1. Who this is between
This addendum is between Preposal (we) and the business that holds a Preposal account (you). It forms part of the Terms of Service and applies for as long as we hold client data for you.
Preposal is a service of Vividly Built Inc. That company is the party to this addendum.
2. What the words mean
- Client data is personal information about your clients, your prospects and their contacts that you or they put into Preposal, or that Preposal records for you, including how a proposal was opened and read.
- Privacy laws are the laws on personal information that apply to the client data, including the California Consumer Privacy Act and the other US state privacy laws, the EU General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection.
- Subprocessor is another company we use that handles client data for us.
3. Who is responsible for what
For client data you decide what is collected and why, and we act on your behalf. Under the GDPR and the UK GDPR you are the controller and we are your processor. Under the California Consumer Privacy Act and similar state laws you are the business and we are your service provider.
Two things are ours rather than yours, and the Privacy Policy covers them: what we hold about you and your own people to run your account and bill for it, and the anonymous trade figures described in section 7 of that policy.
4. What you agree to
- You have the right to put each client's details into Preposal and a lawful basis for everything you ask us to do with them.
- You tell your clients what the law requires you to tell them, including that Preposal records when and how a proposal is opened and read.
- Your instructions to us, including your settings and the email you send through us, are lawful.
- You do not put in information the service is not built for: health or medical details, government identity numbers such as Social Security numbers, bank or card numbers, passwords, or information about anyone under 18. If you do, it is at your own risk, and section 12 of the terms applies to any claim that follows.
5. What we do with client data
We use client data only to provide Preposal to you, as the terms, your settings and your written instructions describe. In particular:
- We never sell it or share it for advertising, and never use it to advertise to anyone.
- We never keep, use or disclose it for any purpose other than providing the service to you, and never outside our direct business relationship with you, except where a privacy law allows it (for example, to keep the service secure, fix faults or comply with the law).
- We never combine it with personal information we get from anyone else, except as the privacy laws allow a service provider to.
- We protect it to the standard the privacy laws require, and we tell you if we can no longer do so. You may then take reasonable steps to stop and fix any unauthorised use.
- If we believe an instruction of yours breaks a privacy law, we tell you and do not have to follow it.
- Where we turn client data into anonymous figures, as section 7 of the Privacy Policy describes, we keep them in a form that cannot identify anyone, we do not try to identify anyone from them, and we bind anyone we share them with to the same.
We understand these restrictions and will follow them.
6. Our people
Only our staff who need client data to run or support the service can reach it, and each of them is bound to keep it confidential. Staff reach a firm's account only through our support tool, and every access through it is recorded with who did it and when, as section 6 of the Privacy Policy says.
7. Keeping it secure
We keep the security measures in Annex 2 in place and may improve them, but never reduce the overall protection they give.
8. Other companies we use
- You authorise the subprocessors listed in Annex 3 and in section 6 of the Privacy Policy.
- Each one is bound by written terms that protect client data at least as well as this addendum does, and we remain responsible to you for what they do with it.
- Before we add a subprocessor that will handle client data, we update that list and email your account owner at least 14 days ahead. If you object on reasonable grounds and we cannot resolve it, you may close your account and we will refund the unused part of any prepaid term.
9. When a client asks about their data
If one of your clients asks us to see, correct, delete or move their data, or to stop us using it, we pass the request to you without undue delay and do not answer it ourselves unless you tell us to or the law requires it. We help you answer it, including by finding, correcting, copying or deleting that client's data.
10. If client data is exposed
If we confirm that client data has been lost, disclosed or accessed without permission, we tell you without undue delay and within 72 hours of confirming it. We tell you what happened, what data and roughly how many people it involves, the likely consequences, and what we are doing about it, and we keep you updated as we learn more. We help you notify your clients and any regulator. Telling you is not an admission of fault.
11. Help with assessments and regulators
We give you the information you reasonably need to carry out a data protection impact assessment, to consult a regulator, or to answer a regulator's questions about how we handle client data.
12. Showing that we comply
- Once a year, we answer a reasonable written security questionnaire about how we handle client data.
- Where a privacy law or a regulator requires an audit beyond that, we allow one on 30 days' written notice, during business hours, at your cost, under a confidentiality agreement, and in a way that does not expose other firms' data. It happens no more than once a year, unless it follows an exposure of client data or a regulator orders it.
13. Where client data is kept
Client data is stored and processed in the United States and on Cloudflare's network, as section 8 of the Privacy Policy says. Where client data comes from the European Economic Area, the UK or Switzerland, the transfer is covered as follows:
- From the EEA: the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are part of this addendum, with you as data exporter and us as data importer. Clause 7 does not apply. Under Clause 9, option 2 applies with the 14 days' notice in section 8 above. The optional wording in Clause 11 does not apply. Clauses 17 and 18: Irish law and the courts of Ireland. Annexes 1 to 3 below complete the clauses' annexes, and the supervisory authority is the one for your establishment in the EEA.
- From the UK: the UK Information Commissioner's International Data Transfer Addendum to those clauses applies, completed with the details in this addendum. Either of us may end it as its Section 19 allows.
- From Switzerland: the same clauses apply, with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority and Swiss law in place of the GDPR where it applies.
Our subprocessors transfer client data under their own equivalent terms.
14. When your account closes
- Before you close, write to us and we will send you a copy of your client data in a common file format.
- When your account is closed, tell us and we will delete client data within 30 days. Our database keeps a rolling 30 day history to undo mistakes, so a deleted record can persist there for up to 30 more days, and no longer.
- We keep only what the law requires us to keep, or what we need to show we handled your account properly, such as the support tool's log, for the periods in section 8 of the Privacy Policy. It stays protected by this addendum while we hold it.
15. Liability
Claims under this addendum, including under the clauses in section 13, count toward the same limit as claims under the terms, in section 11 of the terms, except where the clauses or the law do not allow liability to be limited.
16. If documents disagree
For client data, the clauses in section 13 come first where they apply, then this addendum, then the terms, then the Privacy Policy.
17. Changes
We change this addendum the way section 15 of the terms describes, and we may also update it when a privacy law changes. We will never reduce the protection it gives client data without telling you first. Each version is dated at the top of this page, and earlier versions stay published, word for word, at preposal.io/dpa/ followed by their date.
Annex 1. What we handle
- Whose data: your clients and prospects, the people they name as contacts, and anyone who opens a proposal you send.
- What data: names, email addresses, phone numbers, postal and project addresses, project details, notes you write, messages a client sends back and their acceptances. When a proposal is opened: the time, IP address, browser, the town-level location the network reports, and, outside the EEA, the UK and Switzerland, how long it was open, which parts were looked at and whether the prices came into view.
- Sensitive data: none. Section 4 asks you not to enter any.
- How often: continuously, for as long as you use the service.
- What we do with it: store it, show it to you and your team, put it on the proposals you send, deliver the email you send your clients, look up and map addresses, draft follow-ups when you ask, and tell you how your proposals are read.
- Why: to provide Preposal to you under the terms.
- How long: for as long as your account is open, then as section 14 says.
Annex 2. Security measures
- Everything travels over HTTPS, and there is no unencrypted route in.
- Data is stored on Cloudflare's infrastructure, which encrypts it at rest.
- Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a random salt. Nobody can read one, including us. Sign-in attempts are rate limited.
- Every query in the app is limited to the firm that made it, and a test that fails the build enforces that rule.
- Staff access is only through our support tool. It is limited to named staff accounts, it needs a password typed again each time it is opened, and every read or change through it is logged and kept for three years.
- A rolling 30 day history of the database lets us recover from a mistake or an attack.
- The service is watched around the clock, and our team is alerted at once to outages, to errors and to unusual failures.
- Error reports are configured not to carry personal information.
- Proposal pages load no analytics or third-party scripts, and a strict content security policy blocks anything else from loading.
Annex 3. Subprocessors that handle client data
- Cloudflare, United States: hosting, the database and file storage.
- Resend, United States: delivering the email you send your clients, and telling us when one bounces or is reported as spam.
- Google, United States: maps and Street View for addresses, and the Gemini model when you ask for a follow-up draft or an address lookup. If you add your own Google Chat space, the notifications you choose are posted there.
- RentCast, United States: property details for an address you enter.
- Sentry, United States: error reports, configured not to carry personal information.
Stripe and PostHog, also listed in the Privacy Policy, handle information about your firm and your own people, not client data.
Getting hold of us
Write to support@preposal.io, or by post toPreposal, 18047 Beach Blvd # 1060, Huntington Beach, CA 92648.