Data Processing Agreement

• You decide why and how Customer Data is processed. We process it only on your documented instructions: the Terms, this DPA and your settings and actions in the Service.
• Nature and purpose: storing, organizing, displaying and transmitting Customer Data so you can manage leads and clients, publish pages, send emails and newsletters, place and receive calls and texts, use the AI assistant and take bookings.
• Duration: for the term of your subscription, and afterwards only for the export and deletion period in section 10.
• We will tell you if we believe an instruction violates the law.
• You are responsible for having a lawful basis and the consents required to collect Customer Data and to contact the people in it.

Data subjects: your leads, clients and other contacts, people who visit your pages or call your number, and your own team members.

Types of data, depending on the features you use:

• identity and contact details: name, email, phone number, address;
• real estate preferences you record, such as budget, property type, timeline and financing information (for example pre-approval amounts);
• communications: emails, newsletters, text messages, call logs, call recordings, voicemails, and AI-assistant transcripts and summaries;
• notes, tasks, pipeline stages, bookings and appointment details;
• consent records (email, text, call, AI-call and recording consent, including opt-outs);
• form and website data: page submissions, the ad or link a lead came from (for example UTM parameters or Meta click IDs), IP address and device information;
• team members' account details and activity in the Service.

We act as your "service provider" or "processor" under the California Consumer Privacy Act as amended by the CPRA, the Florida Digital Bill of Rights, and the consumer privacy laws of Virginia, Colorado, Connecticut, Texas, Oregon, Montana and other US states with similar laws (together, "State Privacy Laws"), to the extent they apply. We will:

• not sell or share Customer Data, including for cross-context behavioral advertising;
• not retain, use or disclose Customer Data for any purpose other than providing the Service under the Terms, or outside our direct business relationship with you;
• not combine Customer Data with personal information from other sources, except as State Privacy Laws allow;
• keep everyone who processes Customer Data bound by a duty of confidentiality;
• comply with the obligations that State Privacy Laws place on service providers and processors, and give Customer Data the same level of protection they require;
• notify you if we can no longer meet these obligations, and allow you to take reasonable steps to stop and remedy unauthorized use.

We certify that we understand and will comply with these restrictions.

• Only authorized people who need access to provide or support the Service can access Customer Data, and they are bound to confidentiality.
• Measures include: separation of every account's data (row-level security); encryption in transit (TLS); encryption of Customer Data at rest in our database and file storage; additional encryption of stored connection keys; two-factor authentication; logging of support access; and regular backups.
• We access an account's data for support only when you ask us to or when needed to keep the Service running; support visits are logged and visible to the account owner.

• You authorize these sub-processors: Supabase (database, storage, authentication), Vercel (hosting), Resend (email delivery), Stripe (payments), and, when you connect them, Google or Cal.com (calendar), Google Ads and Meta (lead ads). Twilio and ElevenLabs are used with your own accounts under your agreements with them.
• Each sub-processor we engage is bound by a written contract with data-protection obligations at least as protective as this DPA, as far as they apply to the service it provides. We remain responsible to you for their performance.
• We will notify you in the Service before adding or replacing a sub-processor. You may object for legitimate reasons and cancel if we cannot resolve the objection.

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a breach affecting Customer Data. We will give you the information you reasonably need to meet your own notification obligations and take reasonable steps to contain it.

• We will help you, taking into account the nature of the processing, to respond to requests from individuals (access, correction, deletion, portability, opt-out) and to meet your security, breach-notification and data-protection-assessment obligations. Most requests can be handled directly in the Service.
• On your reasonable request, we will make available the information necessary to demonstrate our compliance with this DPA and State Privacy Laws.
• We will allow and cooperate with reasonable assessments by you or an independent assessor you appoint, at most once a year (or after a security incident), with at least 30 days' notice, during business hours and under confidentiality. Instead of an on-site assessment, we may provide a recent independent report or our sub-processors' security certifications (for example SOC 2) if they reasonably answer your questions.

We may create de-identified or aggregated data from Customer Data (for example how many emails are sent across all accounts) only to operate, secure and improve the Service. We will take reasonable measures so it can't be linked to a person or a customer, publicly commit not to re-identify it, and require anyone we share it with to do the same. We never sell it, and we do not use Customer Data to train third-party AI models.

• Do not store sensitive personal information in the Service beyond what your business needs, and never Social Security numbers, driver's license or passport numbers, full bank or card numbers, or health information. Financial details you record (such as budgets or pre-approval amounts) are treated as confidential and used only to provide the Service.
• The Service is not directed at children, and we do not knowingly process personal information of children under 13 (or under 16 where State Privacy Laws require). Do not enter children's data into the Service.
• You are responsible for complying with the Telephone Consumer Protection Act (TCPA), the Florida Telephone Solicitation Act, Do-Not-Call rules and the CAN-SPAM Act for the calls, texts and emails you send through the Service. The Service's safeguards (consent checks, calling hours, call limits, unsubscribe links) support but do not replace your compliance.

When your account ends, you may request an export within 30 days. Afterwards we delete Customer Data, except where the law requires us to keep it; backups are overwritten on their normal schedule (within 30 days).

Customer Data is stored and processed in the United States.