Data processing addendum.
Scope
This Data Processing Addendum ("DPA") supplements the Terms of Service between Unlevered Inc. ("Processor") and the firm using the Service ("Controller"). It applies to all Personal Data processed in connection with the Service.
Roles
The Controller determines the purposes and means of processing. The Processor processes Personal Data on behalf of and under the documented instructions of the Controller, subject to these terms.
Subject matter & duration
Subject matter: provision of cost segregation software, engine analysis, engineered review, and client deliverables. Duration: for the term of the underlying Terms of Service plus the retention periods documented in the Privacy Policy.
Categories of data subjects
The Service processes Personal Data of: firm staff (CPAs, EAs, tax strategists, admin) and property owners engaging Unlevered directly or invited to client portals.
Types of personal data
Identifiers (name, email, phone), property addresses, document uploads (closing statements, rent rolls, receipts, photographs), tax identifiers (EIN/SSN, encrypted at rest), and operational metadata.
Security measures
Encryption at rest (AES-256) and in transit (TLS 1.3); default-deny row-level access controls; least-privilege role separation; audit logging on material actions; quarterly access reviews; vulnerability management; incident response procedures. See Security for detail.
Subprocessors
Authorized subprocessors:
- Supabase — Postgres + auth · US-East
- AWS (S3, RDS) — object & database storage · US-East
- Vercel — application hosting · US-East
- Stripe — payments & Connect · US
- Anthropic — AI document & photograph analysis; owner identity redacted before processing, API data not used to train models · US
- Fly.io — malware scanning of uploaded files · US
- Smarty — address validation · US
- Google Workspace — email delivery (including client-facing notifications) & docs · US
- Slack — operational alerting · US
- Sentry — anonymized error reporting · US
- Google Analytics & Google Ads — public-website analytics and advertising conversion measurement; receives no client property data, names, or emails
- OpenAI Ads — advertising conversion measurement (ChatGPT Ads pixel after cookie Accept; deposit sale from a ChatGPT ad click); receives a one-way SHA-256 hash of the request email, never client property data, names, or the email itself · US
We’ll provide 14-day advance notice before adding or replacing a subprocessor that handles customer data.
Data subject rights
We’ll assist the Controller in responding to data subject requests (access, deletion, portability) within the timelines required by applicable law.
Breach notification
We’ll notify the Controller of a Personal Data breach without undue delay and in any event within 72 hours of discovery, including the nature of the breach, categories of data and subjects affected, and remediation actions taken.
Audits
The Controller may request a summary of our security controls and SOC 2 audit report (once available) once per year, on reasonable notice and subject to confidentiality.
Return & deletion
On termination, the Controller may export all data via the standard export tools. After 90 days, residual account data is deleted from active systems. Engagement records within their documented retention window, append-only audit ledgers, and encrypted backups are retained per the Privacy Policy and legal retention requirements.