Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") supplements the Porchlight Terms of Service between Cymba Labs, LLC ("Cymba", the "Processor") and the installer or business using the Service (the "Customer", the "Controller"). It governs personal data that the Customer captures from its homeowners and end customers through the Service or provides through lead imports, quote context and prior correspondence for recovery.

2. Roles

The Customer is the data controller for homeowner contact and qualification data collected via the intake widget or SMS, and for personal data it imports or provides for project follow-up and recovery. Cymba is the data processor and acts only on the Customer's documented instructions, including those expressed through the Service's configuration, factual review, message approvals and campaign activation. The Customer is responsible for its authority to supply that data and for the permissions and disclosures applicable to its outreach; Service controls do not independently establish a lawful basis for contact.

3. Subject matter and duration

Processing covers the duration of the Customer's subscription and the operations necessary to provide the Service: storing conversations, leads, and contact records; running the AI agent; generating quotes; sending transactional email and SMS; and serving the customer-facing quote view. Where recovery is enabled, processing also includes importing and reviewing source evidence and prior project context; preparing suggested messages; storing approvals and campaign schedules; sending customer-controlled recovery emails; receiving and correlating replies and delivery events; maintaining permission, suppression and opt-out records; and providing internal alerts and recovery reports. Recovery campaigns may involve commercial outreach and are distinct from transactional account notifications.

4. Categories of data

• Identifiers: name, email, phone, ZIP.
• Project data: project type, size, budget band, timeline, electrical and permitting notes, decision-maker context.
• Conversation transcripts and timestamps.
• Quote line items, totals, and acceptance state.
• Imported inquiry and CSV evidence, forwarded correspondence and participant details, attachment filenames, reviewed facts and corrections, prior activity, and external quote references, dates, amounts, currencies and links supplied by the Customer.
• Suggested and approved email content, sender and recipient addresses, campaign schedules and approvals, replies, delivery metadata, recorded outcomes, and permission, suppression and opt-out records.

5. Data subjects

Homeowners and end customers who interact through the Service or whose existing inquiries, leads or quotes the Customer imports, and other participants identified in customer-provided correspondence.

6. Subprocessors

Cymba uses the subprocessors listed at /subprocessors. Cymba will give prior notice of new subprocessors to the Customer by email. The Customer may object to a new subprocessor on reasonable grounds; if Cymba cannot accommodate the objection the Customer may terminate the affected portion of the Service.

7. Security measures

• TLS encryption in transit for all client connections.
• Encryption at rest for the database and object storage.
• Row-level security policies that enforce per-tenant isolation.
• Production access limited to a small set of authorized personnel, audited via vendor logs.
• Application-level monitoring (Sentry) tagged with org and conversation IDs for incident response.

8. Personnel

Cymba personnel with access to personal data are bound by confidentiality obligations.

9. Breach notification

Cymba will notify the Customer without undue delay (and in any event within 72 hours) of becoming aware of a personal data breach affecting the Customer's data, including the nature of the incident, likely consequences, and the measures taken or proposed.

10. Data subject rights

Cymba will assist the Customer in responding to data subject requests (access, deletion, correction) by providing the tools and data export needed. Requests addressed directly to Cymba will be forwarded to the Customer.

11. Return or deletion at termination

On termination of the Service, Cymba will, at the Customer's choice, return or delete the Customer's personal data within 30 days, except where retention is required by law (including SMS consent and opt-out records retained for TCPA audit).

12. Contact

DPA questions: hello@cymbalabs.com.