Data Processing Agreement

2.1 Subject Matter

This DPA governs the processing of Personal Data by the Processor in connection with the provision of the MB Suite platform as described in the Agreement.

2.2 Duration

This DPA shall remain in effect for the duration of the Agreement and until all Personal Data has been deleted or returned in accordance with Section 9.

2.3 Nature and Purpose of Processing

The Processor processes Personal Data to provide the MB Suite platform, including: hosting and storage of organization data, transmission and display of dashboard and reporting data, analysis of campaign performance metrics, AI-powered conversational assistants and content generation, email marketing campaign delivery and automation, integration with third-party advertising and analytics platforms, and — for Controllers and end users who explicitly connect a Google account — reading and writing Google Calendar events, retrieving free/busy availability, and generating Google Meet links solely to power user-facing scheduling, booking pages, and meeting coordination features. For end users who explicitly connect an email mailbox (Gmail, Microsoft 365 / Outlook via the Microsoft Graph API, or IMAP) or a Microsoft 365 / Outlook calendar, processing additionally includes reading and logging email correspondence, sending email on the user's behalf, and reading and writing calendar events, solely to power user-facing CRM correspondence and scheduling features. For Controllers that enable the telephony (Phones) features, processing additionally includes placing and receiving telephone calls over the public telephone network through the Processor's telephony sub-processor, storing call metadata and the call notes entered by the Controller's users, and — only where the Controller has explicitly enabled call recording for the relevant line — recording calls and generating automated transcriptions of voicemail messages.

2.4 Categories of Data Subjects

• Platform users (employees and contractors of the Controller)
• Clients' contacts managed within the platform
• Email marketing recipients
• End users of client portals
• Callers and called parties on telephone calls placed or received through the platform's telephony features
• Third parties who receive or submit credentials through the Controller's secure Vault links

2.5 Types of Personal Data

• Account data (name, email address, phone number, billing information)
• Contact data (name, email, phone, job title, organizational associations)
• Campaign and marketing data (email content, send history, engagement metrics)
• Integration data (OAuth tokens, platform performance metrics)
• AI conversation data (queries, responses, context data)
• Media files (images, documents uploaded to the platform)
• Audit log data (user actions, timestamps, IP addresses)
• Vault data (credentials stored encrypted with envelope encryption; names, email addresses and salted IP hashes of third parties who receive or submit credentials through secure links)
• Lead generation data retrieved from connected advertising platforms (full name, email address, phone number, job title, company, and any custom form fields the Controller defined on the lead form)
• Google Calendar data for users who explicitly authorize the Google Calendar integration: event titles, descriptions, start/end times, time zones, attendee email addresses and response statuses, locations, video conference links (e.g., Google Meet), reminders, and free/busy intervals. This data is fetched on demand or kept transiently in memory to render scheduling UIs; persistent server-side copies are limited to the metadata strictly required for booking and meeting features as described in our Privacy Notice
• Connected mailbox email data for users who explicitly authorize a Gmail, Microsoft 365 / Outlook (Microsoft Graph), or IMAP integration: message subject and body, sender and recipient email addresses, message timestamps, provider message identifiers, and file attachments. Email is matched to CRM contacts by email address and stored against the relevant CRM records as described in our Privacy Notice
• Voice communications data for Controllers that enable the telephony (Phones) features: call metadata (caller and called telephone numbers, timestamps, duration, direction, and call status), call recordings and voicemail audio (created only where the Controller has explicitly enabled recording for the relevant line), voicemail transcriptions, and call notes and outcomes entered by the Controller's users. Call recordings and voicemail audio are hosted by the telephony sub-processor in the United States; call metadata, voicemail transcriptions, and call notes are stored in the Processor's database

4.1 Authorized Sub-processors

The Controller hereby provides general authorization for the Processor to engage the following sub-processors:

4.2 Notification of Changes

The Processor shall notify the Controller at least 30 days in advance of any intended changes to the list of sub-processors, including the addition or replacement of sub-processors. The Controller may subscribe to sub-processor change notifications by contacting privacy@mb-suite.com.

4.3 Right to Object

The Controller may object to the appointment or replacement of a sub-processor by providing written notice within 14 days of receiving notification. If the Controller objects, the Processor shall make reasonable efforts to provide an alternative solution. If no alternative is available, either party may terminate the affected portion of the Agreement.

4.4 Sub-processor Obligations

The Processor shall impose data protection obligations no less protective than those set out in this DPA on any sub-processor it engages. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations.

4.5 Customer-Authorized Third-Party Applications

The Controller may, through API keys, the MB Suite MCP server or OAuth authorizations approved by its users (the "Developer Platform"), allow applications or services of its choice (including AI assistants such as Claude, ChatGPT or Cursor) to access and process Personal Data held in MB Suite. Such applications are selected and controlled by the Controller, not by the Processor; they are not Sub-processors under this Section 4 and the Processor does not engage them within the meaning of Article 28(2) and (4) GDPR. Each API key created and each authorization approved by a user of the Controller constitutes a documented instruction of the Controller under Section 3 and Article 28(3)(a) GDPR to transmit to that application, within the permissions granted, the Personal Data it requests. The Controller authorizes its users to give such instructions and may withdraw any of them at any time by revoking the key or the authorization. The Controller is solely responsible for (a) the lawful basis and any notices required for that disclosure, including towards the persons whose correspondence or calendar entries are involved; (b) assessing the recipient, including its data processing terms, retention, its use of data to train or improve AI models (which, under consumer plans of some AI assistants, is enabled unless the user disables it) and the location of its processing, and for any transfer mechanism required under Chapter V GDPR or equivalent laws; (c) ensuring that only authorized personnel grant such access and that the disclosure complies with the terms of any connected platform (including the Meta Platform Terms and the WhatsApp Business Solution Terms, which permit sharing of platform data only with the Controller's service providers under written agreements); and (d) revoking the authorization when it is no longer required. The Processor's obligations with respect to Personal Data transmitted to such an application end upon transmission. The Processor keeps a record of each key and authorization (application identity, permissions, organization, user, time and network address) and of the operations executed through it, and makes revocation available at any time.

Connected mailbox and calendar content. Personal Data obtained from connected Google accounts (Gmail, Google Calendar), Microsoft 365 / Outlook accounts (Microsoft Graph) or IMAP mailboxes is made available to such applications only if all of the following conditions are met: (i) an owner of the organization has enabled the "Connected mailboxes and calendars" setting for that organization, which is off by default, can be disabled at any time and is recorded in the audit log together with the notice the owner accepted; (ii) the user approving the application, or the user creating the API key, has granted it the separate "Connected mailboxes and calendars" permission (OAuth scope connected_content:read), which is off by default; (iii) only the mailbox and calendar connected by that same user are involved — the person who connected the account is the one who authorizes its use, and the content of accounts connected by other users is never made available through the Developer Platform; and (iv) only email threads linked to a CRM person, company or deal (message headers, bodies and attachment names, not the attachment files) and only calendar events whose organizer or attendees include a CRM contact are returned — never the whole mailbox or calendar, and never free/busy data. Disabling the setting stops that access immediately for every key and application of the organization. The Controller instructs the Processor to make such content available under those conditions, acknowledges that Google and Microsoft data so transmitted becomes subject to the recipient application's terms, and shall ensure that the recipient does not use it for advertising, for resale or to create, train or improve generalized AI or machine-learning models.

5.1 Notification to Controller

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach. The notification shall include:

• The nature of the Personal Data breach, including the categories and approximate number of Data Subjects and records concerned
• The name and contact details of the Processor's data protection point of contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects

5.2 Notification to Supervisory Authority

Where required by GDPR Article 33, the Controller is responsible for notifying the competent supervisory authority without undue delay and, where feasible, within 72 hours. The Processor shall assist the Controller in fulfilling this obligation by providing all necessary information.

5.3 Cooperation

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data breach.

6.1 Standard Contractual Clauses

To the extent that the processing of Personal Data involves the transfer of Personal Data from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, the parties agree to comply with the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914):

• Module 2 (Controller to Processor): Applies where the Controller transfers Personal Data to the Processor for processing on behalf of the Controller.
• Module 3 (Processor to Processor): Applies where the Processor transfers Personal Data to a sub-processor for further processing on behalf of the Controller.

6.2 Data Privacy Framework

Where sub-processors are certified under the EU-US Data Privacy Framework, UK Extension, or Swiss-US Data Privacy Framework, such certification provides an additional safeguard for transfers to the United States. Current certifications are noted in the sub-processor list in Section 4.

6.3 Supplementary Measures

In addition to the legal safeguards above, the Processor implements technical supplementary measures including: AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls, pseudonymization where technically feasible, and comprehensive audit logging.

6.4 Google API Services User Data Policy

Personal Data obtained through Google APIs (including Google Calendar, Google Ads, Google Analytics, Google Search Console, Google Business Profile, YouTube, and other Google services connected by the Controller) is processed in accordance with the Google API Services User Data Policy, including the Limited Use requirements. Such data is used only to provide and improve the user-facing features for which the user granted authorization, is not sold, is not used for advertising, and is not used to train generalized AI/ML models.

6.5 Microsoft APIs Terms of Use

Personal Data obtained through the Microsoft Graph API (Microsoft 365 / Outlook mail and calendar, connected by an end user) is processed in accordance with the Microsoft APIs Terms of Use. Such data is used only to provide the user-facing CRM correspondence and scheduling features for which the user granted authorization, is not sold, is not used for advertising, and is not used to train generalized AI/ML models.

6.6 Voice Communications and Telephony Data

Telephone calls placed or received through the platform are carried by Twilio Inc. Call recordings and voicemail audio are hosted on Twilio infrastructure located in the United States (Twilio region us1); call metadata, voicemail transcriptions, and call notes are stored in the Processor's United States database region. Transfers of this data from the EEA, UK, or Switzerland to the United States are made on the same basis as the other United States sub-processors listed in Section 4 — the EU Standard Contractual Clauses (Module 3, Processor to Processor) as incorporated in the Twilio Data Protection Addendum — together with the supplementary measures described in Section 6.3. Call recording is disabled by default and is activated by the Controller on a per-line basis; where the Controller has not activated recording for a line, no call audio is created, stored, or transferred.

7.1 Sub-processing by AI Providers

When the Controller's users utilize AI features within MB Suite, Personal Data may be transmitted to one of the authorized AI sub-processors (Google Gemini, OpenAI, or Anthropic) as selected by the Controller's agent configuration. This transmission constitutes sub-processing governed by this DPA and the respective AI provider's data processing agreement. AI assistants and other applications that the Controller connects through the Developer Platform (API keys, the MCP server or OAuth) are not AI sub-processors under this Section 7, even where they are operated by the same companies; Section 4.5 governs them.

7.2 No Training Commitment

All AI providers engaged by the Processor are contractually prohibited from using the Controller's Personal Data to train, improve, or develop their AI models. Data is processed exclusively to generate responses to user queries and is not retained by AI providers beyond the duration necessary to complete the request.

7.3 Data Transmitted to AI Providers

The categories of data transmitted to AI providers include: organization metadata (name, category, industry), task and project information, social media post content, media plan summaries, contact names (email addresses are excluded from context summaries), knowledge document content, and conversation history. The specific data categories transmitted depend on the data sources enabled for each AI agent by the Controller.

7.4 Controller Controls

The Controller retains control over AI data processing through: selection of AI provider per agent, configuration of data sources accessible to each agent, upload and removal of knowledge documents, and the requirement for explicit user confirmation before AI-proposed actions modify any data.

7.5 Exclusion of Calendar Data from AI Sub-processing

Notwithstanding Section 7.3, Personal Data obtained through Google Calendar OAuth scopes (calendar.events and calendar.freebusy) or through the Microsoft Graph Calendars.ReadWrite scope — including event titles, descriptions, attendees, locations, meeting links, and free/busy intervals — is never transmitted to any AI sub-processor (Google Gemini, OpenAI, Anthropic, or any future addition) as context for AI inference or any other purpose. This exclusion is enforced architecturally in the Processor's context-builder pipeline and aligns with the Limited Use requirements of the Google API Services User Data Policy. It does not apply to applications the Controller authorizes under Section 4.5: where an owner has enabled connected mailboxes and calendars for the organization and the application has been granted that permission, the application may read, from the calendar connected by the user who authorized it, the events whose organizer or attendees include a CRM contact (never free/busy data and never the whole calendar), as a disclosure made on the Controller's instruction and under the recipient's own terms.

7.6 Connected-Mailbox Email Data and AI Sub-processing

Email message bodies and attachment contents obtained from connected mailboxes (Gmail, Microsoft 365 / Outlook via Microsoft Graph Mail.Read, or IMAP) are never transmitted to any AI sub-processor, neither as inference context nor for any other purpose, and are never used to train AI/ML models. Limited activity metadata derived from logged correspondence — the message subject line (truncated), activity dates, and attachment file names — may be included in an AI prompt only when a user of the Controller explicitly invokes an AI deal-analysis feature (e.g., the AI Deal Coach) on a specific CRM deal, and solely to generate that user-requested analysis. No mailbox data of any kind is transmitted to AI sub-processors automatically or in the background. Applications the Controller authorizes under Section 4.5, including third-party AI assistants, are not AI sub-processors: where an owner has enabled connected mailboxes and calendars for the organization and the application has been granted that permission, the application may read, from the mailbox connected by the user who authorized it, the messages of email threads linked to a CRM person, company or deal — including their bodies and attachment names, but not the attachment files and never the whole mailbox — on the Controller's instruction and under the recipient's own terms, which may include the retention and model-training practices described in Section 4.5.

8.1 Right to Audit

The Controller has the right to conduct audits, including inspections, to verify the Processor's compliance with this DPA. The Controller shall provide reasonable prior written notice (at least 30 days) and shall conduct audits during normal business hours without unreasonably disrupting the Processor's operations.

8.2 Alternative Audit Mechanisms

The Controller agrees that the Processor may satisfy audit requirements by providing: (a) SOC 2 Type II audit reports, (b) ISO 27001 certification, or (c) other equivalent third-party audit certifications, in lieu of on-site inspections, where such reports adequately address the Controller's compliance concerns.

8.3 Cost of Audits

The Controller shall bear the costs of any audit it conducts. The Processor shall provide reasonable assistance at no additional charge.

9.1 Export Window

Upon termination of the Agreement, the Controller has a 30-day period to export its data through the platform's export features. This is consistent with the data handling provisions in the Terms & Conditions (Section 11).

9.2 Deletion

After the 30-day export period, the Processor shall permanently delete all Personal Data from active systems, unless applicable law requires further storage. Backup copies may persist in encrypted form for up to 90 days as part of disaster recovery procedures, after which they are automatically purged.

9.3 Certification

Upon request, the Processor shall provide written certification that all Personal Data has been deleted in accordance with this Section.

10.1 Encryption

• At rest: AES-256 encryption for all data stored in Firebase/Firestore, Firebase Storage, and GCP Secret Manager
• In transit: TLS 1.3 for all data transmitted between clients, servers, and third-party services

10.2 Access Controls

• Authentication: Firebase Auth with secure session cookies (httpOnly, 5-day expiry)
• Authorization: Role-based access control (RBAC) with four levels: owner, admin, member, viewer
• Multi-tenancy isolation: Organization-scoped data access enforced at the application layer

10.3 Audit Logging

Comprehensive audit logging via Firebase Realtime Database captures user actions, data modifications, authentication events, and administrative operations with timestamps and user identification.

10.4 Secret Management

OAuth tokens and sensitive credentials are stored exclusively in GCP Secret Manager, isolated from the application database. Tokens are encrypted at rest and access is logged.

10.5 Incident Response

Documented incident response procedures include: detection and classification of security incidents, containment and eradication measures, 72-hour notification to affected Controllers, post-incident review and remediation.

10.6 Data Minimization

• AI context: Token budget limits (8K tokens) for AI context windows to minimize data exposure
• Configurable data sources: Organization administrators control which data categories are accessible to each AI agent
• Contact data: Email addresses are excluded from AI context summaries

10.7 Availability and Resilience

• Hosting: Vercel edge network with global CDN distribution
• Database: Firebase multi-region replication
• Backups: Automated backups with encrypted disaster recovery copies retained for up to 90 days

11.1 Precedence

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

11.2 Amendments

This DPA may be amended by the Processor to reflect changes in applicable data protection law. Material changes will be notified to the Controller at least 30 days in advance.

11.3 Governing Law

This DPA shall be governed by the laws of the State of Delaware, USA, without regard to conflict of laws principles. For Controllers located in the EEA, the mandatory provisions of the GDPR shall apply in addition.