Data Processing Addendum

This Data Processing Addendum ("DPA") is between the customer that agreed to our Terms of Service ("Customer") and Aura Technologies LLC. It applies whenever we process Customer Personal Data to provide Real Extent.

Customer is the controller (or, where Customer acts for a brokerage or another controller, a processor), and we are Customer's processor (or subprocessor) and service provider. For the account, billing, and usage information we handle as described in our Privacy Policy, we act as an independent controller, and this DPA doesn't apply.

• "Data Protection Laws": all laws on the processing of personal data that apply to the processing under this DPA, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), and other U.S. state privacy laws.
• "Customer Personal Data": personal data that Customer or its users add to, or connect to, the Service and that we process on Customer's behalf.
• "Subprocessor": a third party we engage to process Customer Personal Data.
• "Security Incident": a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
• "controller", "processor", "data subject", "personal data", "processing", "service provider", and "supervisory authority" have the meanings given in the Data Protection Laws.

• Subject matter and purpose: providing the Service under the Terms, including syncing and sorting email, drafting and sending communications, scheduling, the CRM, deals and listings, public pages, alerts, and AI features, as configured by Customer.
• Duration: the term of the Terms, plus the deletion period in section 11.
• Nature: collection, storage, organization, retrieval, analysis (including by AI models), transmission, and deletion.
• Data subjects: Customer's leads, clients, and contacts; people who correspond with Customer; visitors who submit Customer's open house, booking, contact, and feedback pages; other real estate professionals; and Customer's workspace members.
• Categories of personal data: names and contact details; contents and details of emails and calendar events; property preferences, timelines, and transaction details; notes, tasks, and feedback; birthdays and home anniversary dates; and other information Customer chooses to add.
• Sensitive data: Customer should not submit special categories of personal data, government identifiers, or financial account numbers, as our Acceptable Use Policy explains. Any such data that appears in emails is processed only as part of providing the Service.

We process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, Customer's settings and use of the Service, and other written instructions we agree to. If the law requires other processing, we will tell Customer first unless the law forbids it. We will tell Customer if we believe an instruction breaks Data Protection Laws.

Customer is responsible for having a lawful basis for the processing, for giving data subjects the notices they need, and for the lawfulness of its instructions.

Everyone we authorize to process Customer Personal Data is bound by confidentiality. We maintain appropriate technical and organizational measures to protect Customer Personal Data, including those listed in section 17, and we may improve them over time without reducing overall protection.

Customer gives general authorization for us to use Subprocessors. The current list is in section 18. We will tell Customer about new or replacement Subprocessors by email or in the Service at least 15 days before they start processing Customer Personal Data, except in an emergency affecting the Service, in which case we will tell Customer as soon as we can.

Customer may object on reasonable data protection grounds within those 15 days. We will then try to offer a reasonable alternative. If we can't, Customer may end the affected subscription and receive a refund of the unused part of any prepaid period.

We bind each Subprocessor by a written contract with data protection obligations at least as protective as this DPA, and we remain responsible for its performance.

The Service lets Customer find, correct, export by request, and delete Customer Personal Data. Where Customer needs more help to answer a data subject's request, we will assist as reasonably needed. If a data subject contacts us directly about Customer Personal Data, we will pass the request to Customer and won't respond ourselves, except to confirm we passed it on or where the law requires.

We will notify Customer without undue delay, and in any case within 48 hours, after we confirm a Security Incident. The notice will describe what happened, the data and data subjects likely affected, the likely consequences, and what we are doing about it, as far as that information is available, and we will update it as we learn more. We will take reasonable steps to contain the incident and limit harm. Notifying Customer is not an admission of fault.

We will give Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service, taking into account the nature of the processing and the information available to us.

We will make available the information reasonably needed to show that we comply with this DPA, such as answers to security questionnaires. If that isn't enough, or a supervisory authority requires it, Customer may audit our compliance, either itself or through an independent auditor bound by confidentiality, no more than once in any 12 months, with at least 30 days' written notice, during normal business hours, at Customer's cost, and in a way that doesn't disrupt the Service or expose other customers' data.

When the Terms end, Customer may ask for a copy of Customer Personal Data within 30 days. We will then delete it within 30 days, except where the law requires us to keep it, in which case we will keep protecting it and process it only for that purpose. Copies in system logs and backups are overwritten on a rolling basis.

Customer authorizes us and our Subprocessors to process Customer Personal Data in the United States and in other countries where they operate. Where Data Protection Laws require a transfer mechanism:

• European Economic Area: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module Two where Customer is a controller, and Module Three where Customer is a processor. Customer is the data exporter and we are the data importer. The optional docking clause (Clause 7) applies. Under Clause 9, option 2 (general written authorization) applies, with the notice period in section 6. The optional wording in Clause 11 doesn't apply. Under Clause 13, the competent supervisory authority is determined by the rules in that clause. Clauses 17 and 18 are governed by Irish law and the courts of Ireland. Annex I is completed by sections 1 and 3 of this DPA, Annex II by section 17, and Annex III by section 18.
• United Kingdom: the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies and is incorporated by reference, completed with the information above. Neither party may end it under its Section 19.
• Switzerland: the EU Standard Contractual Clauses apply with the changes Swiss law requires: the competent supervisory authority is the Federal Data Protection and Information Commissioner, references to EU member states include Switzerland so that data subjects there can enforce their rights, and references to the GDPR include the Swiss Federal Act on Data Protection.
• Where a recipient is certified under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions, we may rely on that certification instead.

If these clauses conflict with the rest of this DPA or the Terms, the clauses control.

Where the CCPA or similar U.S. state laws apply, we act as Customer's service provider or processor, and we:

• won't sell or share Customer Personal Data, as those words are defined in the CCPA;
• won't keep, use, or disclose it for any purpose other than the business purposes in the Terms and this DPA, or outside our direct business relationship with Customer;
• won't combine it with personal information we receive from others or collect ourselves, except as those laws allow;
• will give it the same level of privacy protection those laws require of Customer, and will tell Customer if we can no longer meet our obligations under them; and
• will let Customer take reasonable steps to stop and fix any unauthorized use.

We certify that we understand and will comply with these restrictions.

Each party's liability under this DPA is subject to the limitations of liability in the Terms, to the extent Data Protection Laws allow. Nothing in this DPA limits either party's liability to data subjects where the law doesn't allow it.

If there is a conflict, the Standard Contractual Clauses control, then this DPA, then the Terms. This DPA ends when the Terms end, but continues for as long as we hold Customer Personal Data.

We send Customer Personal Data to AI models only to perform the task it is needed for. Our AI Subprocessor may not use it to train its models. We don't use Customer Personal Data to train any AI model.

• Encryption in transit with TLS for all connections, including to email and calendar servers.
• Encryption at rest by our database provider, plus our own AES-256-GCM encryption of access tokens, app passwords, private calendar links, and webhook addresses.
• Passwords hashed with scrypt. Sign-in sessions stored only as hashes, in secure, HttpOnly cookies.
• Separation of each customer's data by workspace, role-based permissions inside each workspace, and database rules that deny all direct client access.
• Least-privilege access to accounts: only the permissions each feature needs, and extra permissions requested only when a feature is used.
• Permission controls (Auto, Ask first, Disabled) and an approval queue for sensitive actions, sending limits, and an activity log of every action the assistant takes.
• Content from emails and documents treated as untrusted data, so instructions inside it can't direct the assistant.
• Rate limits and bot traps on public forms, and checks that block requests to private or internal networks.
• Logs that remove secrets and message contents.
• Data stored in a multi-region U.S. database location for resilience.
• A process for handling and reporting Security Incidents.

• Google LLC (Google Cloud and Firebase): database and cloud infrastructure. United States.
• Vercel Inc.: application hosting and scheduled tasks. United States.
• Anthropic: Claude models for the assistant's features. Based in the United States; processing may occur in other countries under its commercial service terms.
• OpenAI: text embeddings for searching documents and saved memories. Based in the United States; processing is subject to its API service terms and data controls.
• Resend: password reset and team invitation emails. United States.
• PostHog, Inc.: product usage events linked to user IDs. United States.
• Browser push services (Google, Apple, Mozilla, Microsoft): delivery of the phone and browser alerts users turn on. United States.

Stripe, Inc. processes payment information for us as part of our own billing, not Customer Personal Data. Email, calendar, file, messaging (such as WhatsApp, Instagram, Facebook, Quo, Telegram, and Google Voice), and Slack services that Customer connects are chosen and directed by Customer, and are not our Subprocessors.

Questions about this DPA, or notices under it: contact@aura-technologies.co.