SketchCap Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the SketchCap Terms of Service or other agreement (the "Agreement") between the customer named in the Agreement ("Customer") and Quill Marketing, LLC, doing business as SketchCap ("SketchCap"). It applies when SketchCap processes Customer Personal Data on Customer's behalf. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data.

1. Definitions

• "Customer Personal Data" means personal data, personal information or similar terms under Data Protection Laws contained in Customer Content that SketchCap processes for Customer under the Agreement.
• "Data Protection Laws" means all United States federal and state laws that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), the Texas Data Privacy and Security Act ("TDPSA"), and similar laws of Colorado, Connecticut, Virginia, Utah and other states, each as amended.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data held by SketchCap or its Subprocessors.
• "Subprocessor" means a third party SketchCap engages to process Customer Personal Data.
• "Controller," "processor," "business," "service provider," "consumer," "sell" and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles

2.1 Customer is the controller (or business) of Customer Personal Data, and SketchCap is its processor (or service provider).

2.2 Customer is responsible for having a lawful basis for the processing, including giving any notice and getting any consent required to record meetings, upload transcripts, capture images for character pictures, and have SketchCap process them as described in the Agreement.

3. Instructions and processing details

3.1 SketchCap will process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the Service are Customer's complete instructions. SketchCap will tell Customer if it believes an instruction violates Data Protection Laws, and may suspend that processing.

3.2 Processing details:

4. Service provider commitments

SketchCap will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• retain, use or disclose Customer Personal Data for any purpose other than the business purposes in the Agreement, including for any commercial purpose other than providing the Service;
• retain, use or disclose Customer Personal Data outside the direct business relationship between SketchCap and Customer;
• combine Customer Personal Data with personal data it receives from or on behalf of other persons or collects from its own interactions with consumers, except as the CCPA permits;
• use Customer Personal Data to train, retrain or improve any artificial intelligence or machine learning model, or allow any Subprocessor to do so.

SketchCap certifies that it understands and will comply with these restrictions. SketchCap will notify Customer if it determines it can no longer meet its obligations under Data Protection Laws. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

5. Confidentiality

SketchCap will ensure that each person who processes Customer Personal Data is subject to a duty of confidentiality and has access only as needed to provide, secure or support the Service.

6. Security

SketchCap will maintain the administrative, technical and physical safeguards described in Annex 1, appropriate to the risk. SketchCap may update Annex 1 if the updates do not materially lower the overall level of protection.

7. Subprocessors

7.1 Customer gives general authorization for SketchCap to engage Subprocessors. The current list is in Annex 2 and at sketchcap.com/subprocessors.

7.2 SketchCap will enter a written contract with each Subprocessor imposing data protection terms that are at least as protective as this DPA, including the prohibition on training models with Customer Personal Data, and remains responsible for each Subprocessor's performance.

7.3 SketchCap will give at least 15 days' notice of a new Subprocessor by updating the list and emailing customers who have subscribed to updates. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Service and receive a prorated refund of prepaid fees.

8. Security Incidents

8.1 SketchCap will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting Customer Personal Data.

8.2 The notice will describe, to the extent known, the nature of the incident, the data and data subjects affected, likely consequences, and the steps taken or proposed. SketchCap will update Customer as more becomes known, take reasonable steps to contain and remediate the incident, and reasonably help Customer meet any notification obligations.

8.3 Notice of a Security Incident is not an admission of fault.

9. Deletion and return

9.1 Customer can export recaps and People Memory and delete any Customer Content at any time in the Service.

9.2 SketchCap deletes Customer Personal Data according to Customer's retention settings (by default, transcripts and recordings one year after the recap; images used for character pictures immediately after the description is made), and within 30 days after the Agreement ends, from live systems, with backup copies deleted within a further 30 days, unless the law requires keeping them. Any retained copies remain subject to this DPA.

10. Assistance

10.1 SketchCap will, taking into account the nature of the processing, reasonably assist Customer in responding to requests from data subjects to exercise their rights. If SketchCap receives a request directly about Customer Personal Data, it will forward it to Customer within 10 business days and will not respond except to direct the person to Customer, unless Customer authorizes it or the law requires otherwise. Customer authorizes SketchCap to honor, without further instruction, a verified request from a meeting participant to delete that participant's People Memory entry and character settings, and SketchCap will tell Customer when it does.

10.2 SketchCap will provide information reasonably needed for Customer to conduct data protection assessments, risk assessments and cybersecurity audits required by Data Protection Laws.

11. Audits

11.1 SketchCap will make available information reasonably necessary to demonstrate compliance with this DPA, including written responses to reasonable security questionnaires no more than once a year.

11.2 If the information in 11.1 is not enough to satisfy a requirement of Data Protection Laws, Customer may, at its expense and with at least 30 days' notice, arrange an audit by an independent auditor bound by confidentiality, no more than once a year, during business hours, in a way that does not unreasonably disrupt SketchCap's operations or compromise other customers' data. SketchCap may instead provide a third-party assessment report if one exists.

12. Data location

SketchCap and its Subprocessors store and process Customer Personal Data in the United States. The Service is not offered for processing personal data subject to the GDPR, UK GDPR or Swiss data protection law, and this DPA does not include Standard Contractual Clauses.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.

14. Term

This DPA lasts as long as SketchCap processes Customer Personal Data.

Annex 1: Security measures

1. Encryption: TLS 1.2 or higher in transit; AES-256 or provider-equivalent encryption at rest for databases and file storage.
2. Access control: sign-in through Clerk with multi-factor authentication available to customers and required for SketchCap staff; role-based access; least privilege; staff access to Customer Content only to provide support at Customer's request or to investigate abuse or security issues, and logged.
3. Separation: each customer's data is logically separated by account; share links are long, random and unguessable, can expire, and can be revoked by the owner.
4. Retention controls: configurable transcript retention; immediate deletion of character images; hard deletion from live systems with backup expiry within 30 days.
5. Logging and monitoring: audit logs for deletes, exports, settings changes and staff access; alerting on errors and unusual activity.
6. Secure development: code in a private repository; automated tests and a build check that blocks shipping customer or owner data; dependency updates; secrets kept out of code.
7. Vendor management: Subprocessors chosen for security posture, bound by written terms including no training on Customer Content.
8. Incident response: documented process for detecting, containing, investigating and notifying Security Incidents.
9. Business continuity: managed database backups with point-in-time recovery from the hosting provider.
10. Personnel: confidentiality obligations; access removed promptly when no longer needed.

Annex 2: Subprocessors