Data processing addendum

This data processing addendum ("DPA") forms part of the terms of service between Ciolkosz Intelligence LLC ("Ciolk", the "processor") and the customer that has accepted the terms (the "customer", the "controller"). It applies to the extent Ciolk processes personal data on the customer's behalf in providing Ciolk OS (the "service").

The customer determines the purposes and means of processing the personal data it uploads to the service. Under US state privacy laws the customer is the business and Ciolk its service provider; under the GDPR, the UK GDPR and similar laws the customer is the controller and Ciolk its processor. Controller and processor are used below to cover both.

Ciolk is an independent controller of the account, billing, usage and website data described in the privacy policy; that data is outside this DPA. "Personal data", "processing", "data subject" and "personal data breach" have the meanings given by the data protection law that applies to the customer. "Customer data" means the personal data the customer submits to the service.

Subject matter. The provision of Ciolk OS, including record keeping, photo-based estimating, quoting, invoicing, scheduling, evidence sealing and AI-assisted analysis.

Duration. The term of the customer's subscription, plus the retention period in section 9.

Nature and purpose. Storage, organization, retrieval, display, transmission to the customer's own clients at the customer's direction, automated analysis by machine learning models, and deletion, all for the purpose of running the customer's business through the service.

Types of personal data. Names, contact details, addresses, vehicle and property identifiers, job and appointment history, quotes, invoices and payment status, notes, photographs (which may show faces, license plates, vehicle identification numbers, property and documents), communications sent through the service, and corrections to AI output.

Categories of data subjects. The customer's clients, customers, patients (subject to section 5), prospective clients, and the customer's own staff and contractors as they appear in records.

Excluded data. The customer must not submit special categories of personal data, criminal offence data, or protected health information. Photographs of a person's mouth, teeth or body taken for a clinical purpose are protected health information for this DPA.

Ciolk will process customer data only on the customer's documented instructions: the terms of service, this DPA, the customer's configuration and use of the service, and any further written instructions the parties agree. If a law requires Ciolk to process customer data otherwise, Ciolk will inform the customer first unless the law prohibits it. Ciolk will tell the customer if it believes an instruction infringes data protection law.

Ciolk will not sell customer data, share it for cross-context behavioral advertising, retain, use or disclose it for any purpose other than providing the service, or combine it with personal data received from any other source, except as permitted for a service provider by applicable law. Ciolk will not use customer data to train machine learning models. Corrections made by the customer are used to calibrate estimates for that customer only.

Ciolk will ensure that the people it authorizes to process customer data are bound by confidentiality obligations and limited to what their role requires. Access to production data by Ciolk staff is limited to what is needed to operate, support and secure the service.

Ciolk will maintain the technical and organizational measures in section 7 and will not materially reduce the overall level of protection during the term. Taking into account the nature of the processing, Ciolk will assist the customer in responding to data subject requests, in meeting its obligations regarding security, breach notification and data protection impact assessments, and in consultations with a supervisory authority, to the extent the information is available to Ciolk and the customer cannot obtain it from the service itself. Ciolk certifies that it understands these restrictions and will comply with them.

The customer gives Ciolk general authorization to engage the following subprocessors to process customer data in providing the service:

• Vercel Inc. — application hosting, edge network and request logs. United States.
• Supabase Inc. — managed Postgres database holding customer data, encrypted at rest. United States.
• Stripe Inc. — subscription billing and processing of payments from the customer's clients. Stripe acts as an independent controller for the payment data it collects. United States.
• Anthropic PBC — analysis of photos and text submitted for estimates, findings and drafts, under commercial API terms with no training on inputs. United States.
• Clerk Inc. — authentication and session management for the customer's users. United States.
• Resend Inc. — transactional email delivery, only when email sending is enabled. United States.
• Twilio Inc. — telephony and messaging, only when the phone receptionist feature is enabled for the customer's account. United States.

Ciolk imposes data protection obligations on each subprocessor no less protective than those in this DPA and remains responsible to the customer for their performance.

Ciolk will email the account owner at least 30 days before adding or replacing a subprocessor that will process customer data. The customer may object within that period on reasonable data-protection grounds; if the objection cannot be resolved in good faith, the customer may terminate the subscription and Ciolk will refund prepaid fees for the unused period. The current list is also on the security page.

Ciolk OS is not HIPAA compliant. This DPA is not a Business Associate Agreement under the Health Insurance Portability and Accountability Act, and Ciolk does not agree to act as a business associate of the customer or of any covered entity. Ciolk has not signed business associate agreements with its subprocessors, does not offer field-level encryption of health data, and does not maintain a read-access audit log of the kind HIPAA would require.

The customer must not create, receive, maintain or transmit protected health information through the service. A covered entity or business associate may use the service only for operations that do not involve protected health information, for example scheduling by name and contact detail alone, quoting non-clinical work, or managing staff and suppliers, and must keep clinical records in a system designed and contracted for them.

If Ciolk becomes aware that protected health information has been submitted, it may delete the affected data and suspend the account, and will notify the customer. The customer is responsible for any consequence of submitting such information. Ciolk's compliance status and the work that would precede any HIPAA offering are published on the security page; nothing there or in product copy is an offer to enter a Business Associate Agreement.

The customer can meet most requests directly: records can be viewed, corrected and deleted in the product, and quotes, invoices, jobs and clients exported as CSV. Where a request cannot be met with those tools, the customer may email Ciolk, which will assist within 10 business days.

If a data subject contacts Ciolk directly about customer data, Ciolk will acknowledge receipt, direct the person to the customer, and forward the request to the customer without undue delay, unless the law requires otherwise.

Ciolk maintains the following technical and organizational measures for customer data:

• Encryption in transit. All connections between users and the service, and between the service and its subprocessors, use TLS. HTTP Strict Transport Security is enforced.
• Encryption at rest. Customer data stored in the database is encrypted at rest by the database provider using AES-256.
• Tenant isolation. Every query that touches customer data is scoped to the customer's organization in the application layer, with a guard that rejects unscoped queries.
• Access control. Authentication is delegated to a dedicated provider. Every server route that reads or writes customer data verifies the caller's membership and role.
• Sealed records. Evidence records are hashed with SHA-256 and chained daily into a Merkle root, so that alteration after sealing is detectable. Verification never reports an unverifiable record as valid.
• Card data. Payment card data is entered only into Stripe-hosted components and never reaches Ciolk's servers.
• Headers, rate limiting and secrets. A content security policy and related headers are sent on every response; AI, verification and public payment routes are rate-limited; production credentials are held in the hosting provider's encrypted environment and never committed to source control.
• Vulnerability handling. Reports to noahciolkosz@ciolkoszintelligence.com are acknowledged within 72 hours and prioritized by severity.

Ciolk does not currently hold SOC 2 or ISO 27001 certification and does not claim to. The measures above are the ones in place and will be updated as the service matures.

Ciolk will notify the customer without undue delay, and in any case within 72 hours of confirming a personal data breach affecting customer data. The notice will go by email to the account owner and will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information may be provided in phases as the investigation proceeds.

Ciolk will take reasonable steps to contain and remedy the breach and will assist the customer with any notification it must make to data subjects or authorities. Notification is not an admission of fault.

During the term, the customer may export quotes, invoices, jobs and clients as CSV at any time and may request a full export of its account data by email.

On termination or expiry of the subscription, Ciolk will retain customer data for 90 days so that the customer may export it, then delete it, unless the customer asks for deletion sooner, in which case Ciolk will delete within 30 days. Ciolk will confirm deletion in writing on request.

Ciolk may retain customer data beyond that period only where required by law, in backups that expire on a bounded schedule, and as sealed evidence hashes that contain no record content but keep previously issued verification results checkable.

Ciolk will make available the information reasonably necessary to demonstrate compliance with this DPA, including the current subprocessor list, a description of the security measures, and any third-party assessments Ciolk holds.

Once in any 12-month period, on at least 30 days' written notice, the customer or an independent auditor bound by confidentiality may audit Ciolk's compliance with this DPA. The audit is limited to customer data, conducted during business hours without disrupting the service or exposing other customers' data, and begins with written questions and documentary evidence, progressing to interviews only where the documents are insufficient. The customer bears its own costs. An additional audit may be requested after a personal data breach affecting the customer or where a supervisory authority requires it.

The service is hosted in the United States and customer data is processed there by Ciolk and its subprocessors. Where the customer is subject to a law that restricts transfers of personal data to the United States, the parties rely on the standard contractual clauses or an equivalent recognized mechanism under that law, incorporated into this DPA by reference with Ciolk as data importer and the customer as data exporter, and on the corresponding mechanisms in Ciolk's subprocessor agreements. Ciolk will provide the executed clauses on request and cooperate with any transfer impact assessment the customer must perform.

Each party's liability arising out of or relating to this DPA, including any standard contractual clauses incorporated into it, is subject to the exclusions and limitation of liability in the terms of service, and a party's aggregate liability under the terms and this DPA together will not exceed the cap stated in the terms. Nothing here limits liability to data subjects or supervisory authorities where the law does not permit it. The customer is responsible for the accuracy and legality of customer data, the means by which it was obtained, and its instructions to Ciolk.

This DPA takes effect when the customer accepts the terms of service, or on the effective date above if later, and continues until Ciolk has deleted customer data under section 9. Ciolk may update this DPA in the same way as the terms; material changes are notified by email 30 days in advance.

In the event of conflict, the order of precedence is: any standard contractual clauses incorporated under section 11, then this DPA, then the terms of service, then the privacy policy. This DPA prevails over the terms only on the processing of customer data.

Questions about this DPA: noahciolkosz@ciolkoszintelligence.com.