Super.AI Enterprise Agreement

1.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a party, where control means ownership of more than fifty percent of the voting interests.

1.2 "API" means the application programming interfaces Super.AI makes available for submitting Customer Content to, and retrieving Outputs from, the Platform.

1.3 "Customer Content" means all documents, text, images, data and other material submitted to the Platform by or on behalf of Customer or its Users, including material retrieved from systems Customer connects to the Platform.

1.4 "Documentation" means the user documentation for the Platform that Super.AI makes available online, as updated from time to time.

1.5 "Order Form" means a document signed by both parties that identifies the Platform subscription, Professional Services, fees, term and any special terms purchased by Customer, and that incorporates this Agreement.

1.6 "Outputs" means the results the Platform generates from Customer Content, including extracted data, classifications, summaries, chat responses, redactions and the results of flows Customer configures, whether produced by an AI model or by a User working in the Platform's review tooling.

1.7 "Platform" means Super.AI's hosted document processing service, including the chat interface, document upload and processing, the flow builder, organisation and user management, review tooling, the API, and the Documentation, together with updates Super.AI makes generally available. The Platform excludes Third Party Services and any human review, labeling or annotation service.

1.8 "Professional Services" means implementation, configuration, integration or training services described in a Statement of Work.

1.9 "Statement of Work" or "SOW" means a document signed by both parties describing Professional Services and incorporating this Agreement.

1.10 "Subscription Term" means the period of Platform access stated in an Order Form, including renewals.

1.11 "Third Party Services" means products or services not provided by Super.AI that Customer chooses to connect to the Platform, such as storage, messaging or enterprise systems reached through an integration Customer configures.

1.12 "Users" means the employees, contractors and Affiliates' personnel whom Customer authorises to use the Platform under its account, including the personnel Customer assigns to review Outputs.

2.1 Order Forms. Customer purchases Platform subscriptions and Professional Services through Order Forms and SOWs. Each Order Form and SOW forms part of this Agreement. If an Order Form or SOW conflicts with this Agreement, the Order Form or SOW controls for that purchase only, and only where it refers to the section it varies.

2.2 Licence. For the Subscription Term, Super.AI grants Customer a non-exclusive, non-transferable right for its Users to access and use the Platform and the API, in accordance with the Documentation, for Customer's and its Affiliates' internal business purposes. Usage limits, such as user counts, credits or document volumes, are stated in the Order Form.

2.3 Restrictions. Customer will not, and will not permit anyone to: (a) sell, resell, rent or lease the Platform, or offer it to third parties as a service bureau; (b) reverse engineer or attempt to derive the source code of the Platform, except to the extent the law permits despite this restriction; (c) copy, modify or create derivative works of the Platform or Documentation; (d) interfere with the integrity or performance of the Platform, or attempt to gain unauthorised access to it; (e) use the Platform to build a competing product, or publish public benchmarks of it without Super.AI's written consent, which will not be unreasonably withheld for internal and regulatory evaluations; or (f) use the Platform in breach of section 5.

2.4 Reservation of Rights. Except for the rights expressly granted in this Agreement, Super.AI and its licensors retain all right, title and interest in the Platform, the Documentation and Super.AI's tools, models, templates and know-how.

3.1 What the Platform does. The Platform processes Customer Content with AI models and with flows Customer configures, and returns Outputs to Customer through the interface, the API and the integrations Customer chooses. The AI models are run for Super.AI by the model hosting providers named on the sub-processor page, which states where each provider processes data and under what transfer mechanism. Super.AI is the deployer of those models within the meaning of applicable AI regulation, and Customer is the deployer of the Platform within its own operations.

3.2 Outputs may be wrong. Outputs are generated by AI models. They may be inaccurate, incomplete or inconsistent, the same input may produce different Outputs, and Super.AI does not review Outputs before Customer sees them. Customer is responsible for evaluating Outputs before relying on them, for applying human review where the consequences of an error warrant it, and for any decision or action taken on the basis of an Output. Nothing in this section reduces Super.AI's obligations under sections 4, 9 and 16.

3.3 Review tooling; no human review services

The Platform includes review views in which Customer's Users can inspect, correct and approve Outputs. Under this Agreement, Super.AI does not provide human review, labeling, annotation or data entry services, and no Super.AI personnel, contractor or workforce reviews Customer Content or Outputs except as section 4.3 permits for support and security. Customer decides which Outputs are reviewed, staffs that review with its own Users, and is responsible for those Users as for any other User. Any accuracy target stated in an Order Form is measured on the process Customer operates, including its own review, and is not a promise by Super.AI to supply reviewers.

3.3A No labeling services except by separate agreement. Nothing in this Agreement prevents the parties from separately agreeing that Super.AI will provide crowd-based labeling or review services. Any such services are outside the Platform subscription and this Agreement, and are provided only under a separate written agreement negotiated directly between Super.AI and Customer and signed by both parties. Unless and until such an agreement is signed, no crowd, workforce or other Super.AI reviewer is involved in Customer Content or Outputs in any way, and nothing in an Order Form for the Platform, and no course of dealing, brings such services into effect.

3.4 Restricted uses. Customer will not use the Platform, and will not rely on Outputs, to make decisions that produce legal or similarly significant effects on individuals without meaningful human review by Customer, including decisions about employment, credit, insurance, housing, education, healthcare or access to essential services. The Platform is not designed for, and Customer will not use it in, activities where a failure could lead to death, personal injury or severe physical or environmental damage.

3.5 Third Party Services. Customer's agreement with each Third Party Service governs what that service does with data Customer sends it through the Platform. Super.AI is not a party to that agreement and is not responsible for a Third Party Service's acts or omissions. Super.AI remains responsible for its own handling of Customer Content, including passing it on where Customer instructs.

3.6 Changes to the Platform. Super.AI may update the Platform and will not materially reduce its core functionality during a Subscription Term. Super.AI gives at least ninety days' notice before retiring a feature identified in an Order Form, and where the retirement materially reduces the value of the subscription Customer may terminate the affected Order Form and receive a pro-rated refund of prepaid fees.

3.7 Beta features. Features identified as beta or preview are optional, provided as is, may change or be withdrawn, and are excluded from the service levels, warranties and indemnities in this Agreement. They remain subject to sections 11 and 16.

4.1 Accounts and credentials. Customer is responsible for its Users' compliance with this Agreement and for the confidentiality of credentials and API keys issued to its account. Customer will notify Super.AI promptly at security@super.ai of any unauthorised use it becomes aware of. Where Customer purchases single sign-on, Customer's identity provider governs User authentication.

4.2 Security program. Super.AI maintains an information security program with administrative, technical and physical safeguards appropriate to the sensitivity of Customer Content. That program is audited annually by an independent CPA firm against the AICPA SOC 2 Trust Services Criteria, and Super.AI will maintain a current SOC 2 Type II report throughout the Subscription Term. It includes encryption of Customer Content in transit and at rest, role-based access control, logging of access to production systems, vulnerability management with defined remediation windows, an incident response plan tested at least annually, and security training for personnel. Super.AI publishes its security policies on the compliance page and makes its SOC 2 report and penetration test summary available to Customer under this Agreement's confidentiality terms through its Trust Center.

4.3 Access to Customer Content. Super.AI accesses Customer Content only to provide, secure and support the Platform, to prevent or address technical problems, at Customer's request, or where the law requires. Super.AI will not disclose Customer Content to any third party except its sub-processors under section 16 and as compelled by law under section 11.3.

5.1 Customer Content. Customer is responsible for the accuracy, quality and legality of Customer Content, for having the rights and consents necessary to submit it to the Platform and to have it processed as this Agreement describes, and for its Users' use of the Platform.

5.2 Acceptable use. Customer will not use the Platform: (a) in breach of applicable law, including export control, sanctions, data protection and intellectual property law; (b) to upload or generate content that is unlawful, infringing, or that contains malicious code; (c) to attempt to access other customers' data or to disrupt the Platform; or (d) in breach of section 3.4. Super.AI may update this section on at least thirty days' written notice where a change in law or a new feature requires it; the updated section applies from the notice date to conduct after it, and continued use is not treated as acceptance of anything else.

5.3 Suspension. Super.AI may suspend a User's or Customer's access to the Platform if it reasonably determines that continued access presents a security risk to the Platform or to other customers, or breaches section 5.2 in a way that is causing harm. Super.AI will give notice before suspension where practicable, and in any event without undue delay, will limit the suspension to what is necessary, and will restore access as soon as the cause is resolved. Suspension under this section does not extend the Subscription Term or relieve Customer of fees for it, and it is not a remedy for non-payment, which section 8.4 governs.

5.4 Contact details. Customer will keep its billing, security and notice contacts current. Super.AI may rely on instructions from Users who hold an administrator role on Customer's account.

6.1 Availability. Super.AI will make the Platform available in accordance with the service level commitment stated in the Order Form or, where the Order Form is silent, in Super.AI's standard service level terms published at the URL stated in the Order Form. Those terms set out the availability and recovery commitments, which follow Super.AI's Business Continuity and Disaster Recovery Plan, the exclusions for planned maintenance and events outside Super.AI's control, the remedy for shortfalls, which is Customer's sole remedy for them, and the severity model and support handling that follow Super.AI's Incident Response Plan.

6.2 Support. Super.AI provides the support tier stated in the Order Form, with the response targets and contact channels that tier describes. Support does not include reviewing Customer Content or Outputs.

6.3 Business continuity. Super.AI maintains and tests at least annually a business continuity and disaster recovery plan for the Platform, and will make the current plan summary available to Customer under section 11.

7.1 Scope. Super.AI performs Professional Services as described in an SOW, which states the scope, any deliverables, the schedule, the fees and each party's responsibilities. Changes are agreed in a written change order signed by both parties. Professional Services are implementation, configuration, integration and training work on the Platform; they do not include human review, labeling or annotation of Customer Content, which section 3.3A governs.

7.2 Warranty. Super.AI will perform Professional Services in a professional manner consistent with industry standards. If Customer notifies Super.AI within thirty days of delivery that a deliverable does not conform to the SOW, Super.AI will re-perform the non-conforming services or, if it cannot, refund the fees paid for them. This is Customer's exclusive remedy for non-conforming Professional Services.

7.3 Deliverables. Deliverables identified in an SOW and created specifically for Customer belong to Customer on payment of the fees for them. Super.AI retains its pre-existing materials, tools, templates and know-how, and grants Customer a non-exclusive licence to use them as part of the deliverables for as long as Customer uses the Platform.

8.1 Fees. Customer will pay the fees stated in each Order Form and SOW. Except as stated in this Agreement or an Order Form, fees are quoted in United States dollars, are based on the subscription purchased rather than actual usage, and are non-refundable.

8.2 Invoicing. Super.AI invoices subscription fees annually in advance unless the Order Form states otherwise, and Professional Services as the SOW states. Invoices are due thirty days from the invoice date. Customer will provide complete billing information and notify Super.AI of changes.

8.3 Overdue amounts. Undisputed amounts not paid when due may accrue interest at 1.5 percent per month, or the maximum rate the law allows if lower, from the due date until paid.

8.4 Suspension for non-payment. If undisputed amounts are more than thirty days overdue, Super.AI may, after giving at least ten days' written notice to Customer's billing contact, suspend access to the Platform until they are paid. Super.AI will not suspend or charge interest on amounts Customer disputes reasonably and in good faith, provided Customer pays the undisputed part and cooperates diligently to resolve the dispute.

8.5 Price changes. Super.AI may change subscription fees for a renewal term by giving notice at least sixty days before the renewal date. Fees within a Subscription Term do not change.

8.6 Taxes. Fees exclude taxes. Customer is responsible for sales, use, value added, withholding and similar taxes on its purchases, other than taxes on Super.AI's income. Where Super.AI is required to collect a tax, it will invoice it unless Customer provides a valid exemption certificate.

9.1 Mutual. Each party warrants that it has the authority to enter into this Agreement and that doing so does not breach any other agreement it is bound by.

9.2 Platform. Super.AI warrants that during the Subscription Term the Platform will perform materially in accordance with the Documentation, that Super.AI will not materially reduce its core functionality, and that Super.AI will maintain the security program described in section 4.2. If the Platform does not conform and Super.AI cannot correct the non-conformity within thirty days of notice, Customer may terminate the affected Order Form and receive a pro-rated refund of prepaid fees for the remainder of its term.

9.3 Disclaimer. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE PLATFORM, THE PROFESSIONAL SERVICES AND THE OUTPUTS ARE PROVIDED WITHOUT ANY OTHER WARRANTY, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, TO THE MAXIMUM EXTENT THE LAW ALLOWS. SUPER.AI DOES NOT WARRANT THAT OUTPUTS WILL BE ACCURATE OR COMPLETE, OR THAT THE PLATFORM WILL BE ERROR-FREE OR UNINTERRUPTED; SECTION 6 STATES THE AVAILABILITY COMMITMENT AND SECTION 3.2 STATES HOW OUTPUTS ARE TO BE TREATED.

10.1 By Super.AI. Super.AI will defend Customer and its Affiliates against any third-party claim alleging that the Platform, used in accordance with this Agreement, infringes a patent, copyright, trademark or trade secret, or misappropriates a third party's intellectual property right, and will pay the damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement. If such a claim is made or appears likely, Super.AI may procure the right for Customer to continue using the Platform, modify or replace it so that it does not infringe while remaining materially equivalent, or, if neither is commercially reasonable, terminate the affected Order Form and refund prepaid fees for the remainder of its term. Super.AI has no obligation for claims arising from Customer Content, from combination of the Platform with items not supplied by Super.AI where the claim would not arise without the combination, from modifications not made by Super.AI, or from use after Super.AI has notified Customer to stop because of a claim.

10.2 By Customer. Customer will defend Super.AI and its Affiliates against any third-party claim arising from Customer Content, from Customer's use of Outputs, or from Customer's use of the Platform in breach of sections 3.4 or 5.2, and will pay the damages, costs and reasonable attorneys' fees finally awarded or agreed in settlement.

10.3 Procedure. The indemnified party will notify the indemnifying party promptly of the claim, give it sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. The indemnifying party will not settle a claim in a way that imposes an obligation or admission on the indemnified party without its consent, not to be unreasonably withheld. The indemnified party may participate with its own counsel at its own expense.

10.4 Exclusive remedy. This section states each party's entire liability and the other party's exclusive remedy for third-party claims of the kinds it describes.

11.1 Confidential Information. Confidential Information means information disclosed by one party to the other under this Agreement that is marked confidential or that a reasonable person would understand to be confidential. Customer Content and Outputs are Customer's Confidential Information. The Platform, its non-public documentation, Super.AI's security reports and pricing are Super.AI's Confidential Information. The terms of an Order Form or SOW are Confidential Information of both parties; the existence of this Agreement and its published text are not.

11.2 Obligations. The receiving party will use the disclosing party's Confidential Information only to perform this Agreement, will protect it with at least the care it uses for its own confidential information and no less than reasonable care, and will disclose it only to its and its Affiliates' personnel, advisers and, in Super.AI's case, sub-processors under section 16, who need it for that purpose and are bound by obligations at least as protective. These obligations last for five years after disclosure, and for Customer Content, Outputs and trade secrets for as long as the information remains confidential.

11.3 Exceptions and compelled disclosure. Confidential Information does not include information that is or becomes public without breach, was known to the receiving party without restriction before disclosure, is received from a third party without restriction, or is independently developed. A party may disclose Confidential Information where the law or a court compels it, provided it gives the other party prompt notice where lawful, discloses only what is required, and cooperates with reasonable efforts to limit or protect the disclosure.

11.4 Remedies. Breach of this section may cause harm that damages cannot adequately compensate, and either party may seek injunctive relief in addition to other remedies.

12.1 Customer Content and Outputs. As between the parties, Customer owns Customer Content and Outputs. Customer grants Super.AI a non-exclusive, worldwide, royalty-free licence to host, store, transmit, copy, display, convert and otherwise process Customer Content and Outputs, and to sub-license those rights to the sub-processors listed under section 16, solely to provide, secure and support the Platform for Customer. The licence ends when the content is deleted under section 14.4.

12.2 No training on Customer Content

Super.AI does not use Customer Content or Outputs to train AI models for general use or for other customers. At Customer's written request, Super.AI may fine-tune models solely for Customer's own use, on terms stated in an Order Form. Super.AI does not sell Customer Content or Outputs and does not use them for advertising.

The model hosting providers named on the sub-processor page are contractually prohibited from training any model on Customer Content or Outputs.

12.3 Usage data. Super.AI may collect and use data about the operation and use of the Platform, such as feature usage, volumes, performance and error rates, to operate, secure and improve the Platform and to produce aggregated statistics. Usage data does not include Customer Content or Outputs, and aggregated statistics will not identify Customer or any individual.

12.4 Feedback. If Customer chooses to give Super.AI suggestions about the Platform, Super.AI may use them without restriction or obligation. Feedback never includes Customer Content or Outputs.

12.5 Super.AI property. The Platform, the Documentation, Super.AI's models, prompts, tools, templates and know-how, and all improvements to them, belong to Super.AI and its licensors. No rights in them pass to Customer other than the licence in section 2.2 and the licence to deliverables in section 7.3.

13.1 Exclusions from the limits. Nothing in this Agreement limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct, for Customer's payment obligations, for either party's indemnification obligations under section 10, for a party's breach of section 11 or for anything else that the law does not allow to be limited.

13.2 General cap. Subject to sections 13.1 and 13.3, each party's total liability arising out of or relating to this Agreement in any twelve-month period, whether in contract, tort or otherwise, will not exceed the fees paid or payable by Customer under this Agreement in the twelve months preceding the event giving rise to the claim.

13.3 Data protection and security cap. For Super.AI's breach of section 4.2 or section 16, including a personal data breach caused by that breach, Super.AI's total liability in any twelve-month period will not exceed two times the amount in section 13.2. This cap applies instead of, not in addition to, section 13.2 for those claims.

13.4 Excluded damages. Subject to section 13.1, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill or anticipated savings, however arising, even if advised of their possibility. Loss of or damage to Customer Content that Super.AI holds is a direct loss for the purposes of this section, subject to the caps above. Where the law that applies to Customer does not permit liability for a negligent breach of an essential contractual obligation to be excluded, each party remains liable for such a breach up to the foreseeable damage typical of a contract of this kind, and sections 13.2 to 13.4 apply to that liability only so far as that law permits.

14.1 Term. This Agreement starts on the date stated in the preamble and continues while any Order Form or SOW is in effect. Each Subscription Term renews for successive periods of the same length unless either party gives notice of non-renewal at least sixty days before the renewal date.

14.2 Termination for cause. Either party may terminate this Agreement or an affected Order Form or SOW if the other party materially breaches it and does not cure the breach within thirty days of written notice, or becomes insolvent, makes an assignment for the benefit of creditors, or is the subject of bankruptcy proceedings not dismissed within sixty days.

14.3 Effect. On termination or expiry, Customer's right to use the Platform ends, Customer will pay fees accrued to the termination date, and, if Customer terminated for Super.AI's breach, Super.AI will refund prepaid fees for the remainder of the Subscription Term. If Super.AI terminated for Customer's breach, fees for the remainder of the Subscription Term become due.

14.4 Data return and deletion

For ninety days after termination or expiry, Customer may retrieve Customer Content and Outputs through the Platform or, on request to support@super.ai, receive them in a commonly used machine-readable format at no charge. After that period Super.AI will delete Customer Content and Outputs from its production systems within thirty days and, on request, confirm the deletion in writing, identifying the systems covered. Copies in encrypted backups are deleted as those backups expire on Super.AI's published schedule and are not restored except to recover the Platform. Super.AI may retain records it is required by law to keep, and usage data under section 12.3, for as long as the law requires.

14.5 Survival. Sections 1, 2.3, 2.4, 3.2, 8, 9.3, 10, 11, 12, 13, 14.3 to 14.5, 15 and 16 survive termination or expiry.

15.1 Notices. Notices under this Agreement are in writing and in English. Notices to Super.AI go by email to legal@super.ai, with a copy by courier or post to Super.AI Inc., 455 Market St Ste 1940 PMB 577536, San Francisco, CA 94105-2448, USA. Notices to Customer go to the notice contact in the Order Form. Email notices are effective on the business day they are sent if sent before 5 pm in the recipient's time zone, and otherwise on the next business day. Service of process on Super.AI is made on its registered agent, Registered Agent Solutions, 838 Walker Road Suite 21-2, Dover, DE 19904, USA.

15.2 Governing law and disputes. This Agreement is governed by the law of the State of Delaware, excluding its conflict of laws rules and the United Nations Convention on Contracts for the International Sale of Goods. The state and federal courts sitting in Delaware have exclusive jurisdiction over disputes arising out of or relating to this Agreement, and each party submits to that jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its Confidential Information or intellectual property. Before starting proceedings, the parties will attempt for thirty days to resolve the dispute through discussion between executives with authority to settle it.

15.3 Publicity. Neither party will use the other's name or marks in publicity without prior written consent. With Customer's consent, which may be given in the Order Form, Super.AI may identify Customer as a customer, including by name and logo on its website.

15.4 Export and sanctions. Each party will comply with applicable export control and sanctions laws, including those of the United States, the European Union and the United Kingdom. Customer confirms that it, its Affiliates and its Users are not located in, ordinarily resident in, or acting for the benefit of any person in a country or territory subject to comprehensive sanctions, and are not persons with whom Super.AI is prohibited from dealing. Customer will not use the Platform, or allow it to be used, in Cuba, Iran, North Korea, Syria, Russia or Belarus, or in the regions of Ukraine not under the control of the Ukrainian government, or in breach of Article 5n of Council Regulation (EU) 833/2014 or Article 1duodecies of Council Regulation (EC) 765/2006.

15.5 U.S. Government customers. The Platform is commercial computer software and commercial computer software documentation. If Customer is a U.S. Government entity, it acquires only the rights customarily provided to the public under this Agreement, in accordance with FAR 12.211 and 12.212 and DFARS 227.7202.

15.6 Assignment. Neither party may assign this Agreement without the other's written consent, not to be unreasonably withheld, except that either party may assign it in its entirety to an Affiliate or to a successor in a merger, acquisition or sale of substantially all of its assets, on notice to the other party. Any other purported assignment is void.

15.7 Amendment; waiver; severability. This Agreement may be amended only by a written document signed by both parties, except that Super.AI may update the Documentation, the sub-processor list under section 16.4 and section 5.2 as those sections describe. No waiver is effective unless in writing. If a provision is held unenforceable, it is enforced to the maximum extent the law allows and the remainder stays in force.

15.8 Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, other than payment obligations, for as long as the event lasts and provided it uses reasonable efforts to resume performance.

15.9 Entire agreement; precedence. This Agreement, with its Order Forms and SOWs, is the entire agreement between the parties about its subject matter and supersedes all prior agreements and understandings, including any earlier version of Super.AI's terms of service or platform agreement referenced in an Order Form. In case of conflict, the order of precedence is: a signed amendment, then the Order Form or SOW for the term it varies, then section 16, then the rest of this Agreement, then the Documentation. Terms in Customer purchase orders or vendor portals have no effect. The parties are independent contractors.

16.1 Roles. Where Customer Content contains personal data, Customer (or its Affiliate or client, as applicable) is the controller and Super.AI is the processor for that data. This section is the parties' data processing agreement for the purposes of Article 28 of the GDPR and the UK GDPR and equivalent laws, and forms part of this Agreement. Where a law requires additional terms, such as a U.S. state privacy law service provider clause, the parties will treat this section as including them to the extent required. Super.AI acts as a controller only for the account, billing, security and usage data described in section 12.3 and in its Privacy Policy.

16.2 Details of processing. Subject matter: providing the Platform. Duration: the Subscription Term plus the retention and deletion windows in section 14.4. Nature and purpose: hosting and storing Customer Content, extracting text from it, running AI model inference over it, running the flows Customer configures, presenting Outputs for review by Customer's Users, and supporting Customer, in each case on Customer's instructions. Types of personal data: whatever Customer Content contains, together with User account data. Data subjects: Customer's Users, and the individuals described in Customer Content.

16.3 Instructions. Super.AI processes personal data only on Customer's documented instructions, which are this Agreement, the Order Form, the configuration Customer sets in the Platform, and further written instructions the parties agree. Customer's model region setting is an instruction: where Customer restricts model processing to the European Union, model inference takes place only in EU regions; otherwise it takes place in the regions stated on the sub-processor page. Super.AI will inform Customer if it considers that an instruction infringes data protection law.

16.4 Sub-processors. Customer authorises Super.AI to engage the sub-processors listed on the sub-processor page, which states each one's function, location and transfer mechanism. Super.AI will publish any new sub-processor on that page and notify the page's subscription list, and Customer's notice contact, at least thirty days before it first processes Customer personal data. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Order Form and receive a pro-rated refund of prepaid fees. Super.AI imposes on every sub-processor data protection obligations equivalent to this section and remains liable to Customer for their performance, subject to section 13.

16.5 Confidentiality and security. Super.AI ensures that persons authorised to process personal data are bound by confidentiality obligations, and implements the technical and organisational measures described in section 4.2 and in its security documentation, which are appropriate to the risk of the processing.

16.6 Assistance. Taking into account the nature of the processing, Super.AI will assist Customer with reasonable requests to respond to data subject rights requests, to carry out data protection impact assessments, and to consult supervisory authorities, in each case to the extent the Platform is involved. Super.AI will forward to Customer without undue delay any request it receives directly from a data subject concerning Customer personal data, and will not respond except to direct the person to Customer.

16.7 Personal data breaches

Super.AI will notify Customer's security contact of a personal data breach affecting Customer personal data without undue delay after becoming aware of it, in accordance with Super.AI's Incident Response Plan, and in any event in time for Customer to meet its own notification obligations under applicable law. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; where all of that is not available at once, Super.AI will provide it in phases without further undue delay. Super.AI will cooperate with Customer's investigation and with Customer's own notification obligations, and will not identify Customer in any public statement about the breach without Customer's consent unless the law requires it.

16.8 Audit. Super.AI will make available the information reasonably necessary to demonstrate compliance with this section, in the first instance through its SOC 2 Type II report, penetration test summary and responses to Customer's reasonable security questionnaires, at no charge and not more than once a year unless a personal data breach or a supervisory authority requires otherwise. Where those are insufficient to meet a legal requirement, Customer or an independent auditor bound by confidentiality may audit Super.AI's compliance on at least thirty days' notice, during business hours, at Customer's expense, in a manner that does not compromise the security of other customers.

16.9 International transfers. Where Super.AI or a sub-processor transfers personal data protected by the GDPR, the UK GDPR or Swiss law to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where applicable) with the UK International Data Transfer Addendum and the Swiss amendments, which the parties incorporate by reference and complete with the details in this section and the Order Form, or under another lawful mechanism identified on the sub-processor page. Where a transfer impact assessment is required, Super.AI will provide the information Customer reasonably needs for it.

16.10 Deletion and return. At the end of the Subscription Term Super.AI will return and delete Customer personal data as section 14.4 describes. Customer may also delete Customer Content in the Platform at any time, and Super.AI will delete it from production systems within thirty days of that instruction.

16.11 Contact. Super.AI's data protection contact is privacy@super.ai. Where Super.AI is required to designate a representative in the European Union under Article 27 of the GDPR, or in the United Kingdom under Article 27 of the UK GDPR, it publishes the representative's identity and contact details in its Privacy Policy, and Customer may direct data protection correspondence to that representative as well as to Super.AI.