Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") is incorporated into the Terms of Service between you ("Customer") and Pursor, Inc. ("Pursor"). It governs Pursor's processing of "Personal Information" of your customers, contacts, or end users (collectively "Your Customers") through the Service.

For Personal Information of Your Customers:

• Under CCPA/CPRA terminology, you are the "Business" and Pursor is a "Service Provider."
• Under GDPR/UK GDPR terminology, you are the "Controller" and Pursor is the "Processor."
• Under VCDPA/CPA/CTDPA/UCPA terminology, you are the "Controller" and Pursor is the "Processor."

2. Processing instructions

Pursor will process Personal Information only:

• To provide and improve the Service as described in the Terms
• To comply with your reasonable documented instructions
• To comply with applicable law (in which case we will inform you unless legally prohibited)
• For security, abuse prevention, and to enforce our agreements

Pursor will not sell or share Personal Information, will not use it for cross-context behavioral advertising, will not combine it with data from other sources for unrelated purposes, and will not use it to train general-purpose AI models.

3. Subprocessors

Pursor engages the following subprocessors to provide the Service. You consent to their use. We will notify you at least 14 days before adding a new subprocessor or changing the role of an existing one, and you may object to material changes by contacting legal@pursor.co.

The table above is the current list (the Location column is where each one processes Pursor data). We update it here when it changes. All subprocessors are bound by data protection terms substantially equivalent to those in this DPA.

4. Security measures

Pursor implements and maintains appropriate technical and organizational measures including:

• Encryption in transit (HTTPS with HTTP Strict Transport Security) and at rest (our database provider encrypts stored data)
• Application-level AES-256-GCM encryption of Google access tokens and business tax ids, each under its own key
• Least-privilege access: the database limits each business owner to their own data (row-level security), and server code looks up records by the signed-in owner
• Two-factor authentication on the accounts that run Pursor
• Rate limits on sensitive actions and a strict Content-Security-Policy
• A documented incident response procedure (see our Security page)

5. Your customers' rights

If one of Your Customers contacts Pursor directly to exercise their rights (access, deletion, correction, etc.), we will, unless legally required otherwise, route that request to you within 5 business days. You remain responsible for responding within the timelines required by applicable law. Pursor will assist you in fulfilling verified requests at no additional cost beyond ordinary support.

6. Security incidents

If Pursor becomes aware of a security incident involving Personal Information, we will notify you without undue delay and in any event within 72 hours of confirmation. The notification will include the nature of the incident, categories of data and individuals affected, likely consequences, and remediation steps. We will reasonably cooperate with your investigation and any regulatory reporting you are required to make.

7. Return & deletion of data

Upon termination of the Service, Pursor will, at your option and within 30 days of your request, return all Personal Information in a portable format or delete it. We may retain Personal Information beyond that window only where required by law (e.g., billing records, SMS consent logs) and only for the period required.

8. Audits and certifications

On reasonable written request and no more than once per year, Pursor will provide its current security documentation (our security summary and subprocessor list, and the result of Google's security assessment once completed). Pursor does not currently hold SOC 2 or ISO 27001 certification. Customers with elevated audit rights under applicable law may arrange an audit subject to reasonable confidentiality and scoping terms.

9. International transfers

Personal Information is processed in the United States: our database (Supabase) is in Oregon (us-west-2), and our hosting (Vercel) and error tracking (Sentry) use US regions. Our workflow tool, n8n Cloud, processes some data in Germany (EU): missed-call events and the recent Gmail messages it reads to draft replies. If you need specific data-transfer terms, contact us at legal@pursor.co.