Data Processing Agreement

01Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the Terms of Service.

02Scope, Roles, and Subject Matter

2.1 Roles

For Customer Personal Data processed in the course of providing the Service, Customer is the Controller and AUM Pulse is the Processor. This DPA does not govern AUM Pulse's processing of advisor account data (account identification, firm-level configuration, integration credentials), with respect to which AUM Pulse acts as Controller as described in the Privacy Policy.

2.2 Subject matter, nature, purpose, and duration

• Subject matter and nature. Provision of the Service as described in the Terms of Service, including meeting-bot creation via Recall.ai; synthesis of meeting transcripts and related advisor-facing intelligence via Anthropic's Claude API; generation of the synthesized pre-call brief and structured intelligence on the prospect record; computation of the Vital™ relationship-health metric; advisor-initiated Cadence letter compose and send from the Advisor's connected Gmail or Outlook mailbox; optional Trace advertising-spend sync from Meta Ads, Google Ads, and/or LinkedIn Ads; limited Supabase Storage for branding assets and support-ticket attachments; and maintenance of the advisor-correction audit trail.
• Purpose. To enable Customer's Advisors to prepare for, conduct, and follow up on meetings with prospects (including advisor-initiated Cadence correspondence and channel-attribution analytics where opted in), and to support Customer's recordkeeping obligations under SEC Rule 204-2(a)(11) and other applicable rules.
• Duration. For the duration of the Term, plus any post-termination period during which AUM Pulse retains Customer Personal Data as provided in Section 12.
• Categories of Personal Data and Data Subjects. As set forth in Schedule B.

03Documented Instructions

AUM Pulse will process Customer Personal Data only on documented instructions from Customer, unless required to do otherwise by applicable law. Customer's documented instructions comprise:

• the Terms of Service and any Order;
• this DPA;
• Customer's configuration and use of the Service through its Advisors' authenticated sessions; and
• any additional written instructions Customer provides to AUM Pulse from time to time, consistent with this DPA.

AUM Pulse will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

04Confidentiality

AUM Pulse will ensure that personnel authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Section 6.3 of the Terms of Service (Confidentiality) is incorporated into this DPA by reference and applies to Customer Personal Data as Customer's Confidential Information regardless of marking.

05Security of Processing

AUM Pulse will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the nature, scope, context, and purposes of processing. The current measures are set forth in Schedule C. AUM Pulse may update its technical and organizational measures from time to time, provided that no update will materially reduce the protection afforded to Customer Personal Data.

06Subprocessors

6.1 General authorization

Customer authorizes AUM Pulse to engage the Subprocessors listed in Schedule A. Each Subprocessor receives only the Customer Personal Data necessary to perform its function, and is bound by a written agreement imposing data-protection obligations no less protective than those in this DPA. AUM Pulse remains fully liable to Customer for the performance of each Subprocessor's data-protection obligations.

6.2 New Subprocessors

AUM Pulse will provide Customer with at least thirty (30) days' advance written notice before adding any new Subprocessor that materially affects the processing of Customer Personal Data. The notice will identify the proposed Subprocessor, the function it will perform, and the categories of Customer Personal Data it will receive.

6.3 Objection to new Subprocessors

Customer may object in good faith to the engagement of a new Subprocessor on reasonable data-protection grounds by written notice within fifteen (15) days of AUM Pulse's notice. The Parties will discuss the objection in good faith. If the Parties cannot resolve the objection within thirty (30) days of Customer's objection, Customer may terminate the affected Order; AUM Pulse will refund any prepaid fees for the period after the effective date of termination.

07International Transfers

AUM Pulse's primary infrastructure and the infrastructure of its Subprocessors are operated in the United States. Where a transfer of Customer Personal Data from the EEA, UK, or Switzerland to a third country occurs and Applicable Data Protection Law requires a transfer mechanism, the Parties will rely on the SCCs (Module Two: Controller-to-Processor), which are deemed incorporated into this DPA by reference.

AUM Pulse does not commit to a specific data-residency configuration in this DPA. Customers with EU, UK, or Swiss Data Subjects should raise the applicable transfer mechanism with AUM Pulse at onboarding.

08Personal Data Breach Notification

AUM Pulse will notify Customer of any Personal Data Breach affecting Customer Personal Data without undue delay, and in any event within seventy-two (72) hours of AUM Pulse becoming aware of the breach. The notification will include, to the extent then known:

• the nature of the breach, including categories of Customer Personal Data and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its possible adverse effects; and
• a point of contact at AUM Pulse from whom further information can be obtained.

Where it is not possible to provide all information at the same time, AUM Pulse may provide information in phases without undue further delay. AUM Pulse will cooperate with Customer and provide reasonable assistance to enable Customer to investigate and respond to the breach, including any required notifications to supervisory authorities or Data Subjects.

09Data Subject Rights Assistance

9.1 Access requests

At Customer's documented instruction, AUM Pulse will produce a copy of the Customer Personal Data AUM Pulse holds about the requesting Data Subject in a structured, commonly used, and machine-readable format.

9.2 Deletion requests

At Customer's documented instruction, AUM Pulse will execute deletion of the requesting Data Subject's Personal Data through the remove_prospect Postgres function, which: (a) verifies the prospect record belongs to the calling Advisor's firm; (b) cancels any Google Calendar or Outlook Calendar follow-up events created by AUM Pulse for the prospect before completing the meeting-history deletion (each cascade is asynchronous and best-effort and does not gate AUM Pulse-side deletion); (c) deletes the prospect's meeting history, including Cadence-related meeting fields and structured advisor commitments; (d) removes or cascades meeting-linked Cadence draft rows and related booking-token rows under ordinary foreign-key / operational cleanup rules; and (e) cascades deletion through related events, document-state rows, notes, and stage checklist completions. Deletion takes effect immediately at the application layer. Customer Personal Data persists in encrypted physical backups for up to eight (8) days, after which it is unrecoverable. Customer acknowledges this backup window and accepts that AUM Pulse cannot purge Customer Personal Data from physical backups on demand.

Mailbox Sent copies. Cadence messages already delivered via the Advisor's Gmail or Outlook mailbox remain in the Advisor's Sent folder (or Sent Items) under the mailbox provider's retention and the Advisor's control. remove_prospect does not delete those Sent copies. Customer is responsible for any mailbox-side deletion required to complete a Data Subject erasure request with respect to those copies.

9.3 Correction requests

At Customer's documented instruction, AUM Pulse will correct Customer Personal Data held in the prospect record. Where the correction concerns a synthesized claim, AUM Pulse records the correction through the advisor-correction audit-trail mechanism. The audit trail captures the action, the responsible Advisor, the timestamp, and the prior and corrected states of the claim, and is retained as adviser-prepared recordkeeping evidence consistent with SEC Rule 204-2(a)(11).

9.4 Other rights

AUM Pulse will provide reasonable assistance to Customer in responding to requests for portability, objection, restriction, and other rights under Applicable Data Protection Law.

9.5 Direct requests from Data Subjects

If AUM Pulse receives a Data Subject request directly, AUM Pulse will inform the requesting Data Subject that the request must be directed to Customer (the Controller), and notify Customer of the request. AUM Pulse will not respond to the Data Subject substantively without Customer's documented instruction, except as required by Applicable Data Protection Law.

10Data Protection Impact Assessment and Prior Consultation

AUM Pulse will provide reasonable assistance to Customer with any data-protection impact assessment Customer is required to carry out under Applicable Data Protection Law, and with any prior consultation with a supervisory authority that may result. AUM Pulse may, in its discretion, recover its reasonable costs for assistance that exceeds the documentation AUM Pulse makes generally available to its customers.

11Audit Rights

Customer's right to audit AUM Pulse's compliance with this DPA is satisfied by the following, no more than once per twelve (12)-month period:

• AUM Pulse will make available to Customer, on request, the most recent attestation reports for AUM Pulse's Subprocessors, to the extent those reports are made available by the Subprocessor;
• AUM Pulse will make available to Customer, on request, AUM Pulse's own attestation reports, if and when AUM Pulse obtains them; and
• AUM Pulse will make available to Customer, on request, the technical and organizational measures documentation referenced in Schedule C, including the 2026-04-19 RLS audit artifact, and respond to reasonable security questionnaires within thirty (30) days.

On-site audits and direct inspection of AUM Pulse's infrastructure are not granted under this DPA. More frequent audits may be undertaken following a confirmed Personal Data Breach or where required by a competent supervisory authority.

12Return and Deletion of Personal Data at Termination

On termination or expiration of the Terms of Service or the affected Order, AUM Pulse will, at Customer's choice expressed in writing within thirty (30) days of the termination effective date:

• Return Customer Personal Data to Customer in a structured, commonly used, and machine-readable format; or
• Delete Customer Personal Data through the application-layer deletion mechanism described in Section 9.2.

If Customer does not exercise its choice within the thirty (30)-day window, AUM Pulse will delete Customer Personal Data. The Section 9.2 backup-window acknowledgment applies. The advisor-correction audit trail is retained following deletion of the underlying Personal Data, consistent with SEC Rule 204-2(a)(11). AUM Pulse may retain Customer Personal Data to the extent required by applicable law, subject to the confidentiality and security obligations in this DPA.

13Liability

The Parties' liability under or in connection with this DPA is subject to, and forms part of the aggregate liability cap established by, Section 10 of the Terms of Service. The liability cap, the exclusion of consequential damages, and the carve-outs in Section 10 of the Terms of Service apply on an aggregate basis across both the Terms of Service and this DPA, not separately to each.

The carve-outs in Section 10.3 of the Terms of Service apply equally to claims arising under this DPA. Nothing in this Section limits a Data Subject's rights under Applicable Data Protection Law or any rights or remedies that Applicable Data Protection Law makes unwaivable.

14Term, Termination, and Survival

This DPA takes effect on the date the Terms of Service take effect and continues for the duration of the Terms of Service. On termination of the Terms of Service, this DPA terminates automatically, except that the provisions that by their nature should survive termination (including Sections 4, 8, 12, 13, and the obligations associated with retained audit-trail rows under Section 9.3) survive for as long as AUM Pulse retains any Customer Personal Data or related records.

15General Provisions

• Order of precedence. In the event of a conflict between this DPA and any other agreement between the Parties, this DPA controls with respect to the processing of Customer Personal Data. The Terms of Service control on all other matters.
• Governing law and venue. The governing law and venue provisions of Section 11 of the Terms of Service apply to this DPA: Arizona governing law, Maricopa County courts as exclusive venue, thirty (30)-day pre-litigation informal-resolution requirement, and jury-trial waiver.
• Notices. Notices under this DPA may be sent through the notice mechanism in Section 12 of the Terms of Service.
• Amendment. This DPA may be amended only by a written instrument signed by both Parties, except that AUM Pulse may unilaterally update Schedule A consistent with Section 6 and update Schedule C consistent with Section 5.
• Severability. If any provision of this DPA is held unenforceable, the remainder remains in effect, and the unenforceable provision is modified to the minimum extent necessary to make it enforceable while preserving the Parties' intent.

ASchedule A — Subprocessors

The following Subprocessors process Customer Personal Data on AUM Pulse's behalf. Each Subprocessor receives only the data necessary to perform its function. This Schedule is current as of the version date at the top of this DPA.

BSchedule B — Categories of Personal Data and Data Subjects

B.1 Data Subjects

The Data Subjects are the prospects, leads, and clients of Customer (the prospective and existing investment-advisory clients of Customer's Advisors) whose information is entered into or generated by the Service.

B.2 Categories of Personal Data

• Contact information. First name, last name, email address, and optionally phone number.
• Household / spouse contact (optional). Advisor-supplied spouse or household-member name and email, used primarily as default Cc recipients on Cadence post-call correspondence when the Advisor chooses to include them.
• Advisor-supplied financial estimates. An estimate of the prospect's investable assets typed by the Advisor. AUM Pulse does not query any custodian, brokerage, or banking system.
• Advisor-authored notes. Free-text notes equivalent in scope to a standard CRM notes field.
• Booking context. Booking platform, platform event identifier, UTM tracking parameters from trackable booking links (Trace attribution), and advisor-recorded referral relationships.
• Meeting metadata. Meeting date, time, type, duration, scheduling platform, lifecycle timestamps, meeting outcome the Advisor logs, and call-substrate provenance (recorded | unrecorded).
• Synthesized intelligence from meetings. The pre-call brief, the "don't do" note, the psychological-state routing signal, structured claim arrays (goals, concerns, financial picture — each with a verbatim excerpt capped at 280 characters), personality read, Opening Move and evidence, rhythm line and rhythm anchor date, structured advisor commitments (ACI), scheduling-intent signals, and a per-meeting talk-ratio aggregate.
• Cadence draft and send metadata. Ephemeral draft subject/body/paragraphs (purged after send); retained send timestamps, provider message identifiers, package/follow-up status, and offered scheduling slots / intent signals. AUM Pulse does not maintain a long-term archive of full sent message bodies.
• Booking tokens. Opaque self-booking tokens minted into certain Cadence letters — hashed token values, offered slots, expiry, and use/void state.
• Vital™ metric. A relationship-health score derived from non-conversational signals (meeting recency, stage progression, meeting outcomes, engagement patterns). Computed without reading any meeting transcript or synthesized text content.
• Audit trail. Advisor corrections to synthesized claims, retained as adviser-prepared recordkeeping evidence consistent with SEC Rule 204-2(a)(11).

B.3 Categories of Personal Data not collected

• Government-issued identifiers (Social Security numbers, tax identification numbers, dates of birth).
• Custodial financial data (account numbers, routing numbers, holdings, positions, balances, transaction history, capital gains, time-series financial data).
• Actual transferred assets at close.
• Meeting audio — recorded by Recall.ai on Recall.ai's infrastructure; never retained on AUM Pulse infrastructure.
• Raw meeting transcripts — exist only in edge-function memory during synthesis; never written to any database or external destination.
• Prospect document vault / engagement files — AUM Pulse does not provide a general file-upload vault for engagement letters, ACATS forms, or similar prospect documents. Limited advisor-only Supabase Storage uploads are permitted for (a) firm logo / advisor headshot in the branding bucket and (b) support-ticket attachments in support-attachments (capped at three files per ticket, 10 MB each, PNG/JPEG/WebP/PDF/CSV/TXT). Support attachments may incidentally contain prospect-related screenshots; they are not a prospect CRM document store.
• Protected Health Information — AUM Pulse is not configured as a HIPAA-covered service.
• Home addresses or precise geolocation.

B.4 Special Categories of Personal Data

AUM Pulse does not solicit or design the Service to process special categories of Personal Data under Article 9 of the GDPR. Customer is responsible for ensuring that special categories of Personal Data are not entered into the Service except where Customer has a lawful basis under Applicable Data Protection Law.

CSchedule C — Technical and Organizational Measures

These measures are current as of the version date at the top of this DPA. AUM Pulse may update these measures consistent with Section 5.