Data Processing Agreement

This DPA is entered into between the customer identified in the applicable order or account registration ("Customer," acting as the "Controller" or, where applicable, "Processor" on behalf of its own end customers) and Praxion, a software project and service currently operated by its founder as an individual, pending the incorporation of a legal entity ("Praxion," acting as "Processor").

Terms such as "Personal Data," "Processing," "Controller," "Processor," "Data Subject," "Supervisory Authority," and "Personal Data Breach" have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission (currently Commission Implementing Decision (EU) 2021/914 or its successor) for the transfer of personal data to third countries.

This DPA governs the Processing of Personal Data by Praxion on behalf of Customer in connection with the Services described in the Terms of Service. This DPA remains in effect for as long as Praxion Processes Personal Data on Customer's behalf under the Terms of Service, and terminates automatically upon deletion of all such Personal Data in accordance with Section 9.

Subject matter	Provision of a database governance, query optimization, and natural-language-to-SQL platform, operating via an on-premises agent deployed within Customer's own infrastructure and a cloud-hosted control plane operated by Praxion.
Duration	For the term of the Terms of Service, plus any post-termination retention period described in Section 9.
Nature and purpose	Collection and analysis of database performance telemetry (query patterns, execution statistics, schema metadata) to generate optimization suggestions; processing of natural-language prompts submitted by Customer's authorized users to generate SQL queries via a third-party AI provider; account, authentication, and billing administration.
Categories of Personal Data	Account and contact information of Customer's authorized users (name, email address, authentication identifiers); billing contact and payment metadata (processed by our payment sub-processor; Praxion does not store full payment card numbers); to the extent present in Customer's database schema, metadata, or query text submitted by Customer's own users — which Customer represents it has the right to disclose to Praxion for the purposes of this Agreement. Praxion's on-premises agent is designed to operate on database metadata and query statistics rather than full row-level data; Customer remains responsible for the content of any database it connects to the Services.
Categories of Data Subjects	Customer's employees, contractors, and authorized users of the Services; to the extent applicable and disclosed to Praxion as described above, Customer's own end users or customers whose data may be present in the connected database's metadata or query text.

Praxion shall:

1. Process Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by Union or Member State law to which Praxion is subject — in which case Praxion shall inform Customer of that legal requirement before Processing, unless prohibited from doing so.
2. Ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement appropriate technical and organizational measures as described in Section 7.
4. Respect the conditions for engaging sub-processors described in Section 5.
5. Taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures, insofar as reasonably possible, for the fulfillment of Customer's obligation to respond to requests for exercising Data Subject rights under Chapter III of the GDPR.
6. Assist Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR (security of Processing, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to Praxion.
7. At Customer's election, delete or return all Personal Data after the end of the provision of the Services, and delete existing copies, as further described in Section 9.
8. Make available to Customer the information reasonably necessary to demonstrate compliance with this Section 4, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to Section 8.
9. Immediately inform Customer if, in Praxion's opinion, an instruction from Customer infringes the GDPR or other applicable data protection law.

Customer provides general written authorization for Praxion to engage the sub-processors listed below in connection with the provision of the Services. Praxion has entered into, or will enter into, a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA.

Sub-processor	Function	Location
Supabase	Primary application database (Postgres)	European Union
Clerk	Authentication and organization/user management	United States, with EU data residency options
Stripe	Payment processing and billing	European Union / United States
Anthropic	AI processing for natural-language-to-SQL and optimization suggestions	United States
Resend	Transactional email delivery	European Union / United States
Upstash	Redis infrastructure (rate limiting, event bus)	European Union
Render	Hosting of the application backend (control plane API)	European Union
Vercel	Hosting of the web dashboard and marketing site	European Union / United States
Cloudflare	DNS resolution and email routing	Global network

Praxion shall notify Customer of any intended changes concerning the addition or replacement of sub-processors by updating this page and, where Customer has provided a contact email, by emailing that address at least ten (10) days before the change takes effect, giving Customer the opportunity to object on reasonable data-protection grounds. If Customer objects and the parties cannot resolve the objection, Customer may terminate the affected portion of the Services as its sole remedy.

As described in Praxion's Privacy Policy, the Services are currently hosted using infrastructure providers located in the European Union (Germany and France), with the possibility of additional infrastructure located in the United States or other countries in the future. Where Personal Data is transferred outside the European Economic Area, United Kingdom, or Switzerland to a country not subject to an adequacy decision, such transfer shall be governed by the Standard Contractual Clauses (Module Two: Controller to Processor, or Module Three: Processor to Processor, as applicable), which are hereby incorporated by reference, or another legally recognized transfer mechanism.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to the rights and freedoms of natural persons, Praxion implements the following technical and organizational measures:

• Encryption of Personal Data in transit (TLS) and at rest (AES-256, as provided by our infrastructure sub-processors).
• Row-level access isolation between Customer organizations at the database level for applicable data categories, enforced via database-level security policies.
• Role-based access control (RBAC) governing which authorized users may view, apply, or approve optimization actions within the Services.
• An append-only, tamper-evident audit log recording material actions taken within the Services.
• Rate limiting and usage controls on AI-assisted features to prevent abuse and limit the impact of compromised credentials.
• No automatic application of optimization suggestions or schema changes without explicit approval by an authorized user.
• Regular review of sub-processor security practices and reliance on sub-processors' own certifications and contractual commitments where applicable.

No more than once per twelve (12) month period, and subject to reasonable advance written notice (at least 30 days) and confidentiality obligations, Customer or its appointed independent auditor may request information reasonably necessary to verify Praxion's compliance with this DPA. Given Praxion's current scale, such requests will generally be addressed through the provision of relevant documentation, sub-processor certifications, and written responses to reasonable questionnaires, rather than on-site audits, unless otherwise required by a Supervisory Authority or applicable law. Customer shall bear its own costs of any audit; Praxion may charge for time reasonably spent responding to audit requests beyond one such request per year.

Upon termination or expiration of the Terms of Service, and upon Customer's written request, Praxion shall delete or, at Customer's election, make available for export, all Personal Data Processed on Customer's behalf, within thirty (30) days, except to the extent applicable law requires retention of certain data (for example, billing records required for tax or accounting purposes, or audit log entries required to be retained for a defined period as described in Praxion's data retention practices). Data connected via Customer's own on-premises agent is not stored by Praxion beyond the metadata and telemetry described in Section 3; Customer remains in sole control of, and responsible for deleting, its own underlying database.

Praxion shall notify Customer without undue delay, and in any event within 72 hours of becoming aware, after becoming aware of a Personal Data Breach affecting Customer's Personal Data, providing the information reasonably available to Praxion at the time to allow Customer to meet its own notification obligations under Articles 33 and 34 of the GDPR. Praxion shall provide reasonable cooperation and available information to assist Customer's own investigation and any required notifications to Supervisory Authorities or affected Data Subjects.

Each party's liability arising out of or in connection with this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits either party's liability that cannot be limited or excluded under applicable law, including under Article 82 of the GDPR.

This DPA is governed by the same governing law and jurisdiction provisions as the Terms of Service. Where the Standard Contractual Clauses apply under Section 6, the governing law and jurisdiction provisions of the Standard Contractual Clauses themselves prevail with respect to the matters they govern.

In the event of a conflict between this DPA and the Terms of Service with respect to the Processing of Personal Data, this DPA prevails. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

As noted above, this DPA applies automatically upon Customer's submission of Personal Data to the Services under the Terms of Service. The signature block is provided for Customers who require a countersigned copy for their own internal records.

For questions about this DPA, please contact: privacy@praxionapp.com