# OwnersPal Data Processing Addendum

**Effective Date:** 17 September 2026 · **Last updated:** 26 October 2026

**Version:** 1.1

## Changelog

Version 1.1 adds disclosures and, in Sections 2.3, 3.2, 3.4 and 8.1, describes how third-party applications Customer authorises are handled; there is nothing to accept again.

**v1.1 — 17 September 2026.** What changed since v1.0 (14 July 2026):

- **Annex 1** — a processing record for advertising conversion measurement: what is sent to Meta and Google for Customer's own ad accounts (an ad click identifier plus a SHA-256 hash of the email address or phone number given with a booking, never the address or number itself), the once-a-day frequency, the 30-day eligibility window (7 days for Meta) and the marketing-consent condition. (PR #2284, 13 September 2026.)
- **Section 2.8** — a pointer stating that the processing carried out to measure ad conversions for Customer's own ad accounts is described in Annex 1. (PR #2284, 13 September 2026.)
- **Section 2.7** — opt-in diagnostic screenshots attached to problem reports, which may incidentally contain personal data visible on screen, with their retention limit and deletion path. (PR #2040, 19 August 2026.)
- **Section 10.4** — the deletion report shown when Customer deletes its account itself, and the summary emailed to the account's address. (PR for the account deletion report, 27 September 2026.)
- **Section 2.5** — the categories of personal data now name the sale value Customer can record for a lead who became its customer. (PR for the lead value page, 27 September 2026.)
- **Sections 10.3 and 10.5** — how long OwnersPal keeps the account-deletion record (3 years), and copies of deleted personal data in database backups (up to 7 days) and in hosting and error-tracking logs (up to 90 days). (PR for the deletion retention periods, 2 October 2026.)
- **Section 2.3** — the nature and purpose of processing now names keeping records of the recommendations the Service makes to Customer, Customer's decision on each and the aggregate results afterwards (counts and totals, kept for up to 36 months). (PR for the decision records, 2 October 2026.)
- **Sections 2.3, 3.2, 3.4 and 8.1** — third-party applications, such as an AI assistant, that Customer authorises through Settings → AI assistants. These sections add how those authorisations work: disclosure to such applications is added to the purposes of processing (2.3); Customer's authorisations and the permissions it selects form part of Customer's documented instructions (3.2); such applications act for Customer, not as subprocessors of VIVE AI, Inc., and any onward transfer, including outside the EEA, UK, or Switzerland, takes place under Customer's own arrangement with the application's provider (3.4); and OwnersPal's transfer commitments in Section 8.1 are subject to Section 3.4. (PR for connected AI assistants, 2 October 2026.)
- **Section 10.4** — a deletion Customer starts that cannot finish at that moment: OwnersPal records the request, finishes the deletion afterwards and emails the report when it is finished. (PR for finishing interrupted account deletions, 5 October 2026.)
- **Section 2.5** — the categories of personal data now name the setup progress of Customer's website, business email and Google listing, including its domain's DNS and email providers and the DNS records read from public DNS. (PR for guided setup, 16 October 2026.)
- **Section 2.5** — for Customer's business email setup, the categories of personal data now also name the email provider Customer chose, its domain's mail servers (MX records) read from public DNS and the public DNS values Customer copies from its email provider (the domain verification code, the DKIM public key, and Microsoft's mail server name and DKIM host names), never passwords; and the address at Customer's own domain to which Customer asks OwnersPal to send a test email, used only to send that email: the setup progress keeps only when the last test email was sent and whether Customer confirmed it arrived. (PR for the guided setup email step, 18 October 2026.)
- **Section 10.6** — an account whose sign-up was never finished (its user never confirmed being 18 or older and authorised to manage the business's marketing, and never accepted the Terms of Service, the Privacy Policy and this DPA) is deleted 30 days after it was created, or after the day OwnersPal started asking for an older account, after one email 7 days before; an account with an active or trial paid plan is not deleted this way. (PR for the consent screen, 20 October 2026.)
- **Section 2.5** — for Customer's Google listing setup, the categories of personal data now also name the listing's Google Place ID, with whether the listing shows Customer's website and when that was last compared; the Google Place ID of a search result that turned out not to be Customer's listing, with when that was found, so that OwnersPal does not look it up again for 29 days; whether Customer already had a Google listing or needed one; how Customer is verifying the listing with Google; and when Customer told OwnersPal that it had asked Google for a postcard. These Google Place IDs are the only items OwnersPal keeps from what Google returns when it checks the listing. (PR for the guided setup Google listing step, 23 October 2026.)
- **Section 2.5** — if Customer connects its own Google Search Console during setup, the categories of personal data now also name the access tokens Google issues for it, Customer's website address as registered with Google, the verification code Google issues for that address (which Customer's website shows in its page code) and Customer's permission level for it; OwnersPal uses them only to verify the website, add it to Customer's Search Console, submit its sitemap and check that Customer is still its owner, in line with the Google API Services User Data Policy, including its Limited Use requirements; reads none of Customer's Search Console search data; and deletes them when Customer disconnects Search Console, within 7 days (or 9 days if Google could not be reached for more than a day) when the connection ends in another way, and with Customer's account. (PR for the guided setup Search Console step, 25 October 2026.)
- **Sections 2.3, 2.4 and 2.5** — the optional phone assistant: answering Customer's inbound phone calls is added to the nature and purpose of processing (2.3), the people who call Customer's phone assistant number to the categories of data subjects (2.4), and the caller's phone number, the time, length and outcome of each call, call transcripts and summaries, and booking details and messages given by phone to the categories of personal data (2.5). These sections also name the subprocessors that handle the calls (Twilio, ElevenLabs and Google's Gemini, reached through ElevenLabs) and state the disclosure every caller the assistant answers hears first (and, if the assistant picks up but the Service cannot confirm the call, the same disclosure without the business's name, after which the assistant says the line isn't available and ends the call; on such a call Google's Gemini, reached through ElevenLabs, may read anything the caller says before the call ends, and VIVE AI, Inc. keeps no transcript), that calls made while the phone assistant is off or cannot answer are handled by Twilio alone, with no AI, that Twilio keeps Customer's transfer number in the settings of Customer's phone assistant number and that VIVE AI, Inc. asks Twilio to remove it when Customer changes or clears it or deletes its account, and keeps asking until it is removed, that no call audio is recorded, what is removed from transcripts and summaries and the limits of that detection, that the call history is deleted automatically after 90 days and when it is deleted sooner, that bookings and messages are kept like any other, that health details callers may mention (such as an allergy) are an exception to the clause on special categories of personal data, and that VIVE AI, Inc. asks ElevenLabs (which keeps a conversation for no more than 30 days) and Twilio to delete their copies of each call once it ends: normally right after the call, and within two days if VIVE AI, Inc. does not receive the call's end notice. For a call made while the Service was down, VIVE AI, Inc. asks within about an hour of the Service coming back; the log of a call made more than three days before then stays with Twilio under its own retention. (PR for the phone assistant, 24 October 2026.)
- **Section 2.5** — for Customer's social media profiles setup (Facebook, Instagram and Threads), the categories of personal data now also name the social platforms Customer chose, the @name Customer picked for them, the @name from the link to each profile Customer already has, the profile text VIVE AI, Inc. drafted for Customer or that Customer edited or approved, how it was drafted, when Customer asked for drafts, and what Customer told OwnersPal it has done (the checks Customer made on its own public pages and the account-safety steps Customer ticked), never passwords, two-factor codes or recovery codes. (PR for the guided setup Social profiles step, 25 October 2026.)
- **Section 2.5** — for Customer's social media profiles setup, the profile text kept is now described as the text VIVE AI, Inc. drafted for Customer or that Customer edited or approved (not only the text Customer approved), together with how it was drafted and when Customer asked for drafts. (PR for the guided setup social profile text, 26 October 2026.)
- **Section 2.5** — for Customer's social media profiles setup, the categories of personal data now also name, for a Facebook Page or Instagram account Customer has connected, the result of checking that profile (which items matched what was set up, never the profile's contents); VIVE AI, Inc. deletes these results when Customer disconnects that platform, when Meta asks VIVE AI, Inc. to delete its data, and with Customer's account. (PR for the guided setup social profile check, 26 October 2026.)
- **Sections 2.3 and 2.5** — the phone assistant: the disclosure every caller the assistant answers hears first now says that they have reached an AI assistant and that the call may be recorded and shared with our service providers, and 2.3 quotes both opening sentences in that wording; the record of each call's length kept for billing now also notes, for a call the phone assistant answers, which version of the disclosure was used, the call's language and whether the disclosure was heard; and if a caller asks the phone assistant not to keep a record of the call, VIVE AI, Inc. stores no transcript or summary of it (2.5). (PR for the AI assistant disclosure, 25 October 2026.)
- **Section 2.3** — the phone assistant: whenever Twilio rings Customer's transfer number (other than for a call made while the Service cannot be reached), whoever picks up must press 1 to take the call, and the call to Customer's transfer number is not recorded and no AI hears it; and a call that came in while the phone assistant was already on as many calls as Customer allows at once, and that no one at the transfer number takes, is answered by the phone assistant only to take a message and is processed and kept like any other call it answers. (PR for call screening and the message fallback, 25 October 2026.)
- **Section 2.5** — automatic DNS setup (Domain Connect): where Customer's domain is with a DNS provider for which VIVE AI, Inc. has switched it on (only after that provider accepts OwnersPal's record templates), the Service sends Customer's domain name to that provider's public Domain Connect service to ask whether it can add Customer's website or email setup records and, if Customer chooses automatic setup, directs Customer's browser to that provider's own approval page with a signed link naming the DNS records to add; the provider makes the changes only if Customer approves them there and acts for Customer, not as a subprocessor of VIVE AI, Inc.; and nothing from its responses is stored. (PR for guided setup one-click DNS, 26 October 2026.)
- **Unchanged in v1.1:** the sections covering privacy requests from visitors to Customer's website, which already commit OwnersPal to assisting with them.

**v1.0 — 14 July 2026.** The first version recorded against a server-side record of acceptance.

This Data Processing Addendum (**"DPA"**) forms part of the agreement between **VIVE AI, Inc.** ("**OwnersPal**", "Processor") and the customer identified in the related OwnersPal subscription account ("**Customer**", "Controller") for the use of the OwnersPal service (the "**Service**"). It governs the processing of personal data carried out by OwnersPal on Customer's behalf in connection with the Service.

By using the Service, Customer accepts the terms of this DPA. Customer may also counter-sign and return a copy to `privacy@ownerspal.app` if their internal policies require a fully-executed instrument.

---

## 1. Scope and Roles

1.1 In the course of providing the Service, OwnersPal will process certain personal data on Customer's behalf. Customer is the **controller** of that personal data; OwnersPal is the **processor**.

1.2 This DPA applies only to processing of personal data subject to the European Union General Data Protection Regulation 2016/679 ("**GDPR**"), the United Kingdom Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("**CCPA/CPRA**"), and other comparable data protection laws to the extent they apply to Customer's use of the Service.

1.3 This DPA does **not** apply to personal data that OwnersPal processes as a controller in its own right — including Customer's billing contact, account login, and product analytics relating to Customer's use of the Service. Those activities are described in OwnersPal's published Privacy Policy.

## 2. Subject Matter, Duration, Nature and Purpose

2.1 **Subject matter:** Personal data submitted to or generated within the Service by Customer or by Customer's end users.

2.2 **Duration:** For the term of the underlying subscription agreement, plus any post-termination retention required to fulfil deletion / export obligations under Section 10.

2.3 **Nature and purpose:** Provision of the Service — including content generation, ad-campaign management, review monitoring and replies, lead capture, listing sync, analytics, disclosure of Service data and derived statistics to third-party applications Customer authorises (Section 3.4), and any auxiliary processing strictly necessary to deliver those features — and keeping records of the recommendations the Service makes to Customer, Customer's decision on each and the aggregate results afterwards. These records hold counts and totals, no names, email addresses, phone numbers or review text of Customer's customers, are kept for up to 36 months, and are deleted with Customer's account. If Customer turns on the optional phone assistant, VIVE AI, Inc. also answers inbound phone calls to Customer's phone assistant number on Customer's behalf. Before anything else, every caller the assistant answers hears, in English, that they have reached an AI assistant and that the call may be recorded and shared with our service providers. Normally they hear: "Hi, you've reached the AI assistant for [Customer's business name]. This call may be recorded and shared with our service providers." If the assistant picks up but the Service cannot confirm the call, it says "Hi, you've reached an AI assistant. This call may be recorded and shared with our service providers.", tells the caller the line isn't available and ends the call. Google's Gemini language model, reached through ElevenLabs, may read anything the caller says before the call ends, and VIVE AI, Inc. keeps no transcript of such a call. Any words Customer adds to the greeting are spoken after this disclosure; Customer cannot change or remove it. Call audio is not recorded. Twilio carries the call, ElevenLabs processes the caller's voice live, and Google's Gemini language model, reached through ElevenLabs, writes the replies (all three are listed on the Subprocessors Page). When the assistant transfers a call, Twilio connects it only to Customer's transfer number. Calls to Customer's phone assistant number while the phone assistant is off or cannot answer are handled by Twilio alone: Twilio connects the caller to Customer's transfer number if Customer has set one, and otherwise, or if no one answers, plays a fixed voice message saying the line is unavailable. No AI listens to these calls, and neither ElevenLabs nor Google's Gemini receives them. Twilio also keeps Customer's transfer number in the settings of Customer's phone assistant number so that it can still connect calls when the Service cannot be reached; VIVE AI, Inc. asks Twilio to remove it from there when Customer changes or clears it or deletes its account, and keeps retrying until it is removed (until then, a call made while the Service cannot be reached may still be connected to the old number). Whenever Twilio rings Customer's transfer number for a call the phone assistant does not answer or for a call it transfers (other than a call made while the Service cannot be reached), whoever picks up first hears a fixed voice message from Twilio naming Customer's business and asking them to press 1 to answer, and the caller is connected only once they press 1, within about 8 seconds; if no one picks up or no one presses 1, the call is treated as not answered (so a voicemail on that number does not pick it up), and the caller hears the fixed voice message saying the line is unavailable. The call to Customer's transfer number is not recorded, and no AI hears it. One exception: if a call came in while the phone assistant was already on as many calls as Customer allows at once and no one at Customer's transfer number takes it, the phone assistant answers it only to take a message. The caller first hears the opening disclosure and then that everyone is busy and that the assistant can take a message; the assistant can answer questions from Customer's published information and take a message, but cannot book or transfer, and the call lasts at most about 3 minutes. Such a call is processed and kept like any other call the phone assistant answers, as described in this Section 2, and does not count toward Customer's limit of calls at once; if not enough minutes are left, or the assistant cannot be reached for it, the caller hears the fixed voice message saying the line is unavailable, and Customer's transfer number is not rung a second time. The phone assistant takes no payments or orders, sends no text messages and makes no outbound calls of its own; it only connects a caller to Customer's transfer number.

2.4 **Categories of data subjects:** Customer's customers and prospects (people who leave reviews, fill in lead-capture forms, interact with Customer's ads, etc.) and Customer's own personnel who use the Service and, if Customer has a phone assistant number, the people who call it.

2.5 **Categories of personal data:** Names, email addresses, phone numbers, postal addresses, lead-form free text, the sale value Customer records for a lead who became its customer, public review content, public business listing metadata, the setup progress of Customer's website, business email, Google listing and social media profiles (including its domain's DNS and email providers; the DNS records read from public DNS, among them the mail servers, or MX records, its domain uses; the email provider Customer chose; the values Customer copies from its email provider and pastes into the Service — the domain verification code, the DKIM public key, and Microsoft's mail server name and DKIM host names — which are public DNS values and never passwords; and, for Customer's Google listing, the listing's Google Place ID, whether the listing shows Customer's website and when that was last compared, the Google Place ID of a search result that turned out not to be Customer's listing and when that was found (so that OwnersPal does not look it up again for 29 days), whether Customer already had a Google listing or needed one, how Customer is verifying the listing with Google (postcard, phone, email, video or instant) and when Customer told OwnersPal that it had asked Google for a postcard; these Google Place IDs are the only items OwnersPal keeps from what Google returns when it checks the listing; and, for Customer's social media profiles (Facebook, Instagram and Threads), the social platforms Customer chose, the @name Customer picked for them, the @name from the link to each profile Customer already has, the profile text VIVE AI, Inc. drafted for Customer or that Customer edited or approved, how it was drafted, when Customer asked for drafts, and what Customer told OwnersPal it has done (the checks Customer made on its own public pages and the account-safety steps Customer ticked), never passwords, two-factor codes or recovery codes; and, for a Facebook Page or Instagram account Customer has connected, the result of checking that profile (which items matched what was set up, never the profile's contents), which VIVE AI, Inc. deletes when Customer disconnects that platform, when Meta asks VIVE AI, Inc. to delete its data, and with Customer's account), the address at Customer's own domain to which Customer asks OwnersPal to send a test email (used only to send that email; the setup progress keeps only when the last test email was sent and whether Customer confirmed it arrived), ad-campaign identifiers and ad-platform access tokens granted by Customer and, for the phone assistant, the phone number of a caller (unless withheld) and the time, length and outcome of each call, a written transcript and summary of each call the phone assistant answers (other than one the Service could not confirm), the booking details and the caller's spoken agreement to Customer's booking terms for a booking taken by phone, and messages left by phone. For a call the phone assistant does not answer, or one the Service could not confirm, VIVE AI, Inc. keeps at most the caller's phone number and the time, length and outcome of the call. Before a transcript or summary is stored, VIVE AI, Inc. automatically removes card, bank and government ID numbers and medical terms that it detects; detection can miss some, and medical terms are detected in English only. This call history (the caller's phone number, the time, length and outcome of the call, and any transcript and summary) is deleted automatically after 90 days, and sooner when Customer deletes the call, turns the phone assistant off or deletes its account. A booking or message taken on a call is delivered to Customer as an ordinary booking or inbox message, is Customer's data and is kept and deleted like any other booking or message; it reaches Customer as the caller gave it, with only the card numbers that VIVE AI, Inc. detects removed, so that Customer can act on details such as an allergy, and VIVE AI, Inc. uses such details only to handle the call and to give Customer its call history and the caller's booking or message. ElevenLabs processes the conversation before anything is removed from it. VIVE AI, Inc. asks ElevenLabs and Twilio to delete their copies of each call once it ends: normally right after the call, and within two days if VIVE AI, Inc. does not receive the call's end notice. For a call made while the Service was down, VIVE AI, Inc. asks within about an hour of the Service coming back; the log of a call made more than three days before then stays with Twilio under its own retention. If that notice never reaches VIVE AI, Inc. and VIVE AI, Inc. also could not link the call to its ElevenLabs conversation when it started, VIVE AI, Inc. cannot tell ElevenLabs which conversation to delete, so only ElevenLabs' own 30-day limit removes it. ElevenLabs in any case keeps a conversation for no more than 30 days after the call. When Customer deletes its account, VIVE AI, Inc. asks Twilio again for the calls still in Customer's call history; Twilio may keep records that the law requires it to keep. A record of each call's length, which holds no caller data, is kept for billing and deleted with Customer's account. For a call the phone assistant answers, other than one the Service could not confirm, that record also notes which version of the opening disclosure was used, the call's language and whether the disclosure was heard, which VIVE AI, Inc. checks against the call's transcript before anything is removed from it; the record of any other call notes no version and does not mark the disclosure as heard. If a caller asks the phone assistant not to keep a record of the call, the assistant is instructed to tell the caller it won't be kept and to note the request, and VIVE AI, Inc. then stores no transcript or summary of the call; it still keeps the caller's phone number and the time, length and outcome of the call in the call history, any booking or message taken on the call and the call's billing record are kept as usual, and VIVE AI, Inc. asks ElevenLabs and Twilio to delete their copies as for every call. If Customer connects its own Google Search Console during setup, the categories of personal data also include the access tokens Google issues for it, Customer's website address as registered with Google, the verification code Google issues for that address (which Customer's website shows in its page code so that Google can confirm Customer owns it) and Customer's permission level for the website in Search Console. OwnersPal uses these only to verify Customer's website with Google, add it to Customer's Search Console, submit its sitemap and check that Customer is still listed as its owner, in line with the Google API Services User Data Policy, including its Limited Use requirements: it uses them for nothing else, does not transfer them except as needed to provide this, and does not sell them. OwnersPal reads none of Customer's Search Console search data, and deletes these items when Customer disconnects Search Console, within 7 days (or 9 days if Google could not be reached for more than a day) when the connection ends in another way, and with Customer's account. If Customer's domain is with a DNS provider for which VIVE AI, Inc. has switched on automatic setup through the Domain Connect standard (which it does for a provider only after that provider accepts OwnersPal's record templates), the Service, while Customer's website or email setup still has DNS records to add, reads the domain's public `_domainconnect` DNS record and sends Customer's domain name, and no other personal data, to that provider's public Domain Connect service to ask whether it can add those records. If Customer chooses automatic setup, the Service directs Customer's browser to that provider's own approval page with a link, signed by VIVE AI, Inc., that names the domain, the DNS records to add (the same public DNS records the setup step shows Customer to copy by hand) and the OwnersPal page to return to; the provider makes the changes only if Customer approves them there. That provider acts for Customer and is not a subprocessor of VIVE AI, Inc.; OwnersPal never receives Customer's login at that provider and stores nothing from the `_domainconnect` record or from the provider's responses. OwnersPal does not require Customer to submit special categories of personal data and, apart from health details that callers to Customer's phone assistant may mention (such as an allergy), handled as described above, Customer must not submit such categories without prior written agreement.

2.6 **Aggregate site statistics (not personal data):** The Service also produces aggregate usage statistics for Customer's published website — daily counters of page views and button taps together with a coarse traffic source (a referring domain or "direct"). These counters use no cookies and no device identifiers, retain no IP addresses, and are not linkable to any natural person; they are therefore not personal data within the meaning of this DPA. The counters are retained for 13 rolling months and then deleted.

2.7 **Opt-in diagnostic screenshots:** When reporting a problem with the Service, Customer's user may expressly opt in — via a consent prompt shown before any capture occurs — to attach a screenshot of the page they were viewing. Such a screenshot may incidentally contain personal data visible on screen (for example a customer name in a review or lead record). Screenshots are stored in access-controlled storage, are used solely to diagnose the reported problem, are deleted automatically after at most 90 days (uploads never attached to a report are removed within roughly 24 hours), and are deleted when the associated account is deleted. Declining the prompt attaches nothing.

2.8 **Advertising conversion measurement:** The processing OwnersPal carries out to measure ad conversions for Customer's own ad accounts is described in Annex 1.

## 3. Customer Instructions

3.1 OwnersPal will only process personal data on Customer's documented instructions, including with regard to transfers of personal data outside the EEA, UK, or Switzerland.

3.2 The Service configuration set by Customer through the OwnersPal dashboard, including platform connections, audience definitions, post-approval rules, authorisations Customer grants to third-party applications through Settings → AI assistants (including the permissions selected on the authorisation screen), and any administrative actions Customer takes, constitute Customer's documented instructions for the purposes of GDPR Article 28(3)(a).

3.3 OwnersPal will inform Customer promptly if, in its opinion, an instruction infringes applicable data protection law, but is not obliged to give legal advice.

3.4 A third-party application that Customer authorises through Settings → AI assistants, such as an AI assistant, acts for Customer and is not a subprocessor of VIVE AI, Inc. OwnersPal does not transfer personal data to the provider of such an application on its own initiative: the application retrieves data from the Service under Customer's authorisation and only within the permissions Customer selected. Any onward transfer, including outside the EEA, UK, or Switzerland, takes place under Customer's own arrangement with that application's provider.

## 4. Subprocessors

4.1 Customer authorises OwnersPal to engage subprocessors as listed at <https://ownerspal.app/subprocessors> (the "**Subprocessors Page**"), which is the single, authoritative list and is updated whenever a new subprocessor is added.

4.2 OwnersPal will provide at least **30 days'** notice of any new subprocessor by updating the Subprocessors Page. Customer may object in writing within that period; if the parties cannot agree, Customer may terminate the affected portion of the Service for material breach.

4.3 OwnersPal remains liable to Customer for the acts and omissions of its subprocessors as if OwnersPal had performed them itself.

## 5. Security Measures

5.1 OwnersPal will implement and maintain appropriate technical and organisational measures to protect personal data, including:

- Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256 or equivalent);
- Strict access controls — production data is accessible only to a limited group of OwnersPal personnel on a least-privilege basis, with audit logging;
- Annual review of security policies and quarterly access reviews;
- Personnel under written confidentiality obligations and trained on data protection;
- Vulnerability scanning, dependency monitoring (Dependabot or equivalent), and patch management;
- Backup and disaster-recovery procedures suitable for a SaaS service of this scale.

5.2 The technical and organisational measures described above represent OwnersPal's commitments as of the Effective Date and may be updated from time to time; updates will not materially diminish the protection afforded.

## 6. Personal Data Breach

6.1 OwnersPal will notify Customer without undue delay — and in any event within **72 hours** — after becoming aware of a confirmed personal data breach affecting Customer personal data.

6.2 Notification will include, to the extent then known: the nature of the breach, categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

## 7. Data Subject Requests

7.1 Taking into account the nature of the processing, OwnersPal will provide reasonable assistance to enable Customer to respond to requests from data subjects to exercise their rights under applicable data protection law (access, rectification, erasure, restriction, portability, objection).

7.2 If OwnersPal receives a data subject request directly relating to Customer's data, OwnersPal will promptly forward it to Customer and will not respond to it on Customer's behalf unless legally required.

7.3 When a visitor to a website OwnersPal hosts for Customer uses its "Your privacy choices" form, OwnersPal delivers the request to Customer by email and in Customer's OwnersPal inbox, and does not answer it on Customer's behalf. OwnersPal keeps a record of each such request (its reference, type, optional message, a one-way fingerprint of the visitor's email address, and when it was received) for 24 months to help Customer respond and to document response times, then deletes the message and fingerprint. The visitor's name and email address stay in Customer's inbox.

## 8. International Transfers

8.1 Subject to Section 3.4, where OwnersPal transfers personal data outside the EEA, UK, or Switzerland in the course of providing the Service, OwnersPal will use a valid transfer mechanism — including, where applicable, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.

8.2 Customer hereby enters into the appropriate set of those clauses with OwnersPal in the relevant module(s) (controller-to-processor) and authorises OwnersPal to enter into them with any subprocessor on Customer's behalf.

## 9. Audit

9.1 OwnersPal will make available to Customer the information necessary to demonstrate compliance with this DPA, including by responding in writing to reasonable security and privacy questionnaires.

9.2 If a recognised industry-standard certification or third-party audit report (e.g., SOC 2, ISO 27001) becomes available, Customer's audit right under GDPR Article 28(3)(h) will be satisfied by OwnersPal providing a copy under NDA.

9.3 In the absence of such a report, Customer may, no more than once per twelve-month period and on at least 30 days' prior written notice, conduct an on-site audit during normal business hours and at Customer's expense. Customer will minimise disruption and will not be entitled to access other customers' data.

## 10. Return and Deletion of Data

10.1 Upon termination or expiry of the underlying subscription, OwnersPal will, at Customer's choice and within **45 days**:

- return all Customer personal data in a commonly used, machine-readable format; or
- delete all Customer personal data from the Service and certify deletion in writing.

10.2 OwnersPal may retain personal data to the extent and for the duration required by applicable law, in which case OwnersPal will continue to protect it in accordance with this DPA.

10.3 Where OwnersPal retains hashed or otherwise de-identified records strictly for audit, abuse-prevention, or legal-defence purposes (for example, the salted-hash record OwnersPal keeps to satisfy account-deletion audit obligations under Section 13.3 of CCPA-Cal Civ Code § 1798.130), such records do not constitute personal data of the deleted data subject. OwnersPal keeps that account-deletion record (the former account identifier and a salted hash of the email address) for 3 years after the deletion and then deletes it.

10.4 When Customer deletes its account itself in the Service's settings, OwnersPal shows Customer, at that moment, a deletion report listing by category what was deleted, where it was stored, and what OwnersPal or its subprocessors keep, why and until when, with a spreadsheet download, and emails the same summary to the email address on the account. If the deletion cannot finish at that moment, OwnersPal records the request, finishes the deletion afterwards and emails the report when it is finished; that report covers what was deleted when the deletion finished. OwnersPal keeps no copy of the report.

10.5 Copies of deleted personal data in OwnersPal's database backups are kept apart, are not used for any other purpose, and are removed as those backups expire, within 7 days of the deletion. Mentions in OwnersPal's hosting and error-tracking logs are deleted as those logs expire, within 90 days of the deletion.

10.6 Until the user of an account confirms that they are 18 or older and authorised to manage marketing for the business, and accepts the Terms of Service, the Privacy Policy and this DPA, the Service shows that account only the screen that asks for this. If that is not done, OwnersPal deletes the account and all Customer Personal Data stored in it 30 days after the account was created or, for an account created before OwnersPal started asking, 30 days after the day it started. Seven days before, OwnersPal sends one email to the address on the account with the date and a link to finish, keeps the date of that email with the account, and does not delete the account sooner than 7 days after it. An account with an active or trial paid plan, and accounts OwnersPal operates itself, are never deleted this way; OwnersPal contacts the account holder instead. Such a deletion follows Sections 10.3 to 10.5, and the deletion report goes to the email address on the account.

## 11. Term

11.1 This DPA takes effect on the Effective Date and continues for the term of the underlying subscription agreement.

11.2 Sections 6, 7, 9, 10, and any provisions which by their nature should survive, will survive termination of this DPA.

---

## Annex 1 — Processing Record: Advertising Conversion Measurement

- **Purpose:** measuring ad conversions for Customer's own Meta and Google Ads accounts, so Customer can see which of its campaigns led to a real booking.
- **Personal data:** a SHA-256 hash of the email address and phone number Customer's customer gave with the booking, computed in memory at the moment of sending and never stored or logged by OwnersPal (the email address and phone number themselves are never sent); the ad click identifier from the customer's visit (gclid for Google, fbclid for Meta); and the time the booking was made. No booking value is sent. Google receives the hashes only when Customer's Google Ads account reports that it has accepted Google's customer data terms; otherwise it receives the click identifier alone.
- **Categories of data subjects:** Customer's customers who made a booking (confirmed or completed) on Customer's OwnersPal website after clicking one of Customer's ads.
- **Recipients:** Meta Platforms (Conversions API) and Google (Google Ads offline click conversions), each receiving the data for Customer's own ad account.
- **Frequency:** once a day, by an automated job.
- **Retention:** none on OwnersPal's side for the hashed values. A booking is eligible to be sent only within 30 days of being made (7 days for Meta). OwnersPal keeps only an upload record (booking id, platform and status). Deleting the booking, including through an erasure request, removes it and its upload record, so it is never sent afterwards; disconnecting the ad account stops all uploads.
- **Condition:** the visitor accepted marketing cookies on Customer's website and their browser sent no Global Privacy Control signal. Bookings without a click identifier captured under that consent are never sent.

---

## Signatures (optional)

Customer may execute by counter-signing below and returning a scanned copy to `privacy@ownerspal.app`. OwnersPal will counter-sign and return within five business days. Use of the Service constitutes acceptance regardless of whether a wet signature is exchanged.

**For Customer (Controller):**

Name: _____________________________

Title: _____________________________

Company: _____________________________

Date: _____________________________

Signature: _____________________________

**For VIVE AI, Inc. (Processor):**

Name: Vivekananda Adepu

Title: Founder

Date: _____________________________

Signature: _____________________________