Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service and Privacy Policyand governs how Persistent Workforce ("Processor") processes personal data on behalf of customers ("Controller"). It identifies the categories of personal data processed, the sub-processors we rely on, the security measures we maintain, and the rights you can exercise.

Controller. The customer determines the purposes and means of processing the customer and lead data it keeps in the Service. The customer is the controller of that data.

Processor.Persistent Workforce processes that data only on the customer's documented instructions, which are reflected in the features exposed by the Service and the work the customer approves for its AI employees (pipeline and invoices, post and content generation, publishing to connected accounts, email and text messaging, automations and workflows, analytics).

On the customer's behalf, we process the following data about the customer's own customers and leads: names, email addresses, phone numbers, companies, postal addresses, notes, pipeline stages, invoices, form submissions, and the emails, texts and calls exchanged with them through the Service.

We also process data from accounts the customer connects (for example a Facebook Page, Google Business Profile or Slack workspace): account details, access tokens, and what an AI employee reads or publishes there for the customer.

On the customer's behalf, we also process data about recipients of customer-sent emails (welcome, follow-up, drip, lead notifications): email addresses, names, and delivery metadata (open / click / bounce status returned by our email provider).

The Service relies on the following sub-processors, each bound by their own data processing terms. By using the Service you authorize their engagement.

We notify customers of new sub-processors by updating this page; the "Last updated" date above reflects sub-processor changes.

Customer data is stored in the United States (Supabase, US region) and served from Vercel. Platforms the customer connects process the data sent to them under their own terms and in their own regions. EU/UK customers acknowledge that personal data is transferred to the US and processed there. We rely on the standard contractual clauses incorporated into our sub-processors' terms; on request we will furnish copies for the chain relevant to your data.

We maintain the following technical and organizational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 via Supabase Storage and database).
• Row-Level Security (RLS) on every customer-data table — records are scoped to the owning workspace and cannot be read by other customers.
• HTTPS-only with HSTS preload; CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers on every response.
• Webhook signature verification on all inbound integrations (for example Stripe, Twilio and Meta data-deletion requests).
• Tokens for connected accounts encrypted with AES-256-GCM in a table only our server can read.
• Access controls: production access limited to founding operator; service-role credentials rotated on operator change.
• Logging and audit trail: server logs retained ≤ 30 days for security and debugging.

People whose data the customer keeps in the Service can exercise GDPR / CCPA rights (access, correction, deletion, portability) by contacting the customer that uploaded their data. We will support the customer in fulfilling such requests on receipt of a written direction; see legal@persistentmomentum.com for the contact form.

On confirmed personal data breach affecting customer data, we will notify the customer without undue delay and not later than 72 hours after becoming aware, with the information then available, and update the customer as the investigation progresses.

On termination of the customer's account, customer-owned data (customers, leads, pipeline, posts and content, brand) is retained for 30 days for accidental- deletion recovery, then deleted from active systems. Backups age out within a further 30 days. Customers can request earlier deletion via legal@persistentmomentum.com.

Customers may, upon reasonable written notice, audit our compliance with this DPA no more than once per twelve-month period and at the customer's expense. Audits will be conducted during business hours, will be subject to mutual NDA, and will not unreasonably interfere with operations.

This published DPA satisfies most customer requirements. Customers whose procurement process requires a signed contract may request one at legal@persistentmomentum.com — include your company name and the email address of the signatory.

Privacy, security, or DPA questions: legal@persistentmomentum.com.

Security disclosures: see /.well-known/security.txt.