Data processing addendum.

Alovia is a service operated by its founder, Chanpreet Singh, based in San Francisco, California, United States. No incorporated entity is claimed. A street address is available on request. This addendum is provided for transparency and is not legal advice.

Alovia is currently an invite-only free beta. Shield, and this addendum, apply to customers and website visitors in the United States, with a specific focus on California.

Customer

The person or organization that connects a website to Shield and accepts these terms.

Visitor

An individual whose request reaches a website the customer protects with Shield.

Visitor data

Personal information about visitors that Shield processes: IP addresses, request headers, request paths, timestamps, and derived signals about whether a request looks automated.

Agent data

The messages a customer’s AI agents submit to Watchdog for evaluation, which may contain personal information of the customer’s own users, together with the resulting verdicts and short excerpts.

CCPA

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations.

Business purpose

A purpose set out in Cal. Civ. Code §1798.140(e): providing the service the customer engaged Alovia to perform.

For visitor data processed through Shield, the customer is the business (the controller) and Alovia is the service provider (the processor).

• —The customer determines the purposes and means of processing its visitors' personal information, and is responsible for its own compliance with applicable law.
• —Alovia processes visitor data only on the customer's documented instructions, which include the customer's act of enabling Shield on a site and configuring how it responds to traffic.
• —Each party is responsible for complying with the obligations that apply to it in its role under the CCPA.

Alovia processes visitor data for one reason: to provide and improve the Shield protection service for the customer that engaged it. Shield sits in front of the customer's website and inspects incoming visitor web-traffic metadata (IP addresses, request headers, request paths, timestamps) to detect and block bots and scrapers.

This is a business purpose only. Alovia does not process visitor data for its own independent commercial purposes, and does not process it for cross-context behavioral advertising.

Improving the service includes building and training the machine-learning detection models that power Shield. Alovia may use visitor data across the sites it protects for this purpose, which the CCPA permits a service provider to do to improve its own service. Alovia uses this data to distinguish automated traffic from legitimate visitors, not to identify or profile individual visitors, and never to train generative AI. Because this processing affects the customer's own visitors, the customer should reflect it in the notice it gives its visitors.

For agent data, the equivalent improvement processing happens only with the customer's explicit opt-in, set per fleet and off by default. With it on, Alovia keeps the redacted excerpts behind flagged verdicts as training examples for its own security detection models, shared across opted-in customers, and never for generative AI. Alovia applies safeguards intended to prevent re-identification and publicly commits, in line with Cal. Civ. Code §1798.140(m), that it will not attempt to re-identify any person from these examples and will require the same of anyone who processes them on its behalf. Turning the setting off stops future contribution and erases that fleet's stored examples; models already trained are not retrained. Because this processing involves the customer's own users, a customer who opts in should reflect it in the notice it gives those users.

Alovia acts as a service provider. As required by Cal. Civ. Code §1798.140(ag), Alovia makes the following commitments regarding the visitor data it processes on the customer's behalf:

• —(a) No sale or sharing. Alovia will not sell the personal information, and will not share it for cross-context behavioral advertising.
• —(b) No use outside the service. Alovia will not retain, use, or disclose the personal information for any purpose other than performing the services specified in the Terms of Service and this addendum, including for any commercial purpose other than the business purposes specified, and will not retain, use, or disclose it outside the direct business relationship between Alovia and the customer.
• —(c) No unpermitted combination. Alovia will not combine the personal information it receives from, or on behalf of, the customer with personal information it receives from, or on behalf of, another person, or collects from its own interaction with a visitor, except as permitted by the CCPA.
• —(d) Certification. Alovia certifies that it understands the restrictions in this section and will comply with them.

Alovia does not use visitor data to train generative AI. This commitment is non-negotiable and is stated here so the customer can rely on it.

Alovia keeps visitor data confidential and does not disclose it except as permitted by this addendum or required by law. Access is limited to personnel and subprocessors who need it to run the service, and who are bound by confidentiality obligations.

Alovia maintains reasonable technical and organizational security measures appropriate to the nature of the data, including encryption in transit, access controls, and logging. No system is perfectly secure, and Alovia does not claim absolute security.

Alovia retains Shield visitor data for 90 days, after which it is deleted in the ordinary course, unless a longer period is required by law or by a legal hold that applies to a specific matter. Alovia keeps visitor data only as long as needed to provide and improve the protection the customer asked for.

Alovia uses a small set of infrastructure subprocessors to run the service. The current list, with each provider's purpose, the data it handles, and its location, is published at /legal/subprocessors.

• —Alovia remains responsible for its subprocessors and for their processing of visitor data.
• —Alovia binds each subprocessor to obligations no less protective than those in this addendum.
• —Alovia gives the customer notice of material changes to its subprocessor list, so the customer has a reasonable opportunity to object.

Alovia assists the customer, taking into account the nature of the processing, so the customer can meet its own obligations under the CCPA.

• —Consumer rights requests. Alovia helps the customer respond to verified visitor requests to know, delete, or correct personal information that Shield holds, to the extent Alovia can locate and act on that data.
• —Breach notice. If Alovia confirms a security breach that affects the customer's visitor data, Alovia notifies the customer without undue delay, and assists the customer with its own notification duties, consistent with California's breach-notification law (Cal. Civ. Code §§1798.29 and 1798.82). The notice describes what happened, what data was involved, and the steps taken.

The customer is responsible for its own compliance. In particular:

• —The customer must have a lawful basis for using Shield on its site and for the processing of its visitors’ personal information.
• —The customer must give its own visitors any legally required notice, including its own privacy notice and notice at collection.
• —The customer’s instructions to Alovia, including its Shield configuration, must comply with applicable law.

Alovia is not responsible for the customer's own compliance with the law, or for the lawfulness of the customer's instructions.

At a level appropriate to a small beta service, and on reasonable written request, Alovia makes available to the customer the information reasonably necessary to show its compliance with this addendum. The customer may object to a new subprocessor on reasonable data-protection grounds, and Alovia works with the customer in good faith to address the objection.

When the customer stops using Shield, or on the customer's written request, Alovia deletes the visitor data it processes on the customer's behalf, except where retention is required by law or by an active legal hold. Retained data stays subject to the confidentiality and security commitments in this addendum.

This addendum supplements the Terms of Service and the Privacy Policy. If there is a conflict between this addendum and the Terms of Service on the processing of visitor data through Shield, this addendum controls for that data. This addendum is a draft pending review by counsel and is not legal advice.

Questions about this addendum, or requests related to visitor data, go to privacy@aloviaai.com.