Legal

Data Processing Agreement

Version: 2026-10-14

Effective: 2026-10-14

This Data Processing Agreement (the "DPA") is part of the Estimate API Terms of Service (the "Terms") between Hometown Workforce, LLC, 2519 Provence Pl, Biloxi, MS 39531, USA ("Hometown"), and the business that accepts the Terms ("Customer"). Customer accepts this DPA in the developer portal together with the Terms. Hometown records the version and the date and time of acceptance. Terms defined in the Terms have the same meaning here.

1. Definitions

1.1. "Applicable Data Protection Law" means every law on personal data that applies to the processing under this DPA. This includes: (a) Regulation (EU) 2016/679 (the "GDPR"); (b) the UK GDPR and the UK Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025; (c) the Swiss Federal Act on Data Protection (the "FADP"); (d) the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its regulations (the "CCPA"); (e) other US state privacy laws; (f) Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the Diario Oficial de la Federación on 20 March 2025, and its regulations (the "LFPDPPP").

1.2. "Customer Personal Data" means Personal Data in Customer Data that Hometown processes for Customer under the Agreement.

1.3. The following terms have the meaning that Applicable Data Protection Law gives them: "controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority". This also covers their equivalents in each law, such as "business", "service provider", "responsable" and "persona encargada".

1.4. "Subprocessor" means a third party that Hometown engages to process Customer Personal Data.

1.5. "EU SCCs" means the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.6. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, in the version in force from 21 March 2022, as revised from time to time.

1.7. "Restricted Transfer" means a transfer of Customer Personal Data that Applicable Data Protection Law allows only with appropriate safeguards.

2. Scope and roles

2.1. Customer is the controller of Customer Personal Data and Hometown is its processor. If Customer processes the data for another controller, Customer is a processor and Hometown is its subprocessor.

2.2. Hometown is an independent controller of account, billing, authentication, security and Usage Data. Its privacy notices cover that data, and this DPA does not.

2.3. This DPA also applies to Personal Data sent in test mode.

2.4. Annex I describes the processing.

3. Customer obligations

3.1. Customer is responsible for having a lawful basis for the processing, for giving the notices and getting the consents the law requires, and for the lawfulness of its instructions. This includes notice that data is processed with AI and stored in the United States.

3.2. Customer will not send special categories of data or the other data that Section 6 of the Terms forbids.

3.3. Customer is responsible for answering data subjects and for setting retention and deleting data with the tools of the Service.

4. Processing on instructions

4.1. Hometown processes Customer Personal Data only on Customer's documented instructions, including on transfers. The instructions are the Agreement, Customer's settings in the portal and Customer's API calls.

4.2. If the law requires other processing, Hometown will inform Customer before it processes, unless the law forbids that.

4.3. Hometown will tell Customer if, in its opinion, an instruction breaks Applicable Data Protection Law.

4.4. Hometown will not process Customer Personal Data for its own purposes. In particular, it will not: (a) train or fine-tune AI models with it; (b) sell or share it; (c) use it for marketing; (d) profile data subjects; (e) contact Customer's End Customers.

4.5. Hometown may use aggregated statistics that do not identify any person and do not contain the content of Customer Personal Data, as Section 9.3 of the Terms states.

5. Confidentiality

5.1. Hometown ensures that every person it authorizes to process Customer Personal Data is bound by a duty of confidentiality.

5.2. Access is limited to the people who need it to provide the Service.

6. Security

6.1. Hometown implements the technical and organisational measures in Annex II.

6.2. Hometown may update these measures. An update will not reduce the overall level of protection.

7. Subprocessors

7.1. Customer gives a general authorization for Hometown to engage Subprocessors. The current list is in Annex III and at https://wfskills.com/legal/subprocessors.

7.2. Hometown signs a written contract with each Subprocessor that imposes data protection obligations at least as protective as this DPA. Where needed, this includes the EU SCCs.

7.3. Hometown gives at least 30 days' notice before a new or replacement Subprocessor processes Customer Personal Data. The notice is an update to the list and an email to the account owner.

7.4. Customer may object in writing within those 30 days on reasonable data protection grounds. (a) The parties will discuss the objection in good faith. (b) Hometown may offer an alternative, such as not using that Subprocessor for Customer's account. (c) If the parties cannot resolve the objection, Customer may end the affected part of the Service and receive the refund in Section 14.2 of the Terms.

7.5. In an emergency, Hometown may replace a Subprocessor with shorter notice. Examples are a Subprocessor's failure or a security risk. Hometown then gives notice as soon as possible, and Customer has the same right to object.

7.6. Hometown remains responsible for its Subprocessors.

7.7. Hometown will not send Customer Personal Data to any AI model provider that is not listed in Annex III.

8. Data subject requests

8.1. The Service lets Customer find, correct, export and delete Customer Personal Data: (a) GET and DELETE /v1/estimates/{id}; (b) the retention setting from 0 to 30 days; (c) the Records API; (d) JSON export and "Delete all" in the portal.

8.2. If Hometown receives a request directly from a data subject about Customer Personal Data, Hometown will not answer it. The only exception is to refer the person to Customer. Hometown forwards the request to Customer promptly and within 5 business days when it can identify Customer.

8.3. Hometown gives Customer reasonable further help with requests that the tools do not cover.

9. Assistance

9.1. Hometown helps Customer meet its obligations on security, data protection impact assessments and prior consultation (GDPR articles 32 to 36). It does so by giving the information it has about the processing.

9.2. This help covers CCPA cybersecurity audits and risk assessments, and the equivalent LFPDPPP obligations.

10. Personal data breach

10.1. Hometown notifies Customer without undue delay, and in any case within 72 hours after it becomes aware of a personal data breach affecting Customer Personal Data.

10.2. The notice describes, as far as Hometown knows at the time: (a) the nature of the breach; (b) the categories and approximate number of data subjects and records; (c) the likely consequences; (d) the measures taken or proposed; (e) a contact point. Hometown may give the information in stages.

10.3. Hometown takes reasonable steps to contain, investigate and mitigate the breach. It cooperates with Customer and keeps a record of the breach.

10.4. Hometown sends the notice to the account owner and the billing contact.

10.5. Customer decides on notices to authorities and to data subjects. This includes the immediate notice to titulares that LFPDPPP article 19 requires. Hometown does not notify Customer's data subjects without Customer's instruction, unless the law requires it.

10.6. A notice is not an admission of fault.

11. Deletion and return

11.1. During the term, Customer can delete Customer Personal Data with the tools in Section 8.1. Hometown deletes data on the schedule in Annex I.

11.2. Customer should export the Records it needs before the Agreement ends. Hometown answers a request for a copy made within 30 days after the end. Hometown deletes Customer Personal Data within 30 days after the end. Backups expire within 7 more days.

11.3. If the law requires Hometown to keep data, Hometown isolates and protects it, and uses it only for that purpose.

11.4. On request, Hometown confirms the deletion in writing.

12. Audits

12.1. Hometown makes available the information needed to show compliance with this DPA. This includes this DPA, Annex II, answers to one reasonable security questionnaire each year, and any reports from Subprocessors that Hometown may share.

12.2. If that information is not enough, or if a supervisory authority requires it, or after a personal data breach, Customer may audit Hometown under these conditions: (a) Customer or an independent auditor may carry out the audit. An auditor must be bound by confidentiality and must not be a competitor of Hometown; (b) Customer gives 30 days' written notice; (c) the audit takes place during business hours, at most once in 12 months, and remotely where possible; (d) Customer pays its own costs; (e) the audit does not include data of other customers or the facilities of Subprocessors. For those, the Subprocessors' reports apply.

12.3. This process satisfies the audit rights in the EU SCCs and in Section 14.4.

13. International transfers

13.1. Hometown stores Customer Personal Data in the United States on Google Cloud (region us-central1, Iowa). The AI processing takes place in the United States. Hometown personnel may access the data remotely from the United States and Mexico for support and operations.

13.2. EU SCCs. For a Restricted Transfer under the GDPR, the EU SCCs are incorporated into this DPA as follows: (a) Module Two applies when Customer is a controller. Module Three applies when Customer is a processor; (b) Clause 7, the docking clause, applies; (c) Clause 9(a): Option 2 (general written authorization), with the 30 days' notice in Section 7.3; (d) Clause 11(a): the optional language does not apply; (e) Clause 13: the competent supervisory authority is the one that Clause 13(a) determines. Annex I.C sets it out; (f) Clause 17: Option 1, the law of Ireland; (g) Clause 18(b): the courts of Ireland; (h) Annex I of the EU SCCs is Annex I of this DPA. Annex II of the EU SCCs is Annex II of this DPA. Annex III of the EU SCCs is Annex III of this DPA; (i) audits under Clause 8.9 follow Section 12, and the deletion certificate under Clause 8.5 follows Section 11.4.

13.3. UK. For a Restricted Transfer under the UK GDPR, the UK Addendum is incorporated as follows: (a) Table 1: the parties and contacts in Annex I.A; (b) Table 2: the modules and options in Section 13.2; (c) Table 3: Annexes I, II and III of this DPA; (d) Table 4: neither party may end the UK Addendum under its Section 19. If the Information Commissioner issues a revised addendum, the revised version applies when it takes effect.

13.4. Switzerland. For a Restricted Transfer under the FADP, the EU SCCs apply under Section 13.2 with these changes: (a) the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; (b) references to the GDPR mean the FADP; (c) data subjects in Switzerland may bring claims in Switzerland.

13.5. Hometown makes onward transfers only to Subprocessors under the EU SCCs or another valid transfer mechanism.

13.6. Requests from public authorities. (a) If a public authority requests Customer Personal Data, Hometown will notify Customer unless the law forbids it. (b) Hometown will challenge requests that it considers unlawful. (c) Hometown will disclose only the minimum the law requires. (d) As of the effective date, Hometown has not received any such request.

13.7. Hometown gives Customer the information it has to help Customer assess the transfer.

13.8. If a transfer mechanism stops being valid, the parties will cooperate on an alternative. Until then, Customer may suspend the affected transfers or end the affected part of the Service.

13.9. If the EU SCCs or the UK Addendum conflict with this DPA, the EU SCCs or the UK Addendum prevail.

14. CCPA and other US state laws

14.1. Hometown is Customer's "service provider" under the CCPA and its "processor" under other US state laws. The business purpose is to provide the Service as Annex I describes.

14.2. Hometown will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes in this DPA, or as the CCPA otherwise allows; (c) retain, use or disclose Customer Personal Data outside the direct business relationship between Hometown and Customer; (d) combine Customer Personal Data with personal information it receives from others or collects itself, except as the CCPA regulations allow.

14.3. Hometown complies with the CCPA obligations that apply to it, and gives Customer Personal Data the same level of privacy protection that the CCPA requires.

14.4. Customer may take reasonable and appropriate steps to ensure that Hometown uses Customer Personal Data in line with Customer's obligations, including the audits in Section 12. After notice, Customer may require Hometown to stop and remediate any unauthorized use.

14.5. Hometown will notify Customer within 10 business days if it decides that it can no longer meet its obligations under the CCPA.

14.6. Hometown cooperates with Customer on consumer requests, cybersecurity audits, risk assessments and rules on automated decision-making technology, where those apply.

14.7. Hometown binds its Subprocessors in writing to the same terms. Section 7 governs notice of new Subprocessors.

14.8. If Hometown receives de-identified data, it will not try to re-identify it, and it will keep it de-identified.

14.9. Hometown certifies that it understands and will comply with the restrictions in this Section 14.

14.10. This DPA includes the processor terms that other US state laws require: instructions, nature and purpose of the processing, types of data, duration, confidentiality, deletion or return, information and assessments, and written terms with subcontractors.

15. Mexico (LFPDPPP)

15.1. For Customer Personal Data of titulares protected by the LFPDPPP, Customer is the responsable and Hometown is the persona encargada (LFPDPPP article 2, section XII).

15.2. As persona encargada, Hometown will: (a) process the data only on Customer's instructions; (b) not process the data for any other purpose; (c) keep the administrative, technical and physical security measures in Annex II (article 18); (d) keep the data confidential, also after the relationship ends (article 20); (e) delete the data when the relationship ends or when Customer instructs it, unless the law requires Hometown to keep it; (f) not transfer the data, except on Customer's instruction, to Subprocessors authorized under Section 7, or when a competent authority requires it; (g) inform Customer of security breaches under Section 10, so that Customer can inform titulares immediately (article 19); (h) forward requests for ARCO rights within 5 business days, so that Customer can answer within the 20 business days of article 31; (i) not use the data to contact titulares.

15.3. Communications of data from Hometown to its Subprocessors are communications between responsable and encargados. They are not transfers under article 2, section XX. Customer authorizes this subcontracting under Section 7.

15.4. Customer's privacy notice (aviso de privacidad) must tell titulares about this processing, including the use of AI and storage in the United States.

15.5. If Hometown processes the data for its own purposes, it assumes the obligations of a responsable under the law.

16. Liability

16.1. Each party's liability under this DPA is subject to Section 22 of the Terms.

16.2. Nothing in this DPA limits liability to data subjects that the EU SCCs, the UK Addendum or the law do not allow the parties to limit.

17. Term, changes, precedence and governing law

17.1. This DPA lasts as long as the Agreement, and after it ends until Hometown has deleted Customer Personal Data.

17.2. Hometown may update this DPA to comply with law or to reflect a change in the Service, with notice under Section 17 of the Terms. A change that reduces the protection of Customer Personal Data requires Customer's acceptance.

17.3. For Personal Data, this DPA prevails over the Terms.

17.4. This DPA is governed by the law that governs the Terms. The EU SCCs are governed by the law in Section 13.2(f). The UK Addendum is governed by the law of England and Wales.

Annex I. Description of the processing

A. List of parties

Data exporter

• Name and address: the Customer and the address in its developer account.
• Contact: the account owner.
• Role: controller, or processor for its own customers.
• Activities: use of the Estimate API and the Records add-on.
• Signature and date: electronic acceptance in the portal, recorded with version and timestamp.

Data importer

• Name: Hometown Workforce, LLC.
• Address: 2519 Provence Pl, Biloxi, MS 39531, USA.
• Contact: legal@hometownworkforce.com.
• Role: processor, or subprocessor.
• Activities: providing the Service under the Agreement.
• Signature and date: electronic acceptance in the portal, recorded with version and timestamp.

B. Description of the transfer and the processing

Categories of data subjects

• Customer's End Customers, such as homeowners, tenants, property managers and businesses that ask for home work.
• Customer's staff, when Customer includes their data in Input or Records.
• People who appear by chance in photos or text.

Categories of personal data

• Job descriptions and messages, which may contain names, contact details or other details the sender writes.
• Photos of the job. These are processed in transit and are not stored. Hometown keeps only the SHA-256 hash, the file type and the size.
• Service address, postal code and region.
• Estimates and other Output.
• With the Records add-on: name, phone number, email, normalized address, notes, Customer's external ID, and other records of up to 64 KB each.
• Request metadata: a hash of the IP address, routes, timestamps and status codes.

Special categories of data

• None intended. Customer must not send them (Section 6.9 of the Terms).
• Safeguards that apply to any such data sent by mistake are in Annex II.

Frequency of the transfer

• Continuous, each time Customer calls the API.

Nature of the processing

• Receiving data through the API.
• Automated moderation.
• Sending Input to the AI Subprocessor to read photos and text and to produce estimates.
• Storage, retrieval, export and deletion.

Purpose of the processing

• Providing the Estimate API and the Records add-on.
• Support that Customer requests.
• Security and abuse prevention.
• Billing and reconciliation of usage.

Retention

Transfers to Subprocessors

• As Annex III describes, for the same nature and duration.

C. Competent supervisory authority

• The supervisory authority that Clause 13(a) of the EU SCCs determines.
• For the UK, the Information Commissioner's Office.
• For Switzerland, the Federal Data Protection and Information Commissioner.

Annex II. Technical and organisational measures

1. Encryption in transit

• TLS 1.2 or higher on every public address (api.wfskills.com, developers.wfskills.com and wfskills.com, where the portal lives), with HSTS.
• Webhooks to Customer go only to HTTPS addresses.

2. Encryption at rest

• Google Cloud encrypts disks and disk snapshots at rest with AES-256 by default.
• Phone and email fields in Records are also encrypted at the application level with Laravel encrypted casts (AES-256-CBC with an HMAC-SHA-256 signature, under the application key).
• Webhook signing secrets and two-factor (TOTP) secrets are encrypted the same way.
• Lookups by email address use a hash, not the address itself.

3. API credentials

• Hometown stores API keys only as SHA-256 hashes and shows each key once.
• Keys carry a prefix and a checksum so that secret scanners can detect them.
• Controls per key: scopes, optional IP allowlists, expiry, rotation, pause and revocation.
• Automatic pause on unusual usage, when Customer turns it on.

4. Access control

• Role-based access for Hometown personnel, based on least privilege.
• TOTP two-factor authentication (RFC 6238) is required for administrator accounts that manage the platform.
• Recovery codes are stored with bcrypt and work only once.
• Password re-confirmation within 10 minutes before sensitive actions.
• Production access is limited to named personnel through SSH keys or Google Cloud Identity-Aware Proxy.

5. Separation of customers

• Every query on API data is scoped to the customer account.
• Automated tests check isolation on every API route.

6. Data minimisation

• Photos are not stored.
• The text that the Service sends to the AI model is not logged.
• Customers can set request log retention from 0 to 30 days.
• IP addresses in request metadata are hashed.

7. AI Subprocessor

• Requests to the AI model provider ask it not to store them. Under the provider's API terms, API data is not used to train models and is kept for at most 30 days only to monitor abuse.
• Automated moderation runs before an estimate is produced.

8. Abuse prevention

• Limits per key at the web server and in the application.
• Daily caps and monthly spending caps.

9. Webhooks

• Outbound webhooks are signed with HMAC-SHA256 and include a timestamp. The tolerance is 5 minutes.
• Protection against server-side request forgery: HTTPS only, private and local address ranges blocked, DNS resolved and pinned before connecting, no redirects, and a 10-second timeout.
• Inbound payment webhooks are verified by signature and processed only once.

10. Logging and monitoring

• Audit events for keys and account actions, with the actor and the IP address.
• Error alerts by email, uptime checks every 5 minutes from three regions, and nightly reconciliation of usage and billing.

11. Backups and availability

• A database dump every day, kept for 7 days on the server's data disk.
• A snapshot of that disk every day, kept for 7 days in Google Cloud, separate from the server.
• A documented restore procedure.
• Google Cloud infrastructure.

12. Secure development

• Code review, automated tests and static analysis.
• Dependency audit with composer audit and OSV-Scanner.
• Secret scanning with gitleaks and trufflehog.
• A license allowlist.
• Security headers and a content security policy.

13. Personnel

• Confidentiality obligations.
• Access removed when a person leaves.

14. Incident response

• A process to detect, contain and investigate incidents.
• Notice to Customer within 72 hours (Section 10).

15. Physical security

• Hometown runs no data centers of its own. It relies on the physical controls and certifications of Google Cloud.

16. Deletion

• Daily jobs delete expired request logs, estimates, request metadata and Records.
• Tools for Customer to delete data.
• Data is deleted when an account closes, as Section 11 states.

17. Review

• Hometown reviews these measures at least once a year and after any significant incident.

Annex III. Subprocessors

The current list is at https://wfskills.com/legal/subprocessors. Section 7 describes how Hometown gives notice of changes and how Customer can object.

Subprocessors of Customer Personal Data as of the effective date:

Stripe, Inc. processes Customer's billing data for Hometown. It does not receive Customer Personal Data.

Hometown does not use any AI provider located outside the United States.