Effective Date: October 31, 2026 Operator: Pride Nest Properties, LLC ("Pride Nest," "we," "us")

This document has two parts. Part A is the Privacy Policy, explaining how Pride Nest handles information about the businesses and people who use PrideNestProOS. Part B is the Data Processing Agreement ("DPA"), which governs how Pride Nest processes personal information that Platform customers ("Customer," "you") store in their CRM and collect through their websites. Part B forms part of the Terms of Service.

Part A — Privacy Policy

1. Information We Collect

Account information: names, business names, email addresses, phone numbers, business addresses, login credentials, and team member details.

Billing information: plan selections, payment history, and billing contact details. Card numbers are handled by our payment processors and are not stored by Pride Nest.

Customer CRM data: information you and your end customers enter, such as homeowner names, contact details, property addresses, service requests, quotes, visit history, payment status, notes, and photos of properties.

Usage and device data: log data, IP addresses, browser type, pages visited, and feature usage, used to operate and secure the Platform.

Imported website content: text and images from a website you direct us to import.

2. How We Use Information

• To provide, host, maintain, and support the Platform.
• To process subscription billing and the Customer's own customer payments.
• To generate AI estimates and analysis when requested.
• To send transactional emails such as quotes, confirmations, and account notices.
• To secure the Platform, prevent fraud, and enforce our Terms.
• To improve the Platform using aggregated or de-identified data.

We do not sell personal information, and we do not use Customer CRM data to market to your end customers.

3. AI Processing

When an AI feature is used (for example, a photo-based estimate), the submitted photos, notes, and relevant job details are sent to third-party AI model providers solely to generate the requested output. We use providers that do not use API-submitted data to train their general models under their applicable business terms. AI outputs are stored with the related request in your account. AI outputs may be inaccurate and must be reviewed by the Customer.

4. Vendors and Sub-processors

We share information with service providers only as needed to operate the Platform. Categories include:

• Hosting, database, and storage (application and file hosting infrastructure).
• Payments: Base44 Payments for subscription billing; Stripe for Customer payment collection through connected accounts.
• AI model providers for estimates and photo analysis.
• Email delivery for transactional and account messages.
• Website import tooling for retrieving content from a Customer-designated website.
• Domain and DNS services for custom domains.

A current list of sub-processors is available on request. We will give Customers at least fifteen (15) days' notice before adding a new sub-processor that processes CRM personal data.

5. Data Retention

• Active accounts: data is retained while the subscription is active.
• After termination: Customer data is available for export for thirty (30) days, then deleted or de-identified within sixty (60) further days, except where retention is legally required.
• Backups: deleted data may persist in encrypted backups for up to ninety (90) days before being overwritten.
• Billing records: retained as required for tax and accounting purposes, generally seven (7) years.
• Logs: security and access logs are generally retained for up to twelve (12) months.

6. Security

We use reasonable administrative, technical, and organizational safeguards, including encryption in transit, access controls, tenant data isolation so each company's records are separated from other companies, role-based permissions, and private storage for uploaded files. No system is completely secure.

7. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, or to opt out of certain processing. Account holders can update many details in the Platform. End customers of a business using the Platform should contact that business first, as it controls their information; we will assist that business in responding.

8. Children

The Platform is intended for businesses and is not directed to children under 16. We do not knowingly collect children's personal information.

9. Changes

We will post updates here and notify account holders of material changes.

10. Contact

Pride Nest Properties, LLC — Privacy, [Insert Email Address], [Insert Business Address].

Part B — Data Processing Agreement

1. Roles

For personal information the Customer stores in, or collects through, the Platform ("Customer Personal Data"), the Customer is the controller (or "business") and Pride Nest is the processor (or "service provider").

2. Instructions

Pride Nest will process Customer Personal Data only to provide the Platform, on the Customer's documented instructions (including these terms and the Customer's use of Platform features), or as required by law. Pride Nest will not sell or share Customer Personal Data, or retain, use, or disclose it outside the direct business relationship with the Customer, except as permitted by law.

3. Customer Obligations

The Customer is responsible for having a lawful basis and any required consents for the data it collects; providing privacy notices to its end customers; the accuracy of the data; and the lawfulness of its instructions, including communications sent to its customers.

4. Confidentiality and Personnel

Pride Nest will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed.

5. Security Measures

Pride Nest will maintain the security measures described in Part A, Section 6, and update them as reasonably necessary without materially reducing overall protection.

6. Sub-processors

The Customer authorizes the sub-processor categories in Part A, Section 4. Pride Nest will impose data protection terms on sub-processors that are no less protective than this DPA and remains responsible for their performance. The Customer may object to a new sub-processor on reasonable data protection grounds within the notice period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rated refund of prepaid fees for it.

7. Security Incidents

Pride Nest will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a security incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the data affected, the likely consequences, and the steps taken. Pride Nest will reasonably cooperate with the Customer's investigation and any notifications the Customer is legally required to make. Unless required by law, Pride Nest will not notify the Customer's end customers directly without the Customer's consent.

8. Assistance with Requests

Pride Nest will provide reasonable assistance, taking into account the nature of the processing, to help the Customer respond to individuals' privacy requests and to meet its legal obligations regarding security, impact assessments, and regulator consultations.

9. Return and Deletion

Upon termination, Pride Nest will make Customer Personal Data available for export for thirty (30) days, then delete it in accordance with Part A, Section 5, unless retention is required by law.

10. Audits

On reasonable written request, no more than once per year, Pride Nest will provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality.

11. Data Location

Customer Personal Data is primarily processed and stored in the United States.

12. Precedence

For matters involving Customer Personal Data, this DPA controls over the Terms of Service. Limitations of liability in the Terms of Service apply to this DPA to the extent permitted by law.