MetaDay AI Ltd — Data Processing Agreement

Last Updated: 8 November 2026

1. What This Is

This Agreement is part of the MetaDay Terms & Conditions. It applies when MetaDay AI Ltd (Registered in England & Wales, Company No. 17076816, 128 City Road, London, EC1V 2NX, United Kingdom) processes personal data for a Customer. You accept it by accepting the Terms, and no signature is needed. Signed copies are available on Enterprise plans only. If a Customer has a contract signed by both parties that contains its own data processing terms, those terms apply to that contract instead. If this Agreement and the Terms differ on personal data, this Agreement wins.

2. Who Does What

• The Customer is the controller of its applicants and candidates, of contact details from a lookup it asks for, and of a person once it contacts them or processes their data for one of its roles.
• MetaDay is the processor of that data. We act on the Customer's instructions: its settings, pushes and runs in MetaDay, and these Terms.
• MetaDay is a controller of its own sourcing database, of its Talent Network, and of account and billing data. Our Privacy Policy covers those. This Agreement does not.
• Each party is responsible for its part.

3. The Processing

• Subject and purpose: running the MetaDay hiring and sales tools for the Customer.
• Duration: while the Customer uses MetaDay, and until the data is deleted under section 9.
• People: candidates, applicants, people the Customer finds, and the Customer's staff.
• Data: names, work history, skills, location, email, phone, messages, call recordings and transcripts, interview answers and scores, and anything else the Customer puts in.
• Sensitive data: we do not ask for it. A person may mention it on a call.

4. What MetaDay Does

• Processes personal data only on the Customer's documented instructions, unless the law requires otherwise. If so, we tell the Customer first, where the law allows.
• Tells the Customer if we think an instruction breaks data protection law.
• Makes sure our staff keep the data confidential.
• Keeps the data secure, with access controls, encryption in transit, logging and backups.
• Tells the Customer without undue delay after we learn of a personal data breach, and helps with what the Customer must do next.
• Helps the Customer answer people's requests, and passes on any request we get about its data.
• Deletion requests from candidates. The Customer instructs MetaDay to handle a candidate's request to delete their personal data on the Customer's behalf: MetaDay verifies the person's email, deletes their data from the Customer's MetaDay workspace and informs the Customer by email. If the Customer must keep a record for a legal reason, it tells MetaDay within 3 working days of the notice.
• Helps with data protection impact assessments and regulator questions, where these relate to our service.

5. What The Customer Does

• Has a lawful basis for what it asks us to do, and gives people the notices the law requires.
• Chooses its settings, including its Enrichment settings, and answers for them.
• Uses a contact lookup only to introduce real work, or for real sales of its own product. No spam.
• Checks the law where the person lives, not where the Customer is, and carries that duty.

6. Audits

On request, we give the Customer the information it needs to show that we meet this Agreement. An audit needs reasonable notice, takes place in business hours, and stays confidential.

7. Sub-Processors

The Customer agrees that MetaDay may use the sub-processors below. We update this list before adding or replacing one. A Customer can object for a good data protection reason by writing to info@metaday.ai, and if we can't solve it, the Customer may end the affected service.

• Hosting and data: Hetzner, Amazon Web Services, Upstash
• Email and messaging: Amazon Web Services, Google, Postmark, Twilio, Meta (WhatsApp Business), Nylas
• Profile and contact lookups: Bright Data, People Data Labs, FullEnrich, Hunter
• Interview integrity: AutoProctor
• Browser automation: Steel.dev, IPRoyal
• Internal alerts: Slack
• AI: OpenAI (text, and the voice in AI calls and interviews), Anthropic (text), ElevenLabs (voice)

8. Liability

The liability limits and the indemnity in the Terms apply to this Agreement. Nothing here removes a person's rights or a regulator's powers.

9. Transfers And Deletion

• Transfers: data may leave the UK or EEA. Where it does, we use safeguards such as Standard Contractual Clauses.
• Export: the Customer can export its people from MetaDay. An export is then the Customer's own data.
• At the end: when the contract ends, the Customer can ask us to delete its personal data or return it, and we do, unless the law requires us to keep it.

10. Contact

info@metaday.ai