BIG NEWSWe're joining forces with inBuild · AI Invoice Processing is the first step

Data Processing Agreement

Effective: October 13, 2026

This Data Processing Agreement ("DPA") applies automatically to every customer that uses BuilderPad or BuilderPad Finance (formerly inBuild) under our Terms of Service. You do not need to sign it for it to apply. If your organization needs a countersigned copy, email privacy@builderpad.com and we will send one with this Cover Page completed.

Using this DPA

This DPA has two parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 ("DPA Standard Terms"), which are incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized words have the meanings given on the Cover Page. If the Cover Page omits or does not define a word, its default meaning is "none" or "not applicable", and the related clause, sentence or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

In this DPA, Provider means BuilderPad, Inc. and Customer means the customer that has agreed to the Agreement.

Key Terms

Agreement

This DPA supplements the BuilderPad Terms of Service, and any order form or other written agreement between Provider and Customer for the Service (together, the "Agreement").

Approved Subprocessors

The list of Subprocessors available at builderpad.com/subprocessors.

Provider Security Contact

security@builderpad.com · BuilderPad, Inc., 8480 Honeycutt Rd, Suite 227, Raleigh, NC 27615

Security Policy

The measures described in Annex II below.

Changes to the Agreement

DPA Covered Claim. Without limiting the indemnity obligations in the Agreement, Provider will indemnify, defend, and hold harmless Customer from and against any action, proceeding, or claim made by someone other than Customer, Customer's Affiliates, or Users, and all out-of-pocket damages, awards, settlements, costs, and expenses, including reasonable attorneys' fees and other legal expenses, that arise from (1) Provider's breach or alleged breach of the DPA, or (2) Provider's gross negligence or willful misconduct, in each case, that results in a Security Incident.

DPA Liability Cap. The following is added to the end of Section 8.1 of the DPA Standard Terms: However, Provider's total cumulative liability arising out of or related to DPA Covered Claims will not be more than 2 times the fees paid or payable by Customer to Provider in the 12 month period immediately before the claim.

Governing Law and Chosen Courts. Not changed from the Agreement (Delaware).

Service Provider Relationship

To the extent the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers

Not applicable. The Service is offered to customers in the United States, and Customer Personal Data is processed in the United States.

Modifications to the DPA Standard Terms

The following Key Terms change or add to the DPA Standard Terms. Under "Using this DPA", they control over the DPA Standard Terms.

A. No training of AI models. Provider will not use Customer Personal Data or any other Customer Data, or any record-level copy of it, to train, fine-tune or improve artificial intelligence or machine-learning models, and will engage AI providers as Subprocessors only under written terms that prohibit them from using Customer Data to train, fine-tune or improve their models. This Section A controls over any conflicting term of the Agreement or any other document published by Provider. Aggregated Data that meets Section B is not Customer Data, and this Section A does not limit its use.

B. Aggregated Data. Customer authorizes Provider to create Aggregated Data, as defined in Section 5.4 of the Terms of Service. Provider will de-identify Customer's data before combining it with other customers' data. Aggregated Data combines data from at least 10 unrelated customer companies and cannot reasonably be used to identify, infer information about, or otherwise be linked to Customer, any individual, or any vendor or project. Provider will maintain Aggregated Data in de-identified form, will not attempt to re-identify it, and will contractually require any recipient to do the same. Aggregated Data is not Customer Personal Data, and Provider may continue to use it after this DPA ends.

C. Security Incident notice. Section 4.1(a) of the DPA Standard Terms is replaced with: "(a) notify Customer without undue delay, and no later than 72 hours after Provider confirms the Security Incident (Provider will investigate suspected Security Incidents promptly and will not unreasonably delay confirming one), or sooner where Applicable Law requires;".

D. Security reports. Provider does not currently hold third-party security certifications or audit reports. Section 5.2 of the DPA Standard Terms does not apply until Provider obtains such a Report, and the words "In addition to the Report," in Section 5.3 are deleted. Customer may also make a request under Section 5.3 after any Security Incident, in addition to the once-a-year limit.

E. Account contact details. Customer Personal Data does not include the names and contact details of the people who register for and administer Customer's account, which Provider processes for its own account management and marketing as described in its Privacy Policy.

Annex I(A): List of Parties

Data Exporter: Customer, as identified in the Agreement. Role: Controller.

Data Importer: BuilderPad, Inc., 8480 Honeycutt Rd, Suite 227, Raleigh, NC 27615. Contact: Privacy and Security, privacy@builderpad.com. Role: Processor.

Annex I(B): Description of Processing

Service

BuilderPad (construction project management, client portal, scheduling, change orders, selections, purchase orders and invoicing) and BuilderPad Finance (AI invoice processing, accounts payable, vendor payments and accounting integrations).

Categories of Data Subjects

  • Customer's employees and contractors who use the Service
  • Customer's clients, such as homeowners
  • Customer's vendors, subcontractors and suppliers, and their contacts
  • People whose details appear in documents or email that Customer submits

Categories of Personal Data

  • Name
  • Contact information such as email, phone number or address
  • Financial information such as bank account and routing numbers, tax identification numbers, invoice and payment details
  • Transactional information such as account information, purchases, invoices and bills
  • User activity and analysis such as device information or IP address
  • Content of documents and email messages that Customer submits or connects

Special Category Data

No.

Frequency of Transfer

Continuous.

Nature and Purpose of Processing

Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:

  • Receiving data, including collection, accessing, retrieval, recording and data entry, including from mailboxes and integrations Customer connects
  • Holding data, including storage, organization and structuring
  • Using data, including analysis and automated extraction of details from documents
  • Updating data, including correcting, adaptation, alteration, alignment and combination
  • Protecting data, including restricting, encrypting and security testing
  • Sharing data with Approved Subprocessors and with third-party services and payment partners as Customer instructs
  • Returning data to Customer
  • Erasing data, including destruction and deletion

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the DPA Standard Terms; or (ii) by Applicable Laws.

Annex II: Technical and Organizational Security Measures

Encryption in transit. Connections to the Service and to our databases use TLS.

Encryption at rest. Stored data and files are encrypted by our hosting and storage providers. Vendor bank account and routing numbers are additionally encrypted at the field level with a separate key and are masked in the application.

Access control. Access to production systems and Customer Data is limited to personnel and contractors who need it for their role, under written confidentiality obligations. Users authenticate with passwords or with Google or Microsoft single sign-on.

Connected accounts. Mailbox and integration access uses the customer's own authorization (OAuth) and can be revoked by the Customer at any time. We never receive mailbox passwords.

Logging and monitoring. We log application errors and monitor availability, and keep change history for key financial records and an audit log of payouts.

Availability and recovery. We use managed database and storage services with backups.

Incident response. We investigate suspected Security Incidents promptly and notify Customer as described in Modification C.

Subprocessor management. We engage Subprocessors under written agreements with data-protection terms, and AI Subprocessors only under no-training terms.

Data minimization. Connected mailboxes are read only for Inbox messages with attachments within a recent window, as described in our Privacy Policy.

Common Paper Data Processing Agreement (Version 1.1) free to use under CC BY 4.0. Provider has not changed the DPA Standard Terms except for the details on this Cover Page.