Data Processing Addendum

Effective date: September 10, 2026
Parties: NatML Inc., doing business as Muna ("Muna"), and the customer that accepts the Muna Terms of Service or another written agreement with Muna for use of the Muna Inference API ("Customer").

This Data Processing Addendum ("DPA") forms part of the agreement between Customer and Muna for the Inference API (the "Agreement") and applies automatically, without a separate signature. Customers that require a countersigned copy may request one at hi@muna.ai. This DPA incorporates the Muna Zero Data Retention Policy (the "ZDR Policy"). Where this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data.

Capitalised terms not defined here have the meanings given in the Agreement or the ZDR Policy.

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA"), each as applicable.
• "Customer Personal Data" means any personal data contained in Customer Content that Muna processes on behalf of Customer.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means any third party engaged by Muna that may process Customer Personal Data.
• "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.

"Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR.

Customer is the controller (or a processor acting on behalf of its own customers) of Customer Personal Data, and Muna is a processor (or, where Customer is a processor, a subprocessor). For the purposes of the CCPA, Muna is a "service provider".

This DPA applies only to Customer Personal Data. Account data and Service Metadata, which Muna processes to operate, bill for and secure the service, are governed by the Muna Privacy Policy. The details of processing are set out in Annex 1.

Muna will process Customer Personal Data only on Customer's documented instructions. Customer's instructions are the Agreement, this DPA, and Customer's use and configuration of the Inference API. Muna will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, unless the law prohibits Muna from doing so.

Muna will not:

• retain Customer Content except as permitted by the ZDR Policy;
• use Customer Content to train, fine-tune, evaluate, or otherwise improve any model;
• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• retain, use, or disclose Customer Personal Data for any purpose other than providing the Inference API, or outside the direct business relationship between Customer and Muna;
• combine Customer Personal Data with personal data Muna receives from any other source.

Customer is responsible for having a lawful basis for the processing, and for any notices and consents required to submit Customer Personal Data to the Inference API.

Muna will ensure that any personnel authorised to process Customer Personal Data are bound by an obligation of confidentiality. As described in the ZDR Policy, Customer Content is not made available to Muna personnel, except for diagnostic fragments accessed under Section 8.1 of the ZDR Policy and content Customer sends to Muna support.

Muna will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing. These measures include those set out in Annex 2. Muna may update its security measures from time to time, provided the updates do not materially reduce the overall protection of Customer Personal Data.

Customer gives Muna general authorisation to engage Subprocessors. Muna's current Subprocessors are listed in Section 7 of the ZDR Policy.

Muna will:

• impose on each Subprocessor, by written contract, data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services it provides;
• remain liable to Customer for the performance of each Subprocessor's obligations;
• give at least 30 days' notice of a new Subprocessor by updating the list in the ZDR Policy and notifying customers who have asked to receive notices at hi@muna.ai.

Customer may object to a new Subprocessor on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Agreement as its sole remedy, and Muna will refund any prepaid, unused fees for that part.

Because Customer Content is not retained, Muna will generally hold no Customer Personal Data to access, correct or delete. Muna will promptly forward to Customer any data subject request it receives concerning Customer Personal Data, and will not respond to it except on Customer's instructions.

Taking into account the nature of the processing, Muna will provide reasonable assistance to Customer with data subject requests, data protection impact assessments, and prior consultations with supervisory authorities, to the extent Customer cannot address them using information available to it.

Muna will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the Security Incident, the categories of data affected, its likely consequences, and the measures taken or proposed to address it. Muna will provide further information as it becomes available, and will take reasonable steps to contain and remediate the Security Incident.

Notification is not an acknowledgement by Muna of fault or liability.

Customer Content is held only in volatile memory and is not written to persistent storage, except as described in Section 8 of the ZDR Policy. Any Customer Personal Data in diagnostic logs is deleted within 30 days. Any Customer Personal Data that Customer sends to Muna support, or stores using a feature Customer explicitly enables, will be deleted on termination of the Agreement or on Customer's request, unless the law requires Muna to retain it.

On written request, no more than once a year, Muna will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes written responses to a reasonable security questionnaire and the written attestation described in Section 10 of the ZDR Policy. Where that information is not enough to demonstrate compliance, or where a supervisory authority requires it, Customer may conduct an audit at its own expense. The audit must be on reasonable notice, during business hours, and subject to confidentiality obligations, and must not unreasonably disrupt Muna's operations.

Muna processes Customer Content in the United States. To the extent that processing involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA as follows:

• Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) applies where Customer is a processor;
• the optional docking clause (Clause 7) applies;
• Option 2 (general written authorisation) of Clause 9 applies, with the notice period in Section 6;
• the optional language in Clause 11 does not apply;
• Clauses 17 and 18 are governed by, and disputes resolved in the courts of, Ireland;
• Annexes I and II are completed by Annex 1 and Annex 2 of this DPA, and the competent supervisory authority is that of Customer's establishment or representative in the EEA, or otherwise the Irish Data Protection Commission.

For transfers from the United Kingdom, the Standard Contractual Clauses apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. For transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it to be limited. This DPA remains in effect for as long as Muna processes Customer Personal Data under the Agreement. Except as required by the Standard Contractual Clauses, this DPA is governed by the law that governs the Agreement.