Data Processing Addendum

Version 5.4 · Effective October 20, 2026

This Data Processing Addendum (the "DPA") forms part of the Nxera Terms of Service (the "Agreement") between Nxera Digital LLC ("Nxera") and the Client identified in the underlying Agreement ("Client"). It applies whenever Nxera Processes Personal Data on behalf of Client in connection with the Services: the customer list and consent records Client provides for follow-ups, and the member records created when Client's customers enroll in Client's maintenance plans.

In the event of any conflict between this DPA and the Agreement on data-protection matters, this DPA controls. In the event of any conflict between this DPA and any Standard Contractual Clauses or jurisdiction-specific addendum incorporated by reference, that incorporated instrument controls to the extent of the conflict.

1. Definitions

In this DPA:

"Applicable Data Protection Laws" means all data-protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including: the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA"); the data-protection statutes of other U.S. states as they take effect (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Rhode Island, and any successor laws); and, where applicable to Nxera or Client, the EU General Data Protection Regulation ("GDPR"), the UK Data Protection Act 2018 and UK GDPR ("UK GDPR"), the Personal Information Protection and Electronic Documents Act of Canada ("PIPEDA"), and similar laws in other jurisdictions.
"Controller," "Processor," "Data Subject," "Personal Data," "Personal Information," "Process / Processing," "Sale / Share, Service Provider, Contractor" have the meanings given in the Applicable Data Protection Laws.
"Customer Personal Data" means Personal Data Processed by Nxera on behalf of Client under the Agreement, including Client's customer records and Member records.
"Member" has the meaning given in the Agreement.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
"Standard Contractual Clauses" or "SCCs" means, as applicable: the standard contractual clauses approved by the European Commission for the transfer of personal data to third countries (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum to the EU SCCs, and any successor or replacement instruments.
"Sub-processor" means any third party engaged by Nxera to Process Customer Personal Data on Nxera's behalf.

Capitalized terms not defined here have the meanings given in the Agreement.

2. Roles of the Parties

2.1 Roles

For Customer Personal Data, Client is the Controller (or "Business" under CCPA/CPRA), and Nxera is the Processor (or "Service Provider" under CCPA/CPRA), except that Nxera acts as Controller for Personal Data it Processes for its own legitimate business purposes (account management, billing, fraud prevention, security, product improvement in aggregated form, legal compliance, the free competitive scan, and the operation of the Sites generally), as described in the Privacy Policy.

2.2 Compliance

Each party will comply with its respective obligations under Applicable Data Protection Laws.

2.3 Client Responsibilities

Client represents, warrants, and covenants that: (a) Client has and will maintain a lawful basis to Process all Customer Personal Data and to instruct Nxera to Process it (including, where required, the consent of Data Subjects), and records that basis when a contact is added; (b) Client has provided all required notices to Data Subjects, including any notice required for text messages; (c) Client's instructions to Nxera comply with Applicable Data Protection Laws, and Client's approval of a Customer Message is an instruction to send it; (d) Client will not provide Nxera with sensitive or special-category Personal Data except as expressly authorized in writing by Nxera; (e) Client is solely responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which Client acquired it; (f) Client will honor opt-outs it receives directly and will not re-add a contact who unsubscribed.

3. Scope, Nature, and Purpose of Processing

3.1 Subject Matter and Duration

The subject matter of Processing is the Services described in the Agreement. The duration is the term of the Agreement plus thirty (30) days after the Services end for Client (the data is deleted within thirty-seven (37) days of the end date, as set out in Section 4(h)), plus the retention of the records listed in Section 4(h) and any retention period required by law.

3.2 Nature and Purpose

Nxera Processes Customer Personal Data to:

store Client's customer list and consent records;
draft Customer Messages and send them in Client's name only after Client approves each one. A draft Client has not approved by its send time expires unsent. The approval window is between 1 and 168 hours (24 hours unless Client changes it), and review cannot be turned off. This covers every message to a customer on Client's list, every message Nxera's assistant drafts, messages to all Members, offers and coupons, and review requests;
log visits and draft the review requests, check-ins, and offers Client's settings call for, each sent only on Client's approval;
host Client's Plan Page, enroll Members, and store Member messages, photos Members choose to share, and visit requests;
send to Members, without approval of each message: payment receipts; the welcome email when someone joins a plan; failed-payment notices (on days 1, 4, and 10 after a failed charge); the yearly renewal notice for annual plans, about 30 to 45 days before renewal; confirmations of what a Member did (a visit request received, a visit booked, a cancellation or a decision to keep the plan, a new sign-in link the Member asked for); the automatic note that a Member's message was received (unless Client switches it off under Follow-ups, then We got your message); the Member's notice after Client answers a visit request; and replies to STOP and HELP texts;
send visit reminders and the note before a Member cancels only on Client's approval, or on their own if Client ticks "Send visit reminders and the note before a member cancels without asking me";
send text and WhatsApp messages in Client's name from Client's own registered number or WhatsApp sender, but only after Client's registration is approved and Nxera has switched those channels on (on the Effective Date they are switched off for every Client);
deliver Member messages to Client's portal and owner app;
use an AI model (Anthropic's Claude) to draft messages and plan designs, answer Client, sort and summarize incoming customer and Member messages, check drafts for review incentives, and write Client's morning briefing; and
otherwise fulfill the Agreement.

3.3 Categories of Data Subjects

Client's customers and prospective customers whose contact details Client provides;
Members who enroll in Client's plans through Client's Plan Page;
Client's employees and team members whose data Client provides;
Visitors to Client's Plan Page;
Other individuals about whom Client provides Personal Data.

3.4 Categories of Personal Data

Customer Personal Data may include: name; contact details (email, phone, service and mailing address); consent basis and attestation; service history, visit dates, and notes; plan selection, plan status, and language preference; Member messages and photos; Stripe customer and subscription identifiers created on Client's own Stripe account (Nxera does not receive or store card numbers); text and WhatsApp consent records; message delivery, bounce, complaint, and unsubscribe events; and any other Personal Data Client provides or directs Nxera to Process.

3.5 No Sensitive Categories

Client agrees not to provide Nxera with special-category, sensitive, financial-account, government-identifier, biometric, health, children's, or similar restricted data, except as expressly authorized in writing by Nxera. Nxera is not responsible for safeguards specific to such data unless explicitly agreed.

4. Nxera's Obligations as Processor

Nxera will:

(a) Process Customer Personal Data only on documented instructions from Client (the Agreement, this DPA, Client's portal settings, Client's approvals, and Client's use of the Services constitute such instructions), including instructions regarding international transfers, except as required by law (in which case Nxera will notify Client unless legally prohibited);

(b) Confine access to authorized personnel who have a need to know and are bound by confidentiality obligations;

(d) Engage Sub-processors only in accordance with Section 5;

(e) Assist Client, taking into account the nature of the Processing, in responding to Data Subject requests under Applicable Data Protection Laws (access, deletion, correction, portability, restriction, objection), including requests a Data Subject sends to Nxera directly, which Nxera will forward to Client;

(f) Assist Client in fulfilling its obligations under Applicable Data Protection Laws to conduct data-protection impact assessments and prior consultations with supervisory authorities;

(g) Notify Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data (Section 8);

(h) Return and delete Customer Personal Data. While the Services are active, Client may return Customer Personal Data by self-service export (Settings, then Your data, then "Download everything": a file of customers, members, plans, messages, decisions, consent records, and the activity log; photos, documents, and the logo are not in the file and are sent on written request) and may delete it by self-service deletion ("Delete everything", which runs seven (7) days after the request unless Client cancels it in that time) or by written request, which Nxera completes within thirty (30) days. When the Services end for Client, Nxera deletes Client's customer list and Members, with Member messages, photos, and attachments, thirty (30) days after the end date. A weekly job does the deletion, so it is complete within thirty-seven (37) days of the end date. Client should export before then; the export is not available after the deletion. Until the deletion, Nxera will not use the data for any purpose other than storage. After any deletion, Nxera keeps only: (1) payment and tax records; (2) its send ledger (the subject and date of each email sent, without the message body and with the address replaced by a keyed hash), retained as evidence of lawful sending; (3) the entries on its bounce and complaint suppression lists, with the address replaced by a keyed hash, so those addresses are never mailed again; (4) a keyed hash of any address that unsubscribed, retained solely to honor that objection for as long as Nxera operates; (5) consent and opt-out records, with the address or number replaced by a keyed hash and the IP address and browser details removed, kept until four (4) years after the deletion (a STOP list kept by Client is kept until four (4) years after Client's own deletion); and (6) anything Union or Member State law or other applicable law requires Nxera to keep. Activity log entries are deleted after twenty-four (24) months, except compliance records (data requests, consent, suppression, and deletion receipts). Messages between Client and the assistant (in the portal, the app, by text or by WhatsApp) and the history of each decision card (when it was proposed, approved, edited, skipped or expired) are deleted twenty-four (24) months after they are written; decision cards themselves, and the facts the assistant keeps about Client's business (its memory), are kept while Client's account is open and deleted with it;

(i) Make available to Client all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits under Section 6;

(j) Maintain a written record of Processing activities as required by Applicable Data Protection Laws.

4.1 CCPA/CPRA-Specific Provisions

Nxera will not: (a) Sell or Share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement; (c) retain, use, or disclose Customer Personal Data outside of the direct business relationship with Client; or (d) combine Customer Personal Data with personal information Nxera receives from other sources, except as expressly permitted by the CCPA/CPRA. Nxera certifies that it understands and will comply with these restrictions.

4.2 GDPR/UK GDPR-Specific Provisions (When Applicable)

Where Nxera Processes Personal Data subject to GDPR or UK GDPR, the parties agree that this DPA satisfies Article 28 of GDPR and UK GDPR. The SCCs are deemed incorporated into this DPA by reference for any restricted transfer requiring them; the parties' contact details, processing description, and Annex parameters are derived from this DPA and the Agreement.

5. Sub-Processors

5.1 General Authorization

Client authorizes Nxera to engage Sub-processors to Process Customer Personal Data, subject to this Section 5. Nxera will impose data-protection obligations on Sub-processors that are no less protective than those in this DPA.

5.2 Current Sub-processor List

Sub-processor	Role	Company based in
Supabase, Inc.	Database, authentication, file storage (Member photos and attachments), and serverless functions; Customer Personal Data is stored in the United States	USA
Vercel Inc.	Hosting of getnxera.com, the client portal, and Plan Pages, served from a global edge network; custom-domain provisioning; Vercel Web Analytics (cookieless page-view counts)	USA
Stripe, Inc.	Billing of Texts on Nxera's own Stripe account; Stripe Connect processing of Member payments on Client's own Stripe account, with the Plan Payment Fee	USA
Resend, Inc.	Delivery of email sent in Client's name and of Nxera's own email	USA
Anthropic, PBC	Claude API: drafts messages and plan designs, answers Client, sorts and summarizes incoming customer and Member messages, checks drafts for review incentives, and writes the morning briefing. It receives the business's facts, the message context, and the customer names and message text a task needs. Under Anthropic's Commercial Terms it may not train models on this data, and it deletes API inputs and outputs within 30 days (up to 2 years if flagged for a usage-policy violation)	USA
Google LLC	Places business listings and public reviews about Client's business; the Google Business Profile connection (OAuth) when Client connects it; PageSpeed checks; Gemini for the free scan's questions; Knowledge Graph entity lookups for the free scan; font delivery; Tag Manager and Google Analytics 4 on getnxera.com pages (not on Plan Pages, Member pages, or the portal)	USA
Cloudflare, Inc.	Turnstile bot check on forms; DNS lookups for domain checks	USA
Functional Software, Inc. (Sentry)	Error reports and sampled performance traces from every getnxera.com page, including Plan Pages and the portal, and from the Nxera owner app	USA
650 Industries, Inc. (Expo)	Push notifications to the Nxera owner app: the device push token, the notification title and text; customer or Member names appear in the text only if Client turns that on	USA
PostHog, Inc.	Product analytics and masked session recording; used only when Nxera switches it on (it is off on the Effective Date) and never loaded when the browser sends Global Privacy Control	USA
Twilio Inc.	Text messages and carrier registration; used when texting is switched on	USA
Telnyx LLC	Text messages and carrier registration, as an alternative to Twilio; used when texting is switched on and Telnyx is the chosen provider	USA
Meta Platforms, Inc.	WhatsApp messages (WhatsApp Cloud API); used when WhatsApp is switched on	USA

Providers Nxera uses only for the free competitive scan or for its own outreach do not receive Customer Personal Data and are listed for transparency at getnxera.com/sub-processors: OpenAI (scan questions), ZeroBounce (email validity checks for Nxera's own outreach), Yelp (business listing lookups; business names only), Apify (research for Nxera's own outreach), ScreenshotOne (website screenshots for the scan report), and Lob (postcards; no schedule is active). jsDelivr delivers a script on some Nxera account pages; it is not used on Plan Pages.

The current Sub-processor list is also published at getnxera.com/sub-processors and is updated when changes occur.

5.3 Notice of New Sub-processors

Nxera will notify Client of any new Sub-processor at least thirty (30) days before engaging the new Sub-processor (or, in case of urgent operational need, as soon as reasonably practicable).

5.4 Right to Object

Client may object to a new Sub-processor on reasonable, documented data-protection grounds within fifteen (15) days of notice by emailing info@getnxera.com (subject line "Sub-processor Objection"). The parties will discuss the objection in good faith. If the parties cannot resolve the objection within thirty (30) days, Client may cancel the affected Service effective at the end of the current billing period as its sole and exclusive remedy.

5.5 Liability for Sub-processors

Nxera remains responsible to Client for the acts and omissions of Sub-processors as if they were Nxera's own.

6. Audits

6.1 Information and Audit Rights

Nxera will make available to Client information reasonably necessary to demonstrate compliance with this DPA, which may take the form of: (a) Nxera's most recent third-party audit report (when one exists); (b) responses to a reasonable security questionnaire; (c) a written summary of relevant policies and controls.

6.2 On-Site Audits

On reasonable advance written notice (at least sixty (60) days), and no more than once per twelve (12) month period (except when an audit is required following a Personal Data Breach or by order of a supervisory authority), Client may conduct an audit of Nxera's data-protection controls relevant to the Processing of Customer Personal Data.

6.3 Audit Limitations

Audits must: (a) Be conducted during regular business hours and in a manner that does not unreasonably interfere with Nxera's operations; (b) Be conducted by Client or a mutually-agreed independent third-party auditor (not a competitor of Nxera and not a person or firm with which Nxera reasonably objects); (c) Be subject to reasonable confidentiality obligations; (d) Be conducted at Client's expense; (e) Be limited to information relevant to Customer Personal Data Processing; (f) Not include access to information of other Nxera customers or to Nxera's source code, trade secrets, or proprietary methodologies.

6.4 Sub-processor Audits

For Sub-processors, Nxera will make available the most recent audit report or compliance certification of that Sub-processor that Nxera holds. Where Client requires a direct audit of a Sub-processor and the Sub-processor permits, Nxera will use commercially reasonable efforts to facilitate.

7. Security Measures

Nxera implements and maintains technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, or damage, including:

Encryption: TLS 1.2 or higher in transit; encryption at rest provided by underlying cloud-provider infrastructure.
Access Control: Production access is limited to Nxera personnel who need it. Database tables holding customer and Member records are readable only by Nxera's server functions, and every action a Client user takes is limited to that Client's own business.
Authentication: Client users sign in with email and password on the portal (an HttpOnly session cookie) and with bearer tokens in the owner app. Sessions are stored as hashes on the server. Members open their page with a signed link. Incoming webhooks are accepted only with a valid signature.
Network Security: Bot mitigation on forms through Cloudflare Turnstile; monitoring of production functions.
Sending Controls: Marketing and lifecycle messages are limited to one per person from Client every forty-eight (48) hours across email, text, and WhatsApp, and to Client's monthly cap per customer (two (2) unless Client changes it). Drafts are not released between 8 PM and 8 AM in Client's time zone. Every marketing email carries Client's name and postal address and a one-click unsubscribe for Client's business, and Nxera refuses to release a marketing email to a customer on Client's list that lacks the street address, ZIP code, or unsubscribe link. Addresses that bounce or complain are not mailed again. A Client whose own mail draws complaints or hard bounces past Nxera's thresholds is held from sending for seventy-two (72) hours. Transactional Member notices (receipts, failed-payment, renewal, and confirmation notices) carry no unsubscribe link.
Backups: Database backups provided by Supabase.
Vulnerability Management: Nxera patches known vulnerabilities in its dependencies and infrastructure when it learns of them.
Logging and Monitoring: An activity log records sends, approvals and other decisions, data requests, Member and list deletions, and most settings changes (not every setting). Errors in production functions and pages are reported to Nxera.
Incident Response: Personal Data Breaches are handled and notified under Section 8.
Personnel: Confidentiality obligations binding all personnel with access to Customer Personal Data.
Vendor Management: Sub-processor selection criteria include data-security and contractual data-protection commitments.
Physical Security: Cloud-provider data centers maintain physical security controls.

These measures may be updated from time to time, but in no case will updates materially decrease the level of protection.

8. Data Breach Notification

8.1 Notification Timing

Nxera will notify Client without undue delay and in any event within seventy-two (72) hours of confirming a Personal Data Breach affecting Customer Personal Data.

8.2 Notification Content

Notice will include, to the extent then known: the nature of the Breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the Breach and mitigate its effects.

8.3 Cooperation

Nxera will cooperate reasonably with Client in investigating and responding to the Breach.

8.4 No Admission

Notification of a Breach is not an admission of fault or liability by Nxera. The notification timeline begins when Nxera reaches a reasonable conclusion that a Breach has occurred, not at the moment of any precursor incident, suspicion, or alarm.

8.5 Client Notifications

Where Applicable Data Protection Laws require Client (as Controller) to notify Data Subjects or supervisory authorities, Client is responsible for those notifications. Nxera will provide reasonable assistance.

9. International Data Transfers

9.1 US Operations

Nxera operates from the United States. Customer Personal Data is stored in the United States (Supabase). Vercel serves the Sites, the portal, and Plan Pages from a global edge network, so a page request may be handled outside the United States, and other Sub-processors may Process data in the locations their own terms state.

9.2 Transfer Mechanisms

If applicable to a particular Client, Nxera will rely on lawful transfer mechanisms recognized under the Applicable Data Protection Laws, which may include without limitation: (a) the Standard Contractual Clauses adopted by the European Commission; (b) the UK International Data Transfer Addendum; (c) Canada-EU adequacy determinations; (d) explicit Data Subject consent where appropriate; or (e) other mechanisms approved by competent authorities. The applicable mechanism will be deemed incorporated into this DPA upon Client's request and Nxera's confirmation that the Services are made available to that jurisdiction.

9.3 Future Expansion

If Nxera offers Services to Clients in jurisdictions requiring formal SCCs, Nxera will execute the relevant SCCs (or successor instrument) at that time as a separate annex to this DPA.

10. Liability and Indemnification

The liability of each party under this DPA is subject to the limitations of liability set forth in Section 12 of the Terms. Nothing in this DPA increases either party's aggregate liability above the cap stated in the Terms. The indemnification obligations in Section 13 of the Terms apply to claims arising from breach of this DPA.

11. Term and Termination

This DPA takes effect on the Effective Date and remains in effect for the duration of the Agreement and for any period during which Nxera continues to Process Customer Personal Data. Sections that by their nature should survive will survive termination, including without limitation Sections 4(h), 7, 8, 9, 10, and this Section 11.

12. Updates to This DPA

Nxera may update this DPA to reflect changes in Applicable Data Protection Laws or business practice. Each update is posted at getnxera.com with a new version number and effective date, and Nxera emails active Clients about material updates before they take effect. Continued use of the Services after the effective date constitutes acceptance.

13. Order of Precedence

In the order of precedence between this DPA and other Nxera documents on data-protection matters: (a) any executed jurisdiction-specific addendum or executed SCCs control to their extent; (b) this DPA controls over the Privacy Policy and Cookie Policy; (c) the Terms control over this DPA on non-data-protection matters.

14. Contact

Questions about data protection: info@getnxera.com (subject line: "Data Protection")

Nxera Digital LLC 390 NE 191st St STE 59620 Miami, FL 33179

This DPA was last updated on October 20, 2026. Version 5.4.