Data Processing Addendum

Version: 2026-09-25 First Published: April 25, 2026

This Data Processing Addendum ("DPA") forms part of and is incorporated into the Terms of Service between You ("Customer" or "Controller") and WebGrowly LLC, a Delaware limited liability company based in Miami Beach, Florida ("WebGrowly," "we," "our," or "Processor"). This DPA governs the processing of personal information that Customer submits to or collects through the Service about third parties, including homebuyers, sellers, tenants, website visitors, and other end users ("End-User Data").

Capitalized terms not defined in this DPA have the meanings in the Terms of Service. Conflicts between this DPA and the Terms of Service, the Privacy Policy, or a Master Service Agreement are resolved as provided in Section 14.

1.1 For End-User Data, Customer is the Controller (also referred to as "Business" under California law) and WebGrowly is the Processor (also referred to as "Service Provider" under California law).

1.2 Customer determines the purposes and means of processing End-User Data. WebGrowly processes End-User Data only on Customer's documented instructions. Those instructions consist of the Terms of Service, this DPA, the configuration of Customer's account, and Customer's use of the Features, and include the processing described in the Privacy Policy and in the Platform Materials for Customer's hosted website.

1.3 Customer is responsible for: (a) the lawfulness of Customer's instructions and of Customer's own processing of End-User Data; (b) the accuracy, quality, and legality of End-User Data that Customer enters or uploads; (c) obtaining the consents required for Customer's own contact with end users and complying with the data-protection, privacy, consumer-protection, fair-housing, telemarketing, anti-spam, and other laws that apply to Customer's business; (d) reviewing the standard privacy notice, cookie notice, and other Platform Materials that WebGrowly provides for Customer's hosted website under Section 6.9 of the Terms of Service, and providing any additional notice that Customer's own practices outside the Service require; and (e) responding to end users' requests concerning their personal information.

2.1 WebGrowly will process End-User Data only to:

(a) Provide, secure, operate, maintain, and improve the Service; (b) Deliver Features Customer configures and uses, including AI features, the lead portal, notifications, messaging, analytics, and integrations; (c) Prevent, detect, and investigate fraud, abuse, and security incidents; (d) Maintain the Service's fair-housing safeguards and review their consistent operation; (e) Comply with law, subpoenas, and lawful government requests; (f) Enforce the Terms of Service and this DPA; (g) Assist Customer in responding to end-user requests as provided in Section 6; (h) Perform the functions expressly authorized by Customer through the Service.

2.2 WebGrowly will not: (a) sell End-User Data; (b) share End-User Data for cross-context behavioral advertising; (c) retain, use, or disclose End-User Data outside the direct business relationship with Customer; (d) retain, use, or disclose End-User Data for any purpose other than the permitted purposes in Section 2.1; (e) combine End-User Data with personal information WebGrowly receives from other sources to create profiles about individuals, except to the extent necessary to detect and prevent security incidents or as the Features Customer uses require.

2.3 De-identified Data. WebGrowly may create aggregated or de-identified information from End-User Data to operate and improve the Service. WebGrowly will take reasonable measures to ensure such information cannot be associated with an individual, will not attempt to re-identify it, and will contractually prohibit any recipient from re-identifying it.

2.4 WebGrowly certifies that it understands the restrictions in Sections 2.2 and 2.3 and will comply with them.

The categories of End-User Data WebGrowly may process on behalf of Customer include:

• Identifiers: name, email, phone number, online identifiers (IP address, session and visitor identifiers, device identifiers)
• Contact and location information: address, city, state, ZIP code, approximate location derived from IP
• Lead-portal account data: sign-in information (including through Google or Apple), saved properties, saved searches, recently viewed listings, and account activity
• Consent records: the consent or disclosure text displayed, its version, the date and time, and related technical information
• Commercial information: property preferences, budget, inquiries, showing requests, transaction history, deal records
• Inferences the Features produce for Customer's use, such as conversation summaries, stated interests, and estimates of inquiry interest
• Financial information: rent amounts, lease terms, payment records, invoice records, commission records
• Professional information: profession, company, role (if disclosed by the end user)
• Audio transmitted for transcription (not stored by WebGrowly; see Terms of Service §6.7)
• AI search requests and conversations, typed or spoken
• Free-text content submitted by end users or entered by Customer about end users
• Documents uploaded by Customer relating to end users (such as leases, identification documents, and contracts)
• Communications content (chat transcripts, email and text-message logs)
• Public-record information about properties, which may include owner names as they appear in public records

The categories of data subjects whose End-User Data may be processed include:

• Homebuyers, sellers, renters, tenants, and investors interacting with Customer
• Visitors to Customer's hosted website and users of its lead portal
• Leads captured via forms, the AI Chat Widget, exit-intent popups, the lead portal, or Zapier
• Showing attendees, referrals, and prospects entered by Customer
• Persons Customer designates to receive lead alerts
• Transaction counterparties and service providers entered by Customer (such as cooperating agents, lenders, and escrow officers)
• Property owners whose names appear in public records compiled by the Property Passport feature

WebGrowly will implement and maintain reasonable and appropriate technical and organizational measures designed to protect End-User Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. Current measures include:

• Encryption in transit (HTTPS/TLS, with HTTP Strict Transport Security)
• Encryption at rest for the primary database and file storage
• Additional application-level encryption for certain sensitive data, such as integration tokens
• Password hashing using industry-standard algorithms
• Row-level security and application checks that separate each customer's data
• Rate limiting and abuse controls on sign-in and sensitive endpoints
• Security headers and restrictions on browser features
• Administrative access limited to authorized personnel, with time-limited support sessions
• Scrubbing of contact details and credentials from error reports
• Dependency and secret scanning
• Selection of subprocessors based on their security practices
• Incident response procedures

WebGrowly may update its security measures from time to time, provided the updated measures do not materially reduce the overall protection of End-User Data.

5.1 Authorization. Customer generally authorizes WebGrowly to engage subprocessors to process End-User Data, subject to this Section 5.

5.2 Current Subprocessors. The current subprocessors and the purposes for which each processes End-User Data are:

5.3 New Subprocessors. Before engaging a new subprocessor with access to End-User Data, WebGrowly will update the list above, post the updated list at realty.webgrowly.com/legal, and provide notice to Customer by email. Customer may object in writing within 30 days on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer's sole remedy is to terminate the Service under Section 14 of the Terms of Service. If Customer exercises this termination right within twelve (12) months after the date Customer paid the License Fee, Customer is entitled to a pro-rated refund equal to the License Fee actually paid by Customer, multiplied by the number of whole months remaining in that twelve (12)-month period, and divided by twelve (12), counting any partially elapsed month as elapsed. After that period, no refund is owed beyond what may be available under Section 5.3 of the Terms of Service.

5.4 Subprocessor Obligations. WebGrowly will engage subprocessors under written terms that require them to protect End-User Data in a manner consistent with this DPA, and will remain responsible for each subprocessor's performance of those obligations to the extent the subprocessor acts on WebGrowly's behalf. Sign-in services that an end user chooses (such as Sign in with Google or Sign in with Apple), the push-notification services of a user's browser or device, and integrations that Customer chooses to connect (such as Zapier) process data under their own terms, and End-User Data that Customer routes to an integration leaves the Service at Customer's direction.

6.1 WebGrowly will, taking into account the nature of the processing, provide reasonable assistance to Customer in responding to requests by end users to exercise rights under applicable law, including rights to know, access, correct, delete, port, restrict processing, and opt out of sale or sharing.

6.2 If WebGrowly receives a request directly from an end user regarding End-User Data, WebGrowly will (a) not respond to the request on behalf of Customer, except to acknowledge receipt and direct the end user to Customer, and (b) promptly forward the request to Customer at the email address on file for Customer's account. Lead-portal users may delete their own portal account through the Service.

6.3 Customer is responsible for responding to end-user requests. The Service provides tools (such as search, export, and delete) that Customer may use to do so.

7.1 WebGrowly will notify Customer without undue delay after confirming any unauthorized access to or disclosure of End-User Data (a "Personal Information Breach" or "Breach"), and in any event within the period required by applicable law, including Fla. Stat. § 501.171(6) where it applies. Confirmation means the point at which WebGrowly has determined, after reasonable investigation, that a Breach has occurred; mere suspicion, an unverified security alert, or a non-exploitable vulnerability does not constitute confirmation. The notice will include, to the extent known at the time of notice: (a) a description of the nature of the Breach; (b) categories and approximate volumes of End-User Data concerned; (c) likely consequences; and (d) measures taken or proposed to address the Breach.

7.2 WebGrowly will cooperate with Customer's reasonable requests for information to enable Customer to fulfill its own notification obligations under law.

7.3 Customer is responsible for assessing whether a Breach requires notification to end users, regulators, or other parties under applicable law, and for making any such notifications.

8.1 Upon termination of the Terms of Service, Customer has thirty (30) days to export End-User Data (including leads, properties, transactions, and invoices) through export tools provided in the admin panel or, where such tools are not available, by written request to support@webgrowly.com, in which case WebGrowly will provide the data in a commercially reasonable format (such as CSV or JSON) within the export window.

8.2 After the 30-day export window, WebGrowly will delete or de-identify End-User Data in its active systems within a commercially reasonable time, subject to: (a) copies in backups, which are overwritten on the database provider's rolling schedule and remain protected until then; (b) records retained under legal hold or to establish or defend legal claims; (c) records retained as required by law; and (d) consent records and fair-housing safeguard records retained as described in the Privacy Policy.

8.3 At Customer's reasonable request during the 30-day export window, WebGrowly will delete specified End-User Data records prior to the end of the window.

9.1 WebGrowly will make available to Customer, on reasonable request and no more than once per 12-month period, information reasonably necessary to demonstrate compliance with this DPA. This obligation is satisfied by providing Customer with: (a) the then-current subprocessor list; (b) a description of technical and organizational security measures; (c) information about security incidents that affected Customer, if any.

9.2 On-site audits of WebGrowly's facilities are not available. If Customer is subject to a regulatory audit requirement that cannot be satisfied by Section 9.1, the parties will cooperate in good faith to agree to an alternative that does not unreasonably disrupt WebGrowly's operations.

The Service is operated from the United States and intended for Florida-based customers. WebGrowly's primary database and file storage for End-User Data are located in the United States, and subprocessors may process End-User Data in other locations where they or their networks operate. By using the Service, Customer authorizes the transfer of End-User Data to the United States and such processing.

WebGrowly retains End-User Data only as long as necessary to provide the Service, as described in the Privacy Policy and Section 8 of this DPA, or as required by law.

The liability of each party under this DPA is governed by the limitation-of-liability provisions in the Terms of Service. The DPA is not intended to expand the total liability of either party beyond those limits.

This DPA is part of the Terms of Service. If the Terms of Service terminate, this DPA terminates automatically, except that Sections 2.2, 2.3, 7, 8, 11, and 12, and any other provision that by its nature should survive, survive termination. Sections 2.2 and 2.3 continue to apply for as long as WebGrowly or its subprocessors hold End-User Data or information derived from it.

In the event of a conflict between this DPA and the Terms of Service with respect to the processing of End-User Data, this DPA controls. In the event of a conflict between this DPA and the Privacy Policy with respect to the processing of End-User Data, this DPA controls. A Master Service Agreement executed by Customer, and its schedules, control over this DPA as provided in Section 23.1 of the Terms of Service.

For data-processing questions:

WebGrowly LLC Attn: Data Protection 407 Lincoln Rd, Ste 6H, PMB 529 Miami Beach, FL 33139, United States Email: privacy@webgrowly.com