Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Blue Moon OS LLC ("Kayson OS", "we", "us", "our") and the customer that has accepted our Terms of Service ("you", "Customer"). It applies where we process personal data on your behalf in providing the Service.

To execute it, contact us at privacy@kaysonos.com and we will return a signed copy. If you need it incorporated into a larger procurement agreement, we can work with your form.

Where you are a business handling personal information about homeowners, clients, employees or subcontractors, you are usually responsible for that information and we process it on your behalf. This Addendum sets out how.

The Customer is the controller (or "business") of the personal data processed through the Service. We are the processor (or "service provider"), and we process that data only on the Customer’s documented instructions.

The Customer’s instructions are: this Addendum, the Terms of Service, the Privacy Policy, and the Customer’s configuration and use of the Service. We will tell the Customer if, in our opinion, an instruction infringes applicable data protection law.

• "Personal Data" means information relating to an identified or identifiable person that is processed through the Service on the Customer’s behalf.
• "Processing" means any operation performed on Personal Data, including storage, retrieval, transmission and deletion.
• "Data Subject" means the person the Personal Data relates to.
• "Subprocessor" means a third party we engage to process Personal Data on the Customer’s behalf.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

• Subject matter: providing the Kayson OS construction management platform.
• Duration: for as long as the Customer’s workspace is active, plus the retention periods set out in the Privacy Policy.
• Nature and purpose: hosting, storage, backup, display, transmission, computation, document generation, AI-assisted features, notification and support.
• Categories of Data Subject: the Customer’s employees, subcontractors, clients, homeowners, vendors, professional contacts, and other individuals the Customer enters.
• Categories of Personal Data: names, contact details, addresses, employment and role information, pay rates and hours, project and financial records, documents and photographs, and the contents of messages sent through the Service.

We do not require special-category data and the Customer should not enter it. Where the Customer does, the Customer is responsible for having a lawful basis and any consent the law requires.

• Process Personal Data only on the Customer’s documented instructions, and only to provide the Service.
• Not sell Personal Data, and not retain, use or disclose it for our own purposes or for anyone else’s.
• Not combine Personal Data with data from other sources, except as the law permits.
• Ensure that anyone we authorise to process Personal Data is bound by confidentiality.
• Implement the security measures set out in this Addendum.
• Assist the Customer in responding to Data Subject requests and in meeting its own security and breach obligations.
• Make available the information reasonably needed to demonstrate compliance.
• Delete or return Personal Data when the arrangement ends.

• Ensure you have a lawful basis for the Personal Data you enter, and that you have given any notices and obtained any consents the law requires.
• Do not enter special-category data, or another person’s data that you are not entitled to hold.
• Use the Service’s permissions, roles and sharing controls appropriately.
• Tell us promptly if you believe an instruction you have given us is unlawful.

We treat Personal Data as confidential. Access inside our organisation is limited to personnel who need it to operate, secure or support the Service, and who are under confidentiality obligations.

• Encryption of data in transit using TLS, and encryption at rest.
• Passwords stored using a salted, industry-standard hash.
• Private file storage by default, with access through signed, time-limited links validated against record permissions.
• Role-based access control inside the Customer’s workspace, enforced at the data layer.
• Least-privilege access to production systems, with logging.
• Regular application security scanning and dependency maintenance.
• Backup and recovery procedures.

These measures are appropriate to the risk, taking into account the state of the art and the cost of implementation. They are not a guarantee that no breach will occur.

The Customer authorises us to engage the Subprocessors listed below. We have a written agreement with each one that imposes data protection obligations no less protective than this Addendum.

• Base44 — application hosting, database, authentication, file storage, and AI gateway.
• Stripe — subscription billing, and connected-account payment processing.
• Resend — transactional email delivery.

We will give the Customer notice before engaging a new Subprocessor that processes Personal Data, and the Customer may object on reasonable data protection grounds. If we cannot resolve an objection, the Customer may terminate the affected part of the Service. The current list is kept in the Privacy Policy.

If a Data Subject contacts us directly about Personal Data we hold on the Customer’s behalf, we will not respond substantively to the request. We will direct them to the Customer and tell the Customer promptly. We will assist the Customer in fulfilling access, correction, deletion and portability requests, using the functionality of the Service where it exists.

• We will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting its Personal Data.
• The notification will describe, so far as we can: the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed.
• We will take reasonable steps to contain and remediate the breach, and to help the Customer meet its own notification obligations to regulators and Data Subjects.
• We will not make public statements attributing the breach to the Customer without the Customer’s agreement, except where the law requires it.

We host and process Personal Data in the United States. Where Personal Data originating outside the United States is processed there, we will rely on a lawful transfer mechanism — such as the standard contractual clauses or the applicable adequacy framework — and will provide the relevant documentation on request.

We will give the Customer the information reasonably necessary to demonstrate compliance with this Addendum, and will answer reasonable questions about our security practices. Where a regulator or the law requires an on-site audit, we will cooperate, subject to confidentiality and reasonable scheduling. The Customer bears the cost unless the audit reveals a material breach by us.

At the end of the arrangement, and at the Customer’s choice, we will delete or return Personal Data and delete existing copies, unless the law requires us to keep it. Deletion follows the retention schedule in the Privacy Policy. Where Data Vault is subscribed, deletion is deferred for as long as that subscription is paid and the countdown is paused. The Customer can export its data before deletion.

Where the Customer is a business subject to the CCPA and we are a service provider, we:

• will process Personal Information only to provide the Service, and will not retain, use or disclose it for any other commercial purpose;
• will not sell or share Personal Information;
• will not combine Personal Information received from the Customer with Personal Information from other sources, except as the CCPA permits;
• will comply with the applicable obligations of the CCPA, and provide the level of privacy protection the CCPA requires of a service provider;
• will notify the Customer if we determine that we can no longer meet those obligations.

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms of Service. Nothing in this Addendum limits a liability that cannot be limited by law.

This Addendum applies for as long as we process Personal Data on the Customer’s behalf. Its confidentiality, deletion and liability provisions survive its end.

Questions about this Addendum, or a request for a signed copy, should go to privacy@kaysonos.com. Postal mail: Blue Moon OS LLC — mailing address to be added.