Data Processing Addendum

This Data Processing Addendum forms part of the Terms of Use at /terms between Verve AI LLC and the customer that operates a RoofKit workspace. Where this addendum conflicts with the Terms of Use, this addendum controls for the processing of Customer Personal Data.

The customer is the business and the controller. Verve AI LLC is the service provider and the processor. This allocation applies to homeowner and lead personal information collected through the customer's branded public experiences.

Verve AI LLC is the business and the controller for the customer's own account, workspace configuration, and billing information. This addendum does not apply to that data.

Verve AI LLC processes Customer Personal Data only for the specific purposes set out in this addendum and only on the customer's documented instructions. The Terms of Use, this addendum, and the customer's configuration of the platform together are those documented instructions.

Verve AI LLC does not retain, use, or disclose Customer Personal Data for any purpose other than performing the services, and does not retain, use, or disclose it outside the direct business relationship between the parties.

Verve AI LLC tells the customer without undue delay if it determines that an instruction violates applicable privacy law, and may stop the processing concerned.

Verve AI LLC is prohibited from doing each of the following with Customer Personal Data.

• Selling it, as applicable state law defines a sale.
• Sharing it for cross-context behavioral advertising. A customer instruction does not override this prohibition under this addendum.
• Combining it with personal information received from another source, except where applicable law permits a service provider to do so to perform a business purpose for the customer.
• Using it to build or modify a profile of a consumer for the benefit of another business.
• Using it to train a general-purpose model, or any model offered to a party other than the customer, in identifiable form.
• Retaining, using, or disclosing it outside the direct business relationship between the parties.

Verve AI LLC may use service data, aggregated data, and de-identified content as the platform data license in the Terms of Use at /terms describes. That material is not Customer Personal Data. Verve AI LLC maintains it in de-identified form, does not attempt to re-identify it, and requires the same of any recipient.

Measurement training follows that rule. RoofKit uses a property address and precise coordinates only inside RoofKit to validate stored imagery. A training example is covered only when it is a geometric derivative that meets the De-Identified Content standard in the Terms of Use. Linked measurement proposals and operator corrections remain Customer Personal Data.

Verve AI LLC certifies that it understands these restrictions and will comply with them.

The customer gives general authorization for Verve AI LLC to engage subprocessors. The current registry appears in the RoofKit compliance documentation and the Privacy Policy at /privacy lists the categories.

Verve AI LLC imposes on each subprocessor, by written contract, obligations that are at least as protective as those in this addendum. Verve AI LLC remains liable to the customer for the performance of each subprocessor.

Verve AI LLC gives the customer at least 30 days notice before it adds or replaces a subprocessor that processes Customer Personal Data. The customer may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve the objection. If they cannot, the customer may terminate the affected service without penalty.

Verve AI LLC gives the customer the tooling to answer a consumer request. The lead detail view exposes an export action and a delete action for each lead, and the platform records an audit trail for each one.

If a consumer sends a request directly to Verve AI LLC for data that belongs to a customer workspace, Verve AI LLC does not answer it on the merits. Verve AI LLC forwards the request to the customer without undue delay and tells the consumer that it did so.

Verve AI LLC assists the customer with data protection assessments and with security incident notification, taking into account the nature of the processing and the information available.

Verve AI LLC maintains appropriate technical and organizational measures for the processing, including the following.

• Encryption of data in transit and at rest.
• Encryption of integration credentials and webhook signing secrets with a versioned key and an authenticated cipher.
• Tenant isolation enforced at the data access layer.
• Role-based access control and least privilege for personnel.
• Audit logging of privileged operations and of privacy operations.
• Monitoring, alerting, and a documented incident response plan with per-state notification deadlines.
• Personnel confidentiality obligations that survive the end of employment.

Verve AI LLC notifies the customer without undue delay, and in no case later than 48 hours, after it becomes aware of a security incident affecting Customer Personal Data. The notice describes the nature of the incident, the categories and approximate number of records affected, the likely consequences, and the measures taken.

Verve AI LLC makes available the information necessary to demonstrate compliance with this addendum, including the third-party audit reports of its infrastructure providers.

The customer may take reasonable and appropriate steps to verify that Verve AI LLC uses Customer Personal Data in a manner consistent with the customer's obligations, no more than once in any 12-month period, on 30 days written notice, during business hours, and without disrupting the service or the data of another customer.

If the customer discovers unauthorized use of Customer Personal Data, the customer may notify Verve AI LLC, and Verve AI LLC will stop and remediate that use.

Verve AI LLC retains Customer Personal Data for the periods below unless the customer instructs a shorter period.

On termination, Verve AI LLC deletes or returns Customer Personal Data within 90 days, except for records that a legal obligation or the defense of a legal claim requires it to keep. Records kept for that reason remain subject to this addendum.

Consent proof, consent events, and opt-out status survive a deletion request. Removing an opt-out record would cause the platform to forget the opt-out and to contact the consumer again, which converts a privacy control into a violation.

Questions about this addendum can be sent to legal@roofkit.ai. Privacy requests go to privacy@roofkit.ai.

Verve AI LLC may update this addendum to reflect a change in law or in the service. Material changes are announced before they take effect, and the version is recorded in the RoofKit policy version registry.

Related documents: Terms of Use at /terms, Privacy Policy at /privacy, and Cookie Policy at /cookies.