Data Processing Addendum

Capitalized terms that are not defined here have the meaning the Agreement gives them.

• Services means MeridianOS™, including the Customer's website, the admin area, the employee portal and the MeridianOS™ apps, together with the hosting and support Stack Digital provides under the Agreement.
• Customer Data means the information that Customer, its users and its own customers put into the Services or that the Services collect for Customer.
• Customer Personal Data means personal data within Customer Data that Stack Digital processes for Customer in providing the Services.
• Data Protection Laws means the privacy and data protection laws of the United States and its states that apply to the processing of Customer Personal Data under the Agreement, such as the California Consumer Privacy Act ("CCPA").
• The terms "controller", "processor", "personal data", "processing", "personal data breach", "business", "service provider", "sell" and "share" have the meanings the Data Protection Laws give them.

Ownership. Between the parties, Customer Data belongs to Customer.

Roles. Customer is the controller of Customer Personal Data, or the "business". Stack Digital is the processor, or the "service provider". Where Customer is itself a processor for someone else, Stack Digital is a subprocessor, and Customer confirms that its controller has authorized this DPA.

Stack Digital as a controller. Stack Digital is an independent controller only for the account, billing and contact details of Customer and its administrators, and for information it collects on its own website. The Stack Digital Privacy Policy covers that data.

• Stack Digital processes Customer Personal Data only on Customer's documented instructions, unless a law requires otherwise. In that case Stack Digital tells Customer first, unless the law forbids it.
• Customer's instructions are the Agreement and this DPA, the settings Customer chooses and the actions its users take in the Services (for example sending a text, turning on a reminder, connecting a Google or social account, or asking MeridianAI a question), and any other written instruction Stack Digital accepts.
• Stack Digital tells Customer if it believes an instruction breaks Data Protection Laws.
• Stack Digital does not sell Customer Personal Data, does not use it for advertising, and does not use it to train artificial intelligence models. The providers behind MeridianAI and its voice features are barred by contract from training their models on it.
• Stack Digital may compile statistics about how the Services are used, such as message volumes and feature usage, to run, bill for and improve the Services. Those statistics do not identify Customer's customers or any other individual.

Customer's responsibilities. Customer is responsible for the lawfulness of its instructions and of the data it collects. That includes the notices and consents its customers, leads and employees are owed, and the consent required before it texts or emails them. Customer is the sender of the messages it sends through the Services.

Data that does not belong in the Services. Customer will not put the following into the Services unless Stack Digital has agreed in writing: medical or health records, payment card numbers, government identification numbers, or other categories of data that a law treats as sensitive. Card payments are taken by the payment processor named in Annex III, and Stack Digital does not receive or store card numbers.

The details of the processing are in Annex I.

Where Customer Personal Data is subject to the CCPA or a similar state privacy law, Stack Digital:

• processes it only for the business purposes of providing the Services: hosting Customer's website and records, scheduling, estimates, invoices and payments, messaging, the MeridianAI features Customer uses, support, security and fixing errors;
• will not sell or share it;
• will not keep, use or disclose it outside the direct business relationship with Customer or for any purpose other than those business purposes, except as the law permits;
• will not combine it with personal information it receives from other sources, except as the law permits;
• will comply with the law that applies to it and give the data the level of protection that law requires;
• will tell Customer if it decides it can no longer meet these obligations;
• will cooperate with consumer requests that Customer passes on, including requests to delete; and
• accepts that Customer may take reasonable steps, including the steps in section 9, to confirm that Stack Digital uses the data consistently with Customer's obligations, and to stop and correct any unauthorized use.

Stack Digital certifies that it understands these restrictions and will comply with them.

• Everyone Stack Digital authorizes to handle Customer Personal Data is bound by a duty of confidentiality and has access only as far as their work requires.
• Stack Digital puts in place and maintains the technical and organizational measures in Annex II. It may change them as the Services develop, as long as the overall level of protection does not fall.
• Customer is responsible for the security of its own accounts: keeping passwords private, turning on two-factor authentication or passkeys for its users, giving each person their own login, and removing access for people who leave.

• Customer gives Stack Digital general written authorization to use subprocessors. The current list is in Annex III.
• Before a new subprocessor receives Customer Personal Data, Stack Digital posts it to the change log in Annex III, with its purpose and location, at least 30 days in advance. That posting is the written notice Data Protection Laws require. Customer may ask to receive these notices by email by writing to support@stackdigital.com.
• If a subprocessor has to be replaced urgently to keep the Services secure or running, Stack Digital may give shorter notice and will post the change as soon as it reasonably can.
• Within the notice period, Customer may object on reasonable data protection grounds by emailing support@stackdigital.com. The parties will discuss the objection in good faith. If Stack Digital cannot reasonably accommodate it, Customer may end the affected Service.
• Stack Digital binds each subprocessor by written contract to data protection obligations that match this DPA as far as they apply to that subprocessor's service, and remains responsible to Customer for each subprocessor's performance.

Services Customer connects itself. When Customer connects its own account with another provider, such as a Google Business Profile, a Google Ads account, a social media profile or its own payment account, that provider is not Stack Digital's subprocessor. Customer's own terms with that provider govern the data held there, and the Services act on Customer's instruction when they send data to it or read data from it.

• The Services let Customer look up and correct the records it holds about a person and delete most of them. Where Customer cannot complete a request with those tools, for example an export or the deletion of a record tied to a payment, Stack Digital will help, taking the nature of the processing into account.
• If a person sends a request about Customer Personal Data directly to Stack Digital, Stack Digital will refer the person to Customer and will not respond further, other than to confirm the referral.
• Stack Digital will give Customer reasonable information and help with data protection impact assessments and with consultations with regulators, to the extent Customer does not already have the information.

• Stack Digital will notify Customer without undue delay, and in any case within 72 hours, after it becomes aware of a personal data breach affecting Customer Personal Data. Notice goes to the email address of Customer's account owner.
• The notice will describe, as far as Stack Digital knows at the time: what happened, the kinds and approximate amount of data involved, the likely consequences, and what Stack Digital has done or proposes to do. Stack Digital will send updates as it learns more.
• Stack Digital will take reasonable steps to contain the breach and to fix its cause.
• Giving notice of a breach is not an admission of fault or liability.

• Stack Digital keeps Customer Personal Data for as long as Customer uses the Services. During that time Customer decides what is kept and may delete records in the Services.
• On Customer's written request, during the term or when the Services end, Stack Digital will give Customer an export of its Customer Data in a commonly used format such as CSV, together with the media and content Customer supplied. It will do so within the time the Agreement sets or, where the Agreement sets none, within 30 days.
• When the Services end, or earlier on Customer's written instruction, Stack Digital will delete Customer Personal Data from its live systems within 30 days. Before it does, it will offer Customer the export described above.
• Backup copies are replaced every day. Deleted data leaves the backups on that cycle, normally within 24 hours and in every case within 7 days, and stays protected by this DPA until then.
• Stack Digital will confirm the deletion in writing if Customer asks.
• These obligations do not apply to data that a law requires Stack Digital to keep, or to the records Stack Digital holds as a controller under section 1. Payment records held by the payment processor stay subject to that processor's own retention rules.

• Stack Digital will give Customer the information reasonably necessary to show that it complies with this DPA, including its published security information and written answers to a reasonable security questionnaire once in any 12-month period.
• If that information is not enough to meet a requirement of Data Protection Laws, Customer may carry out an audit once in any 12-month period, and also after a personal data breach or when a regulator requires one.
• An audit needs at least 30 days' written notice. It takes place during business hours, under a duty of confidentiality and at Customer's expense, and it must not expose other customers' data or weaken the security of the Services. An outside auditor must be bound by confidentiality and must not be a competitor of Stack Digital.

Stack Digital offers the Services only to businesses based in the United States, and it hosts and processes Customer Personal Data in the United States. The one exception is the mapping service listed in Annex III, which is operated from the United Kingdom and the European Union. It supplies map images to the admin area and receives a service address only when the primary address lookup is unavailable.

Customer will not use the Services to process personal data that is subject to the data protection laws of the European Economic Area, the United Kingdom or Switzerland unless the parties have first agreed in writing on the terms for doing so, including any transfer mechanism those laws require.

• Term. This DPA applies for as long as Stack Digital processes Customer Personal Data.
• Liability. Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws do not allow a limit.
• Order of precedence. For Customer Personal Data, this DPA prevails over the rest of the Agreement if they conflict. Where a signed service agreement gives Customer a greater right over its data, that right stands.
• Governing law. The law that governs the Agreement governs this DPA.
• Changes. Stack Digital may update this DPA when the law or the Services change. It will not reduce the protection given to Customer Personal Data without Customer's agreement. Each version carries a number and an effective date, a material change is posted at least 30 days before it takes effect, and earlier versions are available on request.
• Notices. Notices to Stack Digital under this DPA go to support@stackdigital.com or by mail to the address in Annex I. Notices to Customer go to the email address of its account owner.

Stack Digital maintains the measures below.

• Separation between customers. Each Customer's site runs separately, with its own database and file storage.
• Encryption. Data is encrypted in transit on every connection to the website, the admin area, the employee portal, the apps and the APIs, and encrypted at rest in the database and in file storage. Credentials for the accounts a Customer connects are encrypted again within the database.
• Sign-in. Passwords are stored only as salted hashes and must meet a minimum strength. Every administrator and employee can turn on two-factor authentication and can sign in with a passkey. Repeated failed sign-ins are blocked, and the web sign-in runs an automated bot check.
• Sessions. Sessions expire, end at sign-out, and are revoked when a password is reset or a user is deactivated.
• Roles. Administrators and employees have separate roles. Employees see only their own schedule, jobs, hours and earnings, and taking payments is a permission the business grants per employee.
• The apps. The MeridianOS™ apps keep sign-in tokens in the device's secure storage and can lock behind Face ID, Touch ID or the device passcode.
• Payments. Card payments are handled by a payment processor certified to PCI DSS Level 1. Card numbers go from the payer to that processor and do not reach Stack Digital's servers.
• Application safeguards. Input is validated on the server, uploaded files are checked against their real type, and public forms, booking and messaging are rate limited and filtered for spam. Software dependencies are checked for known vulnerabilities and updated.
• Files. Uploaded files are stored at long random addresses that cannot be listed or guessed.
• Records of activity. The Services record sign-in attempts, active sessions, the emails they send and the actions MeridianAI takes.
• MeridianAI. A request sends the AI provider only the records needed to answer it, under terms that bar the provider from training its models on them. Spoken requests are turned into text by a speech service under the same restriction, and the audio is not kept.
• Backups. Customer databases are backed up every night to a separate offsite location.
• Incidents. Stack Digital follows a written procedure to contain an incident, assess it, notify affected Customers within 72 hours and fix the cause.
• People. Access to customer systems is limited to the Stack Digital personnel who need it to run and support the Services, and each is bound by confidentiality.

Customer's own accounts with Google Business Profile, Google Ads, Facebook, Threads, LinkedIn, X and Bluesky, and its own payment account, are services Customer connects itself under section 5. They are not subprocessors.

Change log