Data Processing Agreement

1. Definitions

• Customer Personal Data: personal information that the Customer, its team or its clients put into Go1000.ai, or that Go1000.ai collects for the Customer (for example through the Customer's website, portal, texts and calls), including "nonpublic personal information" under the Gramm-Leach-Bliley Act (GLBA).
• Data Protection Laws: U.S. federal and state laws that apply to the processing, including the GLBA and the FTC Safeguards Rule (16 CFR Part 314), the California Consumer Privacy Act as amended (CCPA), other state consumer privacy laws, and state data-security and breach-notice laws.
• Security Incident: a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor: a third party Go1000.ai engages that processes Customer Personal Data.

2. Roles and Instructions

The Customer is the business (controller, and where applicable the financial institution) that decides why and how Customer Personal Data is processed. Go1000.ai is its service provider and processor.

Go1000.ai processes Customer Personal Data only to provide, secure and support the service under the Terms, on the Customer's documented instructions (the Terms, this DPA, and the Customer's settings and actions in Go1000.ai), and as required by law (in which case it tells the Customer first unless the law forbids it). Go1000.ai will tell the Customer if it believes an instruction violates the law.

The Customer is responsible for having a lawful basis and any notices and consents needed for the data it puts into Go1000.ai and for its instructions.

3. Service-Provider Commitments (CCPA and State Laws)

Go1000.ai will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes in the Terms, including any commercial purpose of its own; (c) retain, use or disclose it outside the direct business relationship with the Customer; or (d) combine it with personal information from other sources or other customers, except as the law permits a service provider to do. Go1000.ai will comply with the obligations that apply to it as a service provider, provide the same level of privacy protection the law requires, and tell the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remedy unauthorized use. Go1000.ai certifies that it understands and will comply with these restrictions.

4. GLBA and the FTC Safeguards Rule

Go1000.ai will use and disclose nonpublic personal information only to perform the services for the Customer, as permitted by 16 CFR 313.11 (limits on reuse and redisclosure). Go1000.ai maintains the administrative, technical and physical safeguards in Annex 1, appropriate to its size and the sensitivity of the information, so that the Customer can meet its duty to oversee service providers under 16 CFR 314.4(f). On reasonable request, Go1000.ai will answer the Customer's security questionnaire once a year and provide a summary of its security program.

5. Confidentiality of Personnel

Only Go1000.ai personnel who need access to provide or support the service have it, under confidentiality obligations, with training on handling personal information. Support access to a Customer's account is logged with the person, time and reason, and the Customer sees each support visit on its Overview. During a support visit, Go1000.ai personnel may open and change any part of the account needed to help (including client records, documents and messages), only for the reason given, for a limited time, and every change they make is recorded in the account's history.

6. Subprocessors

The Customer authorizes the Subprocessors listed on the Subprocessors page. Go1000.ai binds each by written contract to data-protection obligations at least as protective as this DPA, and remains responsible for their performance.

Go1000.ai will give at least 30 days' notice (by updating that page and emailing the account owner) before adding or replacing a Subprocessor, except in an emergency to keep the service running, in which case it notifies as soon as possible. The Customer may object on reasonable data-protection grounds within that period; the parties will work in good faith to resolve it, and if they can't, the Customer may cancel the affected service and receive a prorated refund of prepaid fees.

7. Help with Individuals' Requests

Taking into account the nature of the processing, Go1000.ai will help the Customer respond to requests from individuals to access, correct, delete, or receive a copy of their information, mainly through the tools in Admin (client records, order archive and export). If Go1000.ai receives a request directly about Customer Personal Data, it will forward it to the Customer within 10 business days and will not answer it except as the Customer directs or the law requires.

8. Security Incidents

Go1000.ai will notify the Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting the Customer's Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences, and the steps taken or proposed, and will be updated as more becomes known. Go1000.ai will take reasonable steps to contain and remedy it, keep records of it, and give the Customer reasonable help with its own notices to individuals and regulators (for example the FTC notice within 30 days for events affecting 500 or more consumers, and state notices). Unless the law requires it, Go1000.ai will not notify the Customer's clients or regulators about the Customer's data without the Customer's agreement.

9. Information and Audits

Go1000.ai will make available the information reasonably needed to show compliance with this DPA, through its security summary and questionnaire answers. If that is not enough, or a regulator requires it, the Customer may audit once a year, with 30 days' notice, during business hours, at its own cost, through an independent auditor under confidentiality, in a way that does not expose other customers' data.

10. Return and Deletion

During the subscription the Customer can export its data or request an export, delivered within 30 days. After the subscription ends, Go1000.ai keeps Customer Personal Data 90 days so the Customer can export it, then deletes it, except where the law requires keeping it. Encrypted backups roll off on their normal schedule and are not restored except for disaster recovery. On request, Go1000.ai confirms deletion in writing.

11. Location

Go1000.ai stores and processes Customer Personal Data in the United States. Content delivery networks may cache public website content worldwide.

12. Health Information

Go1000.ai's appraiser service is not designed for protected health information under HIPAA, and the Customer must not put it there. Any HIPAA-covered service requires a separate Business Associate Agreement signed by both parties.

13. Term and Liability

This DPA lasts as long as Go1000.ai processes Customer Personal Data. Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it.

Annex 1: Security Measures

• Access: two-step sign-in required for Admin and for Go1000.ai staff; role-based permissions per team member; staff access only with a logged, visible reason.
• Separation: every record carries its company, and row-level security in the database limits each company to its own data; automated tests check this separation.
• Encryption: TLS for data in transit; data encrypted at rest by our hosting and database providers; connected-account tokens and secrets additionally encrypted by Go1000.ai.
• Data minimization: Social Security and card-number patterns are hidden in portal messages and AI chats; property-data and AI providers receive only what each request needs; AI providers do not train on the data.
• Logging and monitoring: audit logs of approvals and sensitive actions; an append-only billing record; error and security monitoring.
• Resilience: managed database with backups and point-in-time recovery on the production plan; infrastructure across multiple availability zones.
• Development: code review, automated tests (including data-separation and no-secrets checks), secrets kept only in environment settings, dependencies kept current.
• People and vendors: confidentiality obligations; security due diligence and written contracts with Subprocessors.
• Incident response: a written plan with roles, containment, investigation, notification (Section 8) and review.

Annex 2: Processing Details

• Subject matter and duration: providing Go1000.ai to the Customer for the subscription term and the 90-day export period.
• Nature and purpose: hosting, storing, organizing, transmitting and displaying data to provide the website, quotes, orders, portal, scheduling, payments, messages, texts, calls, AI features, social posting and support.
• People: the Customer's clients and their representatives, website visitors, the Customer's team, and people the Customer contacts.
• Data: names, contact details, property addresses and facts, order and payment status, documents, signed engagement records, messages, call recordings and transcripts, consent records, and technical data (IP address, browser).
• Sensitive data: not intended. The Customer must not upload Social Security, full financial-account or health information unless the service requires it.