Data Processing Addendum

1. Roles of the Parties

For personal information you submit about your own customers, you are the controller / business and Pearl Labs LLC is the processor / service provider. We process such personal information only to provide the Service, on your documented instructions (including as set out in the Terms and this DPA), and not for our own commercial purposes. We do not “sell” or “share” that personal information as those terms are defined under applicable U.S. state privacy laws.

2. Scope and Nature of Processing

Subject matter: provision of the FenceEstimatePro estimating, job-management, proposal, and electronic-signature platform.

Duration: for the term of your subscription, plus the retention periods described in the Privacy Policy.

Categories of data subjects: your customers (e.g., homeowners), your staff, and other individuals whose information you enter.

Categories of personal information: names, contact details, property addresses, project and estimate details, signed-contract records and signing metadata, and related communications.

3. Confidentiality

We ensure that personnel authorized to process personal information are bound by appropriate confidentiality obligations and access production data only on a need-to-know basis.

4. Security Measures

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), row-level access controls, hashed credentials, and restricted production access. A current summary of our security posture is available on request.

5. Subprocessors

You authorize Pearl Labs LLC to engage the following subprocessors to provide the Service. Each is bound by terms protecting the personal information at least as protective as this DPA:

• Supabase — database and authentication (US)
• Vercel — application hosting and delivery (US)
• Stripe — payment processing
• Resend — transactional and notification email
• Sentry — error monitoring
• PostHog — product analytics
• OpenAI and Anthropic — AI-assisted extraction (only when those features are used)
• Google Maps Platform — address autocomplete
• Cloudflare — bot detection and abuse prevention (Turnstile) on sign-up and sign-in (US/global)

We will give notice of new subprocessors and a reasonable opportunity to object before they begin processing your personal information.

6. Data Subject and Consumer Requests

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests from individuals to access, correct, delete, or port their personal information, including through the export and deletion tools available in the Service.

7. Personal Data Breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your personal information, and will provide information reasonably available to us to help you meet your own notification obligations.

8. Return and Deletion

On termination, you may export your data within the window described in the Terms and Privacy Policy. After the applicable retention window, we delete or de-identify personal information from the live Service, except where retention is required by law or for legitimate security, fraud-prevention, billing, or backup purposes.

9. International Transfers

The Service is operated in the United States. Where personal information is transferred from another jurisdiction, the parties will cooperate to put in place any transfer mechanism required by applicable law.

10. Order of Precedence

In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal information, this DPA controls. All other terms remain in effect.

11. Contact

Data protection inquiries: privacy@fenceestimatepro.com