Continuous LLC Compliance Annex (DMCA, DPA & Subprocessors)

Effective Date: October 22, 2026

Part A: DMCA Copyright Policy & EU DSA Notice-and-Action

In accordance with the Digital Millennium Copyright Act (17 U.S.C. § 512) and the EU Digital Services Act (DSA), cntnus responds expeditiously to valid notices of alleged infringement or illegal content hosted on User-Generated Content (UGC) Services (such as shortened URLs, public wikis, infinite-canvas art, or voting widgets).

• Filing a Takedown Notice: Send written notice to legal@cntnus.app including: (1) identification of the copyrighted work or violated law; (2) the exact *.cntnus.app URL of the offending material; (3) your contact details; (4) a good-faith belief statement; and (5) a statement under penalty of perjury that you are authorized to act, signed electronically or physically.
• Repeat Infringer Policy: We terminate the accounts of repeat infringers in appropriate circumstances.

Part B: B2B Data Processing Addendum (DPA) Baseline

For business customers subject to GDPR, UK GDPR, or US State Privacy Laws where cntnus acts as a Data Processor / Service Provider (processing Customer Content on your behalf):

1. Processing Instructions: cntnus shall process Personal Data within Customer Content only on documented instructions from Customer, unless required by law.
2. Confidentiality & Security: cntnus ensures all personnel are bound by confidentiality and maintains technical and organizational controls (TLS 1.3 in transit, AES-256 KMS encryption at rest, strict tenant partition-key isolation, and OIDC least-privilege IAM).
3. Breach Notification: cntnus will notify Customer without undue delay (and within 48 hours) after becoming aware of a confirmed Personal Data Breach affecting Customer Content.
4. Return or Deletion: Upon termination of Services, cntnus will enable Customer to export Customer Content and will purge remaining copies within 30–90 days in accordance with standard backup lifecycles.

Part C: Core Infrastructure Subprocessors