Minno Data Processing Agreement

Version 2026-11-07 · Last updated 7 November 2026

This Data Processing Agreement ("DPA") is part of the Minno Terms of Service (the "Terms") between Rook Industries, Inc. ("Rook") and the customer ("Customer"). It applies automatically to every account. A countersigned copy, with the EU Standard Contractual Clauses and UK Addendum attached where needed, is available from privacy@tryminno.com. Capitalized terms not defined here have the meaning in the Terms.

1. Roles and scope

1.1 For Session Data, Customer is the controller (or "business" or "private entity") and Rook is the processor (or "service provider" or "contractor"). This DPA applies to personal data in Session Data ("Customer Personal Data"), which includes biometric data processed transiently.

1.2 "Data Protection Law" means every law that applies to the processing, including the CCPA and other US state privacy laws, BIPA (740 ILCS 14), Texas Bus. & Com. Code §503.001, Washington RCW 19.375 and the My Health My Data Act, the GDPR, UK GDPR and Data Protection Act 2018, PIPEDA and Quebec's Act respecting the protection of personal information in the private sector.

1.3 Details of processing are in Annex 1. Security measures are in Annex 2. Subprocessors are in Annex 3. The Biometric Addendum is Annex 4.

2. Rook's commitments

2.1 Instructions. Rook processes Customer Personal Data only on Customer's documented instructions (the Terms, this DPA and Customer's use of the API) and only to provide, secure, support and bill the service. Rook will tell Customer if it believes an instruction violates Data Protection Law.

2.2 CCPA service-provider terms. Rook will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes here or outside the direct relationship with Customer; combine it with personal information from any other source except as the regulations permit; or use it to build or improve profiles for another business. Rook will comply with the CCPA, give the same level of protection the CCPA requires, and notify Customer if it can no longer comply. Customer may take reasonable steps to stop and remedy unauthorized use. Rook certifies it understands these restrictions.

2.3 Confidentiality. People with access are bound by confidentiality obligations.

2.4 Security. Rook implements the measures in Annex 2.

2.5 Subprocessors. Customer authorizes the subprocessors in Annex 3. Rook will post changes at tryminno.com/legal/subprocessors at least 30 days before a new subprocessor processes Customer Personal Data; Customer may object in writing within that period, and if the parties can't resolve it Customer may terminate the affected service. Rook remains responsible for its subprocessors.

2.6 No face database. Rook will not store face images, video or biometric templates, will not create a gallery, collection or index of faces, and will not use Customer Personal Data to train or improve any model.

3. Assistance

Rook will, taking into account the nature of the processing, help Customer respond to data-subject requests (Rook forwards any request it receives within 5 business days), carry out data protection and privacy impact assessments (including the assessment Quebec requires for biometric systems), and consult with authorities where required. Rook may charge reasonable fees for assistance beyond what the service already provides.

4. Security incidents

Rook will notify Customer without undue delay, and within 48 hours of confirming, any personal data breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own notification duties, and will update as it learns more.

5. Deletion and return

Session metadata is deleted on the schedule in the Biometric Data Policy (13 months) or earlier on Customer's deletion request. On termination Rook deletes all Customer Personal Data within 30 days, except what the law requires it to keep (billing records, which contain no biometric data). Rook holds no face data to return.

6. Audits

Once a year, or after a security incident, Rook will give Customer the information reasonably necessary to demonstrate compliance (security documentation, test results, subprocessor terms). Rook does not yet hold third-party audit reports and will say so. Customer may conduct a remote audit on 30 days' notice at its own cost, no more than once a year, under confidentiality.

7. International transfers

Processing occurs in the United States. Where Customer transfers personal data from the EEA, UK or Switzerland, the parties enter into the EU Standard Contractual Clauses (Module 2, controller to processor, Decision 2021/914) and the UK International Data Transfer Addendum, which Rook will provide for signature; this DPA's terms are the commercial terms for those clauses, Rook's subprocessors are authorized under Clause 9(a) option 2, and the governing law and forum for the clauses are Ireland. For other countries Customer is responsible for the lawful basis of the transfer.

8. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except that the limits don't reduce either party's liability to data subjects where the law prohibits it. If this DPA conflicts with the Terms, this DPA controls for personal data.

9. Customer's commitments

Customer confirms and promises that it: has a lawful basis for every check it starts; gives every notice and obtains every consent Data Protection Law requires before capture, including the written notice and release that biometric laws require; publishes its own retention and destruction policy where required; does not start a session for any person who has not consented or who is under the age the law requires; does not use results to discriminate unlawfully; and uses the reference frame and any ID portrait only under its own privacy obligations.

Annex 1: Details of processing

• Subject matter and duration: running face liveness and face comparison checks for Customer's end users, for as long as the account is open plus the deletion periods above.
• Nature and purpose: creating a session; issuing short-lived capture credentials; obtaining a liveness decision and confidence score; optionally comparing a reference frame with an ID portrait Customer supplies; returning results; metering usage per key and per reference tag; security and billing.
• Types of personal data: biometric data (face video and derived liveness signals, processed transiently by the cloud provider and not stored by Rook); the reference frame (passed through once if requested); the ID portrait Customer supplies (passed through); session metadata (IDs, status, scores, timestamps, Customer's reference tag); Customer's account and billing data.
• Data subjects: Customer's end users (applicants, account holders, employees or contractors Customer verifies); Customer's own staff.
• Special categories: biometric data for the purpose of uniquely identifying or authenticating a natural person. Customer must have an explicit-consent or other lawful basis under Article 9 GDPR or the equivalent.
• Retention: per Annex 4 and the Biometric Data Policy.

Annex 2: Security measures

• TLS 1.2+ in transit for every call. API keys stored as one-way hashes. Device credentials are 15-minute scoped credentials permitting a single action (start a liveness capture) and nothing else.
• Tenant isolation: every query is scoped to the key that made it; a key can never read another key's sessions.
• No face data at rest: no image, video or template is written to disk, database, log or backup. Enforced in code and covered by automated tests.
• Logs redacted of secrets and credentials; no biometric content in logs.
• Servers operated by Rook in the United States, no public inbound ports, access through an authenticated tunnel, key-based administrative access limited to named personnel.
• Encrypted backups (metadata only) with periodic restore tests.
• Input validation; rate limits per key; dependency and vulnerability monitoring; automated tests and review before each deployment.
• Incident response as in Section 4; vulnerability reports to security@tryminno.com.
• Cloud provider: Amazon Rekognition Face Liveness under the AWS Data Processing Addendum; model-improvement use opted out at the account level.

Annex 3: Subprocessors

Rook hosts the API on servers it operates in the United States. No other subprocessor processes Customer Personal Data.

Annex 4: Biometric Addendum

A4.1 Definitions. "Biometric Identifier" and "Biometric Information" have the meanings in BIPA and the equivalent terms in other biometric laws, and include a face scan, face geometry, liveness signals derived from a face, and any information based on them used to identify a person.

A4.2 Rook's role. Rook is a vendor that may be "in possession" of Biometric Identifiers transiently while a check is processed. Rook does not collect Biometric Identifiers from the public; Customer does, through its own product.

A4.3 Rook will:

• (a) keep a publicly available written policy establishing a retention schedule and guidelines for permanently destroying Biometric Identifiers and Biometric Information (tryminno.com/legal/biometric-policy);
• (b) not sell, lease, trade or otherwise profit from Biometric Identifiers or Biometric Information;
• (c) not disclose, redisclose or disseminate them except to the subprocessor in Annex 3 needed to perform the check, with Customer's instruction (which Customer gives by starting a session), or as required by law or valid legal process;
• (d) store, transmit and protect them using the reasonable standard of care within Rook's industry, and in a manner at least as protective as Rook treats other confidential and sensitive information;
• (e) permanently destroy any Biometric Identifier or Biometric Information in its possession when the initial purpose (returning the check result) is satisfied, and in no case later than the periods in the Biometric Data Policy; in practice nothing is retained by Rook after the result is returned;
• (f) not use them for any purpose other than performing the check Customer requested.

A4.4 Customer will, before any capture: provide the written notice (collection, purpose, retention) and obtain the written release or express consent BIPA and other biometric laws require; maintain its own public retention and destruction policy; and keep records of consent sufficient to demonstrate compliance. Customer will not instruct Rook to retain, share or use Biometric Identifiers beyond performing the check.

A4.5 Illinois. The parties intend Rook to be a vendor acting at Customer's direction and not to independently "collect, capture, purchase, receive through trade or otherwise obtain" Biometric Identifiers within the meaning of BIPA section 15(b). Nothing in this Addendum is an admission that BIPA applies to Rook; the commitments are made in any event.

A4.6 Indemnity. Section 12 of the Terms applies to any claim under a biometric law arising from Customer's end users, including any claim that Customer's notice, consent or policy was inadequate.