Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between the business that registered the account (the "Customer") and Fuelviews, Inc. ("Fuelviews"), and governs the personal information the Service processes on the Customer's behalf. It is accepted together with the Terms at signup, and the accepted version is recorded.

1. Definitions

• "Customer Personal Data" means personal information the Service processes on the Customer's behalf: leads submitted through the Customer's calculators (names, contact details, ZIP codes, answers, and estimate ranges) and the consent records attached to them.
• "Data Subject" means the identified or identifiable person the data is about — in practice, a visitor who used the Customer's calculator.
• "Applicable Law" means the privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended ("CCPA") and comparable US state laws.

2. Scope and roles

The Customer determines the purposes of processing Customer Personal Data and is the "business" or controller under Applicable Law. Fuelviews processes Customer Personal Data only to provide the Service and is the Customer's "service provider" or processor. This DPA applies for as long as Fuelviews holds Customer Personal Data. The Customer's own account data, and anonymised data that is no longer personal information, are outside its scope.

3. Fuelviews' obligations

Fuelviews will:

• process Customer Personal Data only on the Customer's documented instructions — the Terms, this DPA, and the Customer's configuration of the Service are those instructions — unless required otherwise by law, in which case Fuelviews will inform the Customer unless the law forbids it;
• not sell Customer Personal Data or share it for cross-context behavioral advertising;
• not retain, use, or disclose Customer Personal Data for any purpose other than providing the Service, or outside the direct business relationship with the Customer, except as Applicable Law permits;
• not combine Customer Personal Data with personal information from other sources, except as Applicable Law permits a service provider to do;
• ensure everyone it authorizes to process Customer Personal Data is bound by confidentiality;
• assist the Customer, taking into account the nature of the processing, in responding to Data Subject requests and in meeting the Customer's security and breach-notification obligations;
• notify the Customer promptly if it decides it can no longer meet its obligations under Applicable Law, and grant the Customer the right, on notice, to take reasonable steps to stop and remediate unauthorized use of Customer Personal Data.

4. Sub-processors

The Customer gives general authorization to the sub-processors below. Fuelviews remains responsible for them, and binds each to obligations no less protective than this DPA.

Sub-processor	Purpose	Location
Interserver, Inc	Cloud infrastructure hosting the Service and its database	United States
Laravel LLC (Laravel Forge)	Server provisioning and management	United States
Cloudflare, Inc.	DNS, content delivery, and network security in front of the Service	United States (global network)
Mailgun Technologies, Inc.	Transactional email, including lead notifications and follow-up emails sent on the Customer's behalf	United States

Two further providers process data adjacent to, but not within, Customer Personal Data: Stripe, Inc. processes the Customer's own billing information, and Anthropic, PBC processes calculator-configuration content the Customer submits to the AI builder. Lead data is sent to neither.

Fuelviews will update this page before engaging a new sub-processor for Customer Personal Data. If the Customer objects on reasonable data protection grounds within 10 days of the update, the parties will discuss in good faith; if no resolution is possible, the Customer may terminate the affected service.

5. Security measures

• Encryption of data in transit (TLS) on all surfaces, including the embedded widget.
• Hashed credentials; no storage of payment card numbers.
• Tenant isolation enforced in the application for every query, so one Customer's data is not reachable from another's account.
• The embedded widget runs without cookies or sessions, collects nothing until the visitor submits the contact step, and past the Customer's plan cap collects nothing at all.
• Access to production systems restricted to personnel who operate the Service, over authenticated, encrypted channels.
• Automatic deletion of leads and consent records at the end of the retention window described in Section 7.

6. Breach notification

Fuelviews will notify the Customer without undue delay after becoming aware of a breach of security affecting Customer Personal Data, and will provide the information reasonably available to it about the nature of the breach, the data concerned, and the measures taken — sufficient for the Customer to meet its own notification obligations. Fuelviews' notification is not an acknowledgement of fault.

7. Retention, return, and deletion

• Leads and consent records are retained for up to four years from collection and then deleted automatically. The Customer can delete any lead sooner, and deletion is effective, not a flag.
• While the account is active, the Customer can export leads from the dashboard and by webhook.
• After account closure or termination, the Customer may request an export by emailing [email protected] within 30 days. Fuelviews then deletes Customer Personal Data in the ordinary course, except where law requires retention; residual copies in operational logs and backups are removed on their normal cycle.

8. International transfers

Customer Personal Data is stored in the United States. Fuelviews will not transfer it to a jurisdiction that Applicable Law forbids without an approved transfer mechanism.

9. Audits

On written request, no more than once in any 12-month period, Fuelviews will make available the information reasonably necessary to demonstrate compliance with this DPA — in the form of documentation and written responses to a reasonable security questionnaire. Applicable Law's audit rights, where they grant more, prevail.

10. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

11. Governing law

This DPA follows the governing law and dispute resolution terms of the Terms of Service.

12. Contact

Fuelviews, Inc.
PO Box 2
Wiscasset, ME 04578
Email: [email protected]