Data Processing Addendum
Version 2026-10-27 · October 27, 2026
1. Agreement and roles
This Data Processing Addendum (DPA), version 2026-10-27, forms part of the agreement between Capsa Intelligence Inc. (Capsa) and the organization accepting it (Customer). It takes effect when an authorized representative expressly accepts it in the service or signs an agreement incorporating it. Customer determines the purposes and means of processing Customer Personal Data; Capsa acts as its processor or service provider, or as a subprocessor where Customer acts for another controller. For this DPA, Customer Personal Data means connected-email content and email-derived insights processed on Customer’s behalf. This DPA governs that connected-email processing; processing of other service, account, authentication, billing and website data remains governed by the agreement, applicable privacy disclosures and any separately executed DPA. Applicable data protection law governs these roles. This DPA controls conflicting general data-use terms; a separately signed DPA controls conflicting provisions here.
2. Instructions and permitted purposes
Capsa processes Customer Personal Data only on documented Customer instructions to deliver, secure, support and maintain the contracted service, or as required by law. Instructions include the agreement, selected integrations and saved settings. Connected email may be analyzed, including with AI and cross-referencing Aspire and other authorized business records, for sales and operational intelligence: identifying requests and outstanding commitments, pursuing sales opportunities, improving customer service and streamlining operations. This authorization does not represent that every feature is currently available. Capsa will notify Customer if an instruction appears unlawful and may suspend the affected processing pending resolution.
3. Customer authority, notices and consent
Customer represents that it has authority to provide the data and instructions, has provided all legally required notices describing the service and its purposes, and has obtained and documented all required permissions and consents, or established other applicable lawful grounds. This responsibility covers employees, customers, prospects and other correspondents, including applicable employment and communications privacy requirements. Microsoft or Google administrator approval is technical access permission and does not replace these obligations. Retention and analysis are restricted to correspondence involving eligible customer or prospect contacts in Aspire or Capsa. To apply eligibility rules, Capsa transiently retrieves headers from selected mailboxes, including headers of messages that do not qualify; ineligible headers are not saved as retained email or sent for AI analysis. Message text is retrieved only for qualifying messages under the approved sharing level. Internal-only conversations and email without an eligible contact are excluded from retention and analysis; additional exclusions can only narrow this scope. Customer will retain supporting records, respond to individuals’ requests and promptly notify Capsa if authority changes. Capsa remains responsible for its own legal and contractual obligations.
4. Connected-email acceptance and scope
An authorized company administrator must expressly accept the connected-email terms, this DPA and the Privacy Policy before initial collection and when approving changed collection choices. Approval covers the selected mailboxes, provider organization and application, collection and exclusion rules, sharing level, historical lookback, retention and disclosed purposes. Capsa records the accepting user and identity, server-recorded time, document versions, certification wording and approved choices. Earlier collection permission is not deemed acceptance of expanded purposes. Customer can pause collection or disconnect using the service.
5. Use restrictions and confidentiality
Capsa will not sell or share Customer Personal Data for cross-context behavioral advertising, use connected email for advertising or marketing, or use connected email or derived insights to train or fine-tune AI models. Capsa will not authorize AI providers to train on that email. Capsa will not retain, use or disclose Customer Personal Data outside the specified business purposes or direct business relationship, or combine it with information from other customers or Capsa’s own interactions except as permitted by applicable law for the contracted service. Personnel access is limited to authorized people subject to confidentiality obligations. Raw connected email is not displayed to teammates or leadership in the customer-facing product. Human review of message content requires Customer’s explicit authorization, except for security or legal obligations.
6. Security
Capsa will maintain appropriate technical and organizational measures designed to protect Customer Personal Data, including encryption in transit and at rest, tenant access controls, restricted personnel access, credential protection and incident response procedures. Customer remains responsible for its users, provider-side permissions and choices. Neither party promises that security measures eliminate every risk.
7. Subprocessors
Customer authorizes the subprocessors identified in the linked subprocessor list for the specified services. Capsa will bind subprocessors to written data-protection obligations appropriate to their processing and remains responsible for their performance of obligations under this DPA. Capsa will give Customer at least 30 days’ advance notice of a new or replacement subprocessor receiving Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. The parties will work to resolve the objection; if they cannot, Customer may terminate the affected service before the change takes effect.
8. Google Cloud and AI processing
Google Cloud Platform, including BigQuery, Cloud SQL, Vertex AI and Gemini models delivered through Google Cloud, provides hosting, storage and authorized AI inference. Google’s Cloud service terms restrict training or fine-tuning models on customer data without permission or instruction; Capsa does not grant that permission for connected email. No-training commitments do not mean zero retention. Provider service operation, caching, security and abuse monitoring may involve limited retention under applicable Cloud terms and enabled features. Connected email must not be submitted to consumer AI services or unpaid developer services with incompatible data-use terms.
9. Assistance and individual rights
Taking account of the nature of processing, Capsa will reasonably assist Customer with applicable access, correction, deletion, restriction, objection and portability requests, security obligations, impact assessments and regulator consultations. Capsa will direct requests concerning Customer-controlled data to Customer where appropriate, unless legally required to respond itself. Individuals do not need a Capsa account to contact us. Capsa will inform Customer of legally binding disclosure requests unless prohibited by law.
10. Personal data breaches
Capsa will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Capsa will provide available information about the nature of the breach, affected data, likely consequences and mitigation, with updates as information becomes available, and reasonably cooperate with Customer’s response. Notice is not an admission of liability.
11. Retention and deletion
Capsa processes Customer Personal Data for the service term and according to documented retention settings and the agreement. On termination, Capsa will return or delete Customer Personal Data as instructed, subject to legal retention duties and limited backup/recovery retention. Connected-email lookback and expiry are separate. Pausing does not delete retained data. Disconnecting schedules active-storage cleanup; deletion is not instantaneous. Recovery copies remain isolated from ordinary use until expiration. Content-free operational receipts and acceptance records may be retained as needed to establish authorization, comply with law and resolve disputes, subject to applicable retention limits.
12. Compliance information and audits
Capsa will make reasonably necessary information available to demonstrate compliance with this DPA, notify Customer if it can no longer meet applicable obligations, and permit reasonable steps to stop and remediate unauthorized use. On reasonable notice, Capsa will cooperate with proportionate audits by Customer or an independent auditor subject to confidentiality and security safeguards. Existing reports and documentation should be used first where sufficient. These arrangements do not restrict regulator access or rights that cannot be limited under applicable law.
13. International transfers
The current connected-email service uses Google Cloud services in the United States. Customer is responsible for assessing whether its instructions involve restricted international transfers. Where applicable law requires a specific transfer mechanism, the parties must put that mechanism, including any required standard contractual clauses and assessments, in place before the affected transfer. This DPA alone does not establish every required international transfer safeguard.
14. Processing description and contact
Processing includes collection, storage, organization, matching, AI inference, retrieval, generation of derived insights, support and deletion. Data subjects include Customer’s staff, contractors, customers, prospects and correspondents. Data can include names, contact details and CRM/property/job/service information contained in the authorized correspondence, correspondence metadata and authorized message text, and email-derived insights. Attachment contents are excluded from Microsoft Email Sync. Sensitive information is not required for the stated purposes; Customer should use exclusions and avoid providing unnecessary sensitive information. Contact user@capsaintelligence.com for privacy requests, subprocessor questions or assistance. Other agreement terms continue to apply.