Data Processing Addendum

Virtual EstimateAI, Inc.

This Data Processing Addendum ("DPA") describes how Virtual Estimate processes personal data on behalf of its customers. It forms part of our Terms of Service and applies to every subscription. It should be reviewed with your legal counsel.

Roles

For personal data in Customer Data, you (the moving company) act as the controller (the "business") and Virtual Estimate acts as the processor (the "service provider"). We process that data only (a) to provide the Service, (b) to maintain and improve the Service, including our AI models, as authorized in Section 4 of the Terms unless you have opted out, and (c) on your other documented instructions. We do not sell this data and do not use it for advertising.

Nature of processing

We process the categories of data you and your customers submit to operate the moving-company features of the Service, including:

• contact details, addresses, move dates and move details;
• videos, photographs and other survey media of homes and belongings, and the inventories, measurements and estimates generated from them;
• estimates, contracts, bills of lading and electronic signatures, together with signing time, IP address, device information and, where the device allows it, location at the time of signing;
• messages and SMS exchanged with your customers, and records of their messaging consent;
• payment status and amounts (card numbers are handled by your payment processor and are not stored by us);
• information about your staff and crew who use the Service.

Data subjects are your customers and prospects, and your staff and crew. Processing lasts for the term of your subscription and the deletion period described below.

Where data is processed

Customer Data is hosted on servers in Germany (European Union), with backups also stored in Germany. AI video analysis is performed in the United States, and several of the subprocessors listed below process data in the United States.

Security

We maintain technical and organizational measures appropriate to the risk, including a separate database for each company, role-based access, encryption in transit, encryption of stored credentials and secrets, private storage for media and contracts, tokenized customer links scoped to a single request, cryptographically signed service-to-service callbacks, daily off-site backups, and restricted, key-based administrative access to production systems. Personnel with access to Customer Data are bound by confidentiality obligations. See our Security & Trust page.

Subprocessors

You authorize us to use the following subprocessors. We remain responsible for their processing under this DPA and will update this list before a new subprocessor begins processing Customer Data.

Data subject requests & breach

We will assist you, taking into account the nature of processing, in responding to requests from your customers to access, correct or delete their personal data. If we receive such a request directly, we will refer it to you. We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your data.

Return & deletion

You can export your data from the Service, or ask us for an export, during your subscription and for 30 days after it ends. We delete Customer Data within 90 days after termination, or earlier on your written request, except where retention is required by law. Backups containing deleted data are overwritten within 14 days. Improvements to the Service and our AI models made before deletion are not reversed, as they do not contain your Customer Data in identifiable form.

Contact

To request a signed copy of this DPA or ask a question, contact us.