1. Definitions

"Controller" means the MAMA customer (you) who determines the purposes and means of processing personal data through the MAMA platform.

"Processor" means OliWoods LLC ("MAMA"), which processes personal data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Sub-processor" means any third party engaged by the Processor to process Personal Data.

2. Scope of Processing

MAMA processes data solely to provide AI agent orchestration services as described in our Terms of Service. Processing activities include:

• Routing prompts to LLM providers (Anthropic, OpenAI, Google, or user-specified endpoints)
• Storing conversation history for context continuity
• Computing cost analytics and usage metrics
• Managing task orchestration and agent dispatch

3. Data Security

The Processor implements appropriate technical and organizational measures including:

• AES-256 encryption for stored API keys and sensitive credentials
• TLS 1.3 for all data in transit
• Zero-knowledge mode option that strips PII before cloud LLM calls
• Configurable data retention policies (user-defined, default 90 days)
• Role-based access controls and audit logging

4. Sub-processors

Current authorized sub-processors:

• Supabase (Database, Auth) — US East region
• AWS (ECS Fargate, ECR) — US East region
• Anthropic (LLM API) — when Standard privacy mode is used
• OpenAI (LLM API) — when user provides BYOK key

Users on "Local Only" mode have no sub-processor involvement in prompt processing.

5. Data Subject Rights

The Processor assists the Controller in responding to data subject requests including:

• Access: Export all stored data via Privacy Settings
• Rectification: Update account information via Settings
• Erasure: Delete all data via Privacy Settings or by contacting support
• Portability: JSON export of all data

6. Data Retention

Personal data is retained according to user-configured retention policies. Default retention periods:

• Prompt logs: 90 days (configurable 1-365 days)
• Conversation memory: 30 days (configurable)
• Cost and usage analytics: 1 year
• Account data: Duration of service + 30 days

7. Breach Notification

The Processor shall notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach, providing details of the nature of the breach, categories of data affected, and remedial measures taken.

8. GDPR Compliance

This DPA is designed to meet the requirements of the EU General Data Protection Regulation (GDPR). The Processor commits to processing Personal Data in accordance with GDPR Articles 28 and 32, and applicable supplementary measures for international data transfers.

9. SOC 2 Commitment

MAMA is committed to achieving SOC 2 Type II compliance. Our security controls cover the Trust Service Criteria for Security, Availability, and Confidentiality. Contact us for our current compliance documentation.