ANDORG DATA PROCESSING AGREEMENT (TEMPLATE) This template is provided for customers who require a signed DPA. Processing model: personal data and provider keys are processed only in volatile memory for the duration of a single API request, then destroyed. No personal data is retained at rest except (1) customer secret-word lists (encrypted) and (2) Deep Read results (encrypted, <=24h, one-time delivery). Sub-processors: Stripe (billing). Contact legal@andorg.com to execute.