Data Processing Agreement

<!-- Scope note: this DPA is intended for institutional counterparties that enter into a written agreement with Mustro, primarily family-plan principals, enterprise/team customers, and authorized resellers in V2+. Direct individual users (V1) are governed by the Privacy Policy and Terms of Service, not this DPA. -->

Effective Date: September 24, 2026

Last updated: September 24, 2026

This Data Processing Agreement (this "DPA") forms part of the written agreement between Mustro, Inc., a Delaware corporation ("Mustro") and the institutional counterparty signing or otherwise accepting it ("Customer", typically a family-plan principal, enterprise or team customer, authorized reseller, or other organization entering into a commercial arrangement with Mustro that involves Mustro Processing Personal Data on Customer's behalf) (the "Agreement"). It governs the Processing of personal data carried out in connection with the Services Mustro provides to Customer or that Customer provides to Mustro, as the case may be. Capitalized terms not defined here have the meanings given to them in the Agreement.

This DPA does not apply to Mustro's direct individual users (consumers signing up at mustro.ai on their own behalf), whose personal data is governed by Mustro's Privacy Policy. For those users Mustro is the Controller, not a Processor.

1. Subject Matter, Scope, and Roles

1.1 Data Processing

In the course of performing under the Agreement, Mustro may Process personal data provided by, or on behalf of, Customer that constitutes "personal data," "personal information," "personally identifiable information," or an analogous term under applicable law ("Customer Personal Data"). The parties agree to comply with this DPA and with all privacy and data protection laws applicable to the Processing of Customer Personal Data, including, as applicable, those of the European Union, the European Economic Area and its member states, Switzerland, the United Kingdom, and the United States (including the California Consumer Privacy Act and the California Privacy Rights Act, collectively the "CCPA") (collectively, "Data Protection Laws").

1.2 Subject Matter

The subject matter, nature, and purpose of the Processing, the types of Customer Personal Data, and the categories of "Data Subjects" (as defined under applicable Data Protection Laws) are described in Annex I, which is an integral part of this DPA.

1.3 Roles

Customer is a "Controller" or "Business" (as defined under applicable Data Protection Laws) and appoints Mustro as a "Processor" or "Service Provider" (as defined under applicable Data Protection Laws) on behalf of Customer. Customer is responsible for compliance with the requirements of Data Protection Laws applicable to Controllers and Businesses, including for ensuring that Customer has the necessary lawful basis, notices, and consents in place before disclosing Customer Personal Data to Mustro.

If Customer is a Processor on behalf of another Controller (a "Third-Party Controller"), Customer:

• is the single point of contact for Mustro;
• must obtain all necessary authorizations from such Third-Party Controller; and
• undertakes to issue all instructions and exercise all rights on behalf of that Third-Party Controller.

1.4 Direct-User Data Out of Scope

Personal data of Mustro's direct individual users that is generated through their use of the Mustro platform, including profile data, Connector Data (Plaid transactions, Google Calendar events, Gmail messages and drafts, and Health Skill data from Apple HealthKit and Oura), training data (the training goals and constraints the end user provides and the plans, revisions, benchmarks, and adherence records Mustro generates from them), conversation history, briefings, and agent events, is not Customer Personal Data under this DPA. Mustro is the Controller of that data, and it is governed by Mustro's Privacy Policy.

2. Processing Instructions

Mustro will Process Customer Personal Data on behalf of and only in accordance with Customer's documented instructions for the following purposes:

1. Processing in accordance with this DPA, the Agreement, and any applicable order form, statement of work, or scope-of-work document;
2. Processing initiated by authorized users in their use of the Services; and
3. Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement.

Mustro will inform Customer if, in Mustro's opinion, an instruction infringes Data Protection Laws, unless legally prohibited from doing so.

3. Personnel

Mustro will ensure that all personnel authorized to Process Customer Personal Data are subject to a written or statutory obligation of confidentiality and have received appropriate training on data protection and security requirements.

4. CCPA Limitations on Processing

Except as permitted by applicable Data Protection Laws, the Agreement, or this DPA, Mustro will not:

• retain, use, or disclose Customer Personal Data for any purpose other than for the specific purposes of performing the Services and in accordance with Customer's documented instructions;
• retain, use, or disclose Customer Personal Data outside of the direct business relationship between the parties;
• combine Customer Personal Data with personal information that Mustro obtains from, or on behalf of, sources other than Customer, except as permitted by Data Protection Laws; or
• "Sell" or "Share" (as those terms are defined under applicable Data Protection Laws) Customer Personal Data.

Mustro certifies that it understands and will comply with these restrictions.

5. Security and Security Incidents

5.1 Security

Mustro will implement reasonable and appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk presented by the Processing of Customer Personal Data, in accordance with the measures described in Annex II.

5.2 Security Incident Notification

Mustro will notify Customer without undue delay, and within seventy-two (72) hours, after becoming aware of any actual or reasonably suspected unauthorized access to, loss of, or other unauthorized Processing of, Customer Personal Data ("Security Incident"). If notification is delayed beyond seventy-two (72) hours, the notification will be accompanied by reasons for the delay.

5.3 Security Incident Response

Mustro will take reasonable measures in response to a Security Incident, including:

1. measures designed to mitigate the Security Incident and prevent its recurrence;
2. providing Customer with reasonable information about the Security Incident as it becomes known to Mustro; and
3. providing other commercially reasonable assistance to Customer in complying with its obligations under applicable Data Protection Laws.

5.4 Vulnerability Testing

Mustro will perform regular vulnerability scanning and penetration testing of the platform used to provide the Services, at least annually or when significant changes are made to the platform.

5.5 Encryption

Mustro will encrypt Customer Personal Data in transit using TLS 1.2 or higher (with TLS 1.3 preferred) and at rest using AES-256 encryption or equivalent industry-standard encryption techniques.

6. Subprocessing

6.1 Authorization

Customer hereby authorizes Mustro to engage Processors that Process Customer Personal Data on behalf of Mustro ("Subprocessors"). Mustro's current Subprocessors are listed in Annex III.

6.2 Subprocessor Agreements

Mustro will enter into a written agreement with each Subprocessor that imposes substantially similar obligations on the Subprocessor as those imposed on Mustro under this DPA, including requirements for security, confidentiality, and data protection.

6.3 Subprocessor Changes

Mustro will notify Customer at least thirty (30) days in advance of any intended change to its Subprocessors that affects Customer's data, by email to the address associated with Customer's account and by updating the list at <https://mustro.ai/legal/subprocessors>. Customer may object to the addition of a Subprocessor on reasonable grounds that the appointment will result in a material violation of Data Protection Laws by providing written notice setting out those grounds within thirty (30) days of Mustro's notification. The parties will work together in good faith to address Customer's objection. If Mustro chooses to retain the new Subprocessor and the parties cannot reach a mutually acceptable resolution, either party may discontinue providing or using the relevant parts of the Services that depend on that Subprocessor and may terminate the relevant parts of the Services within thirty (30) days.

7. Assistance to Customer

Taking into account the nature of the Processing and the information available to Mustro, Mustro will provide reasonable assistance to Customer:

• in implementing appropriate technical and organizational measures;
• in responding to Data Subject or "Consumer" (as defined under applicable Data Protection Laws) requests;
• in replying to inquiries, complaints, and investigations from regulators; and
• in conducting data protection impact assessments and prior consultations with regulators.

Mustro may charge reasonable fees for assistance that materially exceeds the standard support included in the Agreement.

8. Audit

On Customer's reasonable written request, and no more than once per twelve (12) months unless required by a supervisory authority, Mustro will permit Customer, at Customer's expense, to audit Mustro's controls and compliance with this DPA (an "Audit"), provided that the Audit is:

1. conducted by Customer or by a third-party auditor designated by Customer that has executed an appropriate confidentiality agreement with Mustro;
2. limited to a scope mutually agreed by the parties, including start date, duration, and confidentiality controls;
3. conducted during normal business hours with at least thirty (30) days' prior written notice; and
4. carried out in a manner that does not unreasonably interfere with Mustro's business operations.

As an alternative to an Audit, Mustro may provide Customer with a copy of an equivalent certification or summary report it then maintains. Customer will pay all costs and expenses incurred by Mustro in connection with the Audit. Customer may use the results of an Audit only for the purposes of meeting Customer's regulatory audit requirements and confirming compliance with this DPA.

9. International Data Transfers

9.1 European Data Transfers

Mustro will obtain Customer's specific prior written authorization for any transfer of Customer Personal Data subject to European Data Protection Law that is not subject to an adequacy decision by the European Commission ("International Data Transfer"). Customer authorizes Mustro to conduct International Data Transfers outside the EEA or Switzerland:

• to any country subject to a valid adequacy decision of the European Commission;
• on the basis of an organization's binding corporate rules approved by EEA Supervisory Authorities; and
• to any data importer with whom Mustro has entered into standard contractual clauses ("SCCs").

9.2 European Transfer Mechanisms

Customer and Mustro conclude Module 2 (Controller-to-Processor) of the SCCs and, to the extent Customer is a Processor on behalf of a Third-Party Controller, Module 3 (Processor-to-Subprocessor) of the SCCs, which are incorporated into this DPA and completed as follows:

• the "data exporter" is Customer; the "data importer" is Mustro;
• the optional docking clause in Clause 7 is implemented;
• Option 1 of Clause 9(a) is implemented and the time period therein is specified in Section 6.3 above;
• the optional redress clause in Clause 11(a) is struck;
• Option 1 in Clause 17 is implemented and the governing law is the law of Delaware;
• the courts in Clause 18(b) are the Courts of Delaware;
• Annexes I, II, and III to the SCCs are Annexes I, II, and III to this DPA respectively.

For International Data Transfers from Switzerland, Data Subjects who have their habitual residence in Switzerland may bring claims under the SCCs before the courts of Switzerland.

9.3 UK Data Transfers

Customer authorizes Mustro to perform International Data Transfers outside the United Kingdom:

• to any country subject to a valid adequacy decision issued by the UK Government;
• on the basis of an organization's binding corporate rules approved by the UK Information Commissioner; and
• to any data importer with whom Mustro has entered into the UK Addendum or other standard contractual clauses issued by the UK Information Commissioner.

9.4 UK Transfer Mechanism

Customer and Mustro conclude the UK Addendum, which is incorporated into this DPA and applies to International Data Transfers outside the UK. Part 1 of the UK Addendum is completed as follows:

1. in Table 1, the "Exporter" is Customer and the "Importer" is Mustro; their details are set forth in this DPA and the Agreement;
2. in Table 2, the first option is selected and the "Approved EU SCCs" are the SCCs referred to in Section 9.2 of this DPA;
3. in Table 3, Annexes 1 (A and B), II, and III to the "Approved EU SCCs" are Annex I, II, and III to this DPA respectively; and
4. in Table 4, both the "Importer" and the "Exporter" can terminate the UK Addendum.

10. Return and Deletion

Following the date of expiration or earlier termination of the Agreement, Mustro will return or delete all Customer Personal Data within sixty (60) days, except that Mustro may retain copies of Customer Personal Data:

• as expressly agreed by the parties;
• as required by applicable law; or
• as contained in standard backups,

in each case subject to the protections of this DPA. Customer may request expedited deletion by contacting legal@mustro.ai.

ANNEX I: DESCRIPTION OF THE TRANSFER

A. List of Parties

Data Exporter

• Name: Customer (as defined above)
• Activities relevant to the data transferred under these Clauses: Customer engages Mustro under the Agreement (e.g., as a family-plan principal, enterprise/team customer, or authorized reseller) and provides Personal Data to Mustro in that context.
• Role (controller/processor): Controller, or Processor on behalf of a Third-Party Controller.

Data Importer

• Name: Mustro, Inc.
• Activities relevant to the data transferred under these Clauses: Mustro provides the Services to Customer under the Agreement and Processes Personal Data on behalf of Customer in that context.
• Role (controller/processor): Processor on behalf of Customer, or Subprocessor on behalf of a Third-Party Controller.

B. Description of International Data Transfer

Categories of Data Subjects whose Customer Personal Data is transferred:

• Customer's authorized administrators (e.g., the family-plan principal, the enterprise admin, or the reseller's operations contact);
• End users that Customer provisions onto Mustro (e.g., family members on a family plan, employees on an enterprise plan, downstream customers under a reseller agreement); and
• Other individuals whose personal data Customer chooses to share with Mustro under the Agreement.

Categories of Customer Personal Data transferred:

• Identity and contact details (e.g., name, email address);
• Authentication identifiers (Firebase user identifiers, the verified Google sub claim where Google sign-in is used);
• Billing and plan-administration details (plan tier, billing-contact identity, payment-method reference held by Stripe);
• Connector grant metadata (which sources each end user has authorized, such as Plaid, Google Calendar, Gmail, and the Health Skill's Apple HealthKit and Oura sources, and the connection status);
• Training data created inside the Health Skill (the training goals and constraints the end user provides, and the plans, revisions, benchmarks, and adherence records Mustro generates), as enumerated under Training data (Health Skill training plans) below; and
• Any other personal data that Customer chooses to provide to Mustro under the Agreement.

Note on training data: Training data is not Connector Data and is not synced from any third-party source. The end user writes a training goal and its constraints directly into the Health Skill, and Mustro generates the plan, its revisions, benchmarks, and adherence records from that input together with the sessions the end user logs. Mustro acts as Controller of that data with respect to each end user under the Privacy Policy, on the same basis as Connector Data described below.

Note on Connector Data (Plaid transactions, Google Calendar events, Gmail messages and drafts, and Health Skill data from Apple HealthKit and Oura): Customer's end users grant access to their own financial, calendar, email, and health data directly through the relevant provider's consent flow (for Apple HealthKit, through the on-device HealthKit permission prompt; for Oura, through Oura's OAuth consent). Mustro acts as Controller of that data with respect to each end user under the Privacy Policy, and as Processor for Customer only insofar as Customer has been validly authorized by the end user to direct Mustro's Processing (e.g., a family-plan principal acting under household-finance authority). Customer is responsible for ensuring it has that authority.

Sensitive data transferred (if applicable):

Certain flows are, by their nature, designed to Process special-category or sensitive personal data at the end user's direction:

• financial-account information and email content, through the Plaid, Google Calendar, and Gmail Connectors;
• health and biometric data, through the Health Skill's Apple HealthKit and Oura Connectors, as enumerated under Health and biometric data (Health Skill) below; and
• health information the end user provides directly in the Health Skill's training-plan flows (a goal spec asks for the constraints that shape a plan, and end users state injuries and medical limitations there in free text), together with the plans, benchmarks, and adherence records Mustro generates from it, as enumerated under Training data (Health Skill training plans) below.

Health and biometric data is special-category personal data (GDPR Article 9 and analogous provisions). It is Processed only where the end user has installed the Health Skill (an opt-in action) and granted the relevant source through that source's own affirmative permission step: the iOS HealthKit permission sheet for Apple HealthKit (which records the specific categories the end user grants) and Oura's OAuth grant for Oura. Where a jurisdiction requires explicit consent for special-category data (for example GDPR Article 9), that consent is the affirmative grant given in those steps; Mustro and Customer remain responsible for ensuring a compliant consent record is captured and retained.

The Health Skill's training-plan flows solicit health information directly from the end user rather than from a Connector: the goal spec asks for the constraints a plan must respect, and end users state injuries, limitations, and medical restrictions there in free text. Mustro gives that text, and everything generated from it, the same special-category treatment as synced health data: explicit consent, no sale, no sharing with advertisers, and no model training. For training data the opt-in is a dedicated, recorded explicit consent. Before Mustro accepts constraint text or an imported plan, the end user is shown consent language that names the categories concerned, the AI inference path, the zero-retention terms that apply to it, and the means of withdrawal. Mustro records that act as a consent artefact holding the scope, the version of the consent text shown, a cryptographic digest of the exact text rendered to the end user, the granted categories, the source of the act, and the timestamp. The digest is verified against the published text at the moment of recording, so a consent record cannot attach to wording the end user was not shown. The constraint field remains optional and may be left empty, in which case no such Processing occurs and no consent is sought. Consent may be withdrawn at any time, which stops further Processing on that basis; withdrawal is recorded against the original grant rather than erasing it, because the record of the earlier grant is what evidences the lawfulness of Processing already carried out.

Beyond what end users authorize through the Connector flows and provide through the Health Skill's own training-plan flows, Mustro does not solicit and is not designed to Process additional special-category or sensitive personal data from Customer. Customer must not provide sensitive personal data outside those flows, including additional health information, government-issued identifiers, biometric data, or data revealing racial or ethnic origin, political opinions, religious beliefs, or trade-union membership, without a prior written agreement that specifically addresses such Processing.

Health and biometric data (Health Skill):

The Health Skill (a bundled Connector) syncs the end user's own body and training data from two sources: Apple HealthKit (read on the user's device under the user's per-category HealthKit permission; no health data is transmitted to Apple by Mustro) and Oura (retrieved from the Oura API under the user's OAuth grant). The categories, purpose, sources, and retention are:

• Categories collected: workouts and training sessions (including cardio, and recovery sessions such as sauna, cold plunge, and mobility); sleep sessions and sleep-stage detail; heart-rate variability (HRV), resting heart rate, and Oura readiness, sleep, and activity scores; activity and energy metrics (steps, active energy, exercise minutes); body-composition entries (weight, body-fat percentage, lean mass); vitals (blood pressure, SpO2, respiratory rate, body and wrist temperature); daytime stress and resilience scores (from Oura); and mindfulness minutes. Mustro also derives rolling baselines (for example a 7-day HRV baseline, a 30-day resting-heart-rate baseline, and a wrist-temperature baseline) to power recovery and anomaly signals.
• Purpose: to provide the Health Skill's user-facing features (workout logging, recovery and sleep insight, the health dimension of the daily briefing, and Mustro's health reasoning). Health and biometric data is never sold, never shared with advertisers, and never used to train machine-learning models; it is disclosed to an AI subprocessor only at inference time under the zero-retention terms in Annex III. Consistent with Mustro's cross-Skill memory posture, where health data later contributes to cross-Skill inferences it retains this special-category, explicit-consent, no-sell, no-train treatment.
• Sources and sub-processors: Apple HealthKit is an on-device data source read locally under the user's HealthKit permission; because Mustro transmits no health data to Apple, Apple is not engaged as a Subprocessor for this data. Oura is engaged as a Subprocessor (listed in Annex III) because Mustro calls the Oura API on the end user's behalf; the data Oura returns is the end user's own Oura account data.
• Retention: for the lifetime of the Health Skill installation. On disconnection or revocation of the Health Skill (or of the specific HealthKit or Oura source), the associated health and biometric data is soft-deleted immediately and hard-deleted within thirty (30) days, matching the Connector-deletion window in the Privacy Policy, and subject to the return-and-deletion terms in Section 10 for Customer Personal Data.

Training data (Health Skill training plans):

The Health Skill's training plans create a second class of health data. It is not synced from any source: part of it the end user provides, and part of it Mustro generates. The categories, purpose, sources, and retention are:

• Categories provided by the end user: the goal spec (goal kind, for example a race, general fitness, strength, or endurance goal; event name and date; plan start date; plan length; sessions per week; self-reported experience level; and the gym whose equipment the plan should assume), together with the free-text context the end user writes to shape the plan. That field exists to capture constraints, and end users state injuries, physical limitations, and medical restrictions in it (for example "bad knee, no running"). Mustro treats it as health information. Where the end user imports an existing plan instead of generating one, the plan text the end user pastes is also provided by the end user and may contain the same kind of health information.
• Categories generated by Mustro: the plan document and every revision of it (each with the reason for the change and whether the end user, Mustro, or the system authored it); the weekly phases and volume targets; the prescribed sessions and their prescriptions; benchmark results (measured performance tests such as a timed run, a maximum-repetition set, or a one-repetition-maximum lift) and the training zones derived from them; and adherence records linking each prescribed session to the sessions the end user actually logged.
• Purpose: to generate, revise, and display the end user's training plan; to warn when a scheduled session conflicts with a constraint the end user stated; to resolve training zones from the end user's benchmarks; and to let Mustro answer questions about the plan and adherence. Training data is never sold, never shared with advertisers, and never used to train machine-learning models; it is disclosed to an AI subprocessor only at inference time (plan generation, plan revision, and Mustro's reasoning) under the zero-retention terms in Annex III.
• Special-category treatment: stated constraints, benchmark results, and adherence records describe the end user's body and health, and constraint text in particular may reveal a medical condition. The whole category is treated as special-category personal data (GDPR Article 9 and analogous provisions) on the same terms as the Health Skill's synced data: explicit consent, no sale, no sharing with advertisers, and no model training. Where training data later contributes to cross-Skill inferences, it retains that treatment.
• Sources and sub-processors: no additional Subprocessor is engaged for training data. It is created in the Mustro platform and stored on Mustro's own infrastructure (Google Cloud Platform, Annex III). For training-plan generation and revision, it is disclosed at inference time to the AI subprocessor the end user's model preference selects (Anthropic, or OpenAI where the end user has enabled it). When the end user enables Time AI planning, the consented health-session information needed to plan the schedule goes to Anthropic, regardless of the end user's model preference for training plans. Both AI routes use the zero-retention and no-training terms in Annex III. If the end user separately enables health calendar sharing, Mustro also sends the health event fields described in the Consumer Health Data Privacy Policy, Section 4, to Google Calendar. That sharing places health sessions in the end user's connected calendar. It follows the separate consent and withdrawal controls in Section 5 of that policy.
• Retention: for the lifetime of the plan and of the Health Skill installation. Because training data is not synced from Apple HealthKit or Oura, disconnecting either of those sources does not by itself delete it. When the end user deletes a plan, that plan and the records held under it (its revisions, its prescribed sessions, and the adherence records for those sessions) are soft-deleted immediately and hard-deleted within thirty (30) days. Benchmark results and the training zones derived from them are held at the account level rather than under a single plan, because they describe the end user's measured performance across plans: deleting a plan detaches the benchmark from that plan but does not delete the result. Benchmarks and any remaining training data are deleted within thirty (30) days of the end user uninstalling the Health Skill or closing the account, matching the Health deletion window in the Privacy Policy, and subject to the return-and-deletion terms in Section 10 for Customer Personal Data.

Frequency of the International Data Transfer:

On a continuous basis for the duration of the Agreement.

Nature of the Processing:

The Customer Personal Data will be Processed and transferred as described in the Agreement, including collection, storage, retrieval, consultation, use, organization, structuring, adaptation, deletion, and disclosure for the purposes of providing the Services.

Purpose(s) of the International Data Transfer and further Processing:

• Provision of the Services to Customer's authorized end users (financial, calendar, inbox, and health dashboards; training plans; AI assistant; briefings; anomaly alerts);
• Plan administration (provisioning and deprovisioning end-user seats; usage reporting; billing);
• Technical support and troubleshooting;
• Improvement and development of the Services (excluding any use of end-user content to train AI/ML models, see Section 4 of the Privacy Policy); and
• Compliance with legal obligations.

Period for which the Customer Personal Data will be retained:

For the duration of the Agreement and for sixty (60) days following termination, unless otherwise required by applicable law or longer retention is necessary for legitimate business purposes such as dispute resolution.

For International Data Transfer to (Sub)Processors, also specify subject matter, nature, and duration of the Processing:

For the subject matter and nature of the Processing, reference is made to the Agreement and this DPA. The Processing will take place for the duration of the Agreement and as necessary to provide the Services.

C. Competent Supervisory Authority

• The competent authority for the Processing of Customer Personal Data relating to Data Subjects located in the EEA is the Irish Data Protection Commission.
• The competent authority for the Processing of Customer Personal Data relating to Data Subjects located in the UK is the UK Information Commissioner's Office.
• The competent authority for the Processing of Customer Personal Data relating to Data Subjects located in Switzerland is the Swiss Federal Data Protection and Information Commissioner.

ANNEX II: TECHNICAL AND ORGANIZATIONAL MEASURES

Mustro implements technical and organizational measures designed to protect Customer Personal Data from unauthorized access, acquisition, disclosure, destruction, alteration, accidental loss, misuse, or damage. These measures include, without limitation:

Access Controls

• Multi-factor authentication for administrative access;
• Role-based access control (RBAC) and the principle of least privilege;
• Regular access reviews and timely revocation procedures;
• Unique user accounts for all personnel; and
• Automated session timeouts.

Data Security

• Encryption in transit using TLS 1.2 or higher (with TLS 1.3 preferred);
• Encryption at rest using AES-256 or equivalent;
• Secure key management and rotation procedures;
• Database access logging and monitoring; and
• Secure deletion and data sanitization procedures.

Network Security

• Firewall and intrusion-detection/prevention systems;
• Network segmentation and isolation;
• DDoS protection and mitigation;
• Regular security patching and updates; and
• Vulnerability scanning and penetration testing.

Application Security

• Secure software development lifecycle (SDLC);
• Code review and security testing;
• Input validation and output encoding;
• Protections aligned with the OWASP Top 10; and
• Periodic security assessments and audits.

Physical Security

• Production infrastructure runs on Google Cloud Platform, whose data centers maintain SOC 2 Type II and other industry-standard certifications;
• Physical access controls, monitoring, and environmental controls; and
• Backup power and redundancy systems.

Organizational Measures

• Information security policies and procedures;
• Security awareness training for all personnel;
• Background checks for personnel with access to Customer Personal Data;
• Confidentiality obligations for personnel and contractors;
• Incident response plan and procedures;
• Business continuity and disaster recovery plans; and
• Vendor risk management program.

Monitoring and Logging

• Continuous security monitoring and alerting;
• Audit logging of access to systems handling Customer Personal Data;
• Log retention and analysis; and
• Where applicable, security information and event management (SIEM) capabilities.

Compliance

• Google's required security assessment planned before Gmail access for external users beyond initial testing. Calendar-only access does not establish completion of that assessment.
• PCI-DSS compliance for payment processing achieved through Stripe (full PAN never held by Mustro); and
• Regular third-party security assessments.

ANNEX III: LIST OF SUBPROCESSORS

Customer authorizes Mustro to engage the following Subprocessors. The authoritative roster, including the data classes shared with each Subprocessor and the international-transfer mechanism, is maintained in Subprocessors.md and at <https://mustro.ai/legal/subprocessors>.

Google Calendar operates the end user's connected calendar account under the terms applicable to that account. Its listing above covers the API integration and does not establish that Google handles that account only on Mustro's instructions. Health calendar sharing follows the Consumer Health Data Privacy Policy and the end user's separate sharing choice.

Apple HealthKit is not listed above because it is not a Subprocessor: Health Skill data from HealthKit is read locally on the end user's device under the user's HealthKit permission and synced to Mustro, and Mustro transmits no health data to Apple. HealthKit is described as a data source under Health and biometric data (Health Skill) in Annex I.

Mustro may update this list from time to time in accordance with Section 6.3 of this DPA. The current list of Subprocessors is maintained at <https://mustro.ai/legal/subprocessors>.

Contact Information

For questions regarding this DPA:

Mustro, Inc. Email: legal@mustro.ai Website: mustro.ai