Data Processing Addendum.

This Data Processing Addendum ("DPA") governs the processing of personal data by Varshyl Inc. / JobSite Intel AI on behalf of enterprise customers where applicable privacy or data protection laws require such an agreement.

This DPA supplements and is incorporated into the applicable service agreement between the customer and Varshyl Inc. / JobSite Intel AI.

Scope of Processing

JobSite Intel AI processes customer data solely for the following purposes:

• Providing the contracted services as described in the applicable service agreement
• Maintaining platform security, integrity, and operational stability
• Improving internal operational systems and processes
• Complying with applicable legal obligations
• Maintaining backups and disaster recovery systems
• Improving AI and platform systems using de-identified and aggregated information only (subject to the Construction Intelligence Engine consent requirements described in the AI Transparency notice)

Roles of the Parties

The enterprise customer acts as the Data Controller with respect to personal data submitted to JobSite Intel AI.

Varshyl Inc. / JobSite Intel AI acts as the Data Processor, processing personal data on behalf of and under the instructions of the customer.

Varshyl Inc. will not process personal data for its own independent purposes beyond those described in this DPA and the applicable service agreement.

Security Measures

JobSite Intel AI implements commercially reasonable technical and organizational security measures including:

• Access restrictions limiting data access to authorized personnel
• Encrypted communications for data in transit (TLS 1.2+/HTTPS)
• HMAC-signed, organization-scoped file access controls
• JWT-based authentication with organization tenant isolation
• bcrypt password hashing
• Role-based access controls
• Secure cloud hosting infrastructure (Railway)
• Error monitoring and logging (Sentry, configured to strip credentials)
• Backup and recovery processes
• Security incident response procedures

Subprocessors

JobSite Intel AI engages subprocessors to assist in providing services. The current subprocessor list is maintained at /subprocessors. Key subprocessors include Railway (hosting), Anthropic (AI), OpenAI (transcription), Resend (email), Sentry (monitoring), Apple and Google (authentication), and Open-Meteo (weather data).

We will provide reasonable advance notice of material changes to subprocessors where required by applicable law.

Data Retention and Deletion

• Active accounts: Data is retained for the life of the account.
• Account deletion: Upon deletion request, a 30-day grace period applies. After 30 days, account data is permanently deleted.
• Retention exceptions: Data may be retained beyond deletion for legal compliance, fraud prevention, security investigations, audit obligations, payment dispute resolution (up to the applicable statutory period), and tax record retention requirements.
• Backup retention: Backup systems may retain copies of deleted data for up to 90 days following deletion.
• Anonymized data: De-identified, aggregated data may be retained for platform improvement and analytics purposes.

Data Subject Rights

Upon written request, we will assist enterprise customers in responding to data subject rights requests (access, correction, deletion, portability) within commercially reasonable timeframes and as required by applicable law. Requests should be submitted to kapilav@varshyl.com.

Data Transfers

Customer data is primarily processed in the United States by Varshyl Inc. and its subprocessors. Open-Meteo processes weather data in Switzerland. Varshyl Inc. will take commercially reasonable steps to ensure data transfers comply with applicable data protection laws.

Breach Notification

In the event of a confirmed security breach affecting customer personal data, JobSite Intel AI will notify the affected customer within commercially reasonable timeframes as required by applicable law. Notifications will include available information about the nature of the breach, categories of data affected, and remediation steps.

Governing Law

This DPA is governed by the laws of the State of California.