Last updated: July 2, 2026

Data Processing Agreement

This Data Processing Agreement (“DPA”) applies where Pure Reason Inc. (“Pure Reason”) processes Personal Data as a processor on behalf of a Customer using the Kylon Service. It is incorporated by reference into our Terms of Service and Privacy Policy.

Roles

Customer is the Controller; Pure Reason is the Processor.

Instructions

Pure Reason processes Personal Data only on Customer’s documented instructions, unless otherwise required by law.

Confidentiality and security

As described in our Privacy Policy.

Sub-processors

Customer authorizes Pure Reason to engage sub-processors, listed at kylon.io/subprocessors.

AI processing

As described in Section 5 of our Privacy Policy, covering how workspace content is transmitted to and processed by our third-party AI model providers.

Breach notice, data subject requests, retention, deletion

As described in our Privacy Policy.

International transfers

For transfers of Personal Data of individuals in the EEA, UK, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses, Module Two (Controller-to-Processor), are incorporated by reference, with: Clause 9 Option 2 (general written authorisation); Clause 17 governing law is the law of the EU Member State in which the data exporter is established, or, absent such establishment, the law of Ireland; Clause 18 forum follows accordingly. The UK International Data Transfer Addendum applies correspondingly to UK Personal Data.

Liability

Each party’s total liability under this DPA shall not exceed the total fees paid by Customer for the Services in the twelve (12) months preceding the event giving rise to liability.

Governing law

This DPA is governed by the laws of the State of Delaware.