Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Ambitions LLC, operator of the Jivco service ("Jivco," "Processor") and the customer ("Customer," "Controller") and applies where Jivco processes personal information on the Customer's behalf.

1. Roles

The Customer is the controller (or business) and determines the purposes of processing. Jivco is the processor (or service provider) and processes personal information only on the Customer's documented instructions, including as set out in the Terms of Service and this DPA.

2. Subject matter and details of processing

• Subject matter: provision of the Jivco AI communications Service.
• Duration: for the term of the Customer's subscription, plus any deletion period.
• Nature and purpose: capturing, classifying, drafting responses to, and (where enabled) sending communications on the Customer's behalf.
• Types of personal information: names, email addresses, phone numbers, message content, review content, appointment details, and other information the Customer's contacts provide.
• Categories of data subjects: the Customer's customers, leads, and contacts.

3. Jivco's obligations

Jivco will:

• Process personal information only on the Customer's instructions and not for its own purposes.
• Ensure personnel with access are bound by confidentiality obligations.
• Implement and maintain appropriate technical and organizational security measures, including encryption in transit and at rest, access controls, and monitoring.
• Assist the Customer, taking into account the nature of processing, in responding to requests from data subjects to access, correct, or delete their personal information.
• Notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data.
• On termination, delete or return the Customer's personal information as described in the Terms of Service and Privacy Policy, except where retention is required by law.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

4. Subprocessors

The Customer authorizes Jivco to engage the subprocessors listed below to provide the Service. Jivco imposes data protection obligations on each subprocessor and remains responsible for their performance. Jivco will give notice of changes to this list and provide a reasonable opportunity to object.

Subprocessor	Purpose	Location
Supabase	Database and file storage	United States
Railway	Application hosting	United States
Clerk	Authentication	United States
Anthropic	AI model processing	United States
Twilio	SMS / telephony	United States
Stripe	Payment processing	United States
Sentry	Error monitoring	United States
Google, Meta	Integrations the Customer connects	United States

5. CCPA service-provider terms

To the extent the California Consumer Privacy Act applies, Jivco acts as a "service provider." Jivco will not sell or share the Customer's personal information, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Service, and certifies that it understands and will comply with these restrictions.

6. International transfers

Jivco currently stores and processes personal information in the United States. If processing locations change or international transfer mechanisms become necessary, Jivco will update this DPA and implement an appropriate transfer mechanism.

7. General

This DPA is incorporated into and subject to the Terms of Service. In the event of a conflict regarding the processing of personal information, this DPA controls.

Contact: privacy@jivco.io.