Data Processing Addendum

Version 1.2 · Effective date: October 10, 2026

This Data Processing Addendum ("DPA") forms part of the service agreement between Rook LLC ("Rook") and the business using Rook ("Client") (the "Agreement"). It applies during the free beta and paid service whenever Rook processes personal data on Client's behalf. This DPA controls over conflicting Agreement terms concerning that processing.

1. Roles and instructions

"Client Personal Data" means personal information processed on Client's behalf through Rook. Client acts as controller or business, and Rook acts as processor or service provider, as applicable. Each party must comply with privacy and information-security laws applicable to its role and processing ("Applicable Law"). Rook's own account administration, subscription billing and direct website dealings are governed by its Privacy Policy. Client Personal Data used for service security or support remains covered by this DPA.

Rook will process Client Personal Data only to provide, maintain, secure and support the service on documented instructions in the Agreement, enabled features, Client's settings and other agreed written instructions, or as law requires. Rook will notify Client of legally required processing outside those instructions unless prohibited, and promptly raise instructions it reasonably believes unlawful. Client is responsible for lawful instructions, required privacy notices and messaging permissions. Rook remains responsible for its own compliance.

Client Personal Data excludes a separate home-file copy created only after Client enables that feature and the homeowner accepts its notice and terms. Rook operates that copy as a direct homeowner service and acts as controller where applicable. Processing needed to prepare and lawfully disclose Client's records to that service remains subject to this DPA until that separate copy is created. The original Client records remain Client Personal Data and follow Section 8. Client must have lawful authority for the disclosure; neither this exclusion nor a contract label removes applicable statutory duties or authorizes unrelated use.

2. Processing details

Subject and purpose. Customer communications, service-area checks, scheduling, job and invoice updates, permitted reminders and relationship context. Processing includes collection, storage, analysis, transmission and deletion, including AI processing for enabled features.

Where separately enabled and authorized, preparation and disclosure of selected completed-work records to the home-file service described in the Terms and Privacy Policy.

Duration. The service relationship, including an agreed pause, followed by the return, deletion and backup periods in Section 8.

Individuals. Client's leads, customers, property contacts and personnel whose information appears in Client-controlled service records.

Data categories. Names, contact details, service addresses and relevant locations, messages, chat and form content, photos and their links and descriptions, appointments and calendar information, imported customer and job records, preferences, invoice amounts and payment status, consent and opt-out records, call and delivery metadata, and related technical information. Calls are not recorded.

Sensitive information. Client must not intentionally submit Social Security numbers, government identification, full payment-card details, health information or unrelated account passwords. Unrequested sensitive information remains protected by this DPA. Credentials needed for an authorized integration are handled under Section 3.

3. Confidentiality and security

Rook will restrict access to personnel and contractors who need it for authorized purposes and are bound by confidentiality. It will maintain safeguards appropriate to processing risks, including access controls, encryption in transit, encryption of stored secrets and integration credentials, database-enforced separation of clients' records, password protections, available two-step sign-in, expiring access links, rate limits, monitoring, encrypted backups and vendor oversight.

Rook's code will remove message text, phone numbers, email addresses and addresses before sending diagnostic information to Sentry. Rook will also configure Sentry to scrub sensitive fields, avoid storing IP addresses and exclude personal details from alert emails, and require two-step sign-in for all users of Rook's Sentry account. Protected service records and action histories are maintained separately. Two-step sign-in is required for Rook's administrators and optional for Client's business users. Client must secure its users, devices, permissions and connected accounts. Changes to safeguards must maintain an appropriate level of protection.

4. Subprocessors

Client authorizes the active subprocessors below. Rook will engage them under written contracts requiring Rook's data-protection obligations for their delegated processing and will remain responsible to Client for their performance.

Before a new or replacement subprocessor receives Client Personal Data, Rook will give 30 days' email notice identifying its function, relevant data and known processing locations, unless Client expressly agrees to a shorter period. Client may object within 15 days on reasonable privacy or security grounds. The parties will seek a reasonable solution; Rook will not send the objecting Client's data to the proposed provider while the objection remains unresolved.

If no reasonable solution is available, either party may discontinue the affected feature, and Client may terminate the affected service without a termination fee, with a refund of attributable unused prepaid fees. Rook will maintain the provider list; updating it does not replace required notice or authorization.

5. AI and permitted data use

Rook will send AI providers only information reasonably needed to interpret communications, describe photos and draft wording for enabled features, under terms prohibiting model training on Client Personal Data. Stored access instructions, such as gate or lock codes, are restricted to authorized Client users and excluded from AI context and customer replies. Free-form messages and photos may themselves contain phone numbers, amounts or other personal information.

Rook will not sell Client Personal Data, use it for advertising or model training, or use identifiable customer content for unrelated product development. Aggregated or de-identified service statistics may be used only as authorized by the Agreement and permitted by Applicable Law and platform restrictions. Rook will protect against identification, maintain such data in de-identified form, make any required public commitment, restrict recipients accordingly and not attempt re-identification except as legally permitted to test safeguards.

6. Privacy requests and assistance

Taking account of the processing and information available to it, Rook will reasonably assist Client with access, correction, deletion, portability and other applicable requests, security duties, breach notifications and required data protection assessments. Direct requests concerning Client Personal Data will be promptly referred to Client. Rook will not decide them independently unless Client instructs it or law requires. The parties will coordinate in time to meet applicable legal deadlines.

7. Security incidents

A "Security Incident" means a security breach causing unauthorized access to or disclosure of, or accidental or unlawful loss, alteration or destruction of, Client Personal Data processed by Rook or its subprocessors. Unsuccessful attempts that do not compromise the data are excluded.

Rook will notify Client without undue delay and no later than 72 hours after becoming aware of a Security Incident, or sooner if Applicable Law requires. Notice will not await a completed investigation. Rook will investigate, contain and remediate the incident and provide reasonably available information about affected data and individuals, likely consequences, response measures and a follow-up contact, with material updates. Rook will assist Client's notification obligations without limiting notices Rook itself must give under law.

This is an outside deadline, not permission to wait 72 hours where immediate or earlier notice is legally required. Keep awareness as the trigger, rather than confirmation after investigation.

8. Return and deletion

After service ends, Client may choose return of Client Personal Data in a reasonably usable electronic format or deletion. Rook will fulfill lawful instructions without undue delay and delete remaining active copies within 90 days after the effective end of service, or earlier at Client's request. Client may request return while data remains available, including after dashboard access ends. Rook will also comply with lawful deletion instructions during service. Deletion covers photos and copies held by subprocessors; Rook will direct their compliance.

Raw technical copies of incoming messages and AI replies are cleared within 90 days of receipt or generation; ordinary conversation histories and service records follow the preceding retention rule. Backups will be removed through scheduled rotation within 90 days after active-system deletion. Pending removal, they are protected and excluded from ordinary use; deletion instructions will be reapplied after restoration.

Retention exceptions are limited to information required by law and minimal consent or suppression records lawfully necessary to document permissions or prevent unwanted re-contact. Retained data remains protected, restricted to that purpose and deleted when no longer necessary. Rook will confirm return or deletion on reasonable request.

Messaging-provider photos are retained for up to 180 days from receipt, subject to earlier lawful deletion and the 90-day deletion deadline after service ends. Security and diagnostic records under Rook's control are retained for up to 90 days, subject to lawful preservation and the shorter provider access and retention periods disclosed in the Privacy Policy.

Termination-related deletion of Client Personal Data does not delete the separately authorized home-file copy described in Section 1. That copy is retained under the homeowner's direct agreement, Privacy Policy and applicable law, including homeowner deletion rights. This distinction applies only to selected records actually contributed with both required authorizations; it does not permit Rook to retain all customer messages, ordinary job records or photos as home-file data. Client's original copies remain subject to this section.

9. Compliance and assessments

Rook will provide information reasonably needed to demonstrate compliance and cooperate with reasonable audits or assessments by Client or its qualified designated assessor. Reasonable notice, confidentiality and security procedures must protect other clients and avoid unnecessary disruption without limiting legally required access. Intrusive testing requires prior written authorization. Where legally permitted and Client agrees, a qualified independent assessment and report may be used instead, meeting applicable requirements for standards, frequency and cost, including an annual assessment at Rook's expense where required.

This DPA continues while Rook or its subprocessors retain Client Personal Data. The Agreement's notice, governing-law, dispute and liability provisions apply, subject to mandatory law; neither party's statutory responsibilities are waived. DPA notices and requests to Rook: support@lunisolutions.com. Client must keep its account and incident-contact details current.

Provider list

Only processing on Client's behalf is covered below. Rook's Supabase database is hosted in the United States; other processing locations depend on provider and configuration. Rook will maintain current contracting-entity and processing-location information and provide it on request.

Active subprocessors

Connected platforms and other providers

Client authorizes disclosed data exchanges when it enables or directs a feature. Provider roles depend on the service and account arrangement; Section 4 applies whenever a provider acts as Rook's subprocessor. Rook remains responsible for its own access and transfers.

Other providers Rook uses through its own accounts:

Client-selected platforms, which Client chooses and uses through its own accounts and agreements with their providers. They are not Rook's subprocessors unless a provider processes Client Personal Data on Rook's behalf:

Stripe and other announced connections remain excluded until available and enabled. Facebook and Instagram messaging is built but disabled pending Meta approval. When enabled, Meta Platforms provides the connected messaging platform; data exchanged includes names, message content, photos, Meta-assigned identifiers and connection information. Meta's role depends on the platform and applicable terms and is not automatically that of Rook's subprocessor. Section 4 applies if a provider processes Client Personal Data as Rook's subprocessor. Rook will obtain required permissions and update the list before activation.

Inactive Stripe, Facebook, Instagram and other planned connections are excluded. Rook will update disclosures and obtain required authorization before enabling them.