Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Appraisal Ally ("Processor," "we," "us") and the customer that subscribes to the service ("Controller," "Customer," "you"). It governs personal data that we process on your behalf when you use Appraisal Ally. Where this DPA conflicts with our Terms of Service, this DPA controls for that personal data.

1. Roles: who controls what

Appraisal Ally is practice-management software for real-estate appraisers. When you add information about other people to the app — your clients, borrowers, lenders, AMCs, attorneys, property addresses, orders, invoices, and reports — you decide what to collect and why. You are the Controller (or Business under the CCPA) of that data. We process it only to run the service for you, which makes us your Processor (or Service Provider under the CCPA).

By contrast, data about you and your business as our customer (your account, billing, and company profile) is governed by our Privacy Policy, where we act as controller. This DPA is about the data you store about other people.

2. Scope of processing

Subject matter: our provision of the service. Duration: the term of your subscription, plus the retention periods in Section 8. Nature and purpose: hosting, storing, transmitting, processing, and backing up your data so you can manage clients, appraisals, scheduling, invoicing, payments, documents, and AI assistance.

Categories of data subjects: your clients and contacts, including borrowers, lenders, AMC staff, and attorneys, and any other individuals you reference in your records. Categories of personal data: names, emails, phone numbers, property addresses, order numbers, opinions of value, invoice and payment amounts with Stripe identifiers, calendar and inspection details, and the contents of documents, reports, and engagement letters (including e-signatures) you upload.

3. Your instructions

We process your data only on your documented instructions. Your instructions consist of the Terms, this DPA, the configuration choices you make in the app, and any further written instructions you give us. We will tell you if we believe an instruction violates applicable data-protection law.

4. Confidentiality

Access to your data is limited to personnel who need it to operate or support the service, and they are bound by confidentiality obligations. As a small, founder-run company, that access is tightly held.

5. Security Measures

We maintain technical and organizational measures appropriate to the sensitivity of the data and the size of our company, including:

• Encryption in transit using TLS 1.3.
• Encryption at rest using AES-256.
• Row-Level Security on every multi-tenant table, enforcing that one business's data is never readable by another business.
• Authentication and least-privilege access; OAuth-only access to integrations, so we never hold third-party passwords.
• Daily backups of the production database with point-in-time restore.
• Application and security logging for administrative actions.

We do not currently hold third-party certifications such as SOC 2 or ISO 27001. We will describe our measures honestly on request to support@appraisalally.com.

6. Sub-processors

You authorize us to engage the sub-processors we rely on to run the service. Our current sub-processors are:

• Vercel — application hosting (United States).
• Supabase — database, authentication, and file storage (hosted on AWS, US-East).
• Stripe — subscription billing and client invoice payments; card data is handled solely by Stripe.
• Loops — transactional email delivery.
• Anthropic — AI assistance features (Claude). Your data is not used to train third-party AI models.
• Google (Calendar / Places) and Dropbox — only when you connect those optional integrations.

The authoritative, current list is maintained at /legal/subprocessors. We will give you advance notice by email before adding a new sub-processor. You may object on reasonable grounds; if we cannot address your objection, you may stop using the affected feature or terminate. We bind each sub-processor to data-protection obligations no less protective than those in this DPA, and we remain responsible for their performance.

7. Data subject requests & assistance

The app gives you direct tools to access, correct, export, and delete the records you store, which lets you handle most data-subject requests yourself. Taking into account the nature of the processing, we will also provide reasonable assistance to help you respond to requests to exercise rights of access, rectification, erasure, restriction, portability, and objection, and to meet your security, breach-notification, and impact-assessment obligations.

If one of your data subjects contacts us directly, we will refer them to you and will not respond substantively without your instruction, other than to confirm receipt.

8. Personal data breach notification

If we become aware of a breach affecting the personal data we process for you, we will notify you without undue delay and provide the information you reasonably need to meet your own notification obligations.

9. Deletion or return on termination

You can export your data on demand while your account is active. After you cancel, we provide a 90-day read-only grace period so you can export everything. After that period, your data is deleted or de-identified from production systems, subject to legal retention obligations and standard backup-rotation schedules.

10. International transfers

We and our core sub-processors store data in the United States. If you transfer personal data from the EEA, UK, or Switzerland, you do so as controller; where required, the EU Standard Contractual Clauses (Module 2, Controller to Processor) and the UK International Data Transfer Addendum apply to that transfer and are incorporated by reference.

11. CCPA service-provider terms

For data subject to the CCPA, we act as a Service Provider. We will not sell or share it, will not retain, use, or disclose it for any purpose other than providing the service to you, and will not combine it with personal information from other sources, except as the CCPA permits.

12. Contact

For DPA-related questions or to request a countersigned copy, email support@appraisalally.com.

Appraisal Ally
9235 N Union Blvd Ste 150 #341
Colorado Springs, CO 80920