This Data Processing Agreement ("DPA") is entered into between the organization identified above as Data Controller ("Client" or "Controller") and Olesya Epps, doing business as Epps.ai ("Processor"), and forms part of the Services Agreement or engagement letter between the parties (the "Principal Agreement"). In the event of conflict between this DPA and the Principal Agreement, this DPA shall govern with respect to data processing matters.
For purposes of this DPA:
| Category | Detail |
|---|---|
| Subject matter | AI-assisted real estate analysis, financial modeling, LP reporting, and workflow automation |
| Duration | For the term of the Principal Agreement, plus any retention period specified herein |
| Nature of processing | Session-scoped AI inference, report generation, data parsing, and output formatting |
| Purpose of processing | Delivery of advisory Services as specified in the Principal Agreement |
| Categories of data | Deal financial data, LP investor information, organizational data, contact information |
| Categories of data subjects | Client employees, LP investors (where LP data is inputted), deal counterparties |
Epps.ai, as Data Processor, agrees to:
No model training: Epps.ai expressly agrees that Client Data will not be used to train, fine-tune, evaluate, or improve any AI or machine learning model, whether operated by Epps.ai or any Sub-processor. This obligation survives termination of the Principal Agreement.
The Controller agrees to:
Specifically:
In the event Epps.ai engages a sub-processor that processes data outside the United States, Epps.ai will notify the Controller in writing at least 30 days in advance and provide appropriate safeguards (such as Standard Contractual Clauses) prior to any such transfer.
Epps.ai implements the following security measures:
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.2+ for all data transmitted between browser and Epps.ai infrastructure, and between Epps.ai and Anthropic API |
| Encryption at rest | No server-side storage of Client Data in current architecture. Contact form data stored by Netlify with standard encryption |
| Access control | Platform access restricted via password protection. Per-client credentials issued. Role-based access controls in development |
| Data minimization | Session-scoped processing — no Client Data retained after session end. Browser-native file parsing eliminates server upload |
| AI data isolation | Each session is independent. No cross-session or cross-client data exposure at AI inference level |
| Incident response | Controller notified within 72 hours of confirmed breach. Incident log maintained |
| Personnel | Processing limited to authorized personnel bound by confidentiality obligations |
| Sub-processor oversight | Sub-processors subject to equivalent data protection obligations |
The Controller hereby grants general written authorization for Epps.ai to engage the following Sub-processors as of the date of this DPA:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic, Inc. | AI inference and language model processing for tool outputs | United States |
| Netlify, Inc. | Platform hosting, CDN, and form submission processing | United States |
Epps.ai will notify the Controller at least 30 days before engaging any new or replacement Sub-processor. The Controller may object to such changes in writing within 14 days of notification.
Epps.ai will, taking into account the nature of processing, assist the Controller by implementing appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to data subject requests, including requests for access, correction, deletion, portability, and objection.
Given that Epps.ai's zero-persistence architecture means the vast majority of Client Data inputs are not retained by Epps.ai after session end, most data subject deletion and access requests will be addressed by the Controller's own systems rather than through Epps.ai's infrastructure. For contact form data retained by Netlify, Epps.ai will cooperate with Controller to fulfill deletion requests within 30 days.
This DPA is effective from the date of execution and remains in force for the duration of the Principal Agreement.
Upon termination or expiration of the Principal Agreement, Epps.ai will, at the Controller's election within 30 days of termination: (a) return all Client Data in a structured, machine-readable format; or (b) securely delete all Client Data in Epps.ai's possession. Given the zero-persistence architecture, the primary retention concern is contact form data, which will be deleted from Netlify's system upon written request.
Epps.ai may retain Client Data to the extent required by applicable law, provided it notifies the Controller of such retention requirement and limits processing to the minimum necessary.
This DPA is governed by the laws of the State of California, consistent with the Principal Agreement. Any disputes arising under this DPA shall be resolved through the dispute resolution mechanism specified in the Principal Agreement.
Each party's liability under this DPA is subject to the limitations and exclusions set out in the Principal Agreement, except that neither party limits its liability for: (a) breach of its data protection obligations under Applicable Data Protection Law; or (b) gross negligence or willful misconduct.
For questions regarding this DPA, contact: olesya@epps.ai · (415) 466-5255
By signing below, the parties agree to be bound by the terms of this Data Processing Agreement.