Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement between Lionary LLC and the Customer for Cornerhold (the "Agreement"). It applies when Lionary LLC processes Customer Personal Data on the Customer's behalf.

For Customer Personal Data, the Customer is the controller (or "business" under California law) and Lionary LLC is the processor (or "service provider"). If the Customer is itself a processor for its clients, such as a property manager acting for owners, Lionary LLC is its subprocessor and the Customer is responsible for its own client agreements.

2. Definitions

• Customer Personal Data: personal information within Customer Data that Lionary LLC processes on the Customer's behalf.
• Data Protection Laws: privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended and, where applicable, the GDPR and UK GDPR.
• Security Incident: a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor: a third party engaged by Lionary LLC that processes Customer Personal Data.

3. Processing on instructions

Lionary LLC processes Customer Personal Data only to provide the Service under the Agreement, on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and configuration of the Service (including the connectors it enables) are the Customer's complete instructions. Lionary LLC will tell the Customer if it believes an instruction violates Data Protection Laws, unless the law prohibits it. Details of the processing are in Annex 1.

4. Service provider terms

Lionary LLC will not:

• sell or share Customer Personal Data, as those terms are defined by California law;
• retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with the Customer;
• combine it with personal information received from other sources, except as Data Protection Laws allow for a service provider;
• use it, or allow any Subprocessor to use it, to train or improve machine learning models.

Lionary LLC will comply with applicable obligations under Data Protection Laws, give the same level of protection they require, and notify the Customer if it can no longer meet them. Lionary LLC certifies that it understands these restrictions.

5. Personnel

Lionary LLC ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations and have access only as needed for their role.

6. Security

Lionary LLC implements and maintains the technical and organizational measures in Annex 2, appropriate to the risk. Lionary LLC may update the measures as long as the overall level of protection is not reduced.

7. Subprocessors

The Customer authorizes Lionary LLC to engage the Subprocessors listed on the subprocessors page. Lionary LLC will bind each Subprocessor to written terms at least as protective as this DPA and remains responsible for its performance.

Lionary LLC will notify the Customer by email at least 30 days before a new Subprocessor begins processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected part of the Service without penalty.

8. Requests from individuals

Taking into account the nature of the processing, Lionary LLC will help the Customer respond to requests from individuals exercising their rights, mainly through features of the Service (such as export, correction and deletion). If Lionary LLC receives a request directly about Customer Personal Data, it will refer the person to the Customer and will not respond itself unless the law requires.

9. Security incidents

Lionary LLC will notify the Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident. The notice will describe what is known, the data and people likely affected, the likely consequences and the steps taken or proposed, and will be updated as more is learned. Lionary LLC will take reasonable steps to contain and remedy the incident. Notice is not an admission of fault.

10. Assessments and consultations

Lionary LLC will give reasonable help with data protection impact assessments and consultations with regulators that the Customer must carry out about its use of the Service, using information available to Lionary LLC.

11. Return and deletion

The Customer can export Customer Data at any time. When the Agreement ends, the Customer has 30 days to export. Lionary LLC will then delete Customer Personal Data within 60 days, except copies it must keep by law, which stay protected under this DPA, and copies in backups, which are deleted on their normal schedule (within 35 days) and are not restored except for disaster recovery.

12. Information and audits

Lionary LLC will make available information reasonably needed to show compliance with this DPA, including written answers to security questionnaires. Lionary LLC has not yet completed a third-party certification or audit report such as SOC 2; when it has one, it will provide it on request under confidentiality. If that information is not enough to meet a legal requirement, the Customer may carry out an audit, at its own cost, up to once a year, with 30 days' notice, during business hours, under confidentiality, and in a way that does not compromise other customers' data.

13. International transfers

Lionary LLC processes Customer Personal Data in the United States. Where Data Protection Laws require a transfer mechanism for personal data coming from the European Economic Area, the United Kingdom or Switzerland, the parties agree to the applicable standard contractual clauses (controller to processor, or processor to processor), which are incorporated by reference, with the details in Annex 1.

14. Successors

If Lionary LLC assigns or transfers the Agreement to an affiliate or successor as permitted by the Terms of Service, this DPA transfers with it and binds the affiliate or successor for all Customer Personal Data it receives.

15. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws do not allow it. If this DPA conflicts with the Agreement about the processing of Customer Personal Data, this DPA controls. If it conflicts with standard contractual clauses that apply, the clauses control.

Annex 1. Details of processing

• Subject matter and duration: providing the Service for the term of the Agreement and until deletion under section 11.
• Nature and purpose: hosting, storage, import, organization, abstraction and analysis (including by AI features), accounting, reconciliation, reporting, portals, notifications, support and security.
• Data subjects: the Customer's Users; tenants and their contacts; guarantors; vendors and contractors; owners and owner clients; lenders, brokers and other contacts in Customer Data.
• Personal data: names, business contact details, roles, lease terms and payment history, invoices and bills, bank account records the Customer imports, signatures and other content within uploaded documents, and Service usage records.
• Sensitive data: not intended. The Service stores at most the last four digits of tax identification numbers for 1099 tracking. The Customer should not upload full government identification numbers, full bank account numbers or payment card numbers.

Annex 2. Technical and organizational measures

• Separation of customers: every business table carries an organization id with database row-level security; the application connects through a role that cannot bypass it; automated tests on every change.
• Encryption in transit (TLS, with strict transport security in production) and at rest for the database, file storage and backups.
• Access control: role-based permissions; two-step sign-in available and enforced on every sign-in method when enabled; least-privilege access for personnel.
• Approvals and audit trail: AI output stays a draft until a person approves it; every change is logged with who and when; closed accounting periods lock.
• Application security: content security policy with per-request nonces, input validation, upload type and size checks, rate limits, dependency audits.
• Files: stored per organization, opened through short-lived signed links.
• Resilience: backups and restore procedures for the database and files.
• AI providers: contractual prohibition on training with Customer Data; only data needed for a task is sent.

Contact

Questions about this DPA or a signed copy: write to legal@cornerhold.com. Security notices: write to security@cornerhold.com.