Data Processing Addendum

Version: 1.0

Orbital is a product of Constructr, Inc.

This Data Processing Addendum ("DPA") forms part of the agreement between Constructr, Inc., a Delaware corporation with its registered address at 1484 Pollard Rd, #3006, Los Gatos, CA 95032, USA, which provides the Orbital platform ("Orbital", "we", "us"), and the customer identified in that agreement ("Customer", "you") for Customer's use of Orbital (the "Agreement").

This DPA applies where Orbital processes Personal Information on Customer's behalf. If any term of this DPA conflicts with the Agreement in relation to the processing of Personal Information, this DPA controls.

1. Definitions

Terms defined in the Agreement carry the same meaning here. In addition:

Customer Personal Information means Personal Information contained in Customer Data that Orbital processes on Customer's behalf under the Agreement.
Customer Data means data Customer or its Authorised Users submit to the platform, data an Agent reads from or writes to a system Customer connects, and records of Agent activity generated in the course of providing the platform.
Customer Content means the material Customer puts into the platform and the material its Agents work on, including instructions and prompts, files and data Customer submits, data an Agent reads from or writes to a system Customer connects, Agent outputs, and the content of Customer's agent and workflow configurations.
Operational Telemetry means records of how the platform performed while doing work - such as task durations, token counts, which model or route was selected, latency, retry counts, error rates and error types, cache behaviour, queue depth, compute and cost measures, and whether a task succeeded or failed. Operational Telemetry describes the operation of the platform. It is not Customer Content.
Shared Model means any model, or any component or parameters of a model, that Orbital makes available to, or uses to serve, any customer other than the customer from whose data it was derived.
Customer-Specific Learning means anything Orbital derives from a Customer's Customer Content in order to improve that same Customer's own use of the platform, including fine-tuned weights or adapters, evaluation and test sets, prompt and configuration improvements, retrieval indices and embeddings, cached artifacts, and derived heuristics.
Training Opt-In means a consent that meets all of the requirements in clause 3.4(b).
Agent means an automated process that Orbital runs on Customer's instructions to perform tasks, including reading from and writing to systems Customer connects.
Personal Information has the meaning given in applicable Privacy Law.
Privacy Law means the data-protection and privacy laws applicable to Orbital's processing under this DPA, including the California Consumer Privacy Act as amended ("CCPA") and its implementing regulations.
Service Provider, Business, Consumer, sell, share and Business Purpose have the meanings given in the CCPA.
Sub-processor means a third party Orbital engages to process Customer Personal Information.
Security Incident means a confirmed unauthorised access to, acquisition of, or disclosure of Customer Personal Information in Orbital's custody.

2. Roles of the parties

2.1 For Customer Personal Information, Customer is the Business and Orbital acts as Customer's Service Provider. Where other Privacy Law applies, Customer is the controller and Orbital is the processor, and the equivalent provisions of that law apply to the same effect.

2.2 Orbital processes Customer Personal Information only on Customer's behalf and only for the Business Purposes set out in Annex A. Orbital does not determine the purposes of that processing.

2.3 Orbital acts as a Business in its own right, and not as Customer's Service Provider, for Personal Information it collects for its own purposes - for example information about Customer's account administrators, billing contacts, website visitors and prospective customers. That processing is governed by Orbital's Privacy Policy, not by this DPA.

2.4 Customer is responsible for the lawfulness of Customer Data, for having the authority to instruct Orbital to process it and to grant Agents access to the systems Customer connects, and for providing any notice to, or obtaining any consent from, the individuals concerned.

3. Scope and purpose limitation

3.1 Orbital processes Customer Personal Information only:

(a) for the specific Business Purposes identified in Annex A;
(b) to retain a Sub-processor in accordance with clause 7;
(c) to detect, prevent or investigate security incidents, or to protect against malicious, deceptive, fraudulent or illegal activity; and
(d) where required by law, subject to clause 4.3.

3.2 Orbital will not:

(a) sell or share Customer Personal Information;
(b) retain, use or disclose Customer Personal Information for any purpose other than those in clause 3.1, including any commercial purpose of its own;
(c) retain, use or disclose Customer Personal Information outside the direct business relationship between Orbital and Customer; or
(d) combine Customer Personal Information with Personal Information it receives from any other source, or collects from its own interaction with a Consumer, except where Privacy Law expressly permits it.

3.3 Orbital will provide the same level of privacy protection for Customer Personal Information as the CCPA requires of a Business.

3.4 Model training and data use. Orbital's use of Customer Content and Operational Telemetry is limited to the three cases in this clause. Nothing elsewhere in the Agreement, including any licence to operate, secure or improve the platform, extends them.

(a) Customer Content and Shared Models. Orbital does not use Customer Content to train, fine-tune, or otherwise adjust the parameters of any Shared Model, unless Customer has given a Training Opt-In covering that content. Where no Training Opt-In is in effect, this commitment is absolute.
(b) What a Training Opt-In requires. A Training Opt-In is effective only if it is: (i) given by a person authorised to act for Customer; (ii) specific as to the content covered and the purpose for which it may be used; (iii) recorded in a writing or an in-product record that is separate from Customer's acceptance of the Agreement, this DPA, any terms of use, or any other document that also covers unrelated matters; and (iv) revocable by Customer at any time.
(c) What is not a Training Opt-In. Accepting the Agreement, this DPA or any terms of use does not constitute a Training Opt-In. Continuing to use the platform does not constitute a Training Opt-In. Neither does a pre-selected setting, nor an interface that makes declining harder than accepting. A Training Opt-In applies only to the content and purpose it identifies, and does not extend to other content, purposes or workspaces.
(d) Revocation. On revocation, Orbital stops using the covered Customer Content for training with effect from the date of revocation. Where Customer Content has already been incorporated into a model's parameters, Orbital will not use that content for any further training, but cannot reverse training already completed.
(e) Operational Telemetry. Orbital may use Operational Telemetry to operate and improve the platform, including to improve orchestration and task planning, model routing and selection, token efficiency, reliability, latency, capacity planning and cost. Orbital may use Operational Telemetry to develop and tune the systems that make those decisions, including by statistical and machine-learning methods; those systems are developed from Operational Telemetry only and are not trained on Customer Content.
(f) The boundary between (a) and (e). Operational Telemetry does not include Customer Content. It does not include prompts, instructions, outputs, file contents, or data read from or written to a system Customer connects. Removing identifiers from Customer Content does not turn it into Operational Telemetry. Customer Content remains Customer Content however it is processed, and clause 3.4(a) governs it in every case.
(g) How Operational Telemetry is kept. Orbital maintains Operational Telemetry in a form that cannot reasonably be used to infer information about, or be linked to, any identified or identifiable individual. Orbital takes reasonable measures to ensure it cannot be associated with an individual or a household; publicly commits to maintain and use it in that form and not to attempt to re-identify it, except to test whether its own de-identification is effective; and requires any recipient of it to do the same.
(h) Customer-Specific Learning. Orbital may use a Customer's Customer Content to produce Customer-Specific Learning that improves that Customer's own agents, evaluations, prompts and configurations, within the scope set in Customer's workspace settings, where a workspace administrator can turn it off.
(i) Cross-tenant isolation. Customer-Specific Learning derived from a Customer's Customer Content is held for that Customer alone. Orbital will not make it available to any other customer, will not use it to serve any other customer, and will not incorporate it into any Shared Model or into any product or feature offered to any other customer. This applies to every form of Customer-Specific Learning, including fine-tuned weights and adapters, evaluation sets, prompts and configurations, retrieval indices and embeddings, cached artifacts and derived heuristics. Customer-Specific Learning is Customer Content for the purposes of clause 11.
(j) Third-party model providers. Each model provider in the serving path is engaged under paid, commercial API terms that contractually prohibit the provider from using Customer Content to train or improve its own models. Orbital disables provider settings that would allow Customer Content to be used for model improvement. Orbital has not yet enabled zero-data-retention modes on its own provider accounts, so each provider may retain Customer Content for a limited period under its standard terms, typically for abuse monitoring. Where Customer configures its own provider account or key, that provider processes Customer Content under Customer's agreement with it. The providers and their configurations are listed at withorbital.ai/subprocessors.

3.5 Orbital will notify Customer if it determines that it can no longer meet its obligations under Privacy Law in respect of Customer Personal Information.

4. Customer instructions

4.1 The Agreement, this DPA and Customer's configuration of the platform - including the scopes, policies, approval gates and connectors Customer sets - are Customer's complete instructions for processing Customer Personal Information.

4.2 Orbital will inform Customer if, in its reasonable opinion, an instruction infringes Privacy Law. Orbital may suspend performance of that instruction until it is withdrawn, amended or confirmed.

4.3 If Orbital receives a legally binding demand from a public authority for Customer Personal Information, it will, unless legally prohibited: notify Customer without undue delay; disclose only what the demand requires; and seek to redirect the authority to Customer.

5. Confidentiality and personnel

5.1 Orbital will keep Customer Personal Information confidential and will not disclose it except as this DPA permits.

5.2 Orbital limits access to Customer Personal Information to personnel who need it to perform the Agreement. Access is subject to Orbital's access-control policy, which requires least privilege, individually attributable accounts, multi-factor authentication, and a documented business justification for any access to a customer environment.

5.3 Personnel with access are bound by written confidentiality obligations that survive the end of their engagement.

5.4 Personnel complete security awareness training at onboarding and at least annually.

5.5 Orbital remains responsible for its personnel's compliance with this DPA.

6. Security measures

6.1 Orbital will implement and maintain the technical and organisational measures set out in Annex B, designed to protect Customer Personal Information against unauthorised or unlawful access, destruction, use, modification or disclosure.

6.2 Orbital may update the measures in Annex B provided the overall level of protection is not materially reduced. The current version of Annex B is published with this DPA and is dated.

6.3 Customer is responsible for its own configuration decisions, including the scopes and permissions it grants to Agents, the connectors it enables, the approval gates it requires, and the management of its own credentials and user accounts.

7. Sub-processors

7.1 Customer gives Orbital general authorisation to engage Sub-processors to process Customer Personal Information.

7.2 Orbital maintains a current list of Sub-processors at withorbital.ai/subprocessors, stating for each the purpose of processing, the categories of Customer Personal Information processed, and the processing location.

7.3 Before a new Sub-processor begins processing Customer Personal Information, Orbital will update that list and give Customer at least 30 days' advance notice. Orbital gives that notice by email to Customer's account owners.

7.4 Customer may object to a new Sub-processor on reasonable data-protection grounds by notifying Orbital within the notice period. The parties will discuss the objection in good faith. If Orbital cannot provide the platform without the Sub-processor and the objection is not resolved, Customer may terminate the affected part of the Agreement without penalty by giving written notice, and Orbital will refund any prepaid fees for the terminated period.

7.5 Orbital will impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, including the restrictions in clause 3.2.

7.6 Orbital remains responsible to Customer for its Sub-processors' performance of those obligations.

8. Assisting with consumer and data subject requests

8.1 Orbital will provide reasonable assistance to enable Customer to respond to a verified request from a Consumer to know, access, delete, correct, obtain a portable copy of, limit the use of, or opt out of the sale or sharing of their Personal Information.

8.2 Where the platform provides a self-service means of locating, exporting, correcting or deleting Customer Personal Information, Customer will use it in the first instance.

8.3 Where self-service is not available, Orbital will act on Customer's written instruction within 10 business days.

8.4 If Orbital receives a request directly from a Consumer, it will either act on Customer's instructions or inform the Consumer that the request cannot be acted on because it was sent to a Service Provider, and direct them to Customer.

8.5 Orbital will pass through to Sub-processors any instruction needed to give effect to a request, and will take reasonable steps to confirm it has been actioned.

8.6 Orbital provides the assistance in this clause at no additional charge. Where requests are manifestly unfounded or excessive, Orbital may charge a reasonable fee, on notice to Customer.

9. Security Incidents

9.1 Orbital will notify Customer of a Security Incident affecting Customer Personal Information without undue delay and in any event within 72 hours of confirming it.

9.2 The notice will include, to the extent known: what happened and when; the categories and approximate volume of Customer Personal Information affected; the likely consequences; the steps Orbital has taken to contain and remediate; and a named contact. Orbital will supplement the notice as the investigation develops.

9.3 Notice is given to the contact Customer designates for security notices, or failing that to Customer's account owner.

9.4 Orbital will cooperate reasonably with Customer's investigation and with any notification Customer must make to a Consumer or regulator. Customer is responsible for determining whether it must notify and for making that notification.

9.5 An Orbital notice under this clause is not an admission of fault or liability.

9.6 Orbital will treat a Security Incident at a Sub-processor affecting Customer Personal Information as a Security Incident under this clause.

10. Audit and information rights

10.1 On Customer's written request, no more than once in any 12-month period unless a Security Incident or Privacy Law requires otherwise, Orbital will provide information reasonably necessary to demonstrate its compliance with this DPA. The request path runs in this order:

(a) Documentation. Orbital's then-current security documentation, the measures in Annex B, the Sub-processor list, and responses to a reasonable security questionnaire.
(b) Third-party report. Where Orbital holds a current third-party audit report or attestation covering the platform, a copy under confidentiality obligations.
(c) Customer-led audit. Where (a) and (b) do not reasonably satisfy Customer's obligations under Privacy Law, an audit of Orbital's processing by Customer or an independent auditor Customer appoints who is not a competitor of Orbital and who is bound by confidentiality.

10.2 A Customer-led audit is subject to at least 30 days' written notice, a scope agreed in advance, conduct during business hours, and no unreasonable disruption. It must not extend to any other customer's data, Orbital's trade secrets, or information Orbital is bound to keep confidential.

10.3 Each party bears its own costs, except that Customer bears Orbital's reasonable costs for any audit beyond the once-yearly limit in clause 10.1.

10.4 Customer may exercise reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Information by Orbital, on notice.

11. Retention, return and deletion

11.1 Orbital retains Customer Personal Information for as long as needed to provide the platform under the Agreement, and thereafter only as clause 11.2 permits.

11.2 On expiry or termination of the Agreement, Orbital will delete or return Customer Personal Information within 30 days of Customer's written request, except where Orbital is required by law to retain it.

11.3 Before deletion, Customer may request an export of Customer Data, which Orbital will provide in a machine-readable format.

11.4 Copies held in backups are deleted on the ordinary backup expiry cycle, stated in Annex B. During that period they remain subject to this DPA and are not restored to active use except for disaster recovery.

11.5 Orbital may retain Customer Personal Information where law requires, and will keep it subject to this DPA for as long as it is retained.

11.6 On request, Orbital will confirm deletion in writing.

12. International transfers

12.1 Orbital processes Customer Personal Information in the United States, or in the European Union where Customer has selected an EU processing region on an enterprise plan. The processing locations of Sub-processors are listed at withorbital.ai/subprocessors.

12.2 Some Sub-processors process Customer Personal Information outside the United States. The processing location of each is stated on the Sub-processor list.

12.3 Reserved - international transfer mechanisms. This DPA does not currently include transfer mechanisms for the European Economic Area, the United Kingdom or Switzerland, because Orbital does not presently offer the platform to customers established in those territories.

If Orbital begins offering the platform to customers established in those territories, this DPA will be updated with the applicable transfer mechanisms before any such processing begins.

13. General

13.1 This DPA takes effect when Customer accepts it or executes the Agreement, whichever is earlier, and continues for as long as Orbital processes Customer Personal Information.

13.2 Clauses 3, 5, 9, 10 and 11 survive termination for as long as Orbital retains Customer Personal Information.

13.3 The liability of each party under this DPA is subject to the limitations and exclusions in the Agreement.

13.4 Governing law, jurisdiction and dispute resolution are as set out in the Agreement.

13.5 Orbital may update this DPA on at least 30 days' notice where needed to reflect a change in Privacy Law, a change in the platform, or a change in Sub-processors, provided the change does not materially reduce the protections it gives Customer. Material adverse changes require Customer's agreement.

13.6 Questions about this DPA: privacy@withorbital.ai. Security notices: security@withorbital.ai.

Annex A - Details of processing

Dated October 18, 2026. Version 1.0.

A.1 Subject matter. Orbital's provision of the agent platform under the Agreement: planning and running Agent tasks, enforcing the policies and permission scopes Customer configures, routing model requests, recording Agent activity for Customer's inspection, and supporting Customer's use of the platform.

A.2 Duration. The term of the Agreement, plus the retention period in clause 11.

A.3 Nature of processing. Collection, recording, storage, retrieval, transmission, analysis by automated means, display to Customer's authorised users, disclosure to the Sub-processors listed at withorbital.ai/subprocessors, and deletion.

A.4 Business Purposes. Orbital processes Customer Personal Information only to:

authenticate Customer's authorised users and manage their roles and permissions;
accept, plan and execute Agent tasks Customer initiates, including reading from and writing to the systems Customer connects, within the scopes Customer grants;
enforce the policies, permission scopes, approval gates and spending limits Customer configures;
transmit the content of a task to the model providers listed at withorbital.ai/subprocessors, to obtain the output needed to perform the task;
record Agent activity so Customer can inspect what an Agent did, when, and under what authority;
store and make available Customer Data in the platform;
provide support Customer requests, including investigating a specific issue Customer raises;
maintain the security, availability and integrity of the platform, and detect and investigate abuse;
meter usage for billing;
comply with Orbital's legal obligations.

A.5 Categories of individual. Customer's authorised users and personnel; and individuals whose Personal Information appears in a system Customer connects an Agent to, or in content Customer submits. The second category is open-ended by design: it depends on what Customer connects.

A.6 Categories of Customer Personal Information.

Category	Examples
Identifiers and account data	Name, work email, organisation, role
Authentication data	Credentials, session and MFA data for platform accounts
Connector credentials	Tokens and secrets Customer supplies so an Agent can reach a connected system
Task content	Instructions, files and data Customer submits to an Agent
Data read from connected systems	Whatever the connected system holds, which Customer controls by choosing what to connect and what scopes to grant
Agent activity records	Actions attempted and taken, decisions allowed or denied, approvals given, timestamps, actor identity
Usage and telemetry	Usage events, performance metrics, API logs, device and browser information, IP address
Support data	Tickets, and screenshots or recordings Customer shares

A.7 Special categories and children's data. Customer must not submit, and must not configure an Agent to retrieve, protected health information, payment card data, government-issued identifiers, or Personal Information of children under 16, unless the parties agree in writing in advance. Orbital does not offer a HIPAA Business Associate Agreement and the platform is not configured for protected health information.

A.8 Sub-processors. As listed at withorbital.ai/subprocessors, as updated in accordance with clause 7.

Annex B - Technical and organisational measures

Dated October 18, 2026. Version 1.0.

B.1 Encryption

Customer Personal Information is encrypted in transit using TLS 1.2 or higher.
Customer Personal Information in Orbital's managed storage, including backups, is encrypted at rest using AES-256, with keys managed by the cloud provider's key-management service.
Secrets and credentials are held in a managed secrets store and are never committed to source control, chat or email.

B.2 Access control

Access to Customer Personal Information is limited to personnel with a documented business need, on the principle of least privilege and deny-by-default.
Every person has an individually attributable account; shared accounts are prohibited for human use.
Multi-factor authentication is required for the identity provider, source-code hosting, cloud consoles and production administrative interfaces. Phishing-resistant factors are required for production-administrative access.
Standing production-administrative access is discouraged in favour of time-bounded elevation, with a maximum window of eight hours.
Access to a customer environment requires a recorded justification, and is logged with actor identity, customer, time and justification. Access without a justification is handled as a security incident.
Access rights are reviewed quarterly by managers, and privileged accounts annually by the CTO.
On termination, identity-provider access is disabled within four hours and sessions invalidated.

B.3 Platform controls available to Customer

Role-based access with owner, administrator and member roles.
Permission scopes that restrict what an Agent may access.
Approval gates requiring a person to authorise consequential Agent actions. Enforcement coverage varies by connector.
Per-session credential grants for connected systems.
Spending limits for configured workloads. Limit-trigger behaviour depends on configuration.
Single sign-on (SAML) and SCIM provisioning on enterprise plans.

B.4 Logging and monitoring

Agent execution is recorded in an audit trail available to Customer for inspection.
The audit trail is append-only: records cannot be edited or deleted by customers or by Orbital staff during the retention period.
Administrative actions and access to Customer Personal Information are logged.
Security and audit logs are retained for 12 months; routine operational logs for up to 90 days.

B.5 Secure development and vulnerability management

Changes to production follow a documented change-management process, including peer review, and no individual can unilaterally deploy to production.
Dependencies are scanned continuously for known vulnerabilities, and fixes are prioritised by severity: critical within 7 days, high within 30 days and medium within 90 days.

B.6 Resilience

Customer Personal Information is backed up. Backups are encrypted and expire within 90 days.
A business continuity and disaster recovery plan is maintained and reviewed at least every six months.
Restore procedures are tested periodically under the business continuity and disaster recovery plan.
No availability or uptime commitment is made in this annex. Availability commitments, if any, are made in the Agreement.

B.7 Personnel

Confidentiality obligations in writing for all personnel with access.
Security awareness training, and completion of training before production access is granted. Training is repeated at least annually.

B.8 Incident response

A documented incident response plan with defined severity levels, named roles, and internal response targets.
Post-incident reviews within five business days for high and critical incidents, with tracked corrective actions.
A vendor incident affecting Orbital data is handled as an Orbital incident.
Customer notification as set out in clause 9.

B.9 Sub-processor management

Vendors handling Customer Personal Information are tiered by risk and assessed before engagement, including a review of their security posture and a data-protection agreement.
Vendors handling Customer Personal Information are re-reviewed at least annually.
Customer Personal Information is not sent to a model provider that offers neither a training opt-out nor a zero-retention mode.
A public Sub-processor list is maintained, and a new Sub-processor is added to it before it begins processing.

B.10 Deployment options affecting these measures Orbital offers Orbital-hosted, Customer-hosted (control plane in Customer's own environment) and air-gapped deployment. Where Customer hosts the control plane or operates air-gapped, responsibility for infrastructure-level measures shifts to Customer, and the parties should record the split in the Agreement. Orbital provides a data-flow map for the deployment on request.