Data Processing Agreement

This Data Processing Agreement (“DPA”) supplements the agreement governing Maurie AI between Maurie AI LLC, 5791 Pigeon Creek Rd., Bettendorf, IA 52722, United States (“Maurie”), and the customer identified in the accepted order or written acceptance (“Customer”). It becomes effective only when separately accepted by both parties in writing or expressly incorporated into an accepted order. It is not a representation that every obligation described below has already been implemented in the current system.

For personal data processed on Customer’s behalf (“Customer Personal Data”), Customer acts as controller, or as a processor with authority from its controller, and Maurie acts as processor or subprocessor. This DPA does not cover processing where Maurie or a provider acts independently as a controller, such as its own account administration or provider-controlled payment obligations. Applicable data protection law governs those separate activities.

This DPA prevails over conflicting general terms for its processing subject matter. Applicable mandatory law and any valid international-transfer clauses prevail where required. Neither the TOS liability provisions nor this DPA restrict individuals’ or regulators’ nonwaivable rights.

Subject matter and purpose: providing Customer’s selected AI agents, CRM, tasks, email/support tools, marketing, documents/signatures, register, AI Phone Receptionist, and related integrations. Processing can include collection, organization, storage, retrieval, transmission, generation of AI output, display, support, return, and deletion, as instructed through authorized use and configuration.

Duration: while the account remains active, including a downgrade to Free, and any limited period required for return or deletion under this DPA. Categories of individuals: Customer’s authorized users, employees and contractors, contacts, website visitors, chat participants, email recipients, document recipients/signers, purchasers, and callers to Customer’s AI Phone Receptionist numbers. Data types: names and contact details, identifiers, messages and email threads, attachments and training sources, tasks and CRM information, document/signature records, transactions, caller phone numbers and caller ID, call audio and recordings, transcripts and call summaries, call details, and technical connection or activity metadata associated with those features.

PHI is prohibited. Customer must not submit other regulated or special-category data requiring arrangements the Services do not support. Customer is responsible for lawful instructions, required permissions/notices, data accuracy, minimization, and the authority of administrators. Customer must not configure a use that conflicts with law, provider restrictions, or an agreed purpose.

Maurie will process Customer Personal Data only on documented instructions, including instructions on transfers, except where applicable law requires otherwise. Maurie will inform Customer of such a legal requirement before processing unless the law prohibits notice. Maurie will promptly inform Customer if it believes an instruction infringes applicable data protection law and may pause the affected processing while the parties resolve it. Maurie will not use Customer Personal Data for its own general-model training or independent advertising.

Maurie will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty and receive access limited to their authorized role. It will implement technical and organizational measures appropriate to the nature, scope, context, purposes, and risks of processing under applicable law.

Measures must address access control, authentication, protection of data in transit and storage where appropriate, operational resilience, restoration capability, security testing, and incident handling, as appropriate to those risks. Specific configurations and evidence must be documented for the relevant deployment. This DPA does not certify a particular encryption implementation, audit standard, or recovery objective that has not been verified.

Customer will secure its own credentials, endpoints, and authorized integrations, limit access, and notify Maurie promptly of suspected unauthorized access. Security measures may evolve, but changes must not materially reduce the agreed overall protection during the applicable processing term.

Customer gives general written authorization for subprocessors identified in the confirmed list made available with this DPA, subject to the change procedure below. Maurie will bind subprocessors to data protection obligations providing the protection required by applicable law for their processing and remains responsible to Customer for their performance of those obligations.

Known functional providers are Supabase (production database/authentication/files, US us-east-1), Render (backend, Virginia US), Mailgun (email sending/receiving, US), Resend (backup alert emails), and the active AI provider, Google Gemini or OpenAI. Only one AI provider is active at a time. For the AI Phone Receptionist, Twilio (US) provides phone numbers, connects calls, and stores call recordings and call records, and Google Gemini processes call audio in real time and produces transcripts and summaries, whichever AI provider is active for other features. Relevant messages/history, business training content, images/PDFs, and Inbox email threads/contact information may be sent to that provider. The provider’s exact contracting entity, country scope, processing terms, and account settings must be confirmed for the deployment before regulated processing under this DPA.

Stripe, Google Calendar/Business Profile, Meta, LinkedIn, browser-loaded Google resources, and other enabled providers may have independent-controller or Customer-directed roles. Their role must be identified for the actual processing; a brand name alone does not establish subprocessor status. DataForSEO receives keywords and locations for rank checks rather than CRM or chat records. The separate Singapore development project uses test data and is not authorized by this description for production Customer Personal Data.

Maurie will give prior notice of a planned new or replacement subprocessor, ordinarily at least 30 days before the change where practicable, allowing Customer to object on reasonable data protection grounds. An urgent change will receive as much advance notice as practicable and prompt explanation. The parties will seek a reasonable alternative. If no compliant resolution is possible, Customer may terminate the affected service with a refund of unused prepaid fees for that affected service, subject to the accepted order and mandatory law. Maurie may not override a legally required prior authorization merely by giving notice.

Taking account of the nature of processing, Maurie will assist Customer through appropriate technical and organizational measures with applicable access, correction, deletion, portability, restriction, objection, and other rights requests. Where a request concerns Customer-controlled records, Maurie will promptly notify Customer and avoid acting independently except on instruction or as legally required.

Maurie will provide reasonable assistance with security obligations, impact assessments, and prior regulatory consultations, taking account of the information available to it. The parties may agree reasonable fees for exceptional assistance, but fees or commercial limits must not prevent compliance with mandatory obligations. Customer’s primary privacy contact is its registered administrator unless another contact is designated in writing.

Maurie will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Available information will include the nature of the breach, affected data/individual categories and approximate numbers where known, likely consequences, measures taken or proposed, and a contact for further information. Information may be provided in stages as the investigation develops.

Maurie will take appropriate steps to contain, investigate, and mitigate the breach and assist Customer with legally required notices. Customer remains responsible for its controller notices unless law requires Maurie to act independently. The notification obligation does not require Maurie to characterize unsuccessful attacks with no personal data compromise as a breach, and notification is not an admission of liability. No arbitrary delay is permitted while complete information is being gathered.

On termination of the relevant processing services, Maurie will, at Customer’s choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires continued storage. It will agree and document an operational completion schedule consistent with applicable law and Customer’s instructions, restrict retained data to permitted purposes, and provide reasonable confirmation of completion. A paid-plan cancellation that leaves an active Free account is not termination of all processing.

Current implementation: workspace database records are deleted immediately, but some contact files, signed documents, logos, and login accounts remain; individual users lack self-service account deletion. Supabase retains seven days of daily database backups. Maurie’s own twice-monthly and pre-release backups currently have no fixed expiry. These facts are not a waiver of the return/deletion obligations in this DPA and indefinite retention is not authorized merely because it occurs in a backup.

Before this DPA is activated for processing requiring those obligations, the parties must document a compliant live-data and backup deletion process, retention limits, handling of restored backups, and the required file/authentication cleanup. Residual backup copies may be restricted and removed through an agreed, legally permissible cycle; they must not return to ordinary processing contrary to a valid deletion instruction. Customer may use service@maurieai.com for deletion and return coordination.

Maurie will make available information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections by Customer or a qualified auditor authorized by Customer, as required by applicable law. Reasonable notice, confidentiality, security protections, and coordination may apply without preventing an audit required by law or a competent regulator.

Existing documentation and appropriate independent reports may be used to satisfy requests where sufficient. Commercial restrictions must not eliminate required inspection or audit rights. Audits must avoid unnecessary disclosure of other customers’ information. Any reasonable cost allocation will be agreed without obstructing mandatory rights or investigations.

Maurie will not make a restricted international transfer under applicable law without an appropriate lawful mechanism and any necessary safeguards. Where needed, the parties must execute or validly incorporate the applicable standard contractual clauses and required annexes, UK transfer arrangements, or another lawful mechanism before the transfer. This DPA does not itself attach or execute those instruments or claim Data Privacy Framework certification.

Production US hosting does not establish every provider’s processing location. Customer instructions and the transfer documentation must account for the actual subprocessors and country scope. Maurie will notify Customer of legally binding requests for disclosure where legally permitted and will disclose only the information it is legally required to provide.

Maurie contact: service@maurieai.com, Maurie AI LLC, 5791 Pigeon Creek Rd., Bettendorf, IA 52722, United States. Customer’s legal identity, address, privacy contact, and authorized signatory are supplied in the accepted order or written DPA acceptance.

Before acceptance, document the final subprocessor entities and locations, the active AI account terms, appropriate security measures, live/backup deletion schedule, and applicable transfer documents. These are deployment-specific attachments or records, not assumed certifications. Maurie and Customer must preserve evidence of the DPA version and authorized acceptance. Until that acceptance and required implementation are completed, this document is a proposed agreement rather than an assertion of an existing processor contract.