Business Purpose,” “Consumer,” “Controller,” “Covered Business,” “Personal Data,” “Personal Information,” “Process,” “Processor,” “Sale,” “Service Provider,” “Share,” “Subprocessor,” and “Targeted Advertising” have the meanings given under Applicable Data Protection Law. “Processing” and “Processed” have corresponding meanings.
“Customer Personal Data” means Personal Data contained in Customer Data that Provider Processes on Customer’s behalf in connection with the Services. Customer Personal Data excludes Personal Data that Provider Processes for its own independent business purposes as described in the Privacy Policy.
“Data Subject” means the identified or identifiable individual to whom Customer Personal Data relates.
“Security Incident” means a confirmed breach of Provider security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by Provider. Security Incident excludes unsuccessful attempts or activities that do not compromise Customer Personal Data, including pings, scans, denial-of-service attempts, blocked attacks, and failed login attempts.
“Services” means the New Vintage B2B winery data and AI platform and associated website, application, Data Agent, APIs, integrations, MCP Service, support, and related services provided under the Agreement.
2. Scope, Roles, and Instructions
2.1 Roles.
As between the parties, Customer is the Controller, Business, or Covered Business, and Provider is the Processor or Service Provider with respect to Customer Personal Data, except to the extent Applicable Data Protection Law provides otherwise. Each party is responsible for complying with obligations applicable to its role. Customer determines the purposes and means of Processing Customer Personal Data, subject to the functionality of the Services.
2.2 Instructions.
Customer instructs Provider to Process Customer Personal Data as necessary to: (a) provide, authenticate, secure, administer, maintain, support, and improve the Services for Customer; (b) connect, sync, normalize, analyze, segment, visualize, export, and otherwise Process Customer-authorized winery data; (c) generate requested AI-assisted analyses and outputs; (d) execute Customer-authorized actions in connected systems; (e) provide support and troubleshoot; (f) detect and prevent fraud, abuse, and security threats; (g) comply with the Agreement and documented Customer instructions; and (h) comply with applicable law. The Agreement, Customer’s configuration and use of the Services, and written instructions accepted by Provider constitute Customer’s documented instructions.
2.3 Additional Instructions.
Provider is not obligated to comply with instructions that are inconsistent with the Agreement, technically infeasible, unlawful, or outside the scope of the Services. Additional instructions may require a written amendment and additional Fees. If Provider believes an instruction violates Applicable Data Protection Law, Provider may suspend the affected Processing and notify Customer, unless legally prohibited.
2.4 Customer Responsibilities.
Customer represents and warrants that: (a) it has provided all notices and obtained all rights, permissions, consents, and lawful bases necessary for the Processing described in this DPA; (b) its instructions comply with Applicable Data Protection Law; (c) it will not provide unsupported regulated data prohibited by the Agreement or AUP; and (d) it is responsible for the accuracy, quality, legality, and minimization of Customer Personal Data. Customer is responsible for responding to Data Subjects except to the extent Provider is legally required to respond directly.
3. Processing Requirements
3.1 Limited Processing.
Provider will Process Customer Personal Data only on Customer’s documented instructions, as necessary to provide and secure the Services, or as required by law. If law requires Processing beyond Customer’s instructions, Provider will notify Customer before the Processing unless law prohibits notice.
3.2 No Sale or Targeted Advertising.
Provider will not Sell or Share Customer Personal Data, retain, use, or disclose Customer Personal Data outside the direct business relationship between Provider and Customer, or combine Customer Personal Data with Personal Data received from another person or collected from Provider’s own interaction with a Data Subject, except as permitted by Applicable Data Protection Law for a Service Provider or Processor and as necessary to perform the Business Purposes described in this DPA.
3.3 Model Training.
Provider will not use raw or identifiable Customer Personal Data, AI Customer Input, or AI Customer Output to train or fine-tune generalized artificial-intelligence models. Provider will configure Provider-selected AI model services not to use Customer Personal Data for generalized model training where the applicable service and commercial terms support that configuration. Third-party model providers may Process Customer Personal Data to generate requested results and operate the Services, but such Processing does not authorize Provider to use Customer Personal Data for training. Customer-selected AI clients, MCP-connected services, and integrations may Process information under their own terms and configurations, and Customer is responsible for reviewing and authorizing those services. Any future training or fine-tuning by Provider using raw Customer Personal Data requires Customer’s express opt-in and a separate written agreement.
3.4 Aggregated and Deidentified Information.
Provider may create and use aggregated or deidentified information for service improvement, evaluation, security, analytics, benchmarking, research, and model-performance testing, provided Provider applies reasonable deidentification and aggregation safeguards, does not attempt to reidentify the information except as permitted by law to test deidentification, and does not disclose information that identifies Customer or a Data Subject. Such information is not Customer Personal Data to the extent excluded from Applicable Data Protection Law.
3.5 Confidentiality.
Provider will ensure that personnel authorized to Process Customer Personal Data are subject to obligations of confidentiality or an appropriate statutory duty of confidentiality and access Customer Personal Data only as necessary for their responsibilities.
3.6 Compliance Verification.
Provider will comply with applicable Service Provider and Processor obligations and will provide the level of privacy protection required by Applicable Data Protection Law. Customer may take reasonable and appropriate steps to help ensure Provider uses Customer Personal Data consistently with Customer’s obligations. If Customer reasonably determines that Provider is engaged in unauthorized Processing, Customer will notify Provider and provide a reasonable opportunity to stop and remediate the Processing. Provider will notify Customer if Provider determines it can no longer meet an applicable obligation under Applicable Data Protection Law.
4. Security
4.1 Security Measures.
Provider will maintain commercially reasonable administrative, technical, and physical safeguards designed to protect Customer Personal Data against Security Incidents. The current measures are summarized in Schedule 2. Provider may modify the measures from time to time, provided it does not materially decrease the overall security of the Services during an active subscription term.
4.2 Customer Security.
Customer is responsible for secure account configuration, user administration, permissions, credentials, endpoints, integrations, and Customer systems. Customer will promptly notify Provider of suspected credential compromise or unauthorized access and reasonably cooperate in remediation.
5. Security Incidents
5.1 Notice.
Provider will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data. Notice will be sent to Customer’s designated account, security, or legal contact. Provider’s notice is not an admission of fault or liability.
5.2 Information and Cooperation.
To the extent known and reasonably available, Provider will provide information concerning the nature of the Security Incident, categories of affected Customer Personal Data and Data Subjects, likely consequences, and measures taken or proposed to address the Security Incident. Provider may provide information in phases as it becomes available and will provide reasonable cooperation required for Customer to satisfy applicable notice obligations.
5.3 Response Control.
Provider will take commercially reasonable steps to contain, investigate, mitigate, and remediate a Security Incident within Provider-controlled systems. Customer is responsible for notices to Data Subjects, regulators, and third parties unless Applicable Data Protection Law requires Provider to provide notice directly. Neither party will identify the other in a public statement concerning a Security Incident without prior consultation, except as legally required.
6. Data Subject Requests and Regulatory Assistance
6.1 Requests.
Taking into account the nature of the Processing, Provider will provide Customer with commercially reasonable assistance through available functionality or other reasonable means to respond to verified Data Subject requests to access, correct, delete, or obtain a portable copy of Customer Personal Data, or exercise other applicable rights. If Provider receives a request relating to Customer Personal Data, Provider may direct the requester to Customer and will not respond substantively except on Customer’s documented instructions or as required by law.
6.2 Assistance.
Taking into account the nature of the Processing and information available to Provider, Provider will provide commercially reasonable assistance with Customer’s obligations concerning security, breach notification, data-protection assessments, and regulator inquiries under Applicable Data Protection Law. Provider may charge reasonable Fees for assistance that is unusually burdensome, repetitive, or outside standard Services, unless the assistance is required because of Provider’s breach of this DPA.
7. Subprocessors
7.1 Authorization.
Customer generally authorizes Provider to engage Subprocessors to Process Customer Personal Data. Current categories and known providers are described in Schedule 3 or on Provider’s subprocessor page at https://newvintage.ai/subprocessors. Customer authorizes Provider and its Subprocessors to transmit Customer Personal Data to Customer-selected integrations and AI clients as directed through Customer’s use and configuration of the Services.
7.2 Requirements.
Provider will enter into a written agreement with each Subprocessor that imposes data-protection obligations appropriate to the nature of the Processing and substantially consistent with this DPA. Provider remains responsible for a Subprocessor’s performance of those obligations to the extent required by Applicable Data Protection Law, subject to the Agreement’s limitations of liability.
7.3 Changes and Objections.
Provider may add or replace Subprocessors. Provider will provide notice of material changes through its subprocessor page, email, or another reasonable mechanism at least 15 days before a new Subprocessor begins Processing Customer Personal Data where reasonably practicable. Customer may object during that period on reasonable, documented data-protection grounds. The parties will attempt in good faith to resolve the objection. If they cannot, Provider may avoid use of the Subprocessor, offer a commercially reasonable alternative, or permit Customer to terminate the affected Services as Customer’s exclusive remedy, with a prorated refund of prepaid unused recurring Fees for those Services.
8. Audits and Information
8.1 Information.
Upon written request no more than once annually, Provider will make available information reasonably necessary to demonstrate compliance with this DPA, which may include completed security questionnaires, summaries of controls, or available third-party reports. Provider is not required to disclose information that would compromise security, confidentiality, privilege, or another customer’s information.
8.2 Audit.
If the information provided under Section 8.1 is not reasonably sufficient and Applicable Data Protection Law requires an audit, Customer may request a reasonable audit. The parties will agree in advance on scope, timing, duration, confidentiality, security, and allocation of costs. Audits must occur during normal business hours, minimize disruption, use an independent qualified auditor that is not a Provider competitor, and exclude penetration testing and access to data of other customers. Customer bears audit costs unless the audit identifies a material breach by Provider.
9. Return, Export, and Deletion
During the Term, Customer may export segments and Data Agent result artifacts as CSV through available functionality and may request a fuller export where commercially reasonable. Customer has no post-termination export period unless an Order states otherwise. Upon uninstall, expiration, or termination, Provider may disable access immediately and will delete Customer tenant data within sixty days, unless retention is required by law or permitted for archival backups, billing, fraud prevention, security, audit, dispute resolution, or enforcement. Retained Customer Personal Data remains protected by this DPA and will not be Processed for other purposes. Generated CSV artifacts default to seven days; segment results retain the latest four successful runs; and conversation deletion currently operates as a soft delete. Except for these periods and the sixty-day post-termination deletion period stated above, Provider does not currently maintain fixed retention periods for customer data, user accounts, prompts and outputs, logs, analytics data, backups, billing records, or vendor-held copies. Such information may be retained during the Term as reasonably necessary to provide, secure, administer, and improve the Services and thereafter only as permitted by this Section.
10. Data Location and International Transfers
Provider generally hosts Customer Personal Data in the United States. Customer acknowledges, however, that Cloudflare operates a global edge network and may Process limited network and routing data outside the United States based on the location nearest the user. Customer-selected integrations, AI clients, MCP-connected services, and other third-party services may also Process information in locations determined by their own terms and configurations. The Services are not targeted to users outside the United States, and any non-U.S. Personal Data submitted through the Services is expected to be incidental. Customer will not use the Services to transfer Customer Personal Data in a manner requiring an international transfer mechanism unless the parties first enter into additional terms and Provider confirms operational support. If Provider later supports regulated international transfers, the parties will incorporate an appropriate transfer mechanism by written amendment.
11. Liability; Indemnification
Each party’s liability arising out of or relating to this DPA is subject to the exclusions, limitations, indemnification obligations, and other risk-allocation provisions in the Agreement. This DPA does not enlarge either party’s liability or create additional indemnification obligations. If the Agreement contains a negotiated super-cap for confidentiality, security, privacy, or indemnification obligations, that super-cap applies to claims under this DPA as stated in the Agreement.
12. Term and Termination
This DPA remains in effect for as long as Provider Processes Customer Personal Data on Customer’s behalf. Termination of the Agreement terminates this DPA, except provisions that by their nature should survive, including confidentiality, deletion, audit limitations, liability, and restrictions on retained Customer Personal Data.
13. General
This DPA is governed by the governing-law and dispute-resolution provisions of the Agreement. Amendments must be in writing or accepted through a legally valid electronic process. If a provision is unenforceable, it will be modified to the minimum extent necessary, and the remainder remains in effect. The parties may execute this DPA in counterparts and by electronic signature. If Customer executes this DPA separately, the signature block below applies.
NEW VINTAGE LABS, INC.
By: ______________________________
Name: ______________________________
Title: ______________________________
Date: ______________________________
CUSTOMER: [LEGAL NAME]
By: ______________________________
Name: ______________________________
Title: ______________________________
Date: ______________________________
Schedule 1: Details of Processing
Subject Matter
Processing Customer Personal Data to provide the New Vintage B2B winery data and AI platform, including data connection and normalization, segmentation, analytics, Data Agent functionality, dashboards, exports, integrations, authorized connected-system actions, APIs, MCP Services, support, security, billing, and administration.
Duration
For the Term and the deletion or retention periods described in the Agreement and this DPA.
Nature and Purpose
Collection, receipt, access, hosting, storage, organization, normalization, retrieval, analysis, segmentation, prediction, generation, transmission, display, export, synchronization, support, monitoring, security, deletion, and other Processing necessary to provide and secure the Services on Customer’s instructions. Segmentation, analytics, and prediction features are decision-support tools for winery customers and are not intended to make solely automated decisions producing legal or similarly significant effects concerning individuals.
Categories of Data Subjects
Customer’s Authorized Users; winery customers, contacts, members, purchasers, reservation holders, shipment recipients, and marketing recipients represented in Customer-provided data; Customer personnel, agents, contractors, and business contacts; and other individuals whose Personal Data Customer submits through authorized connected systems.
Categories of Customer Personal Data
Names, email addresses, phone numbers, postal addresses, organization and tenant information, account and role data, authentication and login records, dates of birth or age-confirmation fields, order and transaction data, products, club memberships, reservations, shipping information, payment references, marketing engagement and consent status, notes, segments, profiles, prompts, generated outputs, feedback, conversation metadata, subscription and billing information, browser and device data, cookies and similar identifiers, telemetry, session information, session-replay recordings, and access, security, application, infrastructure, and error logs. Provider does not intentionally collect or retain IP addresses as a separate category of Customer Personal Data, although infrastructure and network providers may Process IP addresses transiently to route, secure, and deliver the Services.
Sensitive or Special Data
The Services are not intended for protected health information, consumer-health data, full payment-card or financial-account data, government identification numbers, biometric identifiers, precise geolocation, children’s data, or other highly sensitive or unsupported regulated data unless expressly authorized in writing under appropriate terms and controls.
Frequency
Continuous or as initiated by Customer and Authorized Users during the Term.
Customer Instructions
The Agreement, this DPA, applicable Orders, Customer’s use and configuration of the Services, and additional written instructions accepted by Provider.
Schedule 2: Technical and Organizational Measures
Provider maintains measures designed to protect Customer Personal Data. Current measures include the following, subject to ongoing development and change consistent with Section 4.1:
Identity and Access Management. WorkOS-managed identity and SSO; signed-token verification; tenant-scoped access checks; admin/member authorization; need-based access; managed secrets and integration-token references; and MCP session revocation.
Tenant and Application Controls. Tenant-isolation controls, tenant-aware authorization checks, supported organizational access features, and limits designed to prevent unauthorized cross-tenant access.
Encryption and Transport. Encryption for data at rest through managed hosting and database environments; HTTPS/TLS for production website, API, and MCP traffic.
Infrastructure and Availability. AWS and Supabase managed database and hosting controls; Cloudflare routing and DNS; Trigger.dev background job execution; infrastructure alarms and exception capture.
Logging, Monitoring, and Session Replay. Application, access, infrastructure, security, and error logging; privacy-filtered MCP telemetry; product analytics; and investigation capabilities for suspected incidents and abuse. PostHog session replay is enabled and hosted in the United States (AWS, Virginia). Default masking covers passwords, payment fields, and sensitive headers, and access to recordings is limited to named internal project members.
Credential and Integration Security. Individual credentials; access-token and API/MCP credential restrictions; managed secret references; integration authorization controls; and revocation capabilities.
Data Lifecycle. Daily cleanup for generated Data Agent CSV artifacts with a seven-day default; retention of the latest four successful segment runs; soft-delete functionality for conversations; and account/integration-disconnection capabilities.
Payment Security. Stripe-hosted payment processing; Provider does not intentionally store full payment-card or bank-account numbers.
Incident Response. Technical and operational capabilities to detect, log, investigate, contain, mitigate, and remediate suspected incidents and to coordinate with relevant providers. Provider is developing its formal written security and incident-response program; this Schedule does not represent that Provider currently maintains formal written policies, testing requirements, evidence-preservation procedures, or security certifications. Provider may engage counsel or forensic specialists as appropriate.
Personnel and Confidentiality. Access limited by role and business need and personnel confidentiality obligations. Internal MFA is used where implemented. Customer-user MFA is not currently represented as universally available, although Provider anticipates offering or requiring it in the future.
No representation is made in this Schedule that Provider has completed a formal security audit or certification, maintains a trust center, or offers standardized audit reports, unless Provider separately confirms that fact in writing.
Schedule 3: Current Subprocessors and Processing Categories
AWS
Purpose: Hosting and infrastructure. Location: United States
Supabase
Purpose: Database and hosting. Location: United States
Cloudflare
Purpose: Routing, DNS, security, and content delivery. Location: Global edge network; processing may occur outside the United States.
WorkOS
Purpose: Identity, authentication, and SSO. Location: United States
Stripe
Purpose: Payment and subscription processing. Location: United States
Trigger.dev
Purpose: Background-job orchestration. Location: United States
PostHog
Purpose: Product analytics and session replay where enabled. Location: United States
OpenAI, Anthropic
Purpose: AI model inference and generation. Location: United States
Braintrust, when enabled
Purpose: AI observability and evaluation. Location: United States
Customer-selected integrations, including Commerce7, Klaviyo, RedChirp, Claude, ChatGPT, and other approved integrations
Purpose: Customer-directed data exchange and functionality. Location: As selected and configured by Customer; independent terms may apply
Schedule 4: U.S. State Privacy Terms
1. California.
To the extent the CCPA applies and Customer is a Business and Provider is a Service Provider, Customer discloses Customer Personal Data to Provider only for the limited and specified Business Purposes described in this DPA. Provider will not: (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose it for a commercial purpose other than the specified Business Purposes or as otherwise permitted by the CCPA; (c) retain, use, or disclose it outside the direct business relationship; or (d) combine it with Personal Information received from another person or collected from Provider’s own interactions with a Consumer, except as permitted by the CCPA. Provider will comply with applicable Service Provider obligations, provide the same level of privacy protection required of Businesses, notify Customer if it can no longer comply, and permit Customer to take reasonable and appropriate steps to help ensure compliant use and to stop and remediate unauthorized use.
2. Other States.
To the extent another U.S. comprehensive privacy law applies and Customer is a Controller and Provider is a Processor, Provider will: (a) Process Customer Personal Data according to Customer’s instructions; (b) ensure persons Processing Customer Personal Data are subject to confidentiality; (c) engage Subprocessors under written contracts; (d) provide reasonable assistance with Data Subject rights, security, breach response, and assessments; (e) make compliance information available as described in Section 8; and (f) delete or return Customer Personal Data as described in Section 9, subject to lawful retention.
3. Conflicts.
If this Schedule conflicts with the body of the DPA, this Schedule controls solely to the minimum extent required by Applicable Data Protection Law.