Data Processing Agreement

PARTIES

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (or the applicable Enterprise agreement) (the “Agreement”) between the customer (the “Controller”) and Refract Systems, Inc., a Delaware corporation with its principal place of business in Sunnyvale, California (the “Processor” or “VirtMCU”), operator of the VirtMCU platform (control plane at virtmcu.com; simulation engine at api.virtmcu.com). For the purposes of this DPA, “GDPR” means Regulation (EU) 2016/679 and, as applicable, the UK GDPR and the Swiss FADP.

1. SUBJECT-MATTER & DURATION

VirtMCU processes personal data in the course of providing the hosted VirtMCU service — an authenticated HTTPS/MCP service for running the Controller's firmware on deterministic, best-effort virtual MCUs, plus the control-plane account/billing functions — for the term of the Agreement and until deletion/return of personal data per Section 10.

2. NATURE & PURPOSE OF PROCESSING

VirtMCU processes personal data solely to provide the Service:

• authenticating API requests by comparing a SHA-256 hash of the bearer token against an authorized set;
• spawning, per session, a dedicated ephemeral environment that loads the Controller's uploaded firmware and runs the requested simulation;
• optionally compiling Controller-supplied source in a hardened, isolated sandbox;
• emitting operational and usage-metering logs keyed by token hash;
• (control plane) administering accounts, authentication, and subscriptions/billing.

Key architectural fact:engine processing is ephemeral and segregated — each session is a single-use environment torn down at session end, with the Controller's firmware destroyed at teardown (Section 10). The engine holds no account identity, email, or payment data — those live in the separate control plane.

3. TYPES OF PERSONAL DATA & DATA SUBJECTS

• API token hash — a SHA-256 hash of the bearer token; pseudonymous, joinable to the Controller only via the control plane.
• Account/identity & billing data (control plane) — email, authentication profile, subscription/billing metadata (payment data is held by Stripe as merchant of record).
• Operational log metadata — request ID, HTTP status, duration, and session-shape metrics, each keyed by token hash.
• Infrastructure request metadata — standard request logs that may include client IP address and user-agent.
• Customer-uploaded firmware / source — to the extent it contains personal data embedded by the Controller; treated as opaque content, not logged or inspected for personal data, and not used to train models.

Data subjects are typically the Controller's developers/end-users who hold API tokens. VirtMCU does not intend the Service for special-category data (Art. 9); the Controller warrants that it will not submit special-category personal data or prohibited/sensitive data (Terms of Service §13) to the Service.

4. PROCESSOR OBLIGATIONS

• Documented instructions: process personal data only on the Controller's documented instructions (Art. 28(3)(a)), unless required by law.
• Confidentiality: persons authorized to process personal data are bound by written confidentiality obligations (Art. 28(3)(b)).
• Security (Art. 32): TLS in transit; tokens stored/compared only as SHA-256 hashes with constant-time checks; one ephemeral environment per session in its own process group; network-isolated, seccomp/rlimit/namespace-hardened compile sandbox; Cloud Armor WAF/DDoS; Workload Identity and Secret Manager; MFA and least-privilege administrative access; encryption at rest; logging/monitoring of security-relevant events; a documented incident-response process; and vulnerability management (SBOM, patching). See Annex II.
• Sub-processors: the Controller gives general written authorization to engage sub-processors under equivalent data-protection obligations (Art. 28(2), 28(4)). VirtMCU gives at least 30 days' notice before adding or replacing a sub-processor, during which the Controller may object on reasonable grounds; unresolved, the Controller may terminate the affected Service. Current list: /sub-processors.
• Assist with data-subject rights (Art. 28(3)(e)) — VirtMCU assists by locating/deleting token-hash-keyed records, responding without undue delay and within 10 business days of a verified request.
• Assist with Art. 32–36 — security, breach notification, DPIA, and prior-consultation obligations (Art. 28(3)(f)).
• Breach notification: notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal-data breach (Art. 33(2)), by email to the Controller's designated contact, with the available details.
• CCPA/CPRA service-provider terms: to the extent VirtMCU processes personal information subject to the CCPA as amended by the CPRA, VirtMCU acts as the Controller's “service provider” and: (a) processes personal information only to perform the Service; (b) does not sell or share it; (c) does not retain, use, or disclose it outside the direct business relationship or for any purpose other than the business purpose, except as the CPRA permits; (d) does not combine it with other sources except as permitted; and (e) will notify the Controller if it can no longer meet these obligations. VirtMCU certifies it understands and will comply with these restrictions.

5. CONTROLLER OBLIGATIONS

The Controller warrants that it has a lawful basis for the processing it instructs, that it will not instruct unlawful processing, and that any personal data it embeds in uploaded firmware/source is lawfully provided to VirtMCU for running the Service, and that it will not submit special-category or prohibited/sensitive data.

6. SUB-PROCESSOR LIST

The maintained list is published at /sub-processors (and reproduced in Annex III). In summary: Google Cloud (GKE + Agones, Cloud Run, L7 Gateway/Cloud Armor/Certificate Manager, Secret Manager, Cloud Logging) in us-central1 / Google edge; Firebase (Authentication, Firestore) in us-central; and Stripe (Managed Payments, merchant of record) globally. Google services are provided by Google LLC (with Google Cloud EMEA Limited for applicable EEA/UK contracting) under the Google Cloud Data Processing Addendum; Stripe services by Stripe, Inc. (and Stripe Payments Europe, Ltd. where applicable) under the Stripe Data Processing Agreement.

7. INTERNATIONAL TRANSFERS

The verified engine processing region is us-central1 (United States). Where personal data of individuals in the EEA/UK/Switzerland is processed in the United States, the parties rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two, Controller-to-Processor), the UK International Data Transfer Addendum, and the Swiss addendum as applicable, incorporated by reference and completed in the Annexes, together with a Transfer Impact Assessment and supplementary measures (TLS in transit, hashed credentials, ephemeral isolated processing).

8. AUDIT RIGHTS

VirtMCU makes available information reasonably necessary to demonstrate compliance with this DPA and Art. 28. Routine audit requests are satisfied by VirtMCU's own documentation together with the relevant third-party certifications/reports of its infrastructure sub-processors (e.g. Google Cloud's SOC 2 / ISO 27001 reports). An on-site or independent-auditor inspection is available only where required by a supervisory authority or the Controller's mandatory law, or under a negotiated Enterprise agreement, and is then subject to reasonable confidentiality, at least 30 days' prior notice, no more than once per 12 months, during business hours, without disrupting the Service, and at the Controller's cost.

9. LIABILITY, TERM & GOVERNING LAW

Each party's liability under this DPA is subject to the Limitation of Liability in Terms of Service §10. This DPA takes effect on its effective date, remains in force for the term of the Agreement, and terminates with it (subject to Section 10 and any surviving provisions). It is governed by the laws of the State of California and the venue/dispute provisions of the Terms of Service, except that where the SCCs/IDTA apply, the governing law and forum for those clauses are as selected in the SCC/IDTA annexes.

10. DELETION / RETURN ON TERMINATION

On termination of the Service or at the Controller's choice, VirtMCU deletes or returns all personal data and deletes existing copies, unless storage is required by law (Art. 28(3)(g)). This is reinforced by the engine's ephemeral-by-design processing:

• uploaded firmware and decoded session state live only for the session's duration on the single-use environment; on session delete (and every reaper teardown) the broker terminates the process group and recursively removes the per-session run directory;
• sessions auto-terminate on TTL (default 900 s) or idle (default 300 s);
• residual token-hash-keyed log records persist per the retention windows in the Privacy Policy (application/edge logs: 30 days), and VirtMCU will delete Controller-associated records earlier on request where technically feasible and not required to be retained by law.

ANNEXES

Annex I (parties & description of processing), Annex II (technical and organizational security measures), and Annex III (sub-processors) are drafted from Sections 1–6 above. The SCC/IDTA annex selections (docking clauses, optional-clause selections, competent supervisory authority) and signature blocks are completed with each customer on execution.