Data Processing Addendum

This addendum is part of the Terms of Service (xtimates.com/legal/terms) between Dycern LLC, an Indiana limited liability company doing business as Xtimates ("Xtimates", "we", "us"), and the company that uses our service ("you"). It covers the personal information of the people who ask you for a price (your "customer data") that your systems send us and that we handle for you. For that data, you're the controller (under the CCPA, the "business") and we're the processor (the "service provider"). You decide what happens to it. We handle it on your behalf and on your instructions.

Your own account information (your name, email, billing details) is covered by the Privacy Policy (xtimates.com/legal/privacy), not by this addendum, because there we're the controller.

We process your customer data only on your documented instructions. These terms, your settings in the dashboard, and what you ask us to do in writing are your instructions. We'll tell you if we think an instruction breaks the law. We won't sell your customer data, share it with another client, use it for our own marketing, or combine it with data from other clients, except to produce numbers that can't identify anyone.

• Only the people on our team who need it to run your account can see it, and each of them is bound to keep it confidential.
• We protect it with the measures in the Security (xtimates.com/legal/security) page and the section below.
• If a homeowner asks you to see, correct or delete their information, we help you answer within the time the law gives you. If they ask us directly, we pass the request to you and act on your instruction.
• We help you with any data-protection assessment or regulator question that concerns our processing, as far as we reasonably can.
• We keep a record of the processing we do for you and make it available on request.
• We don't transfer it outside the United States without telling you first.
• We meet the service-provider requirements of the CCPA and CPRA, and we'll tell you if we can no longer meet them.

We use these providers to run the platform. Each one is under a written contract that limits what it can do with your customer data:

Before we add a sub-processor that will handle your customer data, we'll email you at least 30 days ahead. If you have a good reason to object, tell us in writing within that time and we'll work with you on a fix. If we can't find one, you can cancel without any early-termination cost. We stay responsible for every sub-processor's work.

• Everything between your browser, our servers and our providers travels over HTTPS (TLS).
• Access tokens for connected accounts are encrypted at rest with AES-256-GCM. The database is encrypted at rest by the provider.
• Row-level security at the database, so each client can only reach its own rows, even if the application has a bug.
• Role-based access in the dashboard (owner, admin, member) and limited, logged staff access.
• Stripe holds all card and bank data. It never reaches our servers.
• Secrets live in the host's environment settings, never in code or in the browser.
• Backups taken by the hosting provider, encrypted, in the United States.
• Changes to an estimate's stage or source are recorded with who made them and when.

If we confirm that your customer data was accessed, changed or lost without permission, we'll tell you within 72 hours of confirming it. The notice says what happened, what data and roughly how many people are affected, what we've done, and what we suggest you do. We'll keep you updated as we learn more and help you with any notices the law requires you to send. Telling you about a breach isn't an admission that we're at fault.

Once a year, on written request, we'll answer a reasonable security questionnaire and provide the documents we have that show how we meet this addendum, including our providers' own certifications and reports. If that isn't enough to meet a legal requirement, you can have an independent auditor you choose, bound to confidentiality, review the relevant parts of our processing, during business hours, with 30 days' notice, at your cost. We don't hold a SOC 2 report today.

You can export your estimate records as a CSV at any time while you're a client and during the 30-day read-only period after. When that period ends, or sooner if you ask, we delete your customer data from our live database within 30 days and from provider backups within 90 days. We keep only what the law requires us to keep, as the Data Deletion (xtimates.com/legal/data-deletion) page describes, and we confirm in writing when it's done.

The limits on what we owe each other in the Terms of Service (xtimates.com/legal/terms) apply to this addendum too. If this addendum and the Terms of Service disagree about your customer data, this addendum wins. This addendum is governed by the laws of the State of Indiana.

Dycern LLC, doing business as Xtimates, Indiana. Questions about this addendum: privacy@xtimates.com. To sign a copy, email legal@xtimates.com.