Data Processing Agreement
Data processing terms for Lithi Compute and Connect, including service scope, data categories, provider roles, security boundaries, and rights.
Data processing terms
Last Updated: October 10, 2026
This Data Processing Agreement ("DPA") sets out the processing terms for Lithi Compute and Connect when incorporated into a customer agreement. That agreement identifies the parties, their roles, the services and the customer's processing instructions.
Contents
- Definitions and scope
- Data categories
- Sub-processors
- Security measures
- Retention and rights
- Transfers and breach notification
- Contact and related policies
- Primary action
1. Definitions and Scope
“Personal Data” means any information relating to an identified or identifiable natural person processed by Lithi on a customer's behalf through the services identified in that customer's executed agreement. Compute processing may cover customer-authorized task inputs and outputs. Connect processing may cover records from a selected account or source used for a separately approved relationship task. Account, access, billing, support, security, and receipt records serve their stated product purposes and remain distinct from task content.
2. Data Categories
- Account and access data: Contact and organization details, members, roles, settings, and records needed to administer the selected service.
- Compute work data: Customer-authorized inputs, instructions, accepted outputs, and the usage, approval, receipt, and delivery records associated with a job.
- Connect data: Records from selected accounts and sources, approved message or plan content, recipients, and action status or receipt records.
- Service and support data: Information needed to operate a selected connection, answer a request, secure an account, or reconcile billing.
The categories present depend on the product, account, selected source, purpose, and executed agreement. A business dataset may include personal information about employees, customers, suppliers, or other contacts. Calling it B2B or public does not establish permission or make it eligible for shared processing. The customer's instructions and Lithi's admitted data profile must both permit the actual input.
Processing instructions for the selected service
The customer agreement and its processing schedule identify the parties and roles, subject matter, duration, nature and purpose of processing, personal-data categories, data subjects, and the customer's rights and obligations. The approved task or standing policy narrows those instructions; it cannot expand the agreement or override a refused category.
| Instruction | What the applicable agreement or approved work identifies |
|---|---|
| Purpose and operation | The outcome and supported processing, including any permitted learning use. |
| Input and data subjects | The selected source, minimum fields, actual data categories and affected people. |
| Processing boundary | Permitted executor profile, disclosure, jurisdiction and key custody. |
| Output and destination | The expected result, authorized recipient and destination. |
| Duration and disposal | Retention trigger, applicable period or expiry event, return or deletion instructions, and holds or backup exceptions. |
Credentials and prohibited regulated or secret material remain outside the shared path. The customer supplies only information it is authorized to use and disclose for the agreed purpose.
3. Sub-Processors
The service provider register lists the providers, purposes, data categories and processing locations for each service. Compute processing is separate from account email, customer correspondence, website chat and measurement. The provider's role depends on that activity and the applicable terms; inclusion in the register does not make every provider a subprocessor of customer task content. The customer agreement controls the applicable subprocessor notice, review and objection rights.
Participating Mac executors are a separate part of the Compute processing path. An assigned Mac receives only the inputs granted for its admitted work. The applicable agreement identifies the executor arrangement and any subprocessing authorization. Where an executor acts as a subprocessor, that arrangement must carry the applicable confidentiality, security, restricted-use and disposal obligations. A listed infrastructure vendor's terms do not by themselves establish those obligations for a Mac owner.
4. Security Measures
Security measures depend on the selected service and data path. For Compute, ordinary control and relay services handle approved metadata and ciphertext. An assigned Mac reads its own task piece in the execution workspace; a privileged host owner may be able to inspect ordinary memory. Compute is not a confidential-computing enclave. Results are encrypted for their authorized recipient before leaving the executor.
Managed key release is the default: the run's release authority can technically unwrap block keys and releases them under the assignment and exposure checks. A qualified customer-held profile instead requires the customer's online Kit to release keys. Spread placement limits cumulative input access across one owner's Macs, retries, checking and combining; it does not establish anonymity or rule out collusion. Review encryption and key custody and spread placement before selecting that boundary.
Connect source access and message delivery use the selected account and separate approval for the exact action or plan. Processing the original task does not authorize indefinite content retention, exact-copy learning, model training or another purpose. Those uses require their own applicable instructions, rights and permission.
5. Retention and Data Subject Rights
No single retention period applies to every service or data category. Retention, return, and deletion follow the product policy and executed customer-specific terms. Identify encrypted artifacts, temporary execution copies, keys, safe receipt and accounting records, backups and customer-controlled destination copies separately. The agreement identifies disposal at the end of processing and any lawful retention exception; a content-deletion request does not erase independently required accounting or security records.
Expiring an access link or disconnecting a source does not by itself prove that stored artifacts, backups, or destination copies have been erased. A deletion confirmation identifies the objects and locations covered, observation time and remaining exceptions. Lithi assists with requests concerning access, rectification, erasure, portability, and objection under the applicable agreement. See retention and deletion for the customer decision path.
6. Cross-Border Transfers and Breach Notification
Processing and storage locations depend on the selected service and provider; the Subprocessor register describes the locations declared for listed providers. No single country or provider location describes every data path. The executed customer agreement identifies the transfer mechanism and scope for that relationship. EU Standard Contractual Clauses apply only to transfers within their defined scope. For UK restricted transfers, mechanisms may include adequacy regulations, appropriate safeguards such as the UK IDTA or the UK Addendum to EU SCCs, or an exception. See the European Commission's SCC guidance and the UK ICO's international-transfer guidance. Where Lithi acts as Processor, breach notification to the Controller follows the applicable agreement and law. The UK ICO describes notification without undue delay; any additional contractual timing must be stated in the executed agreement. See the ICO's processor breach guidance.
7. Contact and Related Policies
Lithi Technologies LLC, 68 Harrison Avenue, Suite 605, Boston, MA 02111. Email privacy@lithi.ai. To request a signed copy of this DPA, contact privacy@lithi.ai. Related policies: Privacy Policy, Terms of Service, and Cookie Policy.