Data Processing Addendum

This summary is for convenience and is not part of the agreement. - You, the agency or creator, decide to use Anlora on your creator accounts. You are responsible for having the right to process your fans' data, including telling them what they need to be told. - Anlora handles that data only to run the Service for you, on your instructions, and keeps it secure. - Fan chats on an adult platform can reveal a person's sex life. You confirm you have a legal basis for that. - Anlora tells you without delay if there is a data breach, helps you answer fans' requests, and deletes the data when you leave. - This Addendum is part of the Terms of Service. Accepting the Terms accepts it. There is nothing separate to sign.

1.1 This Data Processing Addendum ("Addendum") forms part of the Anlora Terms of Service ("Terms") between Anlora (operations based in Prague, Czech Republic) and the Organization that accepts the Terms ("Customer"). It applies whenever Anlora processes Personal Data on the Customer's behalf in providing the Service. 1.2 Words defined in the Terms have the same meaning here. "GDPR" means Regulation (EU) 2016/679. "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given in the GDPR. "Fan Data" means Personal Data of fans, subscribers and other end users of a connected Creator Account that Anlora processes for the Customer through the Service. "Sub-processor" means another processor Anlora engages to process Fan Data. 1.3 If this Addendum and the rest of the Terms conflict on the processing of Personal Data, this Addendum controls, except that Section 14 of the Terms (Customer Compliance and Disclosure Obligations) continues to apply in full.

2.1 For Fan Data, the Customer is the Controller and Anlora is the Processor. Where the Customer acts as a processor for a creator, the Customer confirms it is authorised by that creator to engage Anlora, and Anlora acts as a sub-processor. In both cases the Customer is Anlora's only point of instruction. 2.2 Anlora is a separate Controller for the Customer's own account, billing and usage data. That processing is described in the Privacy Policy and is outside this Addendum. 2.3 Anlora does not decide why or how Fan Data is processed beyond what is needed to carry out the Customer's instructions. 2.4 Where a United States state privacy law, such as the California Consumer Privacy Act, applies to Fan Data, Anlora acts as the Customer's service provider or processor under that law. Anlora will not sell or share Fan Data, and will not keep, use, or disclose it outside its direct business relationship with the Customer or for any purpose other than the business purposes in Section 3.

3.1 The Customer instructs Anlora to process Fan Data to provide the Service. The Terms, this Addendum and the Customer's configuration and use of the Service are the Customer's complete documented instructions. They include, for each Creator Account the Customer connects: (a) accessing the Creator Account and receiving its messages, subscriber and transaction events; (b) passing fan messages, fan identifiers and related account data to the AI messaging feature; (c) generating and sending replies and content offers in the creator's name; (d) building and keeping, for each fan, a conversation history, summaries of that history and a fan profile. The profile holds facts the fan has shared, the fan's stated and inferred preferences and interests (which can include sexual preferences), characteristics of how the fan communicates, and the fan's purchase history. It is used only to make replies relevant to that fan on that Creator Account; (e) showing the Customer analytics about its own Creator Accounts; (f) support, fault-finding and security work under Section 27 of the Terms (Support Access); (g) reviewing conversations from the Customer's Creator Accounts in order to assess and improve the quality of the replies the Service generates. The review is carried out by the personnel of Anlora and of its AI conversation provider and by the AI tools they use. 3.2 Anlora will tell the Customer if, in Anlora's opinion, an instruction infringes data protection law. Anlora may pause the affected processing until the Customer confirms or changes the instruction. 3.3 Other than as set out in Section 3.1, Anlora will not process Fan Data for its own purposes, and it will not sell it. Anlora and its AI conversation provider do not train or fine-tune any AI model on Fan Data, do not export it as a dataset, and do not use one fan's messages to generate a reply to another fan. Anonymised statistics made only from service metadata, as described in Section 10 of the Terms, are not Fan Data.

4.1 The Customer is responsible for the lawfulness of the processing it instructs. In particular the Customer confirms that, before connecting a Creator Account and for as long as it stays connected: (a) it has a legal basis under Article 6 GDPR for processing Fan Data through the Service; (b) because fan conversations can reveal information about a person's sex life or sexual orientation, it has a valid condition under Article 9(2) GDPR for that processing, including the fan's explicit consent where no other condition applies; (c) it has given fans the information required by Articles 13 and 14 GDPR, including that messages may be written by an AI system, that a profile of the fan is kept to personalise replies, and that service providers process their data for the Customer; (d) it has carried out any data protection impact assessment the law requires for this processing; (e) it has the creator's authority described in Section 14(c) of the Terms. 4.2 The Customer is the contact point for fans and for supervisory authorities in relation to Fan Data, and is responsible for answering fans' requests to exercise their rights. 4.3 This Section does not reduce any duty that the law places directly on Anlora.

5.1 Confidentiality. Anlora ensures that everyone it authorises to process Fan Data is bound by a duty of confidentiality and accesses Fan Data only where needed for the purposes in Section 3. 5.2 Security. Anlora maintains the technical and organisational measures in Annex 2 and may update them, provided the overall level of protection does not decrease. 5.3 Requests from fans. If a fan contacts Anlora directly, Anlora will pass the request to the Customer without undue delay and will not answer it itself unless the law requires. On the Customer's written request, Anlora will delete, correct or export the Fan Data of an identified fan held in the Service, and will instruct its Sub-processors to do the same, within 30 days. Anlora may charge its reasonable costs for assistance that goes beyond the standard functions of the Service. 5.4 Personal Data Breach. Anlora will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Fan Data. The notice will describe what is known about the nature of the breach, the data and the accounts affected, the likely consequences and the steps taken. Anlora will keep the Customer updated and will help the Customer meet its own notification duties. A notice under this Section is not an admission of fault. 5.5 Assistance. Taking into account the nature of the processing and the information available to it, Anlora will help the Customer with data protection impact assessments, prior consultation with a supervisory authority, and security obligations under Articles 32 to 36 GDPR, by providing the information generally available about the Service. Further assistance is by agreement and at the Customer's cost.

6.1 The Customer gives Anlora general authorisation to engage Sub-processors. The current Sub-processors are listed in Section 6 of the Privacy Policy, which is the single list for this Addendum. 6.2 Anlora will give at least 14 days' notice before adding or replacing a Sub-processor, by email or in the dashboard. The Customer may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may stop using the affected part of the Service or end the Terms without a notice period, as its only remedy. 6.3 Anlora binds each Sub-processor in writing to data protection obligations no less protective than those in this Addendum, and remains responsible to the Customer for each Sub-processor's performance of them.

Anlora stores Fan Data in the European Union. Where a Sub-processor processes Fan Data outside the European Economic Area, Anlora ensures the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses, with any additional safeguards the law requires.

8.1 The Customer can remove a Creator Account or close its Account at any time. Before closing, the Customer may ask Anlora for an export of its Fan Data in a common machine-readable format. 8.2 After the Account is closed, Anlora deletes Fan Data from the Service 30 days later and instructs its Sub-processors to delete their copies. Backups age out as described in Section 7 of the Privacy Policy. Anlora keeps only what the law requires it to keep, such as billing records. 8.3 While the Account is open, Fan Data is kept for the periods in Section 7 of the Privacy Policy.

9.1 On written request, and no more than once in any 12 months, Anlora will give the Customer the information reasonably needed to show compliance with Article 28 GDPR, by written answers or by available third-party reports. 9.2 If that information is not enough, or a supervisory authority requires it, or after a Personal Data Breach affecting the Customer, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality. Where Anlora holds a recent audit report, the Customer will first rely on a summary of it. An audit takes place on at least six weeks' notice, during business hours, without access to other customers' data, and at the Customer's cost.

10.1 Sections 11 (Indemnification) and 13 (Limitation of Liability) of the Terms apply to this Addendum. 10.2 Nothing in this Addendum or the Terms limits the rights of Data Subjects or the powers of supervisory authorities under the GDPR, or either party's liability to them.

11.1 This Addendum applies for as long as Anlora processes Fan Data for the Customer, and Sections 8 and 10 continue after that. 11.2 Anlora may update this Addendum where the law or the Service changes, with 14 days' notice. An update will not reduce the protection of Fan Data. 11.3 This Addendum is governed by the law that governs the Terms, except where Standard Contractual Clauses require otherwise. 11.4 Contact for data protection matters: privacy@meetanlora.com or hello@meetanlora.com.

Subject matter: operating the Service for the Customer's connected Creator Accounts. Duration: for as long as the Account is open, then as set out in Section 8. Nature and purpose: receiving, relaying, storing, analysing and generating messages; keeping a conversation history and fan profile to personalise replies; reviewing conversations to improve reply quality; analytics; support and security. Data Subjects: fans, subscribers and other end users who interact with a connected Creator Account. Types of data: platform user id, username, display name and avatar; message text and media sent to or by the creator; subscription, purchase and tip history; conversation summaries and the fan profile described in Section 3.1(d). Special categories: information revealing a fan's sex life or sexual orientation, where the fan shares it or it can be inferred from the conversation. Retention: as set out in Section 7 of the Privacy Policy and Section 8 of this Addendum.

- Encryption in transit (TLS 1.2 or higher) for all connections - Field-level encryption at rest for platform credentials and session tokens - Each customer's data separated by team, with role-based access control inside the team - Staff access limited to the people who need it, under a duty of confidentiality - Servers in the European Union, containerised, behind a firewall, a web application firewall and DDoS protection - Automated encrypted backups with a separate encryption key - Automatic log rotation and data purging