Data Processing Addendum
Last updated: 7 September 2026
This Addendum forms part of the Terms of Service between the Contractor and Fleet and Fury LLC, a Wyoming limited liability company, and governs personal information about homeowners collected through the Contractor’s visualizer.
1. Roles
The Contractor is the business that determines why and how homeowner personal information is processed. PergolaProof is a service provider that processes it only to deliver the service, on the Contractor’s instructions.
Homeowner personal information is stored in the United States, and the service is sold to US contractors serving US homeowners, so this Addendum is written to the US state privacy laws that apply — principally the CCPA as amended. Where a Contractor has an obligation under another regime, the equivalent roles are controller (Contractor) and processor (PergolaProof), and we will agree additional terms if that regime requires them.
2. What we process, and why
| Category | Purpose | Duration |
|---|---|---|
| Homeowner name, email, phone | Creating the lead and delivering it to you | Life of your account |
| Backyard or property photograph | Generating the render; moderating for unlawful content | Life of your account |
| Design selections and any timeline/budget fields | Making the lead quote-ready | Life of your account |
| Visit and render events | Usage metering, billing, and your guarantee tracker | 24 months |
| City/region derived from IP | Telling you roughly where the job is | Life of the lead record |
3. Our commitments as your service provider
We:
- process homeowner personal information only for the purposes in §2 and only on your documented instructions, including the settings you choose in your dashboard;
- do not sell it and do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA;
- do not retain, use, or disclose it for any purpose other than providing the service, including for any commercial purpose of our own, and not outside our direct business relationship with you;
- do not combine it with personal information we receive from anyone else, except as permitted for a service provider — for example to detect fraud or secure the service;
- do not use homeowner photographs to train general-purpose AI models;
- restrict access to personnel who need it, bound by confidentiality;
- tell you promptly if we determine we can no longer meet these obligations; and
- certify that we understand these restrictions and will comply with them.
You may take reasonable and appropriate steps to confirm we are using homeowner personal information consistently with your obligations, and to stop and remediate any unauthorized use.
4. Security
These are the controls we actually operate, not an aspiration:
- each Contractor’s data is isolated by tenant, enforced by row-level security;
- photos and renders are held in private storage and served only through short-lived signed links, never public URLs;
- widget embedding is restricted to the domains you register, and a Contractor’s custom domain cannot reach our dashboard or admin;
- uploads are content-moderated before rendering;
- data is encrypted in transit, and at rest by our infrastructure providers;
- administrative access to a Contractor account is logged.
Where our people are. Data is stored in the United States, but our support and operations personnel work from the United States and Sri Lanka. Our admin tooling can access a Contractor account to provide support, which means those personnel can see homeowner details and property photos. Every such access is logged, and the personnel are bound by confidentiality. We are telling you this because it is true, not because a regulation forces the disclosure.
5. Sub-processors
You authorize the following sub-processors:
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage |
| OpenAI | Render generation and content moderation of uploaded images |
| Stripe | Payment processing and subscription billing |
| Vercel | Application hosting and delivery |
| Resend | Transactional email — lead alerts, invitations, billing notices — enabled when email alerts are switched on |
Each is bound to protections no less protective than this Addendum, and we remain responsible for their performance. We will give you notice before adding a sub-processor that processes homeowner personal information. If you reasonably object, tell us — and if we cannot offer an alternative, you may cancel without penalty and receive a pro-rated refund of prepaid subscription fees.
6. Homeowner requests
We will assist you in responding to homeowner requests to know, correct, or delete their information. Leads and renders can be exported and deleted from your dashboard, which covers most requests without needing us. If a homeowner comes to us directly, we will pass the request to you and act on your instructions, other than where the law requires us to act ourselves.
7. Security incidents
We will notify you without undue delay, and in any event within 72 hours of confirming a security incident affecting homeowner personal information processed for you. The notice will describe what we know, which of your records are affected, what we are doing, and what we recommend you do. We will not delay notice because an investigation is incomplete.
Notifying regulators and affected homeowners, where state law requires it, is your decision as the business — we will give you the information you reasonably need to make it.
8. Return and deletion
You may export your leads at any time, including after cancellation. Within 90 days of your account terminating, we delete or anonymize homeowner personal information processed for you, except where we must keep records for legal, tax, or accounting reasons, in which case it stays subject to this Addendum for as long as we hold it. We will confirm deletion in writing on request.
9. Your responsibilities
You are responsible for giving homeowners notice at the point you collect their information and for having a lawful basis to contact them afterwards. Our contact form links to a privacy notice and records the homeowner’s agreement, but the relationship — and the marketing rules that come with calling and texting consumers — is yours. Do not instruct us to process homeowner information in a way that would put you in breach.
10. Audits
On reasonable written request, no more than once a year, we will provide the documentation reasonably needed to show we are meeting this Addendum, including a description of our controls and our current sub-processor list. Where a regulator or your own obligations require more, we will cooperate in good faith to agree a proportionate approach.
11. Precedence and term
This Addendum runs for as long as we process homeowner personal information for you. Where it conflicts with the Terms of Service on the handling of personal information, this Addendum governs.
12. Contact
privacy@pergolaproof.com for privacy and data-protection matters. legal@pergolaproof.com for legal notices.