KeroIQ Data Processing Addendum (DPA) — v1-draft

v1-draft (2026-10-29) — not yet counsel-reviewed. Not legal advice. This is the version KeroIQ shows to Operators in the app (published as v1-draft) under the owner's ruling of 2026-10-29. Counsel review may follow as a new version that Operators re-accept. It is drafted to the requirements for a CCPA/CPRA "service provider" contract (Cal. Civ. Code §§1798.100(d), 1798.140(ag); 11 CCR §7051), and terms, limits, and enforceability must still be confirmed by counsel licensed in California against the current statutory and regulatory text.

Version: v1-draft · Effective date: same as the Terms of Service version it is accepted with.

A Spanish courtesy translation will be provided after a qualified human reviewer checks it. Legal text is not machine-translated. If the two differ, the English version controls.

This Data Processing Addendum ("DPA") is incorporated into the KeroIQ Terms of Service (Part II — Operator terms) or other written subscription agreement (together, the "Agreement") between KeroIQ LLC ("KeroIQ," the "Service Provider") and the subscribing business ("Operator," the "Business"). It governs KeroIQ's processing of personal information contained in Operator Data.

Signed agreements control. If the Operator has signed a separate written agreement with KeroIQ LLC covering data processing (for example, a Cloud Service Agreement and Data Processing Agreement), that signed agreement governs, and this DPA applies only to the extent it does not conflict with it. Accepting this DPA in the app does not modify, replace, or renew a signed agreement (Terms of Service, Section 1).

1. Definitions

• "Personal Information," "Business," "Service Provider," "Sell," "Share," "Consumer," and "Business Purpose" have the meanings given in the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code §1798.100 et seq., the "CCPA").
• "Operator Personal Information" means Personal Information contained in Operator Data that KeroIQ processes on the Operator's behalf — described in Annex 1.
• "Sub-processor" means a third party engaged by KeroIQ to process Operator Personal Information — listed in Exhibit A (the Sub-processor List, published at keroiq.com/subprocessors).

Where the Operator or its data subjects are outside California, references to the CCPA should be read to include equivalent obligations under other applicable US state privacy laws.

2. Scope and purpose of processing (limited and specified)

KeroIQ processes Operator Personal Information only for the following limited and specified Business Purposes:

1. providing and operating the Service for the Operator (order management, order-ahead, menus, inventory, loyalty, staffing/timekeeping, reporting, messaging, signage, and related features);
2. providing the AI and voice features the Operator or its staff choose to use (transcription, command parsing, summaries, forecasts, business answers);
3. securing the Service (authentication, audit logging, fraud and abuse prevention, tenant isolation);
4. providing support and troubleshooting at the Operator's request;
5. maintaining backups and business continuity; and
6. complying with applicable law.

KeroIQ shall not:

• sell or share Operator Personal Information (as "sell" and "share" are defined in the CCPA);
• retain, use, or disclose Operator Personal Information for any purpose other than the Business Purposes above, or outside the direct business relationship between KeroIQ and the Operator;
• retain, use, or disclose Operator Personal Information for any commercial purpose other than the Business Purposes; or
• combine Operator Personal Information with Personal Information received from another business or collected from KeroIQ's own interactions with consumers, except as permitted by the CCPA and its regulations (for example, to detect security incidents or protect against fraud).

No model training. KeroIQ does not use Operator Personal Information to train AI models, and configures its AI Sub-processors' API services not to train on it.

3. CCPA compliance; certification

KeroIQ will comply with all sections of the CCPA and its regulations applicable to service providers, and will provide the same level of privacy protection for Operator Personal Information as the CCPA requires of the Operator. KeroIQ certifies that it understands the restrictions in Section 2 and will comply with them.

KeroIQ will notify the Operator without undue delay, and in any event within 5 business days, if it determines it can no longer meet its obligations under the CCPA or this DPA. Upon such notice, the Operator may take reasonable and appropriate steps to stop and remediate unauthorized use of Operator Personal Information.

4. Sub-processors

1. Current list. The Operator authorizes the Sub-processors listed in Exhibit A (published at keroiq.com/subprocessors).
2. Flow-down. KeroIQ will engage Sub-processors only under a written contract imposing obligations no less protective than this DPA, to the extent applicable to the services the Sub-processor provides.
3. Changes. KeroIQ will update Exhibit A and give the Operator notice (email to the account owner) at least 30 days before a new Sub-processor processes Operator Personal Information. If the Operator reasonably objects on data-protection grounds within those 30 days and no resolution is found, the Operator may terminate the affected Service on notice and receive a prorated refund of any prepaid fees for it.
4. KeroIQ remains responsible for its Sub-processors' performance under this DPA.

5. Security measures

KeroIQ implements and maintains reasonable security procedures and practices appropriate to the nature of the information, described in Annex 2. KeroIQ does not currently hold third-party certifications (no SOC 2, ISO 27001, or PCI DSS attestation of its own); payment-card data is processed by Square, which maintains PCI DSS compliance for the card data it handles — KeroIQ never stores card numbers, CVVs, or expiry dates.

6. Consumer rights requests — assistance

1. Routing. The Operator is the business responsible for responding to requests from its own customers and staff (access, deletion, correction, etc.). If a consumer contacts KeroIQ directly about Personal Information KeroIQ processes for an Operator, KeroIQ will forward the request to the Operator without undue delay and will not respond substantively on the Operator's behalf unless instructed.
2. Assistance. On the Operator's documented instruction, KeroIQ will assist in fulfilling verified requests, including deleting, correcting, or producing the consumer's Personal Information held in the Service, within timeframes that let the Operator meet its statutory deadlines, and in any event within 10 business days of a documented instruction. KeroIQ performs this assistance manually today; it is not a self-serve feature.
3. Deletion pass-through. Where KeroIQ deletes Personal Information at the Operator's instruction, it will also instruct its Sub-processors to delete it, except where retention is required by law (e.g., backups on a bounded rolling schedule; payment records held by Square under Square's own legal obligations). The Operator acknowledges that data the Operator itself synced into third-party systems it controls (e.g., its own Square account) is the Operator's to delete there.

7. Security incidents and breach cooperation

1. KeroIQ will notify the Operator without unreasonable delay, and in any event within 72 hours after becoming aware of a breach of security resulting in unauthorized access to or acquisition of unencrypted Operator Personal Information.
2. The notice will describe, to the extent known: the nature of the incident, the categories of Personal Information and consumers affected, the measures taken, and a KeroIQ contact. The Operator may report a suspected security incident, and send any request under this DPA, to KeroIQ's security contact: support@keroiq.com.
3. KeroIQ will cooperate with the Operator's own notification obligations (including under Cal. Civ. Code §1798.82) and follows its internal breach runbook for containment, evidence preservation, and scoping (per-tenant blast-radius analysis via row-level security).
4. Nothing in this section is an admission that KeroIQ is the notifying party under §1798.82 for a given incident; which party owes statutory notice depends on the facts. As the Operator's service provider, KeroIQ notifies the Operator; the Operator, as the business, notifies affected consumers and any regulator where the law requires; and KeroIQ cooperates with those notices.

8. Audit and verification

The Operator may take reasonable and appropriate steps to verify that KeroIQ uses Operator Personal Information consistently with the CCPA, including: (a) written security questionnaires no more than once per year, answered within a reasonable time; and (b) where a material concern cannot be resolved in writing, a remote review of relevant policies and control evidence, scheduled on reasonable notice, at the Operator's expense, no more than once per year and without access to other tenants' data.

9. Return and deletion on termination

Within 60 days after termination of the Agreement, KeroIQ will, at the Operator's choice:

• provide an export of Operator Data in a commonly used machine-readable format (such as CSV or JSON) on a written request made within 30 days after termination, delivered within 15 business days (Terms of Service, Section 15); and/or
• delete the Operator's tenant, including all Operator Personal Information (whole-tenant deprovisioning is an existing, tested capability),

except where retention is required by law (e.g., tax records; payroll records within their legal retention window) and for encrypted backups, which age out of the rolling backup schedule (currently a maximum of ~12 months) rather than being individually purged. Until they age out, backups remain subject to this DPA, and if deleted data is ever restored from a backup, KeroIQ deletes it again.

10. Employee and staff data; Operator notices

The Service processes Personal Information about the Operator's staff (names, roles, wage rates, timecards, PIN credentials, schedules). The Operator is the employer and is responsible for providing its staff any legally required notices at collection (including under the CPRA's employee-data provisions) covering the Operator's use of the Service. KeroIQ will provide, with onboarding, a template staff notice describing what the Service processes.

Voice features have their own consent flow: staff voice on the vendor conversational stack does not activate for a tenant until the Operator enables it and each staff member individually consents in their own language.

11. Term, precedence, and general

• This DPA runs for the term of the Agreement plus any post-termination period in Section 9.
• If this DPA conflicts with the Agreement on the processing of Personal Information, this DPA controls.
• If the Operator has a signed agreement with KeroIQ LLC, the order of precedence in Terms of Service Section 1 applies.
• Governing law and venue follow the Agreement (California; Contra Costa County).
• Liability under this DPA shares the Agreement's general limitation of liability (Terms of Service, Section 5); there is no separate cap.

Annex 1 — Processing details

Annex 2 — Security measures (implemented today; factual)

• TLS/HTTPS encryption in transit for all surfaces.
• Passwords stored only as bcrypt hashes; never logged or emailed.
• Multi-tenant isolation enforced at the database layer via PostgreSQL Row-Level Security on every tenant-owned table, with an application-layer scoped-client backstop.
• Role-based access control (4-role RBAC) with owner-gated destructive operations; per-user kill-switch that also severs live sessions.
• Square OAuth tokens encrypted at rest with a dedicated key.
• Login audit trail (IP, time, outcome) for incident reconstruction.
• Rate limiting on authentication endpoints; account and PIN lockouts.
• Structured logging that excludes passwords, tokens, card numbers, and PII.
• Nightly integrity-checked database backups; encrypted, deduplicated off-site replication (client-side encryption — the storage provider never sees plaintext) on a bounded retention ladder.
• TOTP multi-factor authentication required for the KeroIQ platform admin console (enrolment is forced at first sign-in). Operator accounts support TOTP multi-factor sign-in; in-app self-service enrolment is not yet released.
• Documented breach runbook and recovery/restore runbooks.

(No third-party certifications are claimed. This Annex lists real, shipped controls only.)

Exhibit A — Sub-processor List

The current Sub-processor List is published at keroiq.com/subprocessors and forms Exhibit A to this DPA.