Acorn Data Processing Addendum

1. Definitions

"Data Protection Law" means the privacy and data protection laws that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and U.S. state privacy laws. "Customer Personal Data" means personal data in Customer Content that Acorn processes on Customer's behalf, as described in Annex I. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data. "Subprocessor" means a third party Acorn engages to process Customer Personal Data, including independent worker operators. Other terms have the meanings in the Customer Terms or Data Protection Law.

If this DPA conflicts with the Customer Terms about personal data, this DPA controls. If the Standard Contractual Clauses apply, they control over this DPA to the extent of any conflict.

2. Roles and instructions

Customer is the controller, or a processor acting for its own controller. Acorn is Customer's processor or service provider. Customer is responsible for having a lawful basis, providing required notices, and obtaining required consents, including from people who are recorded.

Acorn will process Customer Personal Data only to provide the Services under the Customer Terms, this DPA, and Customer's documented instructions, including instructions given through the API, the acorn command-line tool, and account settings. If the law requires other processing, Acorn will tell Customer first unless the law prohibits it. Acorn will tell Customer if it believes an instruction violates Data Protection Law, and may suspend the affected processing until the issue is resolved.

Acorn will not sell or share Customer Personal Data, use it to train models, combine it with other data except as Data Protection Law permits, or use it outside the direct business relationship with Customer. Acorn will notify Customer if it can no longer meet its obligations under U.S. state privacy laws.

Customer will not submit special categories of personal data, criminal-offense data, or the restricted data listed in the Customer Terms unless an Order expressly permits it.

3. Confidentiality

Acorn will ensure that its personnel and Subprocessors who process Customer Personal Data are bound by confidentiality obligations. Worker operators are bound by the Worker Agreement, which prohibits listening to, reading, keeping, copying, or disclosing customer content and requires deletion when a job ends.

4. Security

Acorn will maintain the technical and organizational measures in Annex II, taking into account the nature, scope, and risks of the processing. Acorn may update those measures if the update does not materially reduce overall protection.

5. Subprocessors

Customer authorizes Acorn to use Subprocessors in the categories published at acorncompute.com/subprocessors, and the named Subprocessors Acorn provides to Customer with this DPA, including independent worker operators enrolled in Acorn's network.

Acorn will bind each Subprocessor to data protection obligations at least as protective as this DPA, to the extent applicable to the services it provides, and remains responsible for each Subprocessor's performance. Worker operators are individually too numerous and changeable to name; Acorn binds each one to the Worker Agreement before it receives work.

Acorn updates the categories page when categories change. At least 14 days before a new named Subprocessor processes Customer Personal Data, Acorn will notify Customer's designated contact by email. Customer may object on reasonable data protection grounds within that 14-day period. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for them.

6. Data subject requests

If Acorn receives a request from a data subject about Customer Personal Data, Acorn will forward it to Customer and will not respond except on Customer's instructions or as the law requires. Taking into account the nature of the processing, Acorn will help Customer respond to requests, including by deleting or providing the data for identified jobs.

7. Personal Data Breaches

Acorn will notify Customer without undue delay, and no later than 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as known, the nature of the breach, the data and approximate number of people affected, likely consequences, and the measures taken or proposed, and will name a contact. Acorn may provide information in stages. Acorn will take reasonable steps to contain the breach and will cooperate with Customer. A notice is not an admission of fault.

8. Assistance

Taking into account the nature of the processing and the information available to it, Acorn will reasonably assist Customer with data protection impact assessments and consultations with supervisory authorities.

9. Deletion and return

Customer can retrieve transcripts through the API while they are retained. Acorn retains transcripts and job records until Customer asks for them to be deleted. Acorn deletes normalized audio from its servers about 7 days after a job finishes. Audio for a job that ends partly complete is kept so the job can be recovered, then removed by an operator. The worker software deletes job audio from workers' Macs when a job ends.

On Customer's written request, during the term or when the Customer Terms end, Acorn will delete Customer Personal Data for the identified jobs from its live systems and confirm deletion in writing. This does not yet cover jobs that ended partly complete; an operator removes that audio separately. Copies in backups expire on the schedules in Annex II. Other backup copies expire on their own schedules. Acorn will not restore backup copies for ordinary use. Acorn may keep data the law requires it to keep, and will protect it and use it only for that purpose. Acorn cannot delete data already delivered to webhook endpoints or other destinations Customer chose.

10. Audits

Acorn will make available the information reasonably necessary to demonstrate compliance with this DPA, starting with written answers and documentation. If that is not enough, or if a supervisory authority requires it, Customer or an independent auditor bound by confidentiality may conduct an audit on at least 30 days' notice, during business hours, no more than once a year except after a Personal Data Breach or where the law requires. Audits may not access other customers' data or workers' Macs. Customer bears its own audit costs.

11. International transfers

Acorn processes Customer Personal Data in the United States, and worker operators may be located in any country. For transfers of Customer Personal Data from the EU or EEA, the parties incorporate Module Two (controller to processor) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, or Module Three (processor to processor) where Customer is a processor, with these choices: Clause 7 (docking) applies; Clause 9 uses Option 2 (general authorization) with the 14-day advance notice in Section 5; the optional wording in Clause 11 does not apply; Clauses 17 and 18 use the law and courts of Ireland; and Annexes I and II of this DPA complete the corresponding annexes.

For transfers from the UK, the parties incorporate the UK International Data Transfer Addendum issued by the Information Commissioner, completed with the information in this DPA. For transfers from Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority for those transfers.

Acorn will flow equivalent transfer obligations down to Subprocessors.

12. Liability and term

This DPA is subject to the limitation of liability in the Customer Terms. It does not create a separate or additional liability cap, and it does not limit rights of data subjects or supervisory authorities that cannot be limited. This DPA lasts as long as Acorn processes Customer Personal Data. Sections 3, 9, and 12 survive termination.

Signatures

Annex I: Description of processing

A. Parties. Data exporter: Customer, as identified above, acting as controller (or processor). Data importer: Best Price LC, acting as processor (or subprocessor). Activities: providing the Services under the Customer Terms.

B. Data subjects. People whose voices or information appear in audio Customer submits, as determined by Customer, which may include Customer's personnel, customers, end users, and members of the public; and Customer's users who access the Services.

C. Categories of personal data. Audio recordings and the voices in them; transcripts and any personal data spoken in the recordings; job metadata such as file names, source URLs, settings, timestamps, and webhook destinations; and Customer user contact details and credentials stored as hashes. For Mac environments, any personal data Customer places in the virtual machine.

D. Sensitive data. None, unless an Order expressly permits it and states the safeguards that apply.

E. Frequency. Continuous, as Customer submits jobs.

F. Nature and purpose of processing. Receiving and storing audio; converting and splitting it; sending segments or, for some jobs, complete recordings to worker operators' Macs for transcription; merging and returning transcripts; delivering webhooks; running Mac environments where enabled; and securing, supporting, metering, and billing for these activities.

G. Retention. Transcripts and job records until Customer requests deletion; normalized audio about 7 days after a job finishes, except that audio for a job that ends partly complete is kept so the job can be recovered, then removed by an operator; worker-local audio until the job ends; backups as in Annex II.

H. Subprocessors. Hosting; edge network; object storage and database replica; email delivery; infrastructure, backup, and alerting tooling; and independent worker operators, as described in Section 5 and the named list provided with this DPA.

I. Competent supervisory authority. The authority determined under Clause 13 of the Standard Contractual Clauses.

Annex II: Technical and organizational measures

1. Encryption in transit. All connections to Acorn's services use HTTPS. TLS terminates at Acorn's edge network provider.
2. Hosting. Servers run in a single U.S. region. Acorn does not offer region pinning or data residency.
3. Credentials. Customer API keys and worker credentials are stored only as hashes. Operator access to the management console requires a passkey, with one-time recovery codes as backup. Worker credentials are stored in the macOS Keychain. API keys can be revoked and rotated.
4. Access and audit. Production access is limited to authorized operators. Operator actions in the management console and privacy deletions are recorded in audit logs.
5. Work distribution. Long recordings are split into segments so that a worker usually receives only a segment and the task metadata for it. Some jobs send a worker the complete recording. Workers do not receive the merged transcript or other workers' results.
6. Worker controls. Workers accept the Worker Agreement, which prohibits accessing, keeping, or disclosing customer content. The Mac app is signed with Acorn's Developer ID, notarized by Apple, and runs with Hardened Runtime; it does not use the App Sandbox. It stores job audio in the macOS temporary folder, excludes it from Time Machine, and deletes it when the job ends, and a later launch removes crash leftovers more than six hours old.
7. Quality and abuse controls. Acorn validates work with known-answer test jobs, redundant processing, and reputation tiers, and can suspend workers.
8. Webhooks. Webhook deliveries are signed with HMAC-SHA256 so Customer can verify them.
9. Retention and deletion. Normalized audio is deleted automatically about 7 days after a job finishes. Audio for a job that ends partly complete is kept so the job can be recovered, then removed by an operator. Operators delete or scrub a job's audio, transcripts, webhook records, and validation records on verified request; this does not yet cover jobs that ended partly complete. An active legal hold blocks deletion.
10. Backups. Database volume snapshots are kept for 14 days. A continuous database replica in object storage keeps 7 days of point-in-time history. Other backup copies expire on their own schedules. Backups are used to restore service and to test that restores work.
11. Analytics and errors. Product analytics never include job content. Acorn does not use a third-party error-tracking service; crash reports go to Acorn's own servers.
12. Limits. Acorn does not hold SOC 2 or ISO 27001 certification, does not warrant encryption at rest on every system or worker Mac, and does not offer an uptime commitment unless an Order states one.