Scope 2 Estimate Data Processing Addendum

Draft dated 2026-10-17

DRAFT FOR REVIEW — Version 1.0 — October 17, 2026. This is a proposed Data Processing Addendum for Scope 2 Estimate LLC (S2E). It is not an executed agreement or a statement that every proposed control is implemented. It becomes binding only when a final version, a completed processing schedule, and any required transfer terms are expressly accepted by S2E and the applicable business customer in a written service agreement or order. Viewing this page or completing an ordinary website signup does not accept this draft.

1 The work this addendum covers

A construction business may give S2E information about its clients, properties, occupants, employees, or subcontractors while preparing a scope or estimate. This addendum addresses personal information S2E handles on that business customer's behalf through the services identified in its order. The customer decides the lawful purpose of that processing and acts as a controller or business, or as a processor authorized by another controller. S2E acts as a processor or service provider for that information, to the extent those roles apply under the relevant privacy law.

This addendum does not govern information S2E processes for its own account administration, fraud prevention, legal obligations, or direct marketing relationships. Those activities remain subject to S2E's Privacy Policy and applicable law. A homeowner's direct relationship with S2E is ordinarily covered by the Terms of Service, estimating terms, and Privacy Policy. If S2E and a homeowner separately agree that a particular processing relationship requires this addendum, that agreement must identify its scope.

2 The customer's processing instructions

The customer's order, this addendum, the completed processing schedule, and authorized use of the contracted features provide the documented instructions. S2E will collect, organize, store, retrieve, analyze, and return customer personal information only to deliver and support those features, protect that processing, follow lawful instructions, or meet a legal obligation. S2E will notify the customer of a legal requirement before processing when the law permits notice. If an instruction appears to violate applicable privacy law, S2E will promptly tell the customer and may pause the affected processing while the issue is resolved.

The customer is responsible for the notices, permissions, lawful basis, and authority needed to supply information and direct its use. The customer must limit uploads to information reasonably needed for the project, verify the accuracy of its inputs, protect its authorized accounts, and identify instructions requiring additional safeguards. Do not submit payment-card security codes, account passwords, government identifiers, medical records, biometric templates, or other highly sensitive information unless a separate written agreement expressly permits and protects it. Avoid uploading identifiable people or private household details when they are unnecessary for the estimate.

3 Ownership and limits on use

The customer retains its rights in its project content. Processing it does not transfer ownership to S2E. S2E will not sell customer personal information, share it for cross-context behavioral advertising, or use it for unrelated advertising or its own general-purpose model training. S2E will not retain, use, or disclose it outside the specified service purposes and direct business relationship, or combine it with information from other customers or independent sources, except as applicable law permits and the agreement authorizes.

Any use of genuinely deidentified or aggregated information must satisfy applicable legal requirements, prevent reasonable identification, and prohibit reidentification. A general statement about improving software does not override these restrictions or authorize indefinite retention of identifiable client data. If a broader use is proposed, the parties must address its lawful basis, roles, and terms separately before it occurs.

4 People and safeguards

S2E will limit access to personnel who need customer personal information for authorized work and bind them to appropriate confidentiality obligations. S2E will maintain technical and organizational safeguards appropriate to the nature of the information and the risks of processing. The completed security schedule must address access control, authentication, transmission and storage protection, incident handling, vulnerability management, backup and recovery, logging, personnel access, and secure disposal.

This draft does not certify SOC 2, ISO 27001, HIPAA compliance, a particular encryption design, a recovery objective, or a geographic hosting guarantee. Schedule B identifies observations from the current application and the operational evidence that must be confirmed before a final agreement is offered.

5 Service providers and AI processing

S2E may use only subprocessors authorized under the completed processing schedule. It will impose written privacy and security obligations appropriate to their work, assess their suitability, and remain responsible for their performance to the extent required by law and this addendum. Independent services selected directly by the customer are governed by the customer's agreements with those services unless S2E separately engages them on the customer's behalf.

Before a material new subprocessor receives customer personal information, S2E will provide at least 30 days' written notice to the designated customer contact, unless an urgent security or legal need requires a shorter lawful period. The customer may raise a documented, reasonable data-protection objection during that notice period. The parties will seek an alternative or mitigation; if none is reasonably available, the customer may stop the affected feature and terminate that affected processing under its service agreement. The final provider list, notice method, and commercial consequences must be agreed before this provision takes effect.

AI is a processing activity, not permission for unrestricted use. An AI feature may receive only the project information needed for the customer's requested task under disclosed provider terms and safeguards. S2E will not authorize an AI provider to use customer personal information for unrelated general-purpose model training. Before activation, S2E must confirm the provider contract, permitted uses, retention settings, deletion process, and any transfer mechanism. Describing a planned AI or voice feature does not authorize sending customer data to it.

6 Requests, oversight, and legal process

S2E will reasonably assist the customer with legally required access, correction, deletion, portability, restriction, objection, and other individual rights requests concerning information processed on the customer's behalf. If S2E receives a request directly, it will promptly refer it to the customer when appropriate and will not independently change the customer's instructions unless law requires it. Assistance will account for the available information, the processing risk, and applicable deadlines. The parties may agree reasonable charges for exceptional assistance, but a fee dispute will not suspend a nonwaivable legal obligation.

S2E will provide information reasonably needed to demonstrate its obligations and will cooperate with reasonable assessments, audits, and inspections, including those required by a regulator. Existing relevant independent reports may be used first, but they do not remove rights that applicable law requires. Audit arrangements must protect other customers' information and service security. S2E will assist with required impact assessments and regulator consultations relating to its processing. If S2E cannot meet an applicable obligation, it will promptly notify the customer and support reasonable steps to stop and remedy unauthorized processing.

For lawful demands for customer information, S2E will verify the demand, limit disclosure to what is required, and notify the customer unless prohibited by law. The customer remains responsible for its own regulatory and individual notices, except where law assigns a duty directly to S2E.

7 Personal data incidents

S2E will notify the designated customer contact without undue delay after becoming aware of a personal data breach affecting information processed under this addendum. Notice will include available information about the incident, affected records and people, likely consequences, steps taken or proposed, and a contact for follow-up. Incomplete information may be supplied in phases without unnecessary delay. S2E will investigate, take reasonable containment and remediation steps, preserve relevant evidence, and cooperate with the customer's required response.

The processor notification obligation is distinct from any deadline that law places on the customer to notify a regulator or individuals. A breach notice is not, by itself, an admission of legal liability. Routine blocked attacks that do not compromise personal information are not automatically personal data breaches.

8 Return, deletion, and retained records

At the end of the agreed processing, or on a lawful authorized instruction, S2E will return or delete customer personal information, at the customer's choice, unless applicable law requires retention. The completed retention schedule must specify the export format and method, completion period, backup-expiry period, treatment of project revisions and saved-photo history, and any lawful exceptions. S2E will identify retained categories and their legal basis, restrict further use to the permitted purpose, and confirm completion when reasonably requested.

Archiving or marking a project complete is not a deletion request. The current application retains project revisions and saved-photo history, including some photos removed from the current project. A verified manual request process and documented backup treatment are required before offering a final deletion commitment. Until those arrangements are agreed, this draft must not be presented as an automated export or erase feature. Contact privacy@scope2estimate.com to discuss a request.

9 Applicable laws and processing locations

Each party will meet the privacy obligations applicable to its role and the agreed processing. Where California service-provider or contractor rules apply, S2E will provide the required level of protection, observe the purpose and use restrictions in this addendum, notify the customer if it can no longer meet those obligations, and permit the customer's reasonable steps to verify compliance and stop or remedy unauthorized use. Other U.S. state processor-contract requirements apply to the extent the relevant law governs the relationship.

If European, UK, Swiss, or other cross-border transfer rules apply, the parties must identify the relevant locations, roles, lawful transfer basis, and supplementary measures before the affected transfer. This draft does not automatically execute standard contractual clauses, a UK addendum, or an international certification. Any required transfer instrument and completed annexes must be agreed separately. It does not represent that S2E has verified compliance in every jurisdiction.

10 Relationship to other agreements and updates

Once accepted as a final agreement, this addendum will control over inconsistent service terms only for the customer-personal-information processing it covers. Nonwaivable privacy rights and required regulatory powers remain unaffected. Commercial terms apply only where consistent with mandatory law and the final agreement. Material changes require the notice and acceptance process agreed with the customer; publishing a revised draft does not silently amend an executed agreement.

Privacy and processing requests: privacy@scope2estimate.com. Contract and legal notices: legal@scope2estimate.com. Security reports: security@scope2estimate.com. Account assistance: support@scope2estimate.com. These addresses serve Scope 2 Estimate LLC. The final order must identify the customer's legal name, authorized contact, instructions, and agreement date.

Schedule A Project processing record

Proposed subject and purpose: construction project intake, scope organization, estimating inputs and outputs, selections, project communication, and support for contracted features. Do not treat a planned capability as active merely because it is listed here.

Possible people: the customer's clients, homeowners, property occupants, authorized staff, trade contacts, and subcontractors whose information the customer lawfully supplies. Possible information: names, business contact information, project addresses, scope notes, measurements, photos, plans if supported, product selections, and associated service records. Highly sensitive information is excluded unless separately agreed.

Nature and frequency: customer-directed collection, storage, organization, authorized analysis, retrieval, display, and support, occurring when the customer uses contracted features and for the documented retention period. Duration: the service term plus only the return/deletion and lawful-retention periods completed in the final schedule. A blank or unverified period does not establish an unlimited retention right.

Items to complete before execution: customer/controller identity and any upstream controller; exact enabled features; permitted data categories; designated incident contact; export/deletion deadlines and backup expiry; processing countries; approved provider legal entities and locations; any required transfer instruments; and agreed security evidence. These items are intentionally not represented as already verified.

Schedule B Provider and control review for Version 1.0

Application-source observations: the hosted application uses Cloudflare Worker execution, a D1 database, and R2 project-image storage. Owner tools use approved-role checks; project and image access uses account ownership checks. ChatGPT sign-in supplies account identity. The source includes an optional OpenAI API path for project recap and image analysis when configured, and product-link lookup requests to retailer websites. These observations establish code capabilities, not a complete live configuration or contractual subprocessor inventory.

Provider status to confirm: Cloudflare hosting/storage and OpenAI identity-service arrangements require confirmation of the contracting entities, data locations, roles, and applicable terms. Optional OpenAI API recap processing requires a separate activation and contract/settings review. A payment provider, voice provider, or development vendor must be added to the processing schedule if and when it receives covered data for S2E. This draft does not list Stripe, ElevenLabs, or another planned integration as an active project-data subprocessor.

Operational release checklist: verify staff confidentiality and access procedures; authentication and key management; encryption and configuration evidence; tested backups and restoration; vulnerability and incident-response ownership; customer/subprocessor notices; AI data-use settings; retention, export, and deletion procedures; and audit/rights-request handling. Obtain appropriate legal review and complete the customer/provider schedules before removing the draft designation or offering this as an executed DPA.