This Data Processing Addendum ("DPA") forms part of the Planlyx Terms of Service (the "Agreement") between Planlyx ("Planlyx") and the subscribing firm ("Customer"). It governs Planlyx's processing of Customer Personal Data in providing the Planlyx service (the "Service") and in de-identifying it as described in Section 2.3. This DPA is incorporated into the Agreement automatically; no signature is required. A countersigned copy is available on request to legal@planlyx.com.

---

1. Definitions

"Applicable Privacy Laws" means the United States federal and state privacy laws that apply to a party's processing of Customer Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq., and its regulations ("CCPA"), and comparable comprehensive state privacy laws.

"Customer Personal Data" means personal information that Planlyx processes on Customer's behalf in providing the Service — information relating to Customer's clients, vendors, prospects, enquiry submitters, correspondents, and other individuals whose information Customer or its users submit to the Service, as further described in Annex A. It does not include Business Contact Data.

"Business Contact Data" means information Planlyx processes for its own purposes as an independent business: Customer's account registration details, the identity and contact information of Customer's account users in their capacity as Planlyx's own users, billing information for Customer's Planlyx subscription, and Planlyx's records of its relationship with Customer. Planlyx's processing of Business Contact Data is described in the Planlyx Privacy Policy, not this DPA. Records of payments made to Customer by Customer's clients are not Business Contact Data.

"Security Incident" means a confirmed breach of Planlyx's security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

"Personal information," "business," "service provider," "sell," "share," "business purpose," and "consumer" have the meanings given in the CCPA; equivalent terms in other Applicable Privacy Laws (such as "controller" and "processor") are construed accordingly.

2. Roles and scope

2.1 For Customer Personal Data, Customer is the business (controller) and Planlyx is Customer's service provider (processor). Planlyx processes Customer Personal Data only to provide the Service under the Agreement and Customer's instructions given through the Service's features and settings, and to de-identify it as described in Section 2.3. Planlyx processes it for no other purpose.

2.2 United States scope. The Service is designed to process the personal information of individuals located in the United States, and this DPA addresses United States law only. Customer warrants that it will not cause Customer Personal Data of individuals located outside the United States to be processed through the Service, and Customer is solely responsible for any consequences of doing so. This DPA does not incorporate the GDPR, UK GDPR, standard contractual clauses, or any non-U.S. transfer mechanism.

2.3 De-identified data. Under Section 4.2(b) of the Terms of Service, Customer licenses Planlyx to de-identify Customer Content (as defined in Section 4.1 of the Terms of Service) submitted by Customer's Owners and team members, and by vendors who have accepted the Terms of Service, whenever it was submitted, and to use the resulting de-identified data to analyze, develop, train and improve Planlyx's products and services, including machine-learning models. Customer instructs Planlyx, as its service provider, to de-identify the Customer Personal Data contained in that content for that purpose. Content submitted by people who have not accepted the Terms of Service, directly or through Customer — for example Customer's clients, people answering Customer's questionnaires, or people who email into the Service — is not used this way. Nor are the payment records the Service receives from Stripe for Customer's invoices under Section 6A of the Terms of Service, which are not submitted by Customer's users. In this Section 2.3, data is de-identified when it can no longer reasonably be linked to any individual, household, firm, client, project or property. Planlyx will take reasonable measures to keep de-identified data that way, will not attempt to re-identify it (except to test that its de-identification works), and will contractually require anyone it shares de-identified data with to do the same. Data de-identified in this way is not Customer Personal Data. An Owner of Customer's account may opt Customer out of this use under Section 4.2(c) of the Terms of Service, as described in the Planlyx Privacy Policy.

3. Planlyx's obligations as service provider

Planlyx certifies that it understands and will comply with the following restrictions. Planlyx will not:

• (a) sell or share Customer Personal Data;
• (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in Annex A, or as otherwise permitted for service providers under Applicable Privacy Laws;
• (c) retain, use, or disclose Customer Personal Data outside the direct business relationship between Planlyx and Customer; or
• (d) combine Customer Personal Data with personal information received from another customer or collected from Planlyx's own interaction with a consumer, except as permitted for service providers under Applicable Privacy Laws (for example, to detect security incidents or protect against fraudulent or illegal activity).

Planlyx will provide the same level of privacy protection for Customer Personal Data as Applicable Privacy Laws require of Customer; will notify Customer without undue delay if it determines it can no longer meet its obligations under Applicable Privacy Laws; and, upon such notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including by directing Planlyx to stop and remediate it.

De-identifying Customer Personal Data under Section 2.3 is a business purpose specified in Annex A, carried out within the direct business relationship between Planlyx and Customer. Once data has been de-identified under Section 2.3, it is no longer Customer Personal Data, and this Section 3 does not apply to it.

Customer may take reasonable and appropriate steps to ensure Planlyx uses Customer Personal Data consistently with Customer's obligations under the CCPA. Those steps are limited to requesting, no more than once a year, the written information Planlyx makes available about its safeguards. If Customer reasonably believes Planlyx is using Customer Personal Data without authorization, Customer may notify Planlyx in writing, and Planlyx will stop and remediate that use. Planlyx will notify Customer if it can no longer meet its obligations under the CCPA.

4. Customer's obligations

Customer is responsible for: (a) the accuracy, quality, and lawfulness of Customer Personal Data and the means by which it was acquired, including the warranties for imported contact lists in the Agreement; (b) providing all notices and obtaining all consents or authorizations that Applicable Privacy Laws require of Customer for the processing contemplated by the Agreement, including notices to individuals who submit Customer's enquiry forms; (c) its instructions to Planlyx complying with law; and (d) its own compliance with laws governing its communications with individuals, including the CAN-SPAM Act.

5. Requests from individuals

5.1 Routing. If Planlyx receives a request from an individual to exercise a privacy right (access, deletion, correction, portability, or similar) concerning Customer Personal Data, Planlyx will not respond substantively except to inform the individual that the request has been forwarded, and will forward the request to Customer promptly.

5.2 Assistance. Taking into account the nature of the processing, Planlyx will provide reasonable assistance to Customer in responding to verified consumer requests, using the Service's existing features where possible (record access, correction of contact records, project-record export, and — for deletion — the mechanism in Section 9.3). Customer remains responsible for verifying and responding to requests concerning Customer Personal Data.

6. Subprocessors

6.1 Customer generally authorizes Planlyx to engage the subprocessors listed in Annex C to process Customer Personal Data for the purposes described there. Planlyx will keep Annex C and the subprocessor list published on its website (currently planlyx.com/legal/subprocessors) current, updating both to record the date and nature of any addition or replacement of a subprocessor that processes Customer Personal Data. That publication is Planlyx's notice to Customer of the change; Planlyx does not separately notify Customer by email or in the Service before making it.

6.2 If Customer does not wish to continue using the Service following a change to the subprocessor list, Customer may terminate the Agreement for that reason at any time and receive a refund of prepaid unused fees. Upon a termination under this Section 6.2, Planlyx may promptly delete Customer Personal Data — or, where a record structure is append-only or write-once by design and cannot be erased without compromising the integrity of the records of others, de-identify it — without waiting for the written request or the 90-day period described in Section 9.3, in order to end Customer Personal Data's exposure to the new subprocessor. Backup residuals are the exception: they cannot be deleted before their retention period ends, and the offsite copies are not automatically destroyed when it does; Section 9.3(b) describes how they are held.

7. Security

Planlyx will implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of Customer Personal Data, as described in Annex B, and will ensure that personnel with access to Customer Personal Data are subject to confidentiality obligations. Planlyx may update Annex B under Section 10.4.

8. Security Incidents

Planlyx will notify Customer without undue delay after becoming aware of a Security Incident, and will provide, as information becomes available: a description of the incident and the categories and approximate volume of Customer Personal Data affected; the measures taken or planned to address it; and a contact point. Planlyx will take reasonable steps to contain and remediate the incident and will cooperate with Customer's reasonable requests for information. Planlyx's notification is not an admission of fault. Customer is responsible for any notification to individuals or regulators that Applicable Privacy Laws require of Customer as the business.

9. Retention, deletion, and return

9.1 During the term. Planlyx retains Customer Personal Data for as long as the Agreement is in effect, in accordance with the Service's design — including its append-only activity records, message logs, and write-once approval records, whose retention and immutability are disclosed features of the Service that preserve the evidentiary integrity of Customer's project records.

9.2 Export. Customer may export project records through the Service's export features at any time during the term and during the post-termination access period described in the Agreement.

9.3 Deletion on request after termination. Upon Customer's written request made after termination or expiration of the Agreement, Planlyx will, within 90 days of the request, delete Customer Personal Data or, where a record structure is append-only or write-once by design and cannot be erased without compromising the integrity of the records of others, de-identify the Customer Personal Data within it so that it no longer identifies any individual. The following are excepted from deletion: (a) data Planlyx must retain to comply with legal obligations, resolve disputes, or enforce agreements, which will be retained only as long as needed for those purposes and remain protected by this DPA; and (b) residual copies in backup systems, which cannot be erased early and are held as described below. The retention periods that apply to them are currently: up to seven days for the primary provider's point-in-time recovery; and, for the independent offsite backup described in Annex C, a retention lock of at least 90 days (daily copies) and 365 days (monthly copies). The offsite copies are written to storage under a retention lock that the backup system's own credentials cannot remove: while a copy's lock is in force, the job that writes the copies cannot delete or overwrite it, and the retention cannot be shortened from within the Service. Lifting it requires separate administrative access to the storage provider, held only by Planlyx's own account holder. For that reason, the offsite copies cannot be erased before their retention period ends, including upon request. Those lock periods are minimums, not maximums: an offsite copy is not automatically destroyed when its lock expires, and Planlyx does not currently operate an automatic expiry schedule for them. They are never used to operate the Service and are read only to verify they remain restorable, or to perform a restore. On written request, Planlyx will confirm completion of deletion.

9.4 Absent a request. If Customer makes no deletion request, Planlyx retains Customer Personal Data in accordance with the Planlyx Privacy Policy and, where the subscription has lapsed, in accordance with the schedule in Section 12.5 of the Terms of Service, once that schedule operates under Section 12.5(e) of those Terms — under which Customer's stored files are deleted at the end of a retention window of 90 days (a Customer that has held a paid subscription) or 30 days (a trial that never converted), measured from the start of restricted access or, where Customer cancels, from when the cancellation takes effect, with notice to the account Owner when restricted access begins and again approximately 30, 14 and 5 days before the window ends. Restoring a paid subscription before the end of the window stops it. Deletion under that schedule removes stored files; append-only activity, approval and message records are not rewritten by it, and paragraph 9.3(b) applies to backup copies of both. Customer Personal Data is protected at all times by this DPA's restrictions, and this schedule does not shorten any period Planlyx must observe to comply with law.

9.5 De-identified data. Deletion of Customer Personal Data — under this DPA, under Section 12.5 of the Terms of Service, by Customer's users in the Service, or otherwise — and the end of the Agreement do not reach data already de-identified under Section 2.3, or models already trained with it. The Customer Personal Data itself is deleted as this DPA describes.

9.6 Records in Customer's Stripe account. Where Customer uses client payments under Section 6A of the Terms of Service, payment pages, customer records, and the records of payments that Stripe keeps, created through the Service, are held in Customer's own Stripe account under Customer's agreement with Stripe. They are not held by Planlyx, and deletion or de-identification under this Section 9, the end of the Agreement, and disconnecting Customer's Stripe account from the Service do not remove them. Customer can manage or delete them in its Stripe dashboard. If Planlyx receives a request concerning them, it will refer the request to Customer under Section 5.1. Before deleting Customer's account, Planlyx disconnects Customer's Stripe account from the Service, or records a request to do so that stops new payments.

10. General

10.1 This DPA is effective for as long as Planlyx processes Customer Personal Data. Sections 3, 8, 9, and 10 survive termination of the Agreement until processing ceases. Planlyx's commitments about de-identified data in Section 2.3 continue for as long as Planlyx holds that data.

10.2 This DPA is subject to the limitations of liability in the Agreement; each party's liability arising out of this DPA counts toward, and is capped by, those limitations.

10.3 If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA controls. If a provision of this DPA is unenforceable, the remainder stays in effect, and the parties will replace the unenforceable provision with an enforceable one that most closely achieves its intent.

10.4 Planlyx may update this DPA by posting an updated version with a new effective date. An update takes effect when it is posted, and Customer's continued use of the Service after that constitutes acceptance.

---

Annex A — Details of processing

Nature and purpose of processing. Hosting, storage, organization, display, transmission, and retrieval of Customer Personal Data as necessary to provide the Service: sales pipeline and contact management; project management; drawing storage, versioning, review, and comment; revision-round and change-order workflow; proposal and invoice generation; online payment of Customer's invoices through Customer's own Stripe account — creating Stripe-hosted payment pages for Customer's invoices, providing payment links, and recording the payment status, refunds and disputes Stripe reports; client-portal access; sending and receiving email on Customer's behalf, including commercial outreach initiated by Customer; enquiry-form intake; maintenance of append-only activity and approval records; abuse prevention on Customer's public forms; and support, security, and troubleshooting of the Service. In addition, unless Customer has opted out, de-identification of Customer Personal Data as described in Section 2.3; data de-identified in this way is not Customer Personal Data.

Business purposes (CCPA § 1798.140(e)). Performing services on behalf of Customer, including maintaining and servicing accounts, providing customer service, processing transactions, and providing similar services; helping to ensure security and integrity; debugging to identify and repair errors; short-term transient use; and, as specified in Section 2.3, de-identifying Customer Personal Data so that the de-identified data can be used to analyze, develop, train and improve Planlyx's products and services, including machine-learning models.

Duration. The term of the Agreement, plus the period until deletion or de-identification under Section 9 — which, absent a request and where the subscription has lapsed, is the retention window in Terms Section 12.5: 90 days for a Customer that has held a paid subscription, or 30 days for a trial that never converted, measured from the start of restricted access or, where Customer cancels, from when the cancellation takes effect. Backup copies are held as Section 9.3(b) describes. Hashed IP addresses recorded on payment pages are deleted after 30 days.

Categories of individuals. Customer's clients and their co-reviewers; Customer's vendors and consultants; prospects and other sales contacts imported or entered by Customer; individuals who submit Customer's enquiry forms (including submissions rejected by abuse-prevention checks); individuals who correspond with Customer at its Service email address; individuals who pay Customer's invoices online, who may be people other than Customer's clients; and other individuals referenced in content Customer's users enter into the Service.

Categories of personal information. Identifiers and contact details (name, email address, telephone number, organization, postal address where entered); professional and commercial information (deals, proposals, change orders, invoices, project participation, approval records); communications content (messages, comments, email bodies and attachments, prospect replies); free-text notes entered by Customer's users; approval metadata (for proposal approvals, the approver's IP address and browser user-agent captured at the moment of approval); payment records for Customer's invoices (amount, date, status, payment method type, refund and dispute amounts and dates, failure codes, dispute reasons and response deadlines, staff review notes, and Stripe reference numbers), which Planlyx stores without the payer's name, email address, card or bank details — payer details included in Stripe's notifications, and in payment details Planlyx reads back from Stripe — including notifications about payments Customer takes outside the Service — are received transiently and not stored; and hashed IP addresses recorded on Customer's public forms, questionnaire links and payment pages for abuse prevention.

Sensitive personal information. The Service does not request or require sensitive personal information. Customer should not submit it; if Customer's users include it in free-text content or files, it is processed only as content within the categories above. Card numbers, bank account numbers and bank sign-in credentials are entered only on pages hosted by Stripe for Customer's own Stripe account and are not received by Planlyx.

Annex B — Security measures

• Authentication is by emailed one-time sign-in link; the Service stores no passwords. A team member or vendor gains access only upon acceptance of an invitation; clients reach the portal for a project once the Customer invites them.
• Tenant segregation between customers is enforced at the database layer through row-level security tied to authenticated identity, not solely in application code.
• Role-based access within an account (Owner, Team member, Vendor, Client) restricts each user to permitted records; client-portal reads pass through restricted database functions that return only permitted fields.
• File storage is private; project files are accessible only through short-lived signed URLs.
• Encryption in transit via TLS for connections to the Service. Encryption at rest is provided by the infrastructure platforms on which the Service runs.
• Record integrity: activity records are append-only and message content is immutable once recorded, both enforced by database constraint; attachments delivered with a message are attached when they arrive. Approval records are write-once.
• Record of notices given: where a subscription lapses, Planlyx keeps a copy of each notice it sends about it — to the account Owner and, where their portal is closing, to Customer's clients and consultants — recording the subject, the message text, the recipient address, the deadline stated, and whether it was sent and whether it bounced. These are retained after the account they concern has gone, because they are the record of what Customer, its clients and its consultants were told before anything was removed. They are readable by Planlyx personnel only and are append-only apart from their sending and bounce status. Apart from greeting the recipient, their text names only the firm, the dates and totals — never a client name, a project name, or a property address.
• Backups: point-in-time recovery is enabled on the production database with a seven-day window; restoration has been exercised and verified. Separately, an independent offsite backup is written to storage under a retention lock (minimum 90 days for daily copies, 365 for monthly) that the backup system's own credentials cannot remove. That backup covers the Service database and every stored file; it does not include authentication records, which the backup credential cannot read. It is checked automatically each week: the database archive is verified in full against its recorded checksum and confirmed readable as a restorable archive, and a rotating sample of files is verified against theirs. Credentials for the backup store are held separately from the application's own and cannot lift the retention protection. A restore from this backup, of both the database and the files, was performed in September 2026: the database was restored into a separate database and checked, including that each customer's records remained separated from every other's, and every file in the backup copy used was restored into a separate test environment, verified against the backup, and then removed.
• Public-interface protection: rate limiting on all public forms, questionnaire links and payment pages, and automated-submission checks on account registration and, unless Customer switches them off, on public enquiry forms; visitor IP addresses stored only as salted one-way hashes.
• Online payments: payment details are entered only on pages hosted by Stripe for Customer's own Stripe account; the Service does not receive card numbers, bank account numbers or bank sign-in credentials. Notifications from Stripe are accepted only on a dedicated endpoint, separate from Planlyx's own subscription billing, with a signature that is verified before anything is recorded, and each is attributed to a customer only by the Stripe account it concerns. The Service's code reaches Customer's Stripe account only through a single component limited to setting up and reading the account, creating, reading, listing and closing payment pages, and reading payments, refunds, disputes and payment events; it has no function that creates refunds, transfers, payouts or charges, and the build is refused if one is added. Each payment's history of status changes, refunds and disputes is append-only, and a recorded payment's amount and identity cannot be changed.
• Payment links: a link to pay one of Customer's invoices is signed, specific to that invoice, and expires — currently about 13 months after it is sent by email or copied, and about 24 hours after it is shown in the client portal. It works without sign-in and shows only Customer's name and contact details, the invoice number, title, amount and due date, and the invoice's payment status. Recalling an invoice replaces its links, and on every request the Service checks the invoice's current state, so a link stops accepting payment once the invoice is paid, recalled or voided. Payment links are not stored in the Service's email log, though a link that a user pastes into a message, or that a recipient quotes in a reply, is stored with that message. Requests to the payment page are rate-limited, with the visitor's IP address stored only as a salted one-way hash.
• Personnel access: authorized Planlyx personnel can access customer data where needed to operate and support the Service — through an internal operator console, and directly in the production database and file storage; direct database access uses a read-only credential by default. Reading data, by any of these routes, is not recorded in Customer's activity record and is not visible to Customer. Actions taken through the operator console are recorded in an internal ledger and, where they affect Customer's account, in Customer's own activity record.
• Infrastructure account security: Planlyx's own infrastructure provider accounts are protected by multi-factor authentication, either directly or through the single sign-on provider the account signs in with.

Annex C — Subprocessors

About the backup subprocessor. The backup exists so that Customer's records and documents survive events the primary provider's own recovery cannot address — including deletion or corruption that is not detected promptly. Copies are written to storage configured so that they cannot be modified or deleted for a fixed retention period: 90 days for the daily copy and 365 days for the monthly one. The lock cannot be removed by the backup system itself. Accordingly, a backup copy is not deleted during its retention period, including in response to a deletion request. Deletion in the live Service is carried out as Section 9 describes. The copies already taken cannot be removed early, and the periods above are minimums: a copy is not automatically destroyed when its lock expires. This is reflected in Section 9 and in the Planlyx Privacy Policy's retention section. Backups are never used to serve the Service and are read only to verify they remain restorable, or to perform a restore.

About the assistant subprocessor. Planlyx's agreement with Anthropic PBC prohibits training models on data submitted through it. Anthropic deletes submitted inputs and outputs within 30 days, except where content is flagged under its usage policy, in which case it may be retained for up to two years. No project files, plan sets, drawings, comments, client messages, invoices or contact records are transmitted to it. Planlyx deletes its own copy of each conversation 12 months after the conversation's last message.

About the address subprocessor. Planlyx's servers send Google the address text a user is typing (and, for a chosen suggestion, a Google place reference) to return suggestions and the chosen place's full address, and send the typed address when the field is left without a suggestion being chosen and when a public enquiry form is submitted, to check whether it matches a real address. Only the address text, a place reference and an opaque session identifier are sent — never a name, contact details, IP address, Customer identity or form identity — and the user's browser does not contact Google, so Google does not receive the user's IP address from Planlyx. Planlyx does not store the lookups; for an address submitted through a public enquiry form it records on the resulting deal only whether the address was matched, and the address a user chooses or types is stored as that user's own entry in the Service. Google's handling of the requests is governed by its Google Maps Platform terms and privacy policy.

(Until October 8, 2026, address suggestions came from Photon, operated by Komoot GmbH, called directly from the user's browser, and address checks from the U.S. Census Bureau's public lookup, called from Planlyx's servers. Both were replaced by Google Maps Platform on that date; neither receives data from Planlyx now. Until 2026-08-09, a project-location map embedded a frame served by the OpenStreetMap Foundation, and Planlyx's servers separately queried Photon to convert a saved project address into map coordinates; both were removed that day.)

(On October 2, 2026, the Stripe entity was corrected to Stripe, LLC, and Stripe's function was widened to payments by Customer's clients on invoices, through Customer's own connected Stripe account.)

The current subprocessor list is maintained at planlyx.com/legal/subprocessors.

(On October 8, 2026, Google LLC was added as a subprocessor for address suggestions and address checks, and the U.S. Census Bureau lookup was retired.)