Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement — General Terms between Populus Technology, LLC, a Texas limited liability company (“Provider”), and the Customer identified on the signature page (“Customer”), and governs Provider’s processing of personal data contained in Customer Data. The Subprocessor List in Exhibit A below is part of this DPA.

1. Parties and Roles

Customer is the controller of the personal data it submits to the Services (or a processor acting for its own clients); Provider is a processor acting on Customer’s documented instructions. Three tiers of data subject may appear in Customer Data: Customer’s own users; Customer’s clients (typically the bulk of the data); and portal users — Customer’s clients using the client portal under the Client Portal Terms.

2. Scope

This DPA is drawn to the Texas Data Privacy and Security Act and applicable United States state privacy law. If processing subject to other regimes comes into scope, the parties will execute the appropriate addendum. Categories of personal data processed: identity and contact data of Customer’s users and clients; property ownership and address data; valuation, assessment, tax, and payment records; uploaded documents and their extracted contents; billing and session records; and support communications. Special categories are processed only where a product Schedule expressly states so.

3. Instructions

3.1 Provider processes Customer personal data only to provide, secure, and support the Services, per the Agreement and Customer’s written instructions, or as required by law (with notice to Customer unless prohibited).

3.2 Telemetry. Usage telemetry is scoped to identifiers, counts, statuses, and enumerated values — never the contents of Customer records.

3.3 AI processing. Documents uploaded to the Services are read by the AI provider named in Exhibit A to stage structured data for Customer’s review; staged output is never written directly to Customer’s books without an opportunity for review. Provider does not authorize any AI provider to use Customer content to train generalized models.

3.4 No sale. Provider does not sell personal data, does not use it for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects.

4. Confidentiality of Processing

Provider ensures that personnel and contractors with access to Customer personal data are bound by written confidentiality obligations.

5. Security

Provider maintains administrative, physical, and technical safeguards appropriate to the nature of the data, including encryption of data in transit, role-based access controls, network isolation of production data stores, and immutable, versioned off-site backups. Provider will not materially degrade the security of the Services during the Term.

6. Subprocessors

Customer generally authorizes the subprocessors listed in Exhibit A, which is the system of record. Before enabling a new subprocessor, Provider will update Exhibit A and give Customer at least thirty (30) days’ notice. Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, Customer may terminate the affected Schedule pro rata. Provider remains liable for its subprocessors’ performance to the standard of this DPA.

7. Data Subject Requests

Provider forwards to Customer, without undue delay, any data subject request it receives concerning Customer personal data, and does not respond substantively except to direct the requester to Customer. The Services provide self-serve export, correction, and deletion; assistance beyond those capabilities is provided at Provider’s then-current rates.

8. Breach Notice

Provider will notify Customer without undue delay after confirming a breach of security affecting Customer personal data, describing the nature of the incident, the categories affected, likely consequences, measures taken or proposed, and a contact point. Notification is not an admission of fault.

9. Return and Deletion

During the Term, Customer may export Customer Data in machine-readable form through the Services. Following termination and written request, Provider deletes Customer personal data within thirty (30) days, except for backup copies — which persist until they age out of the standard backup rotation, after which they are deleted — and records retained under legal hold or as required by law.

10. Audits

Annually on request, Provider will make available its then-current Exhibits, responses to reasonable security questionnaires, and summaries of test results where they exist. Further audit rights arise only on a demonstrated breach or a regulator’s requirement, and are exercised through an independent auditor under NDA, at Customer’s cost, on thirty (30) days’ notice, with no access to other customers’ data.

11. Product Schedules

For AppealStack™ (Schedule A), the full Section 2 categories apply. Other products are covered by this DPA only when ordered, with any product-specific terms stated in the applicable Schedule.

12. Liability

Liability under this DPA is subject to the limitations of the Agreement. This DPA survives for as long as Provider holds Customer personal data.

---

Exhibit A — Subprocessor List

Version 2026-08-20.1 (frozen as of 20 August 2026). Provider: Populus Technology, LLC (TX). This Exhibit is the system of record for third parties that process Customer personal data in providing AppealStack™. It is updated per Section 6 — a new subprocessor’s row is published, and notice given, at least 30 days before the subprocessor is enabled.

#	Vendor	Function	Personal data involved
1	Railway Corp.	Cloud compute, PostgreSQL, Redis	All application data
2	Cloudflare, Inc. — R2	Document storage; parcel map tiles; database backups (immutable object lock)	Uploaded document contents; full backups
3	Cloudflare, Inc. — DNS / proxy / WAF	Network edge for all HTTP traffic	IP addresses, request metadata
4	Functional Software, Inc. (Sentry)	Error tracking and performance tracing	Error events with request context; user and tenant identifiers
5	PostHog, Inc. (US region)	Product analytics	User and tenant identifiers, event names, counts, and statuses — no record contents
6	Resend	Transactional email	Recipient addresses and message content
7	WorkOS, Inc.	Sign-in / single sign-on	Email, name, identity metadata
8	Smarty	US address autocomplete	Partial address strings as staff type
9	Google LLC — Gemini API	AI document reading (Section 3.3)	Contents of uploaded documents
10	OpenStreetMap Foundation — Nominatim	Geocoding of property addresses	Property street addresses
11	OpenFreeMap	Basemap tiles, fetched by the end user’s browser	Map viewport and browser IP
12	Stripe, Inc.	Card and ACH payments	Billing contact, amounts — card data never transits Provider’s servers
13	Google LLC — Fonts	Web font delivery	Browser IP on page load

Notes.

1. Community-operated services. OpenStreetMap Foundation (Nominatim) and OpenFreeMap are community-operated services engaged under their published usage and privacy policies rather than a negotiated data-processing agreement. They receive, respectively, property street addresses and map-viewport requests, and are disclosed here explicitly on that basis.
2. Optional integrations. Integrations that activate only at Customer’s request (for example, Intuit QuickBooks) become subprocessors only when enabled for Customer, and appear in an updated version of this Exhibit, with notice, per Section 6 before activation.
3. Inbound data sources. State and county GIS services from which the platform retrieves public parcel data are not subprocessors: no Customer personal data flows to them.