Data Processing Addendum

Operated by Pixie Pinch LLC d/b/a DealsOnTrack
Effective Date: September 3, 2026
Last Updated: September 3, 2026

This Data Processing Addendum (the “DPA”) forms part of the agreement between Pixie Pinch LLC, a Florida limited liability company doing business as DealsOnTrack (“DealsOnTrack,” “we,” “us,” or “our”), and the person or entity identified as the customer in the applicable DealsOnTrack account, Order, or other agreement (“Customer”).

This DPA supplements the DealsOnTrack Terms of Service, each applicable Order, and any other written agreement that incorporates it (collectively, the “Agreement”). It applies when DealsOnTrack Processes Customer Personal Data on Customer’s behalf in providing the Service.

This DPA becomes binding when Customer accepts the Terms of Service, enters into an Order that incorporates this DPA, or signs this DPA. A separate signature is not required unless an Order expressly requires one.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

“Applicable Data Protection Law” means a law or regulation concerning the privacy, security, breach notification, or Processing of Personal Data that applies to the relevant Processing under the Agreement. It includes applicable United States state privacy laws and their implementing regulations, as amended.
“Controller” means the person that determines the purposes and means of Processing Personal Data. It includes a “business” and equivalent terms under Applicable Data Protection Law.
“Customer Personal Data” means Personal Data contained in Customer Content that DealsOnTrack Processes on Customer’s behalf under the Agreement. It does not include Account Data or information that has been lawfully aggregated or deidentified so that it cannot reasonably be linked to Customer or an individual.
“Data Subject” means an identified or identifiable individual whose Personal Data is Processed. It includes a “consumer” under Applicable Data Protection Law.
“Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual or household, and any information defined as “personal data,” “personal information,” or a similar term under Applicable Data Protection Law.
“Process” or “Processing” means any operation performed on Personal Data, including collecting, recording, organizing, storing, retrieving, using, analyzing, transmitting, disclosing, restricting, deleting, or destroying it.
“Processor” means a person that Processes Personal Data on behalf of a Controller. It includes a “service provider,” “contractor,” and equivalent terms under Applicable Data Protection Law.
“Security Incident” means unauthorized or unlawful access to, acquisition, use, alteration, disclosure, destruction, or loss of Customer Personal Data in DealsOnTrack’s or its Subprocessor’s possession or control that compromises the confidentiality, integrity, or availability of that data. It does not include unsuccessful attempts or events that do not compromise Customer Personal Data, such as blocked attacks, unsuccessful login attempts, scans, pings, or denial-of-service attempts.
“Sell,” “Share,” and “Targeted Advertising” have the meanings given under the Applicable Data Protection Law that governs the relevant Processing.
“Subprocessor” means a third party engaged by DealsOnTrack to Process Customer Personal Data on Customer’s behalf in providing the Service.

2. Scope and Roles

2.1 Customer as Controller

Customer determines what Customer Personal Data is submitted to the Service, the purposes for which it is used, who may access it, which communications are sent, and how long Customer needs it. Customer is the Controller of Customer Personal Data unless Customer Processes that data for another Controller.

2.2 DealsOnTrack as Processor

DealsOnTrack acts as Customer’s Processor for Customer Personal Data. DealsOnTrack will Process Customer Personal Data only to provide, secure, maintain, and support the Service; carry out Customer’s documented instructions; comply with the Agreement; and meet applicable legal duties.

2.3 Customer as Processor

If Customer is a transaction coordinator, service provider, agent, team, brokerage, or other organization Processing Customer Personal Data for another Controller, Customer acts as a Processor and DealsOnTrack acts as Customer’s Subprocessor. Customer represents that it has authority from the relevant Controller to appoint DealsOnTrack and authorize the Processing described in this DPA. Customer will communicate any lawful instructions from that Controller to DealsOnTrack.

2.4 DealsOnTrack as Independent Controller

DealsOnTrack acts as an independent Controller for information it collects and uses for its own account administration, billing, customer support, security, fraud prevention, legal compliance, and business operations (“Account Data”). The DealsOnTrack Privacy Policy governs that Processing. This DPA does not change either party’s legal role when a role is determined by law and the facts rather than by contract.

3. Customer’s Instructions

3.1 Documented Instructions

The Agreement, this DPA, Customer’s use and configuration of the Service, Customer’s enabled features, and Customer’s written support requests are Customer’s documented instructions to DealsOnTrack. The Processing details in Schedule 1 further describe those instructions.

3.2 Processing Limits

DealsOnTrack will not Process Customer Personal Data for a purpose that is materially different from the purposes described in the Agreement and Schedule 1 unless:

Customer gives an additional documented instruction;
the Processing is reasonably necessary to protect the Service, Customer Personal Data, users, or third parties from fraud, abuse, or a Security Incident; or
applicable law requires the Processing.

If law requires Processing that is outside Customer’s instructions, DealsOnTrack will notify Customer before the Processing unless the law prohibits notice.

3.3 Unlawful Instructions

DealsOnTrack will promptly inform Customer if it reasonably believes a Customer instruction violates Applicable Data Protection Law. DealsOnTrack may suspend the affected Processing while the parties work in good faith to resolve the concern. DealsOnTrack is not required to follow an instruction that violates law, the Agreement, another person’s rights, or a binding provider restriction.

3.4 Additional Instructions

Customer may issue reasonable additional written instructions that are consistent with the Agreement and Applicable Data Protection Law. If an instruction requires a material change to the Service, unusual technical work, or material additional cost, the parties will first agree in writing on scope, timing, and fees.

4. DealsOnTrack Processing Obligations

DealsOnTrack will:

Process Customer Personal Data only for the limited and specific purposes stated in the Agreement and Schedule 1;
comply with Applicable Data Protection Law in its role as Processor;
provide the same level of privacy protection for Customer Personal Data required of a Processor under Applicable Data Protection Law;
limit access to personnel and contractors who need access to perform the Agreement and who are bound by appropriate confidentiality duties;
not Sell or Share Customer Personal Data;
not use Customer Personal Data for Targeted Advertising, data brokerage, third-party marketing, or to determine creditworthiness;
not retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer except as permitted by Applicable Data Protection Law;
not combine Customer Personal Data with Personal Data received from another person or collected from DealsOnTrack’s own interaction with a Data Subject, except as Customer directs or Applicable Data Protection Law permits;
not use participant contact information for DealsOnTrack’s own marketing;
not attempt to reidentify information that DealsOnTrack maintains as deidentified, except to test the effectiveness of its deidentification process where permitted by law;
promptly notify Customer if DealsOnTrack determines it can no longer meet a material obligation under Applicable Data Protection Law; and
allow Customer, upon notice, to take reasonable and appropriate steps to stop and remediate an unauthorized use of Customer Personal Data.

4.1 Artificial Intelligence Processing

When Customer enables an AI Feature, Customer instructs DealsOnTrack to transmit the applicable document, prompt, transaction context, and related Customer Personal Data to the AI provider identified in Schedule 3 so the provider can generate the requested extraction, summary, draft, calculation support, or response.

DealsOnTrack will not use Customer Personal Data or Google user data to train publicly available or generalized AI models. DealsOnTrack will not opt in to AI-model training using Customer Personal Data. AI Features remain subject to the human-review, prohibited-use, and professional-responsibility terms in the Agreement.

4.2 Google User Data

To the extent Customer Personal Data includes information received from Google APIs, DealsOnTrack will Process and transfer that information only as permitted by the Google API Services User Data Policy, including its Limited Use requirements. DealsOnTrack will not Sell that information, use it for advertising, use it to determine creditworthiness, or allow human access except as permitted by that policy and disclosed in the Privacy Policy.

5. Customer Obligations

Customer will:

comply with Applicable Data Protection Law in its collection, use, disclosure, and instructions concerning Customer Personal Data;
have all rights, permissions, notices, consents, and lawful bases required to provide Customer Personal Data to DealsOnTrack and authorize the Processing;
give required privacy notices to Authorized Users, buyers, sellers, transaction participants, and other Data Subjects;
ensure its instructions are lawful, accurate, complete, and consistent with its obligations to any other Controller;
collect and submit only Customer Personal Data that is adequate, relevant, and reasonably necessary for the transaction and enabled Service features;
keep Customer Personal Data reasonably accurate and correct or delete inaccurate information when required;
configure access roles, recipients, reminders, integrations, retention choices, and other settings appropriately;
respond to Data Subject requests and regulatory inquiries for which Customer is responsible; and
maintain independent copies of contracts and other records that law, professional rules, brokerage policy, or contract requires Customer to keep.

Customer is responsible for the acts and omissions of its Authorized Users, administrators, and any person to whom Customer grants access. Customer will not instruct DealsOnTrack to Process Personal Data in a way that violates fair-housing, civil-rights, communications, privacy, licensing, professional, or other applicable law.

5.1 Specially Regulated and Highly Sensitive Data

The standard Service is not designed to Process protected health information subject to HIPAA, payment-card data subject to PCI DSS, consumer-report data subject to the Fair Credit Reporting Act, biometric identifiers, account passwords, authentication secrets, or data subject to a sector-specific processing agreement unless an Order expressly authorizes that Processing.

Customer must not submit Social Security numbers, full bank-account numbers, full payment-card numbers, medical information, government identification numbers, biometric data, passwords, wire instructions, or similar highly sensitive information unless it is lawful, reasonably necessary for the transaction, expressly supported by the Service, and protected by appropriate safeguards. Customer should redact information the Service does not need.

6. Confidentiality and Personnel

DealsOnTrack will ensure that each person it authorizes to Process Customer Personal Data:

has access only as needed to perform duties related to the Service;
receives appropriate privacy and security instructions for that person’s role; and
is bound by a contractual, professional, or legal duty of confidentiality.

DealsOnTrack will remain responsible for its personnel’s compliance with this DPA. The confidentiality obligations in the Agreement also apply to Customer Personal Data.

7. Security Measures

7.1 Safeguards

DealsOnTrack will maintain reasonable administrative, technical, and organizational safeguards designed to protect Customer Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, alteration, or disclosure. The safeguards will take into account the nature, scope, context, and purposes of Processing; the amount and sensitivity of Customer Personal Data; the reasonably foreseeable risks; the state of available technology; and implementation costs.

The current baseline safeguards are described in Schedule 2. DealsOnTrack may update those safeguards as technology, risks, and the Service change, provided the overall level of protection is not materially reduced during an active Order.

7.2 Customer Security Responsibilities

Customer is responsible for securely configuring its account, limiting access to authorized persons, protecting credentials and connected accounts, reviewing permissions, maintaining secure devices and networks, and notifying DealsOnTrack promptly of suspected unauthorized access. DealsOnTrack is not responsible under this DPA for a Security Incident caused by Customer’s violation of the Agreement, Customer-controlled systems, or a third-party service that Customer connects outside DealsOnTrack’s control, except to the extent caused by DealsOnTrack’s breach of this DPA.

8. Security Incident Response

8.1 Notice

DealsOnTrack will notify Customer without undue delay after determining that a Security Incident affecting Customer Personal Data has occurred. Notice will be sent to Customer’s account administrator, designated security contact, or account email unless Customer has provided a different written notice address.

8.2 Available Information

To the extent known and legally permitted, the notice will include:

the nature of the Security Incident;
the categories of Customer Personal Data and Data Subjects affected;
the approximate number of affected Data Subjects or records, if known;
the known or reasonably anticipated consequences;
the containment, investigation, and remediation steps taken or planned; and
a contact for follow-up questions.

DealsOnTrack may provide information in stages as its investigation develops. A notice is not an admission of fault or liability.

8.3 Cooperation

DealsOnTrack will take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident within its control. Taking into account the nature of Processing and the information available, DealsOnTrack will provide reasonable assistance Customer needs to meet legally required breach-notification duties. Customer is responsible for determining whether notice to a Data Subject, regulator, insurer, or other person is required and for issuing that notice, unless law requires DealsOnTrack to do so directly.

9. Subprocessors

9.1 General Authorization

Customer gives DealsOnTrack general written authorization to use the Subprocessors listed in Schedule 3 and to appoint replacement or additional Subprocessors as necessary to provide the Service.

9.2 Subprocessor Duties

Before a Subprocessor Processes Customer Personal Data, DealsOnTrack will enter into a written agreement requiring the Subprocessor to protect that data through obligations that are materially consistent with the obligations imposed on DealsOnTrack under this DPA, to the extent applicable to the Subprocessor’s services. DealsOnTrack remains responsible for its Subprocessors’ performance of those obligations to the extent required by Applicable Data Protection Law.

9.3 Changes and Objections

DealsOnTrack will provide commercially reasonable advance notice of a new Subprocessor that will materially Process Customer Personal Data, generally at least 14 days before the change when reasonably practicable. Notice may be given by email, through the Service, or through an updated Subprocessor notice made available to Customer. Less advance notice may be given when a change is needed to address an emergency, security risk, legal requirement, provider discontinuation, or event outside DealsOnTrack’s reasonable control.

Customer may object during the notice period by emailing legal@dealsontrack.com and explaining the reasonable, documented data-protection grounds for the objection. The parties will work in good faith to address the concern. DealsOnTrack may offer a configuration change, a commercially reasonable alternative, or suspension of the affected feature. If no reasonable solution is available, Customer may stop using the affected feature or terminate the affected Order as its exclusive contractual remedy. Refunds, if any, are governed by the Agreement unless Applicable Data Protection Law requires otherwise.

If Customer does not object within the notice period, the new Subprocessor is authorized.

9.4 Customer-Directed Third-Party Services

A third-party product or account Customer independently connects to the Service may process information under Customer’s direct agreement with that third party. To the extent the third party acts on Customer’s direct instructions and not as DealsOnTrack’s Subprocessor, Customer is responsible for that third party’s terms, permissions, configuration, and Processing.

10. Data Subject Requests

10.1 Customer Responsibility

Customer is primarily responsible for receiving, verifying, evaluating, and responding to requests concerning Customer Personal Data, including requests to access, know, correct, delete, obtain a portable copy, limit Processing, opt out, withdraw consent, or exercise rights concerning profiling or automated decisionmaking.

10.2 DealsOnTrack Assistance

Taking into account the nature of the Processing, DealsOnTrack will provide reasonable assistance through available Service controls and, where reasonably practicable, appropriate technical or organizational measures so Customer can respond to a valid request within the legally required period.

If DealsOnTrack receives a request that clearly concerns Customer Personal Data, DealsOnTrack may refer the requester to Customer, notify Customer, or ask the requester to identify the relevant Customer. DealsOnTrack will not independently respond on Customer’s behalf unless Customer authorizes it or law requires it.

Customer must provide the information and instructions reasonably needed to locate the relevant data and verify the request. If a request requires substantial custom work beyond standard Service functions, the parties may agree on reasonable fees where Applicable Data Protection Law permits.

11. Compliance Assistance

Taking into account the nature of the Processing and the information available to DealsOnTrack, DealsOnTrack will provide reasonable assistance with Customer’s applicable duties concerning:

security of Processing;
Security Incident investigation and breach notification;
data-protection or privacy impact assessments;
cybersecurity audits and risk assessments;
assessments of automated decisionmaking or profiling involving the Service;
consultations with regulators; and
documentation reasonably needed to show compliance with Applicable Data Protection Law.

DealsOnTrack is not required to provide legal advice, disclose information about another customer, reveal trade secrets or source code, weaken Service security, or violate a duty owed to a third party. The parties may agree on reasonable fees for assistance that requires substantial custom work, unless Applicable Data Protection Law requires the assistance without charge.

12. Return, Deletion, and Retention

12.1 During the Agreement

Customer may use available Service controls to access, export, correct, or delete Customer Personal Data. Customer should export required records before canceling, downgrading, closing an account, or allowing access to expire.

12.2 End of Services

At Customer’s written choice, DealsOnTrack will delete or return Customer Personal Data after the end of the relevant Service, unless applicable law requires continued retention. A return will be made through available export tools or another commonly used format that DealsOnTrack reasonably supports.

If Customer submits a verified account-deletion request, DealsOnTrack will generally delete or deidentify Customer Personal Data from active production systems within 30 days, subject to organization-account controls and lawful retention needs described in the Privacy Policy. This is not a fixed deadline for deletion from backup systems.

12.3 Backups

Limited copies may remain in protected backups until overwritten through the normal backup lifecycle. DealsOnTrack does not promise a fixed backup-deletion period. While backup copies remain, they will stay subject to the confidentiality and security protections of this DPA and will not be restored or otherwise Processed except for disaster recovery, security, or legal purposes. If a backup is restored, data that was subject to a valid deletion instruction will be deleted again from the restored active system in accordance with DealsOnTrack’s normal procedures.

12.4 Required Retention

If law requires DealsOnTrack to retain Customer Personal Data, DealsOnTrack will retain only the data required, protect it under this DPA, and Process it only for the legally required purpose. Data that has been lawfully aggregated or deidentified so it is no longer Personal Data may be retained as permitted by the Agreement and Applicable Data Protection Law.

13. Information, Assessments, and Audits

13.1 Compliance Information

Upon Customer’s reasonable written request, DealsOnTrack will make available information reasonably necessary to demonstrate compliance with this DPA and applicable Processor obligations. DealsOnTrack may satisfy a request by providing a completed security questionnaire, relevant policies, summaries of controls, Subprocessor information, or independent reports or certifications if available.

13.2 Assessments

If the information provided under Section 13.1 is not reasonably sufficient to meet a requirement under Applicable Data Protection Law, Customer may conduct a reasonable assessment itself or through an independent assessor that is not a DealsOnTrack competitor and is bound by confidentiality obligations.

Unless a regulator or Applicable Data Protection Law requires otherwise, an assessment must:

occur no more than once in any 12-month period;
follow at least 30 days’ written notice;
occur during normal business hours;
be limited to systems and information relevant to Customer Personal Data;
avoid unreasonable interference with the Service or DealsOnTrack’s operations;
follow reasonable safety and security rules; and
be conducted at Customer’s expense.

An additional assessment may be conducted after a material Security Incident affecting Customer Personal Data or when a regulator with authority over Customer requires it. Customer may not conduct penetration testing, vulnerability scanning, destructive testing, or access another customer’s data, source code, or shared infrastructure without DealsOnTrack’s prior written approval.

13.3 Findings and Remediation

Assessment materials and results are DealsOnTrack Confidential Information. Customer will promptly report a suspected material deficiency and provide reasonable supporting details. DealsOnTrack will evaluate the finding and, where appropriate, take reasonable corrective action. Customer has the right, upon notice, to take reasonable and appropriate steps to verify that an unauthorized use has stopped and been remediated.

14. United States State Privacy Terms

To the extent an Applicable Data Protection Law imposes Processor-contract requirements, the parties intend this DPA to satisfy them. DealsOnTrack will:

follow Customer’s lawful instructions;
ensure persons Processing Customer Personal Data are subject to confidentiality duties;
assist Customer with Data Subject requests, security, breach obligations, and required assessments as described in this DPA;
at Customer’s direction, delete or return Customer Personal Data at the end of the Services unless law requires retention;
provide information reasonably necessary to demonstrate compliance;
allow and cooperate with reasonable assessments as described in Section 13; and
engage each Subprocessor under a written contract requiring appropriate data-protection obligations.

15. Government and Legal Requests

If DealsOnTrack receives a subpoena, court order, warrant, or other binding government demand for Customer Personal Data, DealsOnTrack will, to the extent legally permitted:

notify Customer before disclosure;
direct the requesting authority to Customer when appropriate;
reasonably cooperate with Customer’s effort to seek protective treatment; and
disclose only the Customer Personal Data legally required.

DealsOnTrack may disclose Customer Personal Data without advance notice when law prohibits notice or when an emergency involving imminent risk of death or serious physical harm reasonably requires disclosure. DealsOnTrack will notify Customer afterward when legally permitted.

16. Processing Locations and International Use

The Service is designed primarily for United States business use. Customer Personal Data may be Processed in the United States and in other locations where an authorized Subprocessor operates, as described in Schedule 3 or the applicable provider documentation.

This DPA does not by itself incorporate an international data-transfer mechanism. Before Customer uses the Service for Processing governed by laws that require such a mechanism, Customer must contact legal@dealsontrack.com so the parties can determine whether an appropriate written addendum and Service configuration are available.

Customer will not use the Service in a jurisdiction that requires data localization, regulatory approval, or contractual terms that the Agreement does not provide unless DealsOnTrack agrees in a signed Order or addendum.

17. Liability and Order of Precedence

The disclaimers, exclusions, limitations of liability, indemnification obligations, dispute provisions, and remedies in the Agreement apply to this DPA and claims arising from it, to the maximum extent permitted by law. Nothing in this DPA limits a liability or Data Subject right that cannot lawfully be limited.

If documents conflict concerning Processing of Customer Personal Data, the following order controls:

A signed data-transfer addendum or mandatory contractual clause that expressly applies to the Processing;
this DPA;
an applicable Order;
the Terms of Service; and
the Privacy Policy.

A higher-ranking document controls only to the extent of the conflict.

18. Term and Termination

This DPA begins when it becomes binding under the introductory terms above and remains in effect while DealsOnTrack Processes Customer Personal Data. Termination of the Agreement does not end provisions that must continue to protect retained Customer Personal Data, including confidentiality, security, deletion, audit confidentiality, liability, and legal-request provisions.

19. General Terms

19.1 Changes

DealsOnTrack may update this DPA to reflect changes in law, the Service, security practices, or business operations. DealsOnTrack will provide at least 30 days’ advance notice of a material change unless an earlier change is reasonably necessary to comply with law or address an urgent security or provider requirement. Changes will not retroactively expand DealsOnTrack’s right to use Customer Personal Data. Subprocessor changes are governed by Section 9.

19.2 Notices

Privacy and data-processing notices to DealsOnTrack must be sent to privacy@dealsontrack.com. Legal notices must also follow the notice requirements in the Agreement.

DealsOnTrack’s contact information is:

Pixie Pinch LLC d/b/a DealsOnTrack
14823 SW 110th Terrace
Miami, Florida 33196
United States
Email: privacy@dealsontrack.com
Legal: legal@dealsontrack.com

19.3 Remaining Terms

The Agreement’s governing law, venue, assignment, relationship, force-majeure, waiver, severability, interpretation, and electronic-acceptance provisions apply to this DPA. This DPA creates no third-party beneficiary rights except where Applicable Data Protection Law expressly requires otherwise.

Schedule 1: Processing Details

A. Parties and Roles

Item	Details
Customer	The person or entity identified in the applicable DealsOnTrack account or Order.
Customer address and contact	The address and contact information associated with Customer’s account or Order.
Customer role	Controller or business. If Customer Processes data for another Controller, Customer is a Processor or service provider.
Processor	Pixie Pinch LLC d/b/a DealsOnTrack, 14823 SW 110th Terrace, Miami, Florida 33196, United States.
Processor contact	privacy@dealsontrack.com

B. Subject Matter and Duration

Item	Details
Subject matter	Processing Customer Personal Data to provide the DealsOnTrack real estate transaction-management and deadline-tracking Service.
Duration	The term of the Agreement and any limited period afterward during which DealsOnTrack retains Customer Personal Data under the Agreement, this DPA, Customer’s instructions, or applicable law.
Frequency	Continuous while Customer uses the Service and event-based when Customer uploads, enters, retrieves, changes, sends, exports, deletes, or directs Processing of Customer Personal Data.

C. Nature and Specific Purposes of Processing

DealsOnTrack may collect, record, organize, structure, host, store, retrieve, display, calculate, compare, analyze, transmit, disclose at Customer’s direction, restrict, export, back up, restore, deidentify, and delete Customer Personal Data for these specific purposes:

authenticate Authorized Users and apply Customer-selected roles and access permissions;
host and store transaction records, contacts, documents, settings, notes, tasks, communications, and activity history;
extract contract and addendum terms and support AI-assisted features that Customer chooses to use;
calculate, display, explain, organize, and update transaction dates and deadlines;
create transaction timelines, reminders, reports, summaries, exports, and audit history;
support collaboration among Customer-authorized team members, administrators, transaction coordinators, and transaction participants;
send or schedule Customer-directed emails, reminders, notifications, attachments, and calendar events;
connect Customer-authorized Google, Microsoft, email, or calendar features;
provide customer support and troubleshoot Service errors;
maintain Service security, prevent fraud and abuse, log relevant activity, and investigate incidents;
perform backup, continuity, recovery, deletion, and account-management functions; and
comply with applicable law and enforce the Agreement.

DealsOnTrack will not use Customer Personal Data for third-party advertising, data brokerage, or DealsOnTrack’s own marketing to transaction participants.

D. Categories of Data Subjects

Customer Personal Data may concern:

Customer’s Authorized Users, administrators, employees, contractors, agents, brokers, transaction coordinators, and assistants;
buyers, sellers, landlords, tenants, property owners, and prospective transaction parties;
cooperating agents and brokers;
lenders, mortgage professionals, title professionals, escrow agents, closing agents, and attorneys;
inspectors, appraisers, surveyors, associations, vendors, and other transaction contacts; and
other persons identified in Customer Content or Customer-directed communications.

E. Categories of Customer Personal Data

Depending on Customer’s use of the Service, Customer Personal Data may include:

names, email addresses, phone numbers, mailing addresses, professional titles, roles, companies, and affiliations;
property addresses and property-related information;
contract terms, purchase prices, deposits, financing details, commissions, referral fees, dates, deadlines, contingencies, and transaction status;
participant relationships, assignments, responsibilities, tasks, notes, checklists, and activity history;
contracts, addenda, amendments, attachments, signatures, and other uploaded documents;
messages, email content, recipient details, attachments, calendar-event information, delivery events, and communication history;
AI prompts, document text, extracted terms, summaries, suggestions, confidence information, corrections, approvals, and outputs;
Google or Microsoft profile identifiers, OAuth tokens, and data needed to perform a Customer-authorized email or calendar action;
user permissions, transaction audit history, and security-related activity tied to Customer’s account; and
other Personal Data Customer chooses to include in Customer Content consistent with the Agreement.

F. Sensitive Data

Customer Content may incidentally contain signatures, financial transaction details, government-issued identifiers, information about minors, or other sensitive information. Incidental Processing does not mean the Service is designed, approved, or contracted to handle every category of sensitive data.

Unless an Order expressly states otherwise, DealsOnTrack does not require or request Social Security numbers, full bank-account numbers, full payment-card numbers, wire instructions, login credentials, government identification documents, protected health information, biometric identifiers, or similar highly sensitive information.

Customer must not upload such information unless the applicable feature expressly supports it, the Processing is lawful and reasonably necessary, and Customer has applied appropriate safeguards. Customer must redact sensitive information that the Service does not need.

G. Retention and Deletion

Customer controls retention during an active account through available Service settings and deletion tools. At the end of the Service, Customer may direct DealsOnTrack to return or delete Customer Personal Data as described in Section 12. Active-system deletion after a verified account-deletion request is generally completed within 30 days, subject to stated exceptions. Backup copies follow the normal backup lifecycle, with no fixed contractual deletion period.

Schedule 2: Technical and Organizational Safeguards

DealsOnTrack maintains safeguards appropriate to the risk and maturity of the Service. Current baseline safeguards include:

1. Data Transmission and Storage

Encryption in transit using current transport-security protocols supported by DealsOnTrack’s providers.
Encryption at rest where supported by the applicable hosting or storage provider.
Protected cloud storage for uploaded contracts and documents.

2. Access Control

Unique user accounts and role-based access controls.
Access limited according to job duties and Customer-selected permissions.
Administrative access limited to personnel and contractors with a legitimate need.
Removal or adjustment of access when it is no longer needed.

3. Customer and Tenant Isolation

Logical controls designed to separate Customer workspaces and restrict cross-account access.
Database row-level security and related authorization rules where applicable.
Customer-controlled user roles and organization-administration features.

4. Authentication and Secrets

Authentication handled through protected authentication systems and providers.
Passwords are not stored by DealsOnTrack in readable plaintext.
OAuth access and refresh tokens stored in protected server-side systems and not intentionally exposed through client-side code or ordinary client responses.
API keys, service credentials, and other secrets restricted to authorized server-side functions and personnel as appropriate.

5. Logging and Monitoring

Logging of relevant account, system, security, delivery, and error events.
Monitoring and investigation processes designed to identify operational failures, suspicious activity, and Security Incidents.
Audit or activity history for supported transaction actions.

6. Availability, Backup, and Recovery

Backup and recovery procedures supported by DealsOnTrack’s hosting providers.
Protected backups intended to support restoration after data loss or service disruption.
No promised recovery-time objective, recovery-point objective, or fixed backup-retention period unless stated in an Order.

7. Service Provider Management

Review of material providers’ privacy, security, and contractual commitments appropriate to their role.
Written data-protection terms with Subprocessors as required by this DPA and Applicable Data Protection Law.
Restriction of Subprocessor access to the services they are engaged to provide.

8. Incident Management

Procedures to receive, assess, contain, investigate, document, mitigate, and remediate suspected Security Incidents.
Customer notification and cooperation as described in Section 8.

9. Data Minimization and Disposal

Service design and policies intended to limit Processing to data needed for the supported purpose.
Customer-facing controls for correction, export, disconnection, and deletion when available.
Deletion, deidentification, or restricted retention after the applicable purpose ends, subject to legal duties and backup lifecycles.

10. Customer Controls

Settings for roles, recipients, reminders, connected accounts, and supported retention or deletion actions.
Ability to disconnect supported Google or Microsoft integrations.
Ability to review AI-extracted information before activating or relying on a transaction workflow.

No security program can eliminate all risk. These safeguards are designed to reduce risk and do not guarantee that the Service will be uninterrupted or immune from every incident.

Schedule 3: Authorized Subprocessors

The following providers may Process Customer Personal Data for DealsOnTrack. A provider marked “optional” Processes Customer Personal Data only when Customer enables or uses the related feature.

Subprocessor	Processing Function	Customer Personal Data Involved	Processing Location
Supabase Pte. Ltd.	Database hosting, authentication, backend functions, and file storage	Account identifiers, transaction records, contacts, documents, settings, permissions, tokens, logs, and other Customer Content	The configured cloud region and other locations permitted by Supabase’s DPA and Subprocessor terms
Anthropic, PBC	Optional AI-assisted contract, document, prompt, and response processing through Anthropic’s commercial API	Documents or text submitted to AI Features, prompts, related transaction context, and AI outputs	United States storage; processing may occur in other locations described in Anthropic’s current commercial data-handling terms
Plus Five Five, Inc. (Resend)	Transactional and system email delivery	Sender and recipient information, email content, attachments, delivery events, logs, and metadata	Primarily United States and other locations permitted by Resend’s DPA and Subprocessor terms
Google LLC	Optional Google sign-in, Gmail, and Google Calendar connections	Google profile information, OAuth tokens, Customer-directed email or calendar data, recipients, attachments, and related metadata	Locations used by Google for the enabled service
Microsoft Corporation	Optional Microsoft sign-in, Outlook, and calendar connections	Microsoft profile information, OAuth tokens, Customer-directed email or calendar data, recipients, attachments, and related metadata	Locations used by Microsoft for the enabled service

Stripe and other billing providers may Process Account Data for subscription and payment administration. They are not listed above unless they Process Customer Personal Data on Customer’s behalf for a Service feature covered by this DPA.

Customer authorizes each provider above subject to Section 9. DealsOnTrack may update this Schedule in accordance with the Subprocessor-change process in that Section.