Data Processing Addendum

This Data Processing Addendum ("DPA") is incorporated into and forms part of the BuildMind Terms of Service between BuildMind LLC ("BuildMind") and the Customer. It governs the processing of personal data in connection with the BuildMind platform.

1. Definitions

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• Data Subject — the natural person to whom Personal Data relates.
• Controller — the entity that determines the purposes and means of Processing Personal Data.
• Processor — the entity that Processes Personal Data on behalf of the Controller.
• Sub-Processor — a third party engaged by the Processor to assist in Processing.

2. Roles

• Customer is the Data Controller for all blueprint files and associated project data uploaded to BuildMind.
• BuildMind LLC is the Data Processor, processing data solely on Customer's documented instructions.
• Anthropic, PBC is a Sub-Processor engaged to perform AI analysis on blueprint content.

3. Sub-Processors

BuildMind currently engages the following Sub-Processors:

• Anthropic, PBC (San Francisco, CA, USA) — AI processing of blueprint PDFs and generation of materials estimates.
• Hostinger International Ltd (Kaunas, Lithuania) — VPS hosting, server infrastructure, and data storage.
• Let's Encrypt / ISRG — TLS certificate issuance for encrypted data transmission.
• GitHub, Inc. — Source code backup repository. Note: customer data and blueprints are not stored in the GitHub repository; only application code is stored there.

BuildMind will notify Customer of any material changes to this Sub-Processor list with at least 30 days advance notice.

4. Customer Instructions

BuildMind will process Personal Data only in accordance with Customer's documented instructions as set forth in the Terms of Service and this DPA. BuildMind will promptly notify Customer if it believes any instruction violates applicable law.

5. Confidentiality

BuildMind ensures that personnel authorized to process Customer data are bound by confidentiality obligations, whether by employment contract or separate agreement.

6. Security Measures

BuildMind implements and maintains the technical and organizational security measures described at buildmind.tech/security. These measures are designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction.

7. Data Subject Requests

If BuildMind receives a request directly from a Data Subject relating to Customer's data, BuildMind will promptly forward the request to Customer. Customer is responsible for responding to Data Subject requests relating to data they control. BuildMind will provide reasonable assistance to Customer in fulfilling such requests.

8. Breach Notification

BuildMind will notify Customer within 72 hours of becoming aware of a confirmed Personal Data breach affecting Customer data. The notification will include: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

9. Audit Rights

Upon Customer's written request (no more than once per 12-month period), BuildMind will provide a written summary of its security controls and practices relevant to the processing of Customer's data. Physical audits may be arranged by mutual agreement.

10. Data Return and Deletion

Upon termination of the service agreement, BuildMind will provide Customer with a complete export of their job history and account data within 7 business days. Following Customer's confirmation of receipt, BuildMind will delete Customer's data within 30 days, except where retention is required by applicable law.

11. Contact

Questions regarding this DPA: info@buildmind.tech