Data Processing Addendum

This Data Processing Addendum («DPA») applies when Provider processes personal information contained in Customer Data on Customer's behalf («Customer Personal Data»). For that processing, Customer is the business or controller, and Provider is its service provider, contractor or processor, as those terms are used in the California Consumer Privacy Act and other U.S. state privacy laws («U.S. Privacy Laws»), and its encargadounder Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Annex 1 describes the processing.

Provider will:

1. process Customer Personal Data only to provide the Service under the Agreement and Customer's documented instructions, which include Customer's configuration of the Service, and tell Customer if it believes an instruction breaks the law;
2. ensure that everyone authorized to process Customer Personal Data is bound by a duty of confidentiality;
3. maintain the security measures in Annex 2;
4. help Customer, taking into account the nature of the processing, to respond to requests from individuals exercising their privacy rights and to carry out any data protection assessment the law requires;
5. notify Customer without undue delay, and in any case within seventy-two (72) hours after becoming aware, of any breach of security leading to the unauthorized access to, or loss, alteration or disclosure of, Customer Personal Data, with the information Customer reasonably needs to meet its own obligations;
6. at the end of the Agreement, delete Customer Personal Data held in Provider's systems as described in Section 17.4 of the Terms; and
7. make available the information reasonably necessary to show compliance with this DPA, and answer a reasonable written security questionnaire once a year.

Provider will not: (a) sell or share Customer Personal Data, as those terms are defined in U.S. Privacy Laws; (b) retain, use or disclose it for any purpose other than the business purposes set out in the Agreement, including outside the direct business relationship with Customer; or (c) combine it with personal information Provider receives from or on behalf of anyone else, except as U.S. Privacy Laws permit. Provider will comply with U.S. Privacy Laws, give Customer Personal Data the level of protection they require, and notify Customer if it can no longer meet its obligations under them. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use. Provider certifies that it understands and will comply with these restrictions.

Customer's database lives in the Customer Supabase Account, which Customer contracts directly with Supabase, Inc. under Supabase's own terms. For that account, Supabase acts on Customer's behalf under Customer's agreement with it, not as Provider's subprocessor. Provider accesses that database only with the authorization described in Section 6.2 of the Terms.

Customer authorizes Provider to use the subprocessors listed in Annex 3. Provider imposes on each of them data protection obligations no less protective than this DPA and remains responsible for their performance. Provider will give at least thirty (30) days' notice, by email and on its website, before adding or replacing a subprocessor. If Customer objects on reasonable data protection grounds within that period and the parties cannot resolve the objection, Customer may terminate the affected Service without owing the remaining fees under Section 5.5 of the Terms.

Customer Personal Data may be processed in the United States and in Mexico. Customer's database is created in a Supabase region in the United States, unless the parties agree otherwise.

Each party's liability under this DPA is subject to Section 15 of the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

• Encryption in transit with TLS for all connections, and encryption at rest of the database.
• A separate database, in Customer's own account, and a separate application environment for each customer.
• Row-level security policies on every table, and role-based permissions for Authorized Users.
• Passwords stored only as salted hashes; Provider never sees them.
• Integration tokens for Google and WhatsApp stored encrypted and refreshed automatically.
• Access to production systems limited to the people who need it, with credentials kept out of source code.
• Dependency updates and security fixes applied on a regular basis.