DRAFT — not yet reviewed or approved by counsel. Not in effect.

Last updated: 2026-11-14 (draft)

Cannoli Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Cannoli Terms of Service (the "Terms") or the Enterprise Order Form between [CANNOLI ENTITY] ("Cannoli") and the Customer (together with this DPA, the "Agreement"). It applies to the extent Cannoli processes Personal Data on Customer's behalf in providing the Service.

1. How this DPA applies

1.1 Automatic application. This DPA applies automatically, without signature, to every Customer from the moment the Customer accepts the Terms, and is incorporated into the Terms by reference. This covers Free and Business Plans and any Enterprise Customer that has not separately signed it.

1.2 Enterprise. For Enterprise Customers, this DPA is executed with the Order Form using the signature block in section 19. A Customer on any Plan that needs a countersigned copy may request one at [PRIVACY EMAIL]. The signed and click-through versions have the same terms. Where an Order Form expressly modifies this DPA, the Order Form prevails for that Customer.

1.3 Scope. This DPA covers: (a) Transcript text and Research Excerpts that Cannoli processes in Managed Mode ("Content Data"); and (b) personal data about Customer's Users and Administrators held in the Account ("Account Data"). It does not cover BYO Key Mode or Local-only Mode, in which Cannoli does not process Content Data; in BYO Key Mode, the Customer's own agreement with the AI Provider governs. Cannoli is an independent controller of the limited data described in section 16, which this DPA does not otherwise cover.

2. Definitions

"CCPA" means the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations.

"Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the CCPA, and other US state privacy laws.

"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law.

"Personal Data" means information relating to an identified or identifiable natural person that Cannoli processes on Customer's behalf under the Agreement, and includes "personal information" under the CCPA.

"Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings in the GDPR; "Business", "Service Provider", "Sell" and "Share" have the meanings in the CCPA. "Controller" includes a Business and "Processor" includes a Service Provider.

"Restricted Transfer" means a transfer of Personal Data that would be prohibited by the GDPR, UK GDPR or FADP absent a lawful transfer mechanism.

"SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

"Sub-processor" means a third party engaged by Cannoli to process Personal Data on Customer's behalf.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022).

Capitalized terms not defined here (including Managed Mode, BYO Key Mode, Local-only Mode, Transcript, Notes, Research Excerpts, Relay, AI Provider, User, Administrator, Organization, Plan, Service, Subscription Term) have the meanings in the Terms.

3. Roles

3.1 Customer is the Controller of Content Data and of Account Data about its Users. Cannoli is Customer's Processor. Where Customer is itself a Processor acting for a third-party controller, Customer warrants that it has authority to engage Cannoli as a sub-processor on these terms, and Cannoli acts as Customer's sub-processor.

3.2 Anthropic, PBC ("Anthropic") is a Sub-processor of Cannoli for Content Data in Managed Mode. The other Sub-processors and their roles are in Annex III.

3.3 Each party will comply with the Data Protection Laws applicable to it in its role.

4. Details of processing

The subject matter, duration, nature and purpose of processing, and the categories of Data Subjects and Personal Data, are set out in Annex I. In summary: the subject matter is provision of the Service; the duration is the term of the Agreement plus the deletion periods in section 12; the nature is transient transmission of text to the AI Provider and return of its output (Content Data) and storage of account records (Account Data); the purpose is generating Notes at the Customer's request and operating the Account.

5. Instructions and Customer responsibilities

5.1 Cannoli will process Personal Data only on Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by law to which Cannoli is subject, in which case Cannoli will inform Customer of that legal requirement before processing unless the law prohibits this on important grounds of public interest.

5.2 Customer's documented instructions are: (a) the Agreement; (b) the configuration and use of the Service by Customer and its Users, in particular each User's or Administrator's selection of Mode and of the optional features (Live Mode, web research, research folders), which determine whether Content Data is transmitted at all and what it contains; (c) each request a User makes for Notes; and (d) any further written instructions agreed between the parties. Cannoli will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, without an obligation to conduct a legal review.

5.3 Cannoli does not and cannot access Content Data to carry out additional instructions (for example, to search, correct or delete a particular passage), because it holds no copy. Instructions about Content Data are carried out by Customer in the App; as to the AI Provider's transient copy, Cannoli will forward documented requests under section 9.

5.4 Customer is responsible for: the lawfulness of the Personal Data it causes to be processed, including the lawful basis, notice and (where required) consent for transcribing meeting participants' speech; the accuracy of Account Data; the choice of Mode; and ensuring that Research Excerpts contain only data Customer may lawfully process. Customer warrants that its instructions comply with Data Protection Laws.

6. Confidentiality of personnel

Cannoli ensures that persons it authorizes to process Personal Data are bound by written confidentiality obligations or a statutory duty of confidentiality and have access only to the extent their role requires. No Cannoli personnel access Content Data in the ordinary course: the Relay is designed so that Content Data is handled by code only, in memory, and is not logged. Access to Account Data is limited to personnel operating billing, support and the platform.

7. Security

7.1 Cannoli will implement and maintain the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to Data Subjects, so as to ensure a level of security appropriate to the risk, including protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

7.2 Cannoli may update Annex II from time to time, provided the overall level of security is not materially reduced during a Subscription Term. The current description is at cannoli.ai/security.

7.3 Customer is responsible for the security of the Macs on which the App runs (including enabling FileVault, device access controls and operating-system updates), of the email accounts its Users use to sign in, and of its own configuration of the Service.

8. Sub-processors

8.1 General authorization. Customer gives general written authorization to Cannoli's use of the Sub-processors listed at cannoli.ai/legal/subprocessors (reproduced in Annex III as of the Last updated date).

8.2 Flow-down. Cannoli will impose on each Sub-processor, by written contract, data-protection obligations providing materially the same level of protection as this DPA, and remains fully liable to Customer for each Sub-processor's performance of those obligations. For Anthropic, the applicable terms are Anthropic's Data Processing Addendum (effective February 24, 2025), under which Anthropic acts as processor and which incorporates the EU SCCs and UK and Swiss addenda, and Anthropic's Commercial Terms of Service (effective June 17, 2025), section B of which provides that Anthropic may not train models on Customer Content.

8.3 AI Provider retention. According to Anthropic's published policy, Anthropic deletes API inputs and outputs within 30 days of receipt or generation by default, except where it must retain them to comply with law or they are flagged by its trust-and-safety systems, in which case it may retain them for up to two years. Cannoli does not currently have a zero-data-retention arrangement with Anthropic and makes no commitment to obtain one. If Cannoli does obtain one for its Managed Mode organization, it will update the Subprocessor page and notify Customers under section 8.4.

8.4 Changes. Cannoli will give at least 15 days' notice before engaging a new Sub-processor or materially changing an existing Sub-processor's role, by email to Administrators and by updating the Subprocessor page.

8.5 Objection. Customer may object in writing to [PRIVACY EMAIL] within the 15-day period on reasonable, documented data-protection grounds. The parties will discuss the objection in good faith. If Cannoli cannot reasonably accommodate it (including by offering a configuration that avoids the Sub-processor, such as BYO Key Mode or Local-only Mode where the change concerns the AI Provider), Customer may terminate the affected subscription on written notice within 30 days of Cannoli's response and receive a pro-rated refund of prepaid Fees for the remainder of the Subscription Term. This is Customer's sole remedy for an objection.

8.6 Emergency replacement. If a Sub-processor must be replaced urgently for security or availability reasons, Cannoli may do so and notify Customer without undue delay afterwards; the objection period in section 8.5 then runs from that notice.

9. Data Subject requests

9.1 Taking into account the nature of the processing, Cannoli will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability and objection).

9.2 In practice: Content Data is on Customer's Macs, where Customer can search, export, correct and delete Transcripts and Notes directly in the App. Administrators can view and correct Account Data in the Account, and Cannoli will export or delete it within 15 days of a written request. For the AI Provider's transient copy, Cannoli will forward a documented request to Anthropic without undue delay; Anthropic's default deletion within 30 days will often make the request moot.

9.3 If Cannoli receives a request directly from a Data Subject relating to Customer's Personal Data, Cannoli will, where it can identify the Customer, promptly forward the request and will not respond except to direct the Data Subject to Customer, unless law requires otherwise.

10. Impact assessments and prior consultation

Cannoli will provide reasonable assistance to Customer with data protection impact assessments and prior consultation with Supervisory Authorities under Articles 35 and 36 GDPR (or equivalents), to the extent the information is in Cannoli's possession and not already available in the Documentation, the Security Overview or this DPA. Cannoli may charge reasonable fees for assistance exceeding eight hours in any year, except where Data Protection Laws require otherwise.

11. Personal Data Breach

11.1 Cannoli will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data, by email to Administrators and to the Account's billing contact.

11.2 The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information may be provided in phases as it becomes available.

11.3 Cannoli will cooperate reasonably with Customer's investigation, notifications to authorities and Data Subjects, and remediation. Notification is not an admission of fault.

11.4 A Personal Data Breach at a Sub-processor is treated the same way once Cannoli becomes aware of it. Because the Relay stores nothing, a compromise of Cannoli's infrastructure cannot expose stored Content Data; the realistic exposure for Content Data is limited to requests in flight or an incident at the AI Provider.

12. Deletion and return

12.1 Content Data. Cannoli retains no Content Data after each Managed Mode request completes, so there is nothing to return or delete at termination. Transcripts and Notes remain on Customer's Macs and are unaffected by termination. The AI Provider's copy is deleted under its retention schedule (section 8.3).

12.2 Account Data. Within 30 days after termination of the Agreement, or earlier on Customer's written request, Cannoli will delete Account Data, except data Cannoli must retain to comply with law (notably billing and tax records) or to establish, exercise or defend legal claims, which Cannoli will keep confidential and process only for those purposes. Server request logs expire on their own 30-day cycle. On request made before deletion, Cannoli will export Account Data in a common machine-readable format.

12.3 Backups. Account Data in encrypted database backups is overwritten in the ordinary backup cycle, not exceeding 30 further days.

13. Audit

13.1 Cannoli will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, and will allow for and contribute to audits, in the manner described in this section.

13.2 Documentation first. Cannoli will respond to Customer's reasonable written security and privacy questionnaires no more than once in any 12 months (and additionally after a Personal Data Breach affecting Customer or where a Supervisory Authority requires it), and will provide the Security Overview, this DPA, the Subprocessor page, and, when they exist, third-party audit reports or certifications covering the Service (none exist at launch; see the roadmap in the Security Overview), together with the published trust information of its Sub-processors.

13.3 No on-site audit at this stage. Cannoli operates no data centres; its infrastructure runs on Sub-processors that do not permit customer site visits. Cannoli therefore offers no on-site or remote technical audit of its systems, except where Data Protection Laws or a Supervisory Authority require one, in which case a mutually agreed independent auditor bound by confidentiality will conduct it on 30 days' notice, during business hours, no more than once in 12 months, at Customer's expense, without access to other customers' data.

13.4 Customer will keep audit information confidential and share it only with its professional advisers and regulators.

14. International transfers

14.1 Cannoli is a United States entity and processes Personal Data in the United States, where its Sub-processors are also located (Annex III). Cannoli does not participate in the EU-US Data Privacy Framework or its UK and Swiss extensions and makes no claim to.

14.2 EU transfers. To the extent Customer's transfer of Personal Data to Cannoli is a Restricted Transfer from the European Economic Area, the SCCs are incorporated into this DPA and apply as follows: Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; Clause 7 (docking clause) is included; in Clause 9, Option 2 (general written authorization) applies with the notice period in section 8.4; the optional language in Clause 11 is not included; for Clause 13, the competent Supervisory Authority is that of the EU member state in which Customer (or its EU representative) is established; for Clause 17, the SCCs are governed by the law of Ireland; for Clause 18, disputes are resolved before the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

14.3 UK transfers. For Restricted Transfers from the United Kingdom, the UK Addendum applies and is incorporated, with Tables 1 to 3 completed by the information in this DPA and its Annexes, and Table 4 selecting that either party may end the UK Addendum as set out in section 19 of the UK Addendum.

14.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner ("FDPIC"): references to the GDPR are read as references to the FADP; the FDPIC is the competent authority under Clause 13; Clauses 17 and 18 refer to Swiss law and Swiss courts where Swiss law applies exclusively to the transfer; and the SCCs protect the data of legal entities until the FADP is amended to exclude them.

14.5 Onward transfers. Cannoli's onward transfer of Content Data to Anthropic is covered by Anthropic's Data Processing Addendum, which incorporates the SCCs (processor to processor) and the UK and Swiss addenda.

14.6 If the SCCs or UK Addendum are invalidated or replaced, the parties will cooperate in good faith to adopt the replacement mechanism. If Cannoli cannot lawfully continue the transfer, Customer may use BYO Key Mode or Local-only Mode, or terminate as described in section 8.5.

14.7 Government access. Unless legally prohibited, Cannoli will notify Customer of any legally binding request for disclosure of Personal Data by a public authority, will challenge requests it reasonably considers unlawful, and will disclose only the minimum required. As of the Last updated date, Cannoli has received no such request. Cannoli will provide a summary transfer impact assessment on request. The relevant facts are simple: Cannoli stores no Content Data, so the only Personal Data a public authority could obtain from Cannoli is Account Data and request metadata.

15. CCPA service-provider terms

Where the CCPA applies to Personal Data processed under this DPA, Cannoli acts as a Service Provider and:

(a) will not Sell or Share the Personal Data;

(b) will not retain, use or disclose the Personal Data for any purpose, including a commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship between Cannoli and Customer;

(c) will not combine the Personal Data with personal information it receives from other sources or collects from its own interactions with consumers, except as the CCPA regulations permit (for example, to detect security incidents);

(d) will comply with the CCPA and provide the same level of privacy protection the CCPA requires of Businesses;

(e) grants Customer the right to take reasonable and appropriate steps to ensure Cannoli uses the Personal Data consistently with Customer's CCPA obligations (sections 9 and 13), and, on notice, to stop and remediate unauthorized use;

(f) will notify Customer within 15 days if it determines that it can no longer meet its obligations under the CCPA;

(g) will flow these obligations down to its Sub-processors under section 8.2 and notify Customer of new engagements under section 8.4; and

(h) certifies that it understands and will comply with these restrictions.

Customer discloses Personal Data to Cannoli only for the business purposes in the Agreement.

16. Cannoli as independent controller

For the limited data Cannoli processes for its own purposes (billing and tax records, business contact details of Customer personnel, Website request logs, security logs, and usage metadata used for billing and fair-use assessment), Cannoli acts as an independent controller as described in the Privacy Policy and complies with Data Protection Laws in that role. The parties are not joint controllers.

17. Liability

Each party's liability under this DPA, including under the SCCs as between the parties, is subject to the exclusions and limitations in section 22 of the Terms or in the Order Form. Nothing in this section limits a party's liability to Data Subjects under the SCCs or Data Protection Laws. Cannoli's total liability for all claims by Customer and its affiliates under this DPA and the Agreement together is a single aggregate cap.

18. Precedence, term and changes

18.1 For the processing of Personal Data, this DPA prevails over the Terms. The SCCs and UK Addendum prevail over this DPA where they apply and conflict. An Order Form prevails over this DPA only where it expressly says so.

18.2 This DPA remains in force for as long as Cannoli processes Personal Data on Customer's behalf, including the deletion period in section 12.

18.3 Cannoli may update this DPA on notice as described in section 26 of the Terms, including to reflect changes in Data Protection Laws or in the Service. No update will reduce the protection of Personal Data during a Subscription Term without Customer's consent.

18.4 Governing law and venue follow the Terms, except where the SCCs or UK Addendum require otherwise.

19. Signature (Enterprise, or on request)

For Free and Business Customers, this DPA is accepted by accepting the Terms and needs no signature.

Annex I — Details of processing

A. Parties

Data exporter: Customer, as identified in the Account or Order Form. Role: Controller (or Processor, where section 3.1 applies).

Data importer: [CANNOLI ENTITY], [ADDRESS], [PRIVACY EMAIL]. Role: Processor.

B. Description of processing

C. Competent Supervisory Authority: as determined under section 14.2.

Annex II — Technical and organizational measures

1. No storage of Content Data. The Relay is stateless: Content Data is held in process memory for the duration of a request, forwarded to the AI Provider, and discarded. Content is never written to disk, database, cache or log. The Relay logs only timestamp, Organization, device identifier, job type, model, token counts, latency and status.

2. Encryption in transit. All connections between the App, the Website, the Relay, the AI Provider and other Sub-processors use TLS 1.2 or higher.

3. Encryption at rest. The account database (Neon) is encrypted at rest by the provider. Secrets (the AI Provider key, the entitlement signing key, database credentials) are held only in the hosting platform's encrypted environment configuration, never in source code or on personal devices.

4. Data on the customer's device. Transcripts and Notes are stored under the User's Application Support folder, protected by macOS file permissions and data protection. Cannoli recommends FileVault full-disk encryption and device-management controls. The BYO Key Mode API key and the device refresh token are stored in the macOS Keychain.

5. Access control. Least-privilege access to vendor consoles (hosting, database, billing, email, AI Provider), restricted to named personnel with a need, protected by multi-factor authentication, reviewed when personnel change. No personnel have a tool or path to read Content Data.

6. Authentication. Account sign-in is by single-use email link; no passwords are stored. Devices authenticate with a refresh token issued through a device-code flow and revocable by an Administrator. Entitlements are Ed25519-signed tokens the App verifies offline.

7. Application integrity. The App is signed with an Apple Developer ID certificate, built with the hardened runtime, and notarized by Apple. Updates are delivered through an EdDSA-signed appcast; the App rejects unsigned updates. The App sends no telemetry and contains no crash reporter.

8. Minimal permissions. The App requests only Microphone, Screen & System Audio Recording (for the audio of calls) and Speech Recognition permissions. It does not request Accessibility, video screen recording, Full Disk Access, or keyboard input monitoring.

9. Relay hardening. The Relay accepts only the AI Provider API paths and models the App uses, validates the device token on every request, enforces per-Organization allowances, and rejects everything else.

10. Logging and monitoring. Server request logs (IP address, user agent, timestamp, path, status) are retained 30 days. Alerts on error rates and authentication failures. No content in any log.

11. Sub-processor management. Sub-processors are selected for published security posture (SOC 2 or PCI DSS attestations where applicable), bound by data-protection terms, and listed publicly with 15-day change notice.

12. Incident response. Security contact [SECURITY EMAIL]; breach notification to Customers under section 11; post-incident review and remediation.

13. Business continuity and secure development. Managed, redundant hosting with provider-managed backups of the account database; Customer Content is not held or backed up by Cannoli, and Customer is responsible for backing up its Macs. Dependencies pinned and reviewed; secrets scanning; changes to the Relay and entitlement code reviewed before deployment.

Annex III — Sub-processors

The authoritative list is at cannoli.ai/legal/subprocessors, which also carries the change-notice mechanism. As of the Last updated date:

Not a Sub-processor, disclosed for completeness: at first run the App downloads its speaker-separation model file once from Hugging Face, Inc. (USA). That request discloses the device's IP address to Hugging Face and nothing else; no Customer Personal Data is processed.