Data Processing Addendum

Iota-Home processes personal data only to provide the Services and on the Customer's documented instructions, including as set out in the Terms and this DPA.

Widget analytics. The widget is designed to be privacy-minimal. For embedded analytics we collect event-level telemetry such as anonymous session identifiers, event type (e.g. session start, calculation), and which calculator was used. We do not passively collect or store visitor financial inputs, and we do not store visitor IP addresses or persistent personal identifiers as part of widget analytics.

Opt-in lead submissions. Where the Customer enables lead capture, and only when a visitor explicitly submits the save form, we process on the Customer's behalf: the visitor's name, email address, optional phone number, a snapshot of the calculator scenario they built (which contains the financial figures they entered), summary engagement figures, and the consent statement presented at submission together with its timestamp. This data is stored for the Customer and delivered via the Customer's portal, a notification email, and — where the Customer configures one — a webhook to the Customer's own CRM or lead-management endpoint. On the Customer's behalf we also send the visitor a transactional email containing the link to the scenario they asked to keep. Lead data is not used by Iota-Home for any independent purpose.

Scenario-link view activity. When a saved-scenario link is opened, we record an aggregate view count and a last-viewed timestamp on the snapshot and surface these to the Customer. No viewer identity, IP address, or device information is captured as part of this.

We use the following subprocessors to deliver the Services:

• Supabase — database, authentication, storage (including stored lead submissions).
• Vercel — application and serverless function hosting.
• Stripe — subscription billing and payment processing.
• Resend — transactional email: lead notifications to the Customer and the visitor's own saved-scenario link.
• Google Analytics — marketing-site analytics (consent-gated; not loaded in embedded widgets).

Brand-matched fonts inside embedded widgets are served from Iota-Home's own infrastructure — widget visitors' browsers make no font requests to third parties.

We will provide notice of new subprocessors and maintain an up-to-date list on request.

• Row-Level Security and server-enforced tenant isolation in the database.
• Domain-locked embeds via per-tenant Content-Security-Policy enforced on every request.
• High-entropy, rotatable embed tokens; service-role keys kept server-side only.
• JWT-based authentication and encryption in transit (TLS).
• Privileged billing and entitlement fields writable only by server/service-role code.

Personnel authorized to process personal data are bound by appropriate confidentiality obligations.

Taking into account the nature of the processing, we will provide reasonable assistance to the Customer in responding to data-subject requests relating to data we process on the Customer's behalf. Data-subject requests we receive directly from a visitor about a lead submitted through the Customer's widget will be forwarded to the Customer; the Customer can delete individual leads from their portal at any time.

We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer's data and will provide information reasonably required for the Customer to meet its own notification obligations.

Tenant Lifecycle:

• Cancellation: Subscription ends at period end; tenant remains active through paid term
• Data Access: Customer can export all personal data within 30 days of termination
• Production Deletion: Production data deleted 30 days after termination unless legally required to be retained
• Backup Retention: Encrypted backup copies retained for 90 days for disaster recovery, then purged
• Billing Records: Stripe subscription and invoice records retained separately as required by tax law (7 years)
• Lead Submissions: Customer can delete individual leads from their portal at any time; deletion requests processed within 48 hours
• Scenario Links: Saved-scenario links expire automatically one year after creation

The Customer can request immediate full deletion via email; we will comply within 48 hours except where data retention is legally required.

Where personal data is transferred across borders, we rely on the safeguards provided by our subprocessors and applicable transfer mechanisms. Specific mechanisms will be confirmed on legal review.

For data-protection inquiries: contact@iota-home.com