Data Processing Agreement

01Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the Terms of Service.

02Scope, Roles, and Subject Matter

2.1 Roles

For Customer Personal Data processed in the course of providing the Service, Customer is the Controller and AUM Pulse is the Processor. This DPA does not govern AUM Pulse's processing of advisor account data (account identification, firm-level configuration, integration credentials), with respect to which AUM Pulse acts as Controller as described in the Privacy Policy.

2.2 Subject matter, nature, purpose, and duration

• Subject matter and nature. Provision of the Service as described in the Terms of Service, including meeting-bot creation via Recall.ai, synthesis of meeting transcripts via Anthropic's Claude API, generation of the synthesized pre-call brief and structured intelligence on the prospect record, computation of the Vital™ relationship-health metric, and maintenance of the advisor-correction audit trail.
• Purpose. To enable Customer's Advisors to prepare for and conduct meetings with prospects, and to support Customer's recordkeeping obligations under SEC Rule 204-2(a)(11) and other applicable rules.
• Duration. For the duration of the Term, plus any post-termination period during which AUM Pulse retains Customer Personal Data as provided in Section 12.
• Categories of Personal Data and Data Subjects. As set forth in Schedule B.

03Documented Instructions

AUM Pulse will process Customer Personal Data only on documented instructions from Customer, unless required to do otherwise by applicable law. Customer's documented instructions comprise:

• the Terms of Service and any Order;
• this DPA;
• Customer's configuration and use of the Service through its Advisors' authenticated sessions; and
• any additional written instructions Customer provides to AUM Pulse from time to time, consistent with this DPA.

AUM Pulse will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

04Confidentiality

AUM Pulse will ensure that personnel authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Section 6.3 of the Terms of Service (Confidentiality) is incorporated into this DPA by reference and applies to Customer Personal Data as Customer's Confidential Information regardless of marking.

05Security of Processing

AUM Pulse will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the nature, scope, context, and purposes of processing. The current measures are set forth in Schedule C. AUM Pulse may update its technical and organizational measures from time to time, provided that no update will materially reduce the protection afforded to Customer Personal Data.

06Subprocessors

6.1 General authorization

Customer authorizes AUM Pulse to engage the Subprocessors listed in Schedule A. Each Subprocessor receives only the Customer Personal Data necessary to perform its function, and is bound by a written agreement imposing data-protection obligations no less protective than those in this DPA. AUM Pulse remains fully liable to Customer for the performance of each Subprocessor's data-protection obligations.

6.2 New Subprocessors

AUM Pulse will provide Customer with at least thirty (30) days' advance written notice before adding any new Subprocessor that materially affects the processing of Customer Personal Data. The notice will identify the proposed Subprocessor, the function it will perform, and the categories of Customer Personal Data it will receive.

6.3 Objection to new Subprocessors

Customer may object in good faith to the engagement of a new Subprocessor on reasonable data-protection grounds by written notice within fifteen (15) days of AUM Pulse's notice. The Parties will discuss the objection in good faith. If the Parties cannot resolve the objection within thirty (30) days of Customer's objection, Customer may terminate the affected Order; AUM Pulse will refund any prepaid fees for the period after the effective date of termination.

07International Transfers

AUM Pulse's primary infrastructure and the infrastructure of its Subprocessors are operated in the United States. Where a transfer of Customer Personal Data from the EEA, UK, or Switzerland to a third country occurs and Applicable Data Protection Law requires a transfer mechanism, the Parties will rely on the SCCs (Module Two: Controller-to-Processor), which are deemed incorporated into this DPA by reference.

AUM Pulse does not commit to a specific data-residency configuration in this DPA. Customers with EU, UK, or Swiss Data Subjects should raise the applicable transfer mechanism with AUM Pulse at onboarding.

08Personal Data Breach Notification

AUM Pulse will notify Customer of any Personal Data Breach affecting Customer Personal Data without undue delay, and in any event within seventy-two (72) hours of AUM Pulse becoming aware of the breach. The notification will include, to the extent then known:

• the nature of the breach, including categories of Customer Personal Data and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its possible adverse effects; and
• a point of contact at AUM Pulse from whom further information can be obtained.

Where it is not possible to provide all information at the same time, AUM Pulse may provide information in phases without undue further delay. AUM Pulse will cooperate with Customer and provide reasonable assistance to enable Customer to investigate and respond to the breach, including any required notifications to supervisory authorities or Data Subjects.

09Data Subject Rights Assistance

9.1 Access requests

At Customer's documented instruction, AUM Pulse will produce a copy of the Customer Personal Data AUM Pulse holds about the requesting Data Subject in a structured, commonly used, and machine-readable format.

9.2 Deletion requests

At Customer's documented instruction, AUM Pulse will execute deletion of the requesting Data Subject's Personal Data through the remove_prospect Postgres function, which: (a) verifies the prospect record belongs to the calling Advisor's firm; (b) cancels any Google Calendar or Outlook Calendar follow-up events created by AUM Pulse for the prospect before completing the meeting-history deletion; and (c) cascades deletion through all related tables. Deletion takes effect immediately at the application layer. Customer Personal Data persists in encrypted physical backups for up to eight (8) days, after which it is unrecoverable. Customer acknowledges this backup window and accepts that AUM Pulse cannot purge Customer Personal Data from physical backups on demand.

9.3 Correction requests

At Customer's documented instruction, AUM Pulse will correct Customer Personal Data held in the prospect record. Where the correction concerns a synthesized claim, AUM Pulse records the correction through the advisor-correction audit-trail mechanism. The audit trail captures the action, the responsible Advisor, the timestamp, and the prior and corrected states of the claim, and is retained as adviser-prepared recordkeeping evidence consistent with SEC Rule 204-2(a)(11).

9.4 Other rights

AUM Pulse will provide reasonable assistance to Customer in responding to requests for portability, objection, restriction, and other rights under Applicable Data Protection Law.

9.5 Direct requests from Data Subjects

If AUM Pulse receives a Data Subject request directly, AUM Pulse will inform the requesting Data Subject that the request must be directed to Customer (the Controller), and notify Customer of the request. AUM Pulse will not respond to the Data Subject substantively without Customer's documented instruction, except as required by Applicable Data Protection Law.

10Data Protection Impact Assessment and Prior Consultation

AUM Pulse will provide reasonable assistance to Customer with any data-protection impact assessment Customer is required to carry out under Applicable Data Protection Law, and with any prior consultation with a supervisory authority that may result. AUM Pulse may, in its discretion, recover its reasonable costs for assistance that exceeds the documentation AUM Pulse makes generally available to its customers.

11Audit Rights

Customer's right to audit AUM Pulse's compliance with this DPA is satisfied by the following, no more than once per twelve (12)-month period:

• AUM Pulse will make available to Customer, on request, the most recent attestation reports for AUM Pulse's Subprocessors, to the extent those reports are made available by the Subprocessor;
• AUM Pulse will make available to Customer, on request, AUM Pulse's own attestation reports, if and when AUM Pulse obtains them; and
• AUM Pulse will make available to Customer, on request, the technical and organizational measures documentation referenced in Schedule C, including the 2026-04-19 RLS audit artifact, and respond to reasonable security questionnaires within thirty (30) days.

On-site audits and direct inspection of AUM Pulse's infrastructure are not granted under this DPA. More frequent audits may be undertaken following a confirmed Personal Data Breach or where required by a competent supervisory authority.

12Return and Deletion of Personal Data at Termination

On termination or expiration of the Terms of Service or the affected Order, AUM Pulse will, at Customer's choice expressed in writing within thirty (30) days of the termination effective date:

• Return Customer Personal Data to Customer in a structured, commonly used, and machine-readable format; or
• Delete Customer Personal Data through the application-layer deletion mechanism described in Section 9.2.

If Customer does not exercise its choice within the thirty (30)-day window, AUM Pulse will delete Customer Personal Data. The Section 9.2 backup-window acknowledgment applies. The advisor-correction audit trail is retained following deletion of the underlying Personal Data, consistent with SEC Rule 204-2(a)(11). AUM Pulse may retain Customer Personal Data to the extent required by applicable law, subject to the confidentiality and security obligations in this DPA.

13Liability

The Parties' liability under or in connection with this DPA is subject to, and forms part of the aggregate liability cap established by, Section 10 of the Terms of Service. The liability cap, the exclusion of consequential damages, and the carve-outs in Section 10 of the Terms of Service apply on an aggregate basis across both the Terms of Service and this DPA, not separately to each.

The carve-outs in Section 10.3 of the Terms of Service apply equally to claims arising under this DPA. Nothing in this Section limits a Data Subject's rights under Applicable Data Protection Law or any rights or remedies that Applicable Data Protection Law makes unwaivable.

14Term, Termination, and Survival

This DPA takes effect on the date the Terms of Service take effect and continues for the duration of the Terms of Service. On termination of the Terms of Service, this DPA terminates automatically, except that the provisions that by their nature should survive termination (including Sections 4, 8, 12, 13, and the obligations associated with retained audit-trail rows under Section 9.3) survive for as long as AUM Pulse retains any Customer Personal Data or related records.

15General Provisions

• Order of precedence. In the event of a conflict between this DPA and any other agreement between the Parties, this DPA controls with respect to the processing of Customer Personal Data. The Terms of Service control on all other matters.
• Governing law and venue. The governing law and venue provisions of Section 11 of the Terms of Service apply to this DPA: Arizona governing law, Maricopa County courts as exclusive venue, thirty (30)-day pre-litigation informal-resolution requirement, and jury-trial waiver.
• Notices. Notices under this DPA may be sent through the notice mechanism in Section 12 of the Terms of Service.
• Amendment. This DPA may be amended only by a written instrument signed by both Parties, except that AUM Pulse may unilaterally update Schedule A consistent with Section 6 and update Schedule C consistent with Section 5.
• Severability. If any provision of this DPA is held unenforceable, the remainder remains in effect, and the unenforceable provision is modified to the minimum extent necessary to make it enforceable while preserving the Parties' intent.

ASchedule A — Subprocessors

The following Subprocessors process Customer Personal Data on AUM Pulse's behalf. Each Subprocessor receives only the data necessary to perform its function. This Schedule is current as of the version date at the top of this DPA.

BSchedule B — Categories of Personal Data and Data Subjects

B.1 Data Subjects

The Data Subjects are the prospects, leads, and clients of Customer (the prospective and existing investment-advisory clients of Customer's Advisors) whose information is entered into or generated by the Service.

B.2 Categories of Personal Data

• Contact information. First name, last name, email address, and optionally phone number.
• Advisor-supplied financial estimates. An estimate of the prospect's investable assets typed by the Advisor. AUM Pulse does not query any custodian, brokerage, or banking system.
• Advisor-authored notes. Free-text notes equivalent in scope to a standard CRM notes field.
• Booking context. Booking platform, platform event identifier, UTM tracking parameters from trackable booking links, and advisor-recorded referral relationships.
• Meeting metadata. Meeting date, time, type, duration, scheduling platform, and lifecycle timestamps.
• Synthesized intelligence from meetings. The pre-call brief, the "don't do" note, the psychological-state routing signal, the structured claim arrays (goals, concerns, financial picture — each with a verbatim excerpt capped at 280 characters), and a per-meeting talk-ratio aggregate.
• Vital™ metric. A relationship-health score derived from non-conversational signals (meeting recency, stage progression, meeting outcomes, engagement patterns). Computed without reading any meeting transcript or synthesized text content.
• Audit trail. Advisor corrections to synthesized claims, retained as adviser-prepared recordkeeping evidence consistent with SEC Rule 204-2(a)(11).

B.3 Categories of Personal Data not collected

• Government-issued identifiers (Social Security numbers, tax identification numbers, dates of birth).
• Custodial financial data (account numbers, routing numbers, holdings, positions, balances, transaction history, capital gains, time-series financial data).
• Actual transferred assets at close.
• Meeting audio — recorded by Recall.ai on Recall.ai's infrastructure; never retained on AUM Pulse infrastructure.
• Raw meeting transcripts — exist only in edge-function memory during synthesis; never written to any database or external destination.
• Uploaded files — AUM Pulse provides no file-upload interface.
• Protected Health Information — AUM Pulse is not configured as a HIPAA-covered service.
• Home addresses or precise geolocation.

B.4 Special Categories of Personal Data

AUM Pulse does not solicit or design the Service to process special categories of Personal Data under Article 9 of the GDPR. Customer is responsible for ensuring that special categories of Personal Data are not entered into the Service except where Customer has a lawful basis under Applicable Data Protection Law.

CSchedule C — Technical and Organizational Measures

These measures are current as of the version date at the top of this DPA. AUM Pulse may update these measures consistent with Section 5.