Data Processing Addendum

Effective October 29, 2026

This Data Processing Addendum (the “DPA”) is part of the Daywright Terms of Service, or any other agreement between Fine Folk LLC (“Daywright,” “we,” “us”) and the company that uses Daywright (the “Customer”) covering the service (together, the “Agreement”). It applies whenever we process personal data on the Customer’s behalf in providing Daywright.

1. Definitions

• “Customer Personal Data” means any information relating to an identified or identifiable person that we process on the Customer’s behalf under the Agreement.
• “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data, which may include U.S. state privacy laws (such as the California Consumer Privacy Act, as amended, the “CCPA”) and, where they apply, the EU and UK General Data Protection Regulation (“GDPR”).
• “Data Subject” means the person a piece of Customer Personal Data is about: for example, one of the Customer’s clients, a real estate agent on an order, someone the Customer texts or emails, or a member of the Customer’s staff.
• “Subprocessor” means a third party we engage to process Customer Personal Data.
• “Controller,” “processor,” “business,” “service provider,” “sell,” “share,” and “process” have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. The Customer is the controller (or “business”) of Customer Personal Data, and Daywright is the Customer’s processor (or “service provider”). The Customer decides what personal data it puts into Daywright and why. Where the Customer is itself a processor for someone else, it confirms it has authority to engage us as its subprocessor.

2.2 Details of processing. The subject matter, duration, nature and purpose of the processing, and the categories of personal data and Data Subjects, are described in Annex I.

2.3 Where we are the controller. This DPA does not cover data we process for our own purposes as a controller, such as the Customer’s account and billing records, support conversations, and security logs. Our privacy policy describes that processing.

3. Processing instructions

3.1 We process Customer Personal Data only on the Customer’s documented instructions, including as to international transfers, unless the law requires otherwise (in which case we will tell the Customer first, unless the law forbids it). The Agreement, this DPA, and the Customer’s use and configuration of Daywright are the Customer’s documented instructions. That includes taking and booking orders, setting up routines that send messages, connecting integrations (such as a phone system, a payment processor, or a mailbox), importing records from another system, and using AI-assisted features.

3.2 We will tell the Customer promptly if we believe an instruction breaks Data Protection Laws.

3.3 No selling or secondary use. We will not: sell or share Customer Personal Data (as the CCPA defines those terms); retain, use, or disclose it for any purpose other than providing Daywright and as Data Protection Laws allow service providers (including security, fraud prevention, and legal compliance); retain, use, or disclose it outside our direct business relationship with the Customer; combine it with personal data from other sources except as Data Protection Laws allow service providers; or use it to train artificial-intelligence models for anyone other than the Customer. We certify that we understand and will comply with these restrictions.

4. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by appropriate confidentiality obligations and accesses it only as needed to provide Daywright.

5. Security

We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including the measures in Annex II. We may update these measures as long as the updates do not materially reduce overall protection.

6. Subprocessors

6.1 Authorization. The Customer generally authorizes us to engage the Subprocessors listed on our subprocessor list (Annex III). We impose data protection obligations on each Subprocessor that are materially no less protective than this DPA, and we remain responsible for their performance.

6.2 Changes. We will give notice, by email to the Customer’s owners or inside Daywright, at least 15 days before we add or replace a Subprocessor. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may end the affected part of the service and receive a pro-rated refund of any prepaid fees for the unused period.

6.3 Urgent replacements. If we must replace a Subprocessor quickly to protect Customer Personal Data or keep Daywright running (for example, after a security incident at a provider), we may give shorter notice, and will tell the Customer as soon as practicable. The Customer’s right to object under section 6.2 still applies.

6.4 Services the Customer connects. Services the Customer connects under its own accounts and agreements (for example its own Stripe, Authorize.net, Twilio, Aircall, or Quo account, a staff member’s own Google Calendar, HAVEN, Scribeware, or a system it imports from) act on the Customer’s behalf and at its direction. They are not our Subprocessors, and the Customer’s agreements with those providers govern them.

7. Helping with Data Subject requests

7.1 Taking into account the nature of the processing, we will help the Customer, by appropriate technical and organizational measures, to meet its obligations to respond to Data Subject requests (access, correction, deletion, portability, restriction, and objection).

7.2 Tools in Daywright. The Customer can respond to most requests itself:

• Access and portability: view records and export them, one file per kind of record. Stored files such as reports, photos, and attachments are listed in the export and downloaded separately.
• Correction: edit contact and order details.
• Deletion: delete a contact, an agency, or an order that has never been used for anything real (no payments, invoices, signed agreements, sent messages, completed visits, or documents), and delete individual documents.
• Anonymisation: where a client is on an order and cannot be deleted, anonymise them. Their name becomes “Former client,” their email addresses, phone numbers, notes, and photo are removed, and their personal details are replaced with “removed” in their history.

7.3 Records that stay. Anonymisation does not remove the Customer’s business records about the work it did: orders (including the property address and order notes), signed agreements (including the name they were signed with), invoices, payments, messages already sent, and call records stay as the Customer’s records, because they are the record of a transaction and may be needed to meet record-keeping obligations or to answer a later claim. The Customer decides whether keeping them is lawful for the request in front of it, and we will help it delete or anonymise anything Daywright can.

7.4 If a Data Subject sends a request about Customer Personal Data to us directly, we will forward it to the Customer promptly and will not respond to it ourselves except as the Customer instructs or the law requires.

8. Personal data breaches

We will notify the Customer without undue delay, and in any event within 72 hours, after we confirm a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of records and Data Subjects affected, the likely consequences, and the measures taken or proposed. We will reasonably cooperate with the Customer’s investigation and with any notifications the law requires of it. Our notice is not an admission of fault.

9. Deletion and return

9.1 During the term. Customer Personal Data is kept for as long as the Customer’s account is active, unless the Customer deletes it sooner or it is covered by the retention period below. Free text that builds up over time (AI assistant conversations and the files attached to them, inbound text messages, and call summaries) is deleted automatically after the retention period the Customer chooses in Daywright: 3, 6, 12, 24, or 36 months, with 12 months as the default.

9.2 Export. The Customer can export its records from Daywright at any time during the term, one file per kind of record. The export lists stored files such as reports, photos, and attachments but does not include them, so the Customer should download any it wants to keep before the Agreement ends. For 30 days after it ends, we will provide an export of the records on request.

9.3 After termination. When the Agreement ends, and after the 30-day export window, we will delete Customer Personal Data, including stored files, within 30 days, except where the law requires us to keep it, and keep a record of the deletion (counts and timestamps, not content). We also keep, as our own contract record, the Order the Customer agreed to: the company’s name, the plan, prices, seats, discounts, trial and renewal dates, our subscription reference, and the text of the Order confirmation we sent. That record holds no personal data of the Customer’s users or clients: the addresses the confirmation went to are removed, and only how many there were is kept. Copies in our encrypted backups are not restored except to recover from a disaster, and expire as the backups rotate, within 7 months.

9.4 Address lookups. To avoid paying for the same lookup twice, we keep a shared cache of address lookups (coordinates, county, and public property facts such as square footage). The cache holds addresses only, with no link to any customer, order, or person, and is not deleted with a customer’s data.

10. Audits and information

We will make available to the Customer the information reasonably necessary to show that we comply with this DPA (including summaries of our security measures, our subprocessor list, and relevant audit or assessment reports when available). We will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints, no more than once a year (except after a breach), on at least 30 days’ notice, during business hours, under confidentiality obligations, and in a way that does not put other customers’ data or our security at risk. The Customer bears the cost of audits it starts.

11. International transfers

We and our Subprocessors process Customer Personal Data mainly in the United States. Some Subprocessors process it elsewhere, as our subprocessor list shows. To the extent Customer Personal Data is subject to GDPR or similar laws that require safeguards for transfers, the standard contractual clauses approved by the relevant authority (the EU Standard Contractual Clauses, Module 2, controller to processor, and the UK Addendum) are incorporated by reference, with the Customer as data exporter, Daywright as data importer, and the Annexes of this DPA as the corresponding appendices. Daywright is currently offered only to businesses in the United States; this section keeps cross-border transfers covered if that changes.

12. Liability

Each party’s liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement.

13. Order of precedence and duration

This DPA controls over conflicting terms of the Agreement as to the processing of Customer Personal Data, and stays in effect for as long as we process Customer Personal Data.

Annex I: Details of processing

Subject matter. Providing Daywright, scheduling and operations software for inspection businesses: order intake and online booking, scheduling and routing, agreements and electronic signatures, invoices and payment records, client and agent portals, email and text messaging, connected phone systems and shared inboxes, report delivery, data import, and AI-assisted features.

Duration. The term of the Agreement, plus the deletion periods in section 9.

Nature and purpose. Hosting and storage; scheduling and route planning; sending and receiving email and text messages at the Customer’s direction; generating documents such as agreements and invoices; collecting electronic signatures; recording payments made through the Customer’s own payment processor; address lookup and property records lookup; syncing with services the Customer connects; processing by large language models when a user asks the assistant a question, when the Customer turns on the Conversations assistant, or when a user imports a document; backups and disaster recovery.

Categories of Data Subjects.

• The Customer’s clients and prospective clients, including people who book online or use the client portal, payment pages, or signing pages;
• Real estate agents and other people associated with an order (such as buyers, sellers, and their representatives), including agent portal users;
• People the Customer sends messages to or receives messages from;
• The Customer’s staff and contractors, such as inspectors and office staff.

Categories of personal data.

• Names, email addresses, phone numbers, and mailing addresses;
• Property addresses and property details (such as size, age, and access notes), including gate and lockbox codes, which are stored encrypted;
• Order, appointment, and service details, and notes the Customer records;
• Agreement records: the signed text, the signer’s name and signature, and the time; for a signature made remotely, the IP address and device used; for a signature made in person on an inspector’s phone, the phone’s location when signing began and the inspector’s confirmation;
• Invoices and payment records: amounts, statuses, and the payment processor’s reference numbers (never full card or bank account numbers, which go straight to the processor);
• Message contents and attachments, including inbound texts and, where the Customer connects a shared inbox, the contents of that mailbox;
• Call records from a phone system the Customer connects (numbers, times, and the phone provider’s summary, if the Customer turns that on);
• Documents and reports the Customer stores or delivers through Daywright;
• Staff details: names, contact details, roles, schedules, time off, pay records, and the busy times from a staff member’s own calendar, if they connect it.

Sensitive data. Daywright is not designed to process sensitive personal data, and the Customer should not use it to collect government identification numbers, health information, or full payment card numbers. Every in-person signature records the location of the inspector’s phone when signing began, as proof of where it took place.

Frequency. Continuous, as the Customer uses Daywright.

Annex II: Technical and organizational measures

• Encryption in transit: TLS for connections to Daywright and between Daywright and its Subprocessors.
• Encryption at rest: databases and file storage are encrypted at rest by our hosting and storage providers. Integration credentials, API secrets, and property access codes are additionally encrypted in the application with AES-256-GCM before they are stored.
• Credentials: passwords are stored only as Argon2id hashes. Session tokens, API keys, and single-use links are stored only as SHA-256 hashes.
• Sign-in protection: two-factor sign-in is available to every user, and an owner can require it for any role. Repeated failed sign-ins are limited without letting a stranger lock out the real user.
• Customer isolation: every query is limited to the customer’s own account, and the database enforces the same limit independently with row-level security.
• Access control: roles (owner, admin, office, inspector) and owner-controlled permissions inside each account. Daywright staff reach a customer’s account only through a time-limited support session that records who, when, and why, and shows a banner in the account while it lasts.
• Audit trail: an activity log that the application can add to but not change or delete, enforced by the database.
• Data minimization: only busy times are stored from connected calendars; error monitoring excludes request bodies, cookies, headers, IP addresses, and database values; application logs mask tokens and query values; the AI assistant is never given access codes or secure links.
• Retention: free-text records are deleted automatically on the schedule in section 9.1.
• Backups: encrypted database backups every six hours, checked automatically after each run, with a monthly test restore. Backups are kept for 14 days, plus the first backup of each month for six months counted from the start of the current month, so none is more than seven months old.
• Application security: validation of all input; rate limiting; signature or secret verification on webhooks we receive; protections against outbound requests to internal addresses; a security review checklist applied to every change.
• Personnel: access to production data is limited to authorized personnel bound by confidentiality obligations.

Annex III: Subprocessors

The Subprocessors on our subprocessor list on the effective date of this DPA, as updated under section 6.2.

Contact

Questions about this DPA, or to request a signed copy: hello@daywright.io.