Legal

This Data Processing Addendum ("DPA") supplements and forms part of the Notify Master Service Agreement (the "Agreement") between Informic LLC, an Indiana limited liability company doing business as "Notify" ("Company," "Service Provider," or "Processor"), and the Client identified in the Agreement ("Client," "Business," or "Controller").

This DPA applies to Company's Processing of Personal Information on Client's behalf in connection with the Service. In the event of a conflict between this DPA and the body of the Agreement with respect to the Processing of Personal Information, this DPA controls.

1. DEFINITIONS

1.1 Capitalized terms not defined here have the meanings given in the Agreement.

1.2 "Applicable Privacy Laws" means all U.S. state privacy and data protection laws applicable to the Processing of Personal Information under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, and any other comparable state law as enacted or amended.

1.3 "Business," "Business Purpose," "Consumer," "Sell," "Share," "Service Provider," and "Personal Information" have the meanings given in the CCPA. "Controller," "Processor," "Personal Data," and "Process"/"Processing" have the meanings given in the VCDPA, CPA, CTDPA, UCPA, and TDPSA as applicable. For convenience, "Personal Information" as used in this DPA includes "Personal Data."

1.4 "Client Personal Information" means Personal Information contained within Client Data that Company Processes on Client's behalf in performing the Service, including Visitor names, contact information, conversation transcripts, uploaded images, and booking records collected through Client's chat widget.

1.5 "Security Incident" means a confirmed unauthorized acquisition of, or unauthorized access to, Client Personal Information in Company's possession or control that compromises its security, confidentiality, or integrity.

1.6 "Sub-processor" means a third party engaged by Company, directly or through an authorized managed service provider, to Process Client Personal Information in connection with the Service.

2. ROLES OF THE PARTIES

2.1 Allocation of Roles. With respect to Client Personal Information collected through Client's chat widget and Processed through the Service:

• Client is the Business (under the CCPA) and the Controller (under other Applicable Privacy Laws).
• Company is the Service Provider (under the CCPA) and the Processor (under other Applicable Privacy Laws).

2.2 Company as Business/Controller. Company acts as a Business and Controller with respect to: (a) Personal Information of Client's own account holders and Authorized Users collected for account administration, billing, security, and support; and (b) Personal Information collected through Company's own marketing website. This DPA does not govern that Processing, which is described in Company's Privacy Policy.

2.3 Client's Responsibilities as Controller. Client determines the purposes and means of Processing Client Personal Information. Client is solely responsible for: (a) providing all legally required notices to Consumers, including any notice at collection; (b) obtaining any legally required consents; (c) responding to Consumer rights requests as described in Section 7; and (d) ensuring it has the right to transfer Client Personal Information to Company for Processing under this DPA.

2.4 No Joint Controllership. Nothing in this DPA is intended to create a joint controller, joint business, or partnership relationship between the Parties with respect to Client Personal Information.

3. SCOPE AND DETAILS OF PROCESSING

3.1 Subject Matter. Provision of the Notify AI chat, lead capture, appointment booking, automated follow-up, alerting, and analytics platform as described in the Agreement.

3.2 Duration. For the Term of the Agreement, plus any post-termination retention period permitted under Section 9.

3.3 Nature and Purpose of Processing. Collecting, recording, organizing, storing, retrieving, transmitting, analyzing, and deleting Client Personal Information solely to: generate AI chat responses; assess job photos uploaded by Consumers; classify message urgency; capture and store leads; check calendar availability and create appointments; draft and send follow-up emails on Client's behalf; deliver notifications and alerts to Client; display analytics to Client; secure and maintain the Service; and provide support.

3.4 Categories of Personal Information. Identifiers (name, telephone number, email address); commercial information (service requested, booking details); Internet or network activity information (IP address, browser type, referral and UTM data, timestamps); visual information (images voluntarily uploaded by a Consumer); and free-text content submitted by a Consumer in the course of a chat conversation.

3.5 Categories of Consumers. Client's customers and prospective customers who interact with the Notify chat widget deployed on Client's website.

3.6 Sensitive Personal Information. The Service is not designed or intended to solicit Sensitive Personal Information, and Client will not configure the Service to solicit it. Consumers may nonetheless volunteer it in free-text messages or images. Such content may be stored, displayed to Client, and transmitted through the managed AI service to generate a response or assess a job photo, or used for an authorized follow-up. Company will limit that Processing to the specific Service purposes in Section 3.3 and Client's lawful documented instructions, will not use it for advertising, profiling unrelated to the service request, or model training, and will assist Client with deletion requests under Section 7. This disclosure is not authorization to solicit regulated data or to Process information contrary to Applicable Privacy Laws.

4. COMPANY'S OBLIGATIONS — CCPA SERVICE PROVIDER TERMS

Company makes the following commitments, which are required of a Service Provider under CCPA § 1798.140(ag) and § 1798.100(d):

4.1 No Sale or Sharing. Company will not Sell or Share Client Personal Information. Company receives no monetary or other valuable consideration in exchange for Client Personal Information, and Company does not disclose Client Personal Information for cross-context behavioral advertising.

4.2 Limited Purpose and Privacy Protection. Client discloses Client Personal Information to Company only for the limited and specified Business Purposes in Section 3.3. Company will not retain, use, or disclose Client Personal Information for any other purpose, including any other commercial purpose, except as expressly permitted by the CCPA and its implementing regulations. Company will comply with applicable obligations under the CCPA and its implementing regulations and provide the same level of privacy protection required of businesses under those laws.

4.3 Outside the Direct Business Relationship. Company will not retain, use, or disclose Client Personal Information outside of the direct business relationship between Company and Client, except where permitted by the CCPA.

4.4 No Combining. Company will not combine Client Personal Information with Personal Information received from or on behalf of another person, or collected from Company's own interaction with a Consumer, except to the extent expressly permitted by the CCPA and its implementing regulations. Client authorization alone does not permit combining prohibited by those laws.

4.5 Certification. Company certifies that it understands the restrictions in Sections 4.1 through 4.4 and will comply with them.

4.5.1 No Model Training. Company will not use Client Personal Information to train, fine-tune, retrain, or otherwise develop or improve any artificial intelligence or machine learning model.

AI chat responses, job-photo assessments, and follow-up drafts use Anthropic Claude through Lovable's managed AI Gateway. Lovable receives the requests as Company's managed platform and AI intermediary; the model provider is in the upstream processing chain rather than a direct API account maintained by Company. Company will require the managed provider and its AI Sub-processors not to use Client Personal Information to train, fine-tune, or improve models. This requirement is a contractual obligation of Company, not a representation that a direct Anthropic agreement exists. General provider documentation alone does not establish the gateway-specific contractual terms, retention, or processing locations; Company will provide available evidence on reasonable request under Sections 5.6 and 8 and remains subject to Sections 4.6 and 4.7 if it cannot meet this DPA.

This Section does not restrict Company's use of aggregated and de-identified information as permitted under Section 4.9 of this DPA and Section 6.5 of the Agreement, provided such information is not Personal Information and Company does not attempt to re-identify it.

4.6 Notification of Inability to Comply. Company will notify Client promptly, and in no event later than five (5) Business Days after determination, if Company determines that it can no longer meet its obligations under Applicable Privacy Laws or this DPA.

4.7 Client's Right to Remediate. Upon reasonable notice, Client may take reasonable and appropriate steps to stop and remediate unauthorized use of Client Personal Information by Company, including requiring Company to cease the Processing at issue, delete affected Client Personal Information, or provide written confirmation of remediation.

4.8 Client's Right to Monitor. Client may take reasonable and appropriate steps to confirm that Company uses Client Personal Information consistent with Client's obligations under the CCPA, as further described in Section 8.

4.9 De-identified Information. Where Company creates de-identified information as permitted under Section 6.5 of the Agreement, Company will: (a) take reasonable measures to ensure the information cannot be associated with a Consumer or household; (b) publicly commit to maintain and use it in de-identified form and not attempt to re-identify it, except as permitted by law solely to test de-identification; and (c) contractually obligate any recipient to the same requirements.

5. COMPANY'S OBLIGATIONS — MULTI-STATE PROCESSOR TERMS

The following terms are required of a Processor under the VCDPA, CPA, CTDPA, UCPA, TDPSA, and comparable laws:

5.1 Processing on Documented Instructions. Company will Process Client Personal Information only on Client's lawful documented instructions. The Agreement, this DPA, and Client's configuration of the Service constitute the initial instructions; Client may provide additional lawful written instructions, including rights-request and deletion instructions. Company will notify Client if, in Company's reasonable opinion, an instruction violates Applicable Privacy Laws, unless prohibited by law.

5.2 Duty of Confidentiality. Company ensures that each person authorized to Process Client Personal Information is subject to a duty of confidentiality with respect to that information, whether by written agreement, professional obligation, or statutory duty.

5.3 Security. Company will implement and maintain appropriate technical, administrative, and physical safeguards designed to protect the confidentiality, integrity, and availability of Client Personal Information, as further described in Section 6 and in Section 6.8 of the Agreement.

5.4 Assistance with Controller Obligations. Taking into account the nature of the Processing and the information available to Company, Company will provide reasonable assistance to Client in: (a) responding to Consumer rights requests as described in Section 7; (b) meeting Client's obligations relating to the security of Processing; (c) responding to Security Incidents; and (d) conducting any data protection assessment required of Client under Applicable Privacy Laws, insofar as it relates to the Service.

Assistance under subsections (a), (b), and (d) is provided at Client's reasonable expense where it requires materially more than the functionality already available within the Service. Assistance under subsection (c), and cooperation under Section 11.3, is provided at Company's own cost where the Security Incident arises from systems within Company's control, and Company will not invoice Client for such cooperation.

5.5 Deletion or Return. At Client's direction, Company will delete or return all Client Personal Information at the end of the provision of the Service, as further described in Section 9.

5.6 Demonstrating Compliance. Company will make available to Client, upon reasonable written request and no more than once per twelve (12) month period absent a Security Incident or a request from a regulator, information reasonably necessary to demonstrate Company's compliance with this DPA.

5.7 Assessments. Company will allow for, and reasonably cooperate with, an assessment of Company's policies and technical and organizational measures in support of its obligations under Applicable Privacy Laws, as described in Section 8. Company may satisfy this obligation by providing a report of an independent assessment where one is available.

6. SECURITY MEASURES

6.1 Company maintains the following measures, at minimum:

• Encryption of Client Personal Information in transit using TLS, and encryption at rest for stored data.
• Salted, hashed storage of authentication credentials.
• Row-level access controls enforcing logical separation of each Client's data.
• Restriction of administrative access to personnel with a legitimate operational need.
• Storage of private platform and AI-provider credentials server-side, never exposed to customer browsers. Public client configuration is not a private credential. An authenticated, authorized Client may view or manage its own integration credentials, including its webhook signing secret; those credentials are not made available to other Clients or Visitors.
• Use of managed cloud infrastructure whose providers maintain and patch the underlying systems.

6.2 Company may update these measures from time to time, provided that updates do not materially degrade the overall level of protection.

7. CONSUMER RIGHTS REQUESTS

7.1 Direction to Client. Because Client is the Business/Controller for Client Personal Information, Consumers must direct rights requests concerning that information to Client.

7.2 Forwarding. If Company receives a rights request from a Consumer relating to Client Personal Information, Company will not respond substantively except to acknowledge receipt and direct the Consumer to Client, and will forward the request to Client without undue delay.

7.3 Assistance. Company will provide Client with the functionality within the Service, or reasonable technical assistance where the Service does not provide such functionality, necessary for Client to access, correct, delete, or export Client Personal Information in response to a verified Consumer request.

8. AUDIT AND VERIFICATION

8.1 Client may verify Company's compliance with this DPA by submitting a written request for information under Section 5.6.

8.2 If the information provided is insufficient to demonstrate compliance, Client may request an assessment, subject to the following: it must be requested at least thirty (30) days in advance; conducted during normal business hours; conducted no more than once per twelve (12) month period, absent a Security Incident or regulator request; scoped to Company's Processing of Client Personal Information; conducted subject to the confidentiality obligations of the Agreement; and conducted at Client's sole expense, including reimbursement of Company's reasonable costs for time and resources expended. The frequency, notice, and cost conditions in Sections 5.6 and 8.2 will not prevent reasonable and appropriate monitoring or remediation under Sections 4.7 and 4.8, or assessments, information requests, and cooperation required by Applicable Privacy Laws.

8.3 An assessment may not include access to Company's source code, security testing against Company's production systems without written consent, or access to information relating to any other client of Company.

9. RETENTION, DELETION, AND RETURN

9.1 Company retains Client Personal Information for the periods described in Company's Privacy Policy and Section 6.6 of the Agreement.

9.2 Following termination of the Agreement, Client may export Client Personal Information during the thirty (30) day Export Window. Upon expiration of the Export Window, or earlier at Client's written direction, Company will delete Client Personal Information from its active production systems. Company will also instruct its Sub-processors, directly or through the applicable managed provider, to delete or return Client Personal Information held on Company's behalf, subject only to Section 9.3. This obligation includes related stored images, files, and identifiable logs containing Client Personal Information.

9.3 Company may retain Client Personal Information: (a) to the extent required by applicable law; (b) in encrypted backup systems until those backups cycle out in the ordinary course; (c) in de-identified or aggregated form as permitted under Section 4.9; and (d) with an AI Sub-processor only for a documented, limited retention period consistent with this DPA, after which it must be deleted under the applicable processing agreement. Unverified gateway retention does not authorize indefinite retention or remove Company's duties under Sections 4.6 and 4.7. Any information so retained remains subject to this DPA for as long as it is retained. Retained Client Personal Information will be isolated from ordinary Service use and used only for the purpose permitting retention. If a backup is restored, previously applicable deletion instructions will be reapplied. Minimal suppression records may be retained where required by applicable law to honor a recipient opt-out; those records must not be used to resume marketing or follow-up communication.

9.4 Company will provide written certification of deletion upon Client's written request.

10. SUB-PROCESSORS

10.1 General Authorization. Client provides general written authorization for Company to engage Sub-processors to Process Client Personal Information, subject to this Section.

10.2 Current Sub-processors. Company maintains a current list of Sub-processors at its Sub-processor Page, referenced in Company's Privacy Policy.

10.3 Obligations. Company will enter into a written agreement with each direct Sub-processor imposing data protection obligations no less protective than those in this DPA with respect to Client Personal Information, including the applicable Service Provider and Processor obligations in Sections 4 and 5. Where a managed provider engages an upstream Sub-processor, Company will require that provider to impose equivalent applicable obligations through its processing chain. For commercially available services, standard published terms or a data processing addendum may satisfy this requirement only to the extent they actually impose the required obligations; the existence of public documentation alone is not verification of applicable contractual coverage.

10.4 Notice and Objection. Company will update the Sub-processor Page and notify each affected Client under Section 19.4 of the Agreement before a new or replacement Sub-processor, whether engaged directly or through a managed provider, begins Processing that Client's Client Personal Information, allowing at least fifteen (15) calendar days' advance notice and the full ten (10) Business Day objection period. Client may reasonably object on data protection grounds within ten (10) Business Days after notice. The Parties will discuss a timely objection in good faith, and Company will not permit the new Sub-processor to Process the objecting Client's Client Personal Information while the objection remains unresolved. If no resolution is reached, Client may terminate by written notice with immediate effect, notwithstanding Section 5.2 of the Agreement, and Company will refund the unused portion of prepaid fees for the terminated period. Where a change must be made on shorter notice to address a security vulnerability, service outage, or legal requirement, Company will give notice as far in advance as reasonably practicable. Shorter notice does not shorten the ten (10) Business Day objection period or remove the same termination and refund rights; Company will suspend the affected Processing for an objecting Client if necessary while the objection is unresolved, except to the extent Processing is required by law.

10.4.1 Managed Platform Providers. Company may use managed providers that engage upstream Sub-processors. Company will require those providers to maintain equivalent applicable data protection obligations through the processing chain and to provide information and advance notice sufficient for Company to meet Section 10.4. Managed-provider status does not exempt relevant upstream changes from Section 10.4 or reduce Company's obligations under Sections 10.3 and 10.5. The Sub-processor Page distinguishes direct providers from upstream providers and does not represent that Company has a direct Anthropic API agreement.

10.5 Liability. Company remains liable to Client for the acts and omissions of its Sub-processors in Processing Client Personal Information to the same extent Company would be liable if performing the services directly, subject to the limitations of liability in Section 13 of the Agreement.

11. SECURITY INCIDENTS

11.1 Company will notify Client of a Security Incident affecting Client Personal Information without undue delay after Company confirms the incident, and in no event later than seventy-two (72) hours after such confirmation.

11.2 Such notice will include, to the extent then known and as it becomes available: the nature of the incident, the categories and approximate volume of Client Personal Information affected, the likely consequences, and the measures taken or proposed to address it.

11.3 Company will take reasonable steps to mitigate the effects of a Security Incident and will reasonably cooperate with Client in Client's investigation and in meeting Client's own notification obligations under Applicable Privacy Laws.

11.4 Company's notification of a Security Incident is not an acknowledgment of fault or liability.

11.5 Client is solely responsible for determining whether the incident triggers a notification obligation to Consumers or regulators under Applicable Privacy Laws and for making any such notification, except where Company is independently required to notify.

12. GENERAL

12.1 Limitation of Liability. Each Party's liability arising out of or related to this DPA is subject to the limitations and exclusions in Section 13 of the Agreement. Any claims brought under this DPA count toward, and do not increase, the aggregate cap in Section 13.2 of the Agreement. The incorporated third-party exclusions do not remove Company's responsibility under Section 10.5; the applicable caps and carve-outs remain unchanged.

For the avoidance of doubt: claims arising out of or relating to this DPA, to a Security Incident, or to Company's Processing of Client Personal Information are subject to the aggregate cap in Section 13.2 of the Agreement, and are not claims for breach of Section 11 (Confidentiality) of the Agreement for purposes of Section 13.4(c) or the super-cap in Section 13.5 of the Agreement, regardless of whether the Client Personal Information at issue also constitutes Client's Confidential Information. A Party may not recharacterize a claim under this DPA as a confidentiality claim to avoid the cap in Section 13.2.

12.2 Term. This DPA takes effect on the Effective Date of the Agreement and continues until Company has deleted or returned all Client Personal Information in accordance with Section 9.

12.3 Changes in Law. If a change in Applicable Privacy Laws requires modification of this DPA, the Parties will negotiate in good faith to amend it as necessary to comply.

12.4 Conflict. In the event of a conflict between this DPA and the body of the Agreement or the Privacy Policy with respect to the Processing of Client Personal Information, this DPA controls.

12.5 Governing Law. This DPA is governed by the law and dispute resolution provisions set out in Sections 17 and 18 of the Agreement.

12.6 Incorporation. This DPA is incorporated into and forms an integral part of the Agreement. Acceptance of the Agreement constitutes acceptance of this DPA. Future material contractual changes are subject to the notice and effective-date requirements in Section 19.10 of the Agreement.