Data Processing Addendum

Terry Limited LLC, a limited liability company formed under the laws of the Commonwealth of Pennsylvania, United States ("Terry Limited LLC", "we", "us", "our"), and the business that opens an account (the "Customer", "you", "your").

Effective date: 2 November 2026. Version: 1.2.

This Addendum forms part of the Terry Terms of Service at https://terryai.io/terms (the "Terms") and applies whenever we process Customer Content on your behalf. It does not need to be signed: it applies from the moment you accept the Terms, for as long as we process Customer Content for you. If you need a counter-signed copy for your own records, write to legal@terryai.io and we will provide one.

Words defined in the Terms have the same meaning here. If this Addendum conflicts with the Terms on a data protection matter, this Addendum prevails. If it conflicts with the Terms on anything else, the Terms prevail.

1. Roles, and what each of us is accountable for

1.1 You are the business. For Customer Content, including Contact data, you are the controller and the "business" under the state privacy laws that use that term. You decide who is contacted, on what basis, and what is said to them.

1.2 We are your service provider. Terry Limited LLC is your service provider and processor for Customer Content. We process it only to provide the Service, and only on your instructions.

1.3 Your instructions are your use of the product. Your documented instructions are the Terms, this Addendum, and the settings, flows, rules, lists and actions you configure in the Service. We do not act on instructions given any other way unless we agree in writing. If we believe an instruction would break the law, we will tell you and may decline it.

1.4 We are the controller of our own records. Your account details, your Users' login and profile data, billing records, and usage and diagnostic data about how the Service performs are ours as controller, and the Privacy Policy at https://terryai.io/privacy governs them. This Addendum does not apply to them.

1.5 Your own vendors are not our Sub-processors. A CRM you connect, a video provider you choose other than Terry Call (such as Zoom, Google Meet or Microsoft Teams), and a model provider whose API key you supply are your vendors. Their terms govern what they do with your data.

2. Our service provider commitments

This section is the certification required of a service provider under the California Consumer Privacy Act as amended, at Cal. Civ. Code section 1798.140(ag), and the equivalent processor commitments under the other state privacy laws that apply to you. We give it to every Customer, whether or not any of those laws applies to you, because we would rather not operate two standards.

2.1 We do not sell and we do not share. We do not sell Customer Content, and we do not share it for cross-context behavioural advertising. We receive no consideration for it of any kind.

2.2 We do not retain, use or disclose it for anything else. We do not retain, use or disclose Customer Content for any purpose other than performing the Service for you, including any commercial purpose of our own, and we do not retain, use or disclose it outside the direct business relationship between us, except where a law requires it.

2.3 We do not combine it. We do not combine Customer Content with personal information we receive from any other customer or from any other source, except as permitted to detect security incidents, to protect against fraudulent or illegal activity, and to perform the Service for you.

2.4 We do not train models on it. We do not use Customer Content or Outputs to train, fine-tune or evaluate machine learning models, and we contract with our model providers on terms that do not allow them to do so either. This is a commitment about every model, including the one running when you supply your own API key.

2.5 We understand and will comply. We understand the restrictions in this section and we will comply with them. We will tell you promptly if we determine that we can no longer meet them, and you may then stop and remediate our unauthorised use of Customer Content as the law allows.

2.6 You may take reasonable steps to confirm this. Section 9 sets out how.

3. What we process, and why

The detail is in Annex 1. In summary: we process the business contact details, message history and engagement history of the people you choose to contact, together with whatever your Users add to a record and whatever the Service reads about a named person from public professional pages when one of your Users asks it to. The purpose is to draft, check, send, and record the outcome of the messages you send, to book meetings arising from them, and, where you use Terry Call, to host the call and, only where every participant other than the host has agreed, to transcribe it, write notes for your team and let Terry speak on your host's behalf.

We do not seek special category or sensitive personal information, and the Service filters family, health, financial, religious, political, racial, sexual-orientation, age, arrest and litigation material out of what it reads about a person before anything is stored. You must not import special category or sensitive personal information into the Service.

4. Where it is processed and how it is kept apart

4.1 Location. Customer Content is processed in Amazon Web Services region US East (Northern Virginia), us-east-1. Our Sub-processors operate in the United States and, in the case of the connector named in Annex 3, in the European Union.

4.2 Separation. We run shared infrastructure: one database server and one container cluster across Customers. Within it, each Customer has its own database, its own database role, and its own encryption key, and no Customer's credentials can read another Customer's database. We describe it this way rather than as a dedicated environment because that is what it is. Dedicated environments are available by arrangement.

4.3 Encryption. Customer Content is encrypted in transit with TLS and at rest, including in backups. Mailbox tokens, SMTP credentials and multi-factor seeds are encrypted with keys held separately from the data they protect.

5. Our people

Everyone we allow near Customer Content is bound by a duty of confidentiality that survives the end of their engagement with us, has access only where they need it to do their job, and has that access logged. We limit the number of people with production access and review it.

6. Sub-processors

6.1 You authorise the Sub-processors listed in Annex 3. The list in Annex 3 is the current list. Only those marked "always" process Customer Content for every Customer; the others process it only if you turn on the feature they serve.

6.2 Each is under written terms. We have a written contract with each Sub-processor imposing data protection obligations no less protective than those in this Addendum, and we remain liable to you for their performance.

6.3 Changes. We will give you at least 30 days' notice before adding a Sub-processor that will process Contact data. We will give notice by email to your Admins and by updating section 8 of the Privacy Policy. You may object on reasonable grounds within those 30 days. If we cannot resolve your objection, you may terminate the affected part of the Service and we will refund any fees you have paid for it in advance.

6.4 Replacing one urgently. If a Sub-processor fails in a way that puts the Service or your data at risk, we may replace it with less notice, and we will tell you as soon as we reasonably can and explain why.

7. Requests from individuals

7.1 Stopping. If a Contact asks to stop being contacted, we act on it ourselves and immediately, without waiting for you. The person is suppressed and will not be contacted again through Terry by you.

7.2 Everything else. If a Contact asks for access, correction, portability or deletion, we do not answer for you, because you are accountable for that information and we do not know how you obtained it. We forward the request to you within 5 business days and we give you the tools and the information you need to answer it within the time the law allows, which is 45 days in California and the shortest period any other applicable state law allows.

7.3 What deletion does. When you delete a Contact, their records and messages are deleted, the send-audit trail is anonymised, and a one-way hash of the email address or telephone number is kept so that the same person cannot be imported and contacted again. We keep that hash for as long as your account exists. Forgetting that somebody asked not to be contacted is how they get contacted again.

7.4 Legal demands. If an authority demands Customer Content, we disclose it only where the law requires, and we tell you first unless the law forbids it.

8. Security incidents

8.1 Notice. If we confirm a breach of security safeguards involving Customer Content, we will notify you without undue delay and in any case within 72 hours of confirming it.

8.2 What the notice contains. What happened, when, what categories and roughly how many records were affected, what we have done, what we are doing next, and a named contact. If we do not have all of it within 72 hours, we send what we have and follow with the rest rather than waiting.

8.3 Help. We will give you the information you reasonably need to meet your own notification duties to individuals and to state authorities, and we will not require you to pay for it.

8.4 Who notifies individuals. You notify the Contacts, because you hold the relationship with them and you are accountable for their data. We will notify individuals and authorities ourselves where a law requires us to.

9. Confirming that we do what this says

9.1 By documentation first. On written request, no more than once a year, we will answer a reasonable security questionnaire and provide the documentation we hold about our security measures, within 30 days.

9.2 By audit where documentation is not enough. If documentation does not reasonably satisfy you, or after a security incident affecting your Customer Content, you may audit our processing on 30 days' written notice, no more than once a year, during business hours, in a way that does not disrupt the Service or expose another Customer's data. You bear your own costs and ours unless the audit finds a material failure to meet this Addendum, in which case we bear ours.

9.3 Confidentiality. Audit findings and anything you learn in the course of one are our Confidential Information under the Terms.

10. Retention, and what happens at the end

10.1 While your account exists. Contact data, messages and engagement history are kept for the life of your account, or until you delete the record or the person is erased under section 7.3.

10.2 Mail bodies. The text of replies and bounces read from a connected mailbox is scrubbed after a retention period you set, 540 days by default, and immediately when that mailbox is disconnected. The fact that a reply happened, how it was classified and when, is kept as engagement history without the text.

10.3 Other periods. Terry Call: audio and video are not kept; the transcript of a call, including its chat messages and what Terry said, and the host's suggestions are deleted 30 days after the call, wherever they are held; Terry's notes (the summary, decisions, objections and next steps) and the participants' answers to the notes and voice notices stay with the conversation until you delete the person or the account ends. Send-audit records and list attestations: 7 years, with Contact fields anonymised after erasure, because they are the evidence that a message was lawful to send. Call recordings: until the retention horizon recorded on the consent event for that call. Credentials and tokens: until you disconnect them or delete the account. Application logs: 30 days. Backups: taken daily and kept 7 days, so deleted data leaves the backups when the backup expires. Billing records: as long as tax law requires.

10.4 On termination. You may export Customer Content in CSV and JSON for 30 days after termination. After that we delete it from live systems within 30 days, and it leaves the backups as those backups expire. We keep only the suppression hashes under section 7.3, the anonymised send-audit records under section 10.3, and anything a law requires us to keep.

10.5 On request. If you want deletion sooner than section 10.4 provides, write to legal@terryai.io and we will do it, and confirm in writing when it is done.

11. Transfers

Terry is not offered to Customers established in the European Union or the United Kingdom, and you must not import the personal information of people in the European Union or the United Kingdom into the Service. There is therefore no Standard Contractual Clause, no United Kingdom Addendum and no transfer impact assessment in this Addendum. If that restriction is ever lifted, we will put the appropriate transfer mechanism in place before it is, and this section will say so.

Customer Content is processed in the United States. You are responsible for any notice to Contacts that the law requires about processing outside the country where they live.

12. Liability

Our liability under this Addendum is subject to the limitations in the Terms. Nothing in this Addendum increases or reduces either party's liability under the Terms, and nothing in it limits a liability that the law does not allow to be limited.

13. Changes to this Addendum

We may change this Addendum, and we will give at least 30 days' notice to your Admins before a change that materially reduces your protections. If you do not accept such a change you may terminate the Service before it takes effect and we will refund fees you have paid for the period after termination. Changes required by a change in the law take effect when the law does.

---

Annex 1. Details of the processing

Subject matter. Providing the Terry service: drafting, checking, sending and recording outreach and replies on the Customer's behalf, and booking meetings arising from them.

Duration. For as long as the Customer's account exists, plus the periods in section 10.

Nature and purpose. Collection, storage, organisation, retrieval, generation of message text, classification of replies, consent and suppression checking, transmission through the Customer's own mailboxes and connected accounts, scheduling, hosting video calls, speech to text transcription and summaries of calls where every participant other than the host agreed, speech synthesis of Terry's own lines in a call, erasure.

Categories of individual. The Contacts a Customer chooses to contact, who are business people contacted in their professional capacity; the Customer's own Users; any person who replies to a message the Service sent; where message requests are on, a person who writes first to a connected mailbox or messaging account; and anyone a User invites into a Terry Call.

Categories of personal information.

Special categories. None sought, none permitted. See section 3.

Annex 2. Security measures

Annex 3. Sub-processors

The current list is this Annex and section 8 of the Privacy Policy, which say the same thing. Notice of changes is in section 6.3.

---

Terry Limited LLC · 13 Kodiak Pass, Morgantown, PA 19543, United States · legal@terryai.io · privacy@terryai.io