Last updated September 15, 2026
01Introduction
This Data Processing Addendum ("DPA") supplements the Orenyx Terms of Service between Orenyx Labs, LLC ("Orenyx," "Processor," "we," "us," or "our") and Customer ("Controller," "Customer," or "you") governing Customer's use of the Orenyx AI Engine platform (the "Service"). This DPA applies to the extent Orenyx Processes Personal Data on Customer's behalf in the course of providing the Service. Capitalized terms not defined in this DPA have the meanings given in the Terms of Service.
02Definitions
"Personal Data" means any information relating to an identified or identifiable natural person that is submitted to, or processed by, the Service on Customer's behalf, including information relating to Customer's Authorized Users and End Users. "Process" or "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion. "Data Protection Laws" means all applicable laws and regulations governing the Processing of Personal Data, including applicable U.S. state privacy laws. "Sub-processor" means any third party engaged by Orenyx to Process Personal Data in connection with the Service.
03Roles of the Parties
As between the parties, Customer is the Controller of Personal Data relating to its Authorized Users and End Users, and determines the purposes and means of Processing such Personal Data. Orenyx is a Processor acting on Customer's behalf and will Process Personal Data solely for the purpose of providing the Service, in accordance with Customer's documented instructions as set forth in the Terms of Service, the applicable Order Form, and this DPA, except where otherwise required by applicable law.
04Scope of Processing
Orenyx Processes Personal Data submitted through Customer's use of the Service, including Personal Data reflected in dispatch events, bot executions, payment-decisioning calls, routing and workflow records, and conversation state maintained across connected Orenyx products, for the duration of Customer's subscription and as further described in the Orenyx Privacy Policy.
05Confidentiality
Orenyx will ensure that personnel authorized to Process Personal Data are subject to a binding obligation of confidentiality with respect to such Personal Data.
06Security Measures
Orenyx will implement and maintain appropriate technical and organizational measures designed to protect Personal Data, consistent with the practices described in the Orenyx Security Statement, including logical tenant isolation for Starter and Growth Plan Customers and dedicated infrastructure for Enterprise Plan Customers where applicable.
07Sub-processors
Customer authorizes Orenyx to engage Sub-processors to Process Personal Data in connection with the Service, including Stripe, Inc. for payment processing, and Orenyx's hosting and infrastructure providers. Orenyx will impose data protection obligations on its Sub-processors that are substantially consistent with those set forth in this DPA and will remain responsible for its Sub-processors' performance of their obligations. Orenyx will provide notice of the addition of a new material Sub-processor, and Customer's continued use of the Service following such notice constitutes acceptance of the new Sub-processor.
08Assistance with Data Subject Requests
Taking into account the nature of the Processing, Orenyx will provide reasonable assistance to Customer, at Customer's expense where the request requires material engineering or administrative effort, to enable Customer to respond to requests from individuals seeking to exercise their rights under applicable Data Protection Laws with respect to Personal Data Processed through the Service.
09Personal Data Breach Notification
Orenyx will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data Processed through the Service. Such notification will include such information as Orenyx has available at the time to enable Customer to meet any of its own notification obligations under applicable Data Protection Laws.
10Retention and Deletion
Personal Data reflected in usage, telemetry, decision, and routing logs is retained in accordance with Customer's subscribed logging tier, as described in the Orenyx Privacy Policy, being seven (7) days for basic logging, thirty (30) days for full logging, and a custom period for premium or Enterprise retention as separately agreed. Following termination of Customer's Account, Orenyx will delete or, at Orenyx's election, anonymize Personal Data in accordance with its standard data retention practices, except to the extent retention is required by applicable law or for legitimate business archival, audit, tax, or dispute-resolution purposes.
11Audit Rights
Upon Customer's reasonable written request, and no more than once per twelve-month period, Orenyx will make available information reasonably necessary to demonstrate compliance with this DPA, which may take the form of a summary of Orenyx's security practices, a relevant third-party audit report if available, or written responses to a reasonable security questionnaire, at Orenyx's discretion, in lieu of an on-site audit.
12International Transfers
Personal Data Processed under this DPA is Processed in the United States. To the extent Personal Data originating outside the United States is transferred to Orenyx for Processing, Customer is responsible for ensuring that such transfer is lawful under applicable Data Protection Laws.
13Liability
Each party's liability arising out of or relating to this DPA is subject to the limitations of liability set forth in the Terms of Service.
14Term and Governing Law
This DPA remains in effect for as long as Orenyx Processes Personal Data on Customer's behalf under the Terms of Service, and is governed by the laws of the State of Wyoming, consistent with Section 18 of the Terms of Service.