Data Processing Agreement
Last Updated: April 12, 2025
1. INTRODUCTION
1.1 About These Terms
These Terms of Use (“Terms”) explain how Gray Whale Inc (“Gray Whale,” “we,” “us,” or “our”), a Delaware C corporation, provides software services, developer tools, APIs, applications, and related consulting services through our website https://graywhale.ai (the “Website”) and the terms and conditions that apply to your use of our services.
By accessing or using our Website, services, developer tools, or APIs, including within a software application, website, tool, or product you create or offer to others (your “Application”), you are agreeing to these Terms and to comply with any accompanying documentation that applies to your use of our services. You represent and warrant to us that you have the authority to accept these Terms on behalf of yourself, a company, and/or other entity, as applicable.
We may change, amend or terminate these Terms at any time. Your use of our services after any change or amendment means you agree to the new Terms. If you do not agree to the new Terms or if we terminate these Terms, you must stop using our services.
We may update these Terms from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes to these Terms, we will notify you by updating the “Last Updated” date at the top of these Terms and, where required by law, we may provide you with more prominent notice (such as by sending you an email notification or displaying a banner on our Website).
1.2 Structure of This Agreement
These Terms consist of:
- The main Terms of Use that apply to all users of our services
- The Data Processing Agreement (DPA) in Section 16, which applies when we process personal data on your behalf
- Any additional terms, policies, or agreements referenced herein
2. SERVICES
2.1 Our Services
Gray Whale provides artificial intelligence software services, developer tools, APIs, applications, and related consulting services. Our services may include, but are not limited to:
- Access to our AI models and algorithms
- Developer tools and APIs for integration with your applications
- Software applications that utilize our AI technology
- Consulting services related to AI implementation and optimization
2.2 Service Modifications
We may modify, suspend, or discontinue any part of our services at any time. We will provide reasonable notice of material changes to our services when practicable. If you do not agree with any modifications, your sole remedy is to terminate your use of our services.
3. ACCOUNT REGISTRATION AND SECURITY
3.1 Account Creation
To access certain features of our services, you may need to create an account. You agree to provide accurate, current, and complete information during the registration process and to update such information to keep it accurate, current, and complete.
3.2 Account Security
You are responsible for safeguarding your account credentials and for all activities that occur under your account. You agree to notify us immediately of any unauthorized use of your account or any other breach of security. We cannot and will not be liable for any loss or damage arising from your failure to comply with this section.
3.3 Age Restrictions
Our services are not intended for use by individuals under the age of 18. By using our services, you represent and warrant that you are at least 18 years of age.
4. USER OBLIGATIONS
4.1 Acceptable Use
You agree to use our services only for lawful purposes and in accordance with these Terms. You agree not to use our services:
- In any way that violates any applicable federal, state, local, or international law or regulation
- To transmit, or procure the sending of, any advertising or promotional material, including any “junk mail,” “chain letter,” “spam,” or any other similar solicitation
- To impersonate or attempt to impersonate Gray Whale, a Gray Whale employee, another user, or any other person or entity
- To engage in any other conduct that restricts or inhibits anyone’s use or enjoyment of our services, or which, as determined by us, may harm Gray Whale or users of our services or expose them to liability
4.2 API Usage and Rate Limits
If you use our APIs, you agree to comply with any rate limits and other restrictions that we may impose on the use of our APIs. We reserve the right to monitor your usage of our APIs and to modify or revoke your access to our APIs if we believe you are violating these Terms or using our APIs in a manner that may impose an unreasonable load on our infrastructure.
4.3 Prohibited Uses
You agree not to use our services to develop, train, or improve (directly or indirectly) any product, service, system, or other method that competes with our services. You may not reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, algorithms, or architecture of our services.
5. INTELLECTUAL PROPERTY RIGHTS
5.1 Our Intellectual Property
All rights, title, and interest in and to our services, including all intellectual property rights therein, are and will remain the exclusive property of Gray Whale and its licensors. Our services are protected by copyright, trademark, and other laws of the United States and foreign countries. Nothing in these Terms grants you any right, title, or interest in or to our services or any intellectual property rights therein, except for the limited license expressly set forth in Section 5.2.
5.2 Limited License
Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, non-sublicensable license to access and use our services for your internal business purposes or personal use. This license does not include any resale or commercial use of our services or any derivative use of our services.
5.3 Your Content
You retain all rights, title, and interest in and to any content that you submit, post, or display through our services (“Your Content”). By submitting, posting, or displaying Your Content, you grant us a worldwide, non-exclusive, royalty-free license to use, reproduce, modify, adapt, publish, translate, and distribute Your Content in connection with providing our services to you.
5.4 Feedback
If you provide us with any feedback, suggestions, or ideas regarding our services (“Feedback”), you grant us a perpetual, irrevocable, worldwide, royalty-free license to use, reproduce, disclose, distribute, modify, and otherwise exploit such Feedback for any purpose without restriction or compensation to you.
6. DATA PROCESSING AND PRIVACY
6.1 Data Processing
When you use our services, we may process data on your behalf. Our processing of personal data is governed by the Data Processing Agreement in Section 16 of these Terms.
6.2 Privacy Policy
Our Privacy Policy, available at https://graywhale.ai/privacy-policy, explains how we collect, use, and disclose information about you when you use our services. By using our services, you consent to our collection, use, and disclosure of information as described in our Privacy Policy.
7. CONFIDENTIALITY
7.1 Confidential Information
“Confidential Information” means any non-public information disclosed by one party to the other party, either directly or indirectly, in writing, orally, or by inspection of tangible objects, that is designated as “confidential,” “proprietary,” or some similar designation, or that should reasonably be understood to be confidential given the nature of the information and the circumstances of disclosure.
7.2 Protection of Confidential Information
Each party agrees to use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but in no event less than reasonable care) to (i) not use any Confidential Information of the other party for any purpose outside the scope of these Terms, and (ii) limit access to Confidential Information of the other party to those of its employees, contractors, and agents who need such access for purposes consistent with these Terms and who have signed confidentiality agreements with the receiving party containing protections no less stringent than those herein.
7.3 Exclusions
Confidential Information shall not include information that (i) is or becomes generally known to the public without breach of any obligation owed to the disclosing party, (ii) was known to the receiving party prior to its disclosure by the disclosing party without breach of any obligation owed to the disclosing party, (iii) is received from a third party without breach of any obligation owed to the disclosing party, or (iv) was independently developed by the receiving party without use of or reference to the disclosing party’s Confidential Information.
7.4 Compelled Disclosure
If the receiving party is compelled by law to disclose Confidential Information of the disclosing party, it shall provide the disclosing party with prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at the disclosing party’s cost, if the disclosing party wishes to contest the disclosure.
8. THIRD-PARTY SERVICES AND CONTENT
8.1 Third-Party Services
Our services may contain links to third-party websites, services, or content that are not owned or controlled by Gray Whale. We do not endorse or assume any responsibility for any such third-party websites, services, or content. If you access any third-party website, service, or content from our services, you do so at your own risk and you agree that Gray Whale will have no liability arising from your use of or access to any third-party website, service, or content.
8.2 Third-Party Content
Our services may display content from third parties. You acknowledge that we are not responsible for the accuracy, completeness, or quality of any third-party content displayed through our services.
9. FEES AND PAYMENT
9.1 Fees
You agree to pay all fees specified for our services. Unless otherwise specified, all fees are quoted in U.S. dollars and are non-refundable. We reserve the right to change our fees at any time upon reasonable notice.
9.2 Payment
If you provide credit card or other payment information to us, you authorize us to charge such payment method for all fees incurred. You agree to provide current, complete, and accurate billing information and to promptly update all such information.
9.3 Taxes
All fees are exclusive of taxes, which we will charge as applicable. You are responsible for paying all taxes associated with your use of our services, except for taxes based on Gray Whale’s net income.
10. TERM AND TERMINATION
10.1 Term
These Terms will remain in effect until terminated by you or Gray Whale.
10.2 Termination by You
You may terminate these Terms at any time by discontinuing your use of our services and closing your account.
10.3 Termination by Gray Whale
We may terminate these Terms and your access to all or any part of our services at any time, with or without cause, with or without notice, effective immediately.
10.4 Effect of Termination
Upon termination of these Terms, your right to use our services will immediately cease. The following sections will survive termination: 5 (Intellectual Property Rights), 7 (Confidentiality), 9 (Fees and Payment), 10.4 (Effect of Termination), 11 (Disclaimer of Warranties), 12 (Limitation of Liability), 13 (Indemnification), 14 (Dispute Resolution), and 15 (General Provisions).
10.5 Data Deletion and Return
Upon termination of these Terms, Gray Whale will, at your choice, return all your data or provide you with the ability to export such data. Within 90 days following termination, Gray Whale will delete all your data from its systems, including backups, except where retention is required by law. Upon your request, Gray Whale will provide written certification of deletion.
11. DISCLAIMER OF WARRANTIES
11.1 Service Warranty Disclaimer
OUR SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRAY WHALE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.
11.2 Specific Disclaimers
GRAY WHALE DOES NOT WARRANT THAT (I) OUR SERVICES WILL MEET YOUR REQUIREMENTS, (II) OUR SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, (III) THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF OUR SERVICES WILL BE ACCURATE OR RELIABLE, (IV) THE QUALITY OF ANY PRODUCTS, SERVICES, INFORMATION, OR OTHER MATERIAL PURCHASED OR OBTAINED BY YOU THROUGH OUR SERVICES WILL MEET YOUR EXPECTATIONS, OR (V) ANY ERRORS IN OUR SERVICES WILL BE CORRECTED.
11.3 Internet Delays
OUR SERVICES MAY BE SUBJECT TO LIMITATIONS, DELAYS, AND OTHER PROBLEMS INHERENT IN THE USE OF THE INTERNET AND ELECTRONIC COMMUNICATIONS. GRAY WHALE IS NOT RESPONSIBLE FOR ANY DELAYS, DELIVERY FAILURES, OR OTHER DAMAGE RESULTING FROM SUCH PROBLEMS.
12. LIMITATION OF LIABILITY
12.1 Exclusion of Certain Damages
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL GRAY WHALE BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO YOUR USE OF, OR INABILITY TO USE, OUR SERVICES.
12.2 Limitation of Liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, GRAY WHALE’S TOTAL LIABILITY TO YOU FOR ANY DAMAGES ARISING FROM OR RELATED TO THESE TERMS OR YOUR USE OF OUR SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, SHALL NOT EXCEED THE AMOUNT PAID BY YOU TO GRAY WHALE IN THE TWELVE (12) MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE LIABILITY, OR ONE HUNDRED DOLLARS ($100) IF NO SUCH PAYMENT HAS BEEN MADE.
12.3 Data Protection Liability
Notwithstanding the general limitation of liability in Section 12.2, Gray Whale’s liability for damages arising from breaches of data protection obligations shall not be subject to the general liability cap, but shall instead be limited to the greater of (a) three times the fees paid in the 12 months preceding the event giving rise to liability, or (b) $1,000,000.
12.4 Basis of the Bargain
THE LIMITATIONS OF DAMAGES SET FORTH ABOVE ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN GRAY WHALE AND YOU.
13. INDEMNIFICATION
13.1 Your Indemnification
You agree to defend, indemnify, and hold harmless Gray Whale, its affiliates, licensors, and service providers, and its and their respective officers, directors, employees, contractors, agents, licensors, suppliers, successors, and assigns from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses, or fees (including reasonable attorneys’ fees) arising out of or relating to your violation of these Terms or your use of our services, including, but not limited to, your User Contributions, any use of our services’ content, services, and products other than as expressly authorized in these Terms, or your use of any information obtained from our services.
13.2 Procedure
Gray Whale will (a) promptly notify you in writing of any such claim, suit, or proceeding, (b) give you sole control of the defense and settlement of such claim, suit, or proceeding (provided that you may not settle any claim, suit, or proceeding unless the settlement unconditionally releases Gray Whale of all liability), and (c) provide to you all reasonable assistance, at your expense.
14. DISPUTE RESOLUTION
14.1 Governing Law
These Terms and any dispute or claim arising out of or in connection with these Terms or their subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the State of Delaware, without giving effect to any choice or conflict of law provision or rule.
14.2 Arbitration
Any dispute, controversy, or claim arising out of or relating to these Terms, including the formation, interpretation, breach, or termination thereof, including whether the claims asserted are arbitrable, will be referred to and finally determined by confidential arbitration in accordance with the JAMS International Arbitration Rules. The tribunal will consist of three arbitrators. The place of arbitration will be San Francisco, California. The language to be used in the arbitral proceedings will be English.
14.3 Class Action Waiver
YOU AND GRAY WHALE AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. Further, unless both you and Gray Whale agree otherwise, the arbitrator may not consolidate more than one person’s claims, and may not otherwise preside over any form of a representative or class proceeding.
14.4 Exceptions
Notwithstanding the foregoing, either party may seek equitable relief in any court having jurisdiction to protect its intellectual property rights or confidential information prior to or pending resolution of any dispute through arbitration.
15. GENERAL PROVISIONS
15.1 Entire Agreement
These Terms constitute the entire agreement between you and Gray Whale regarding your use of our services and supersede all prior and contemporaneous written or oral agreements between you and Gray Whale.
15.2 Waiver and Severability
The failure of Gray Whale to enforce any right or provision of these Terms will not be deemed a waiver of such right or provision. If any provision of these Terms is held to be invalid or unenforceable, such provision shall be struck and the remaining provisions shall be enforced to the fullest extent under law.
15.3 Assignment
You may not assign or transfer these Terms, by operation of law or otherwise, without Gray Whale’s prior written consent. Any attempt by you to assign or transfer these Terms without such consent will be null and of no effect. Gray Whale may assign or transfer these Terms, at its sole discretion, without restriction.
15.4 Notices
Any notices or other communications provided by Gray Whale under these Terms will be given by posting to the Website or, if you have provided your email address, by email to the email address you provided.
15.5 Force Majeure
Gray Whale shall not be liable for any delay or failure to perform resulting from causes outside its reasonable control, including, but not limited to, acts of God, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, strikes or shortages of transportation facilities, fuel, energy, labor or materials. Notwithstanding any force majeure event, Gray Whale shall continue to implement appropriate security measures to protect Customer data and shall notify Customer of any impact on data processing activities. Core data protection obligations, including confidentiality and security requirements, shall not be excused by force majeure events.
15.6 Export Control
You agree to comply with all applicable export and re-export control laws and regulations, including the Export Administration Regulations maintained by the U.S. Department of Commerce, and trade and economic sanctions maintained by the Treasury Department’s Office of Foreign Assets Control.
15.7 U.S. Government Rights
If you are a U.S. government entity, you acknowledge that any software or documentation that are provided to you are “Commercial Items” as defined at 48 C.F.R. 2.101, and are being provided as commercial computer software subject to the restricted rights described in 48 C.F.R. 2.101 and 12.212.
16. DATA PROCESSING AGREEMENT (DPA)
This Data Processing Agreement (“DPA”) forms part of the Terms of Use and applies to the extent that Gray Whale processes personal data on behalf of customers. Gray Whale complies with applicable data protection laws including but not limited to the EU GDPR, UK GDPR, and US state privacy laws as applicable to the processing activities.
16.1 Definitions
In this DPA, the following terms shall have the meanings set forth below:
“Applicable Data Protection Laws” means all applicable laws, rules, regulations and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time;
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data;
“Customer” means the entity that has entered into these Terms with Gray Whale;
“Customer Personal Data” means the Personal Data processed by Gray Whale on behalf of Customer in connection with the provision of the Services;
“Data Subject” means the identified or identifiable person to whom Personal Data relates;
“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR” as defined in section 3 of the Data Protection Act 2018;
“Personal Data” means any information relating to an identified or identifiable individual or device, or is otherwise “personal data,” “personal information,” “personally identifiable information” and similar terms, and such terms shall have the same meaning as defined by applicable data protection laws;
“Processor” means the entity which Processes Personal Data on behalf of the Controller;
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data;
“Services” means the services provided by Gray Whale to Customer pursuant to the Terms;
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as approved by the European Commission;
“Sub-processor” means any Processor engaged by Gray Whale to process Customer Personal Data.
16.2 Roles and Responsibilities
The parties acknowledge and agree that:
(a) When providing services to customers, Gray Whale generally acts as a “processor” of personal data under the GDPR and similar laws, while the Customer acts as the “controller.” In certain circumstances, such as when processing data for service improvement, Gray Whale may act as an independent controller.
(b) For the purposes of the US Data Protection Laws, Gray Whale will act as a “service provider” or “processor” in its performance of its obligations pursuant to these Terms.
Each party shall comply with their respective obligations under Applicable Data Protection Laws.
16.3 Details of Data Processing
The subject matter, nature, purpose, and duration of the Processing, as well as the types of Personal Data collected and categories of Data Subjects, are set forth below:
Subject Matter: The provision of the Services by Gray Whale to Customer.
Nature and Purpose of Processing: Gray Whale will Process Customer Personal Data as necessary to provide the Services pursuant to these Terms, as further specified in the documentation and instructions provided by Customer.
Duration of Processing: Gray Whale will Process Customer Personal Data for the duration of these Terms, unless otherwise agreed upon in writing.
Types of Personal Data: The Personal Data processed may include, but is not limited to, name, email address, phone number, address, IP address, device identifiers, usage data, and other information provided by Customer or its users through use of the Services.
Categories of Data Subjects: The Data Subjects may include Customer’s employees, contractors, and end users, as well as individuals whose Personal Data is processed through Customer’s use of the Services.
16.4 Customer Instructions
Gray Whale shall Process Customer Personal Data only on behalf of and in accordance with Customer’s documented instructions. These Terms and any specific instructions provided by Customer constitute Customer’s documented instructions. If Gray Whale is required by law to Process Customer Personal Data other than in accordance with Customer’s instructions, Gray Whale shall inform Customer of the legal requirement before Processing, unless prohibited by law.
16.5 Security Measures
Gray Whale implements and maintains appropriate technical and organizational security measures designed to ensure security of Customer Personal Data, including:
- Encryption of personal data in transit using TLS 1.2 or higher and at rest using AES-256
- Logical access controls with role-based permissions and least privilege principles
- Multi-factor authentication for all administrative access
- Password requirements including minimum 12-character length, complexity, and regular rotation
- System audit logging and monitoring with 90-day retention
- Regular security assessments and penetration testing
- Employee security training and awareness programs
- Physical security measures for data centers and offices
- Business continuity and disaster recovery plans
- Formal incident response procedures
Gray Whale shall ensure that any person authorized to Process Customer Personal Data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality.
16.6 Sub-processors
Customer grants Gray Whale general authorization to engage Sub-processors to provide the Services. A current list of Sub-processors is available at [URL]. Gray Whale will provide at least 15 days’ prior written notice of any intended addition or replacement of a Sub-processor. If Customer reasonably objects to such change, Customer may terminate the affected services upon written notice within 10 days of notification.
Gray Whale shall (i) enter into a written agreement with each Sub-processor imposing data protection obligations no less protective of Customer Personal Data than Gray Whale’s obligations under this DPA to the extent applicable to the nature of the services provided by such Sub-processor; and (ii) remain fully liable for each Sub-processor’s compliance with the obligations under this DPA.
16.7 Data Subject Rights
Gray Whale will provide reasonable assistance to Customer in responding to data subject requests. Gray Whale will forward any data subject requests received directly to Customer within 3 business days. Where possible, Gray Whale will provide self-service tools to help Customer fulfill such requests. For complex requests, Gray Whale will provide additional assistance as reasonably required, which may be subject to reasonable fees.
16.8 Security Incidents
Gray Whale will notify Customer without undue delay, and in any event within 48 hours, af