Data Processing Addendum

This addendum forms part of the Terms of Service between GuardPostSync LLC ("Processor", "we") and the subscribing company ("Controller", "you"). Where it conflicts with the Terms, this addendum governs on the subject of personal information.

---

1. Roles

You are the controller (the "business" under California law) of the personal information you put into GuardPostSync. You decide what is collected, why, and for how long.

We are the processor (the "service provider"). We handle that information only to provide the service, only on your documented instructions, and for no purpose of our own.

Your instructions are: the Terms of Service, this addendum, the settings you choose in the product, and anything you tell us in writing.

We will tell you if we believe an instruction of yours breaks the law, and we may decline to follow it.

2. What we will not do

We will not:

• sell your personal information, or share it for cross-context behavioural

advertising, as those terms are defined under California law;

• retain, use or disclose it for any purpose other than providing the service, or

outside the direct business relationship between us;

• combine it with personal information from another source, except as permitted for a

service provider;

• use it to train machine learning models.

We certify that we understand these restrictions and will comply with them.

3. What is processed

Categories of individual: your employees — security officers, schedulers, supervisors, owners.

Categories of personal information:

• Identity: name, preferred name, date of birth, home address
• Contact: mobile number, email, emergency contact
• Government credentials: state security licence number, class, issuing state, expiry

date, and photographs of the physical licence card

• Employment: status, schedules, assignments, availability, time off, hours
• Consent records for text messaging, including the wording shown and its version
• Audit records attributing actions to named individuals
• Account and billing contact details

Never processed, by design: Social Security numbers, tax forms (I-9, W-4 or any other), bank details, payroll or compensation amounts, payment card numbers, background check results, location or biometric data, health information.

Duration: for as long as you are a customer, plus the periods in §9.

4. Security measures

This is what we do, not what we intend to do.

Access separation. Each customer's data is isolated at the database level using row-level security enforced by PostgreSQL itself, not only by application code. A query without a valid company context cannot read another company's rows.

Encryption. TLS in transit. Encryption at rest by our database and storage providers.

Credential images. Licence card photographs are stored in private object storage under keys scoped to a single company. There are no public URLs and no guessable paths.

Data minimisation in messages. SMS bodies and app notifications deliberately contain no licence number, no licence class, no site address and no company name; the detail stays behind an authenticated link. App notifications are additionally encrypted to the officer's device, so the push service that delivers them cannot read them.

Scrubbed error reporting. Licence numbers, phone numbers, email addresses, tokens and connection strings are removed before an error report leaves our systems. If the scrubbing fails, the report is discarded rather than sent.

Audit. Credential and assignment decisions are recorded against a named principal with a timestamp.

Rate limiting. Authentication, password reset and intake endpoints are rate limited to slow credential stuffing and enumeration.

Personnel. Production access is limited to named personnel who require it for their role, each bound by confidentiality obligations, with access removed when the role ends. We will tell you on request how many people currently hold production access.

We are not SOC 2 certified, and nothing in this addendum should be read as claiming we are.

5. Subprocessors

You authorise the subprocessors listed in Appendix A.

Each is bound by terms no less protective than these, and we remain responsible for their performance as if it were our own.

New subprocessors. We will give you 30 days' notice by email before a new subprocessor begins processing your data. If you reasonably object on data protection grounds within that period, tell us and we will try to resolve it. If we cannot, you may terminate the affected part of the service and receive a refund of any prepaid, unused fees.

6. Confidentiality

Anyone we allow near your data is bound by confidentiality obligations that survive the end of their engagement.

7. Security incidents

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to your personal information, we will notify you without undue delay, and in any event within 72 hours of confirming it.

The notice will describe what happened, the categories and approximate number of individuals and records affected, the likely consequences, and the steps we are taking. Where we do not have all of that at once, we will send what we have and follow up.

We will help you meet your own notification obligations, including to state attorneys general and to affected officers.

We will not notify your employees directly unless you ask us to or the law requires it of us.

8. Your obligations

You will:

• have a lawful basis for everything you put into the service;
• give your officers whatever notice their state requires;
• obtain and maintain consent for text messaging using the mechanism we provide, and

not send anything outside what that consent covers;

• keep your roster accurate, and deactivate officers who leave;
• not upload data the service is not built to hold — Social Security numbers, tax

forms, bank details, background check results or health information;

• manage your own users' access and remove people who should no longer have it.

9. Deletion and return

During the subscription: you can export your data from within the product at any time.

On termination: your data remains available for export for 30 days, then is deleted within 60 days. Database backups age out within 7 days. We will confirm deletion in writing on request.

We may keep information where law requires it, and we will tell you what and why.

10. Audit

On written request, no more than once a year, we will provide the information reasonably needed to show we are meeting this addendum: our security documentation, our current subprocessor list, and answers to a reasonable security questionnaire.

Where a third-party audit report exists in future, providing it satisfies this clause.

We do not offer on-site inspection or customer penetration testing of production. Given the size of this company and the number of customers, an inspection right would be more disruptive than protective. If your compliance function requires one, tell us before subscribing.

11. Assistance

We will help you, at your cost where the effort is more than trivial, with:

• responding to requests from individuals about their own information;
• data protection impact assessments;
• consultations with a regulator.

Because you control your data inside the product, you can handle most individual requests yourself without us.

If an individual contacts us directly we will not respond substantively. We will direct them to you and tell you it happened.

12. International transfers

All storage and processing of your data occurs in the United States. The one exception is delivery of app notifications, which runs over the browser vendor's own network (Appendix A) and may cross borders: what crosses is a device address and a payload encrypted to that device, which the vendor cannot read. If anything else changes we will notify you under §5.

13. Liability

Liability under this addendum is subject to the limitations in the Terms of Service.

---

Appendix A — Subprocessors

As at 2026-09-27. The current list is maintained at docs/subprocessors.md and is authoritative; this appendix is a snapshot of it.

Processing today

Configured, not yet processing

Data that never leaves

• No Social Security numbers, tax forms, I-9, W-4 or bank details are collected anywhere
• No payroll data; the hours export carries no dollar amounts
• No card details touch our systems; checkout happens on Stripe's own page
• No credential data reaches Stripe or Sentry

---

GuardPostSync LLC · 7104 Cherry Beam Path, Austin, TX 78744 · legal@guardpostsync.com