Data Processing Addendum

• You are the controller of the personal information in your workspace, including information about your customers, prospects, and staff. You decide why and how it is processed.
• We are your processor for that information. We act on your documented instructions, which are your agreement with us, this addendum, the documentation, and how you configure and use the platform.
• We are an independent controller for usage information, aggregated data, the account and billing details of your administrators, and processing we do for security, fraud prevention, legal compliance, and product improvement. That processing is described in the Privacy Policy, and it is broad: it includes training the models we deploy across our customer base.

If we believe an instruction from you would break data protection law, we will tell you, unless we are legally prohibited from doing so.

• We do not sell or share personal information as those terms are defined by privacy law.
• We do not use personal information for any purpose other than performing the service, except for the independent-controller processing described above.
• We do not combine personal information from your workspace with information from another source, except as the law and your agreement allow.
• Our people who handle personal information are bound by confidentiality, trained, and limited to those with a need to know.
• We assist you, at your cost for non-trivial effort, in responding to data subject requests, running impact assessments, and answering regulators.
• If a person contacts us directly about your data, we tell you and direct them to you rather than answering ourselves.

We maintain technical and organizational measures appropriate to the risk, covering separation between customers, role-based access with least privilege, authentication and session control, encryption in transit and at rest, separation of production from test environments, audit logging and monitoring, secrets and change management, vulnerability management, personnel screening and training, backup and recovery, and vendor diligence. Those measures may improve over time; they will not be degraded. The overview is on the Security page, and specifics are available to customers under confidentiality.

You give general authorization for us to engage subprocessors, subject to these terms. They fall into these categories, each processing within the United States: application hosting and content delivery; managed database, authentication, and object storage; background job and event processing; geospatial, mapping, and property analytics; payment processing; transactional and notification email; diagnostics and error monitoring; and AI-assisted feature processing.

• The identity of our specific vendors is confidential and is not published, as a security measure. We disclose the current list to a customer on reasonable written request, under confidentiality, within ten business days.
• We give at least 30 days notice before engaging a new subprocessor that will process personal information, so you can object on documented data protection grounds.
• If we cannot resolve an objection, you may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.
• Every subprocessor is bound in writing to obligations no less protective than these, and we remain fully liable for their performance.

If we confirm a security incident affecting your personal information, we notify you without undue delay and within 72 hours, with the nature and scope, the categories and approximate number of records affected, the likely consequences, what we are doing, and a contact point, updated as the investigation develops. We cooperate with your own notification obligations to individuals and regulators. Notification is not an admission of fault. You must tell us within 24 hours of learning that credentials are compromised or that someone has reached your workspace who should not have.

Unsuccessful attempts that compromise nothing, such as failed log-ins, pings, port scans, and blocked network attacks, are not security incidents and are not reported individually.

On written request, once per year, or more often after a confirmed incident affecting you or where a regulator requires it, we provide the information reasonably needed to demonstrate compliance: a summary of our security measures, our most recent third-party assessment or penetration test summary where one exists, and answers to a reasonable security questionnaire. Where that is genuinely insufficient, you may request an audit on 30 days notice, conducted during business hours without disrupting operations or exposing other customers, by an auditor under confidentiality who is not a competitor of ours, at your cost. We will not disclose material that would compromise the security of the platform or another customer, or that is privileged.

We process and store personal information in the United States. We will not transfer it outside the United States without your prior written consent and an appropriate transfer mechanism. Personnel or subprocessors outside the United States may be permitted remote access solely for support and maintenance, under access controls and confidentiality obligations, and we disclose those arrangements on request.

We retain personal information for the term of your subscription and afterwards as your agreement provides. You can export at any time while active, and for 30 days after termination we make your data available in a structured, machine-readable format. After that we delete it from production and will do so within 90 days, with backup copies expiring on their ordinary rotation and remaining protected until they do. We may retain what the law requires, what is needed to establish or defend a legal claim, and the independent-controller data described in section 1.

The platform gives you built-in tools to access, correct, export, and delete records, and those are your primary means of responding to a request from one of your customers or staff. Where you need our help beyond that, we assist as described in section 2. Individuals should direct requests to the company that holds their information; our public request process is on the Your Privacy Rights page.

These terms apply to customers as part of our agreement. If your procurement process needs a countersigned copy, or a supplement for a specific regulation, request it through the contact page with “DPA” in the subject and we will turn it around. This version is effective as of August 20, 2026. Related: Privacy Policy, Security, Government and Law Enforcement Requests.