Data Processing Agreement (DPA)

Effective Date: May 16, 2026 Last Updated: October 17, 2026 Version: 1.8.1 (reconciled with Terms of Service v1.10.0 + Privacy Policy v1.10.1 — v1.8.1 [2026-10-17]: §4.1a Sign in with Apple also authenticates the landlord at signup in the iPhone app. v1.8.0 [2026-10-16]: §4.1b Apple bills subscriptions bought in the ClearDeduct iPhone app (App Store), processes only the Customer's own billing data and is not a Sub-processor under this DPA; §3.2 no download period on termination for cause; §3.4 precise geolocation cites Cal. Civ. Code §1798.140(ae)(1)(C); §4.3 how a Customer who objects to a new Sub-processor ends the subscription, and the refund for each place of purchase; §7.1 security measures include the password checks of Privacy Policy §9. v1.7.0 [2026-09-24]: the Processor is named, Efkan Turen, doing business as ClearDeduct (preamble), with a mailing address (§12); §4.1 cites CPRA §1798.140(ag)(2); §7.1 security measures match Privacy Policy §9. v1.6.0 [2026-09-24]: §2.2(b) the tenant notice no longer has to name ClearDeduct; §4.1 sub-processor list matches the Service (no Android push provider; Stripe and PostHog are not Sub-processors of Tenant Personal Data, new §4.1b); §4.1a Sign in with Apple is also in the iPhone app. v1.5.0 [2026-09-24]: Tenant Personal Data is processed while the Customer's plan is active and deleted 60 days after it ends (30 days after an account deletion); the four-year post-termination archive and the §1798.105(d)(8) override are withdrawn (§3.2, §5.3, §7.3, §10.1). v1.4.0 [2026-09-23]: coordinated bump, no DPA text change. v1.3.0 [2026-09-23]: coordinated bump, no DPA text change; v1.2.0 corrects the retention basis in §3 and §9 [BUG-112, 2026-09-22]: photographs are required by Civil Code §1950.5(g)(1)–(2), the four-year period is Cal. Code Civ. Proc. §337; v1.1.0 added 5G.31 scope-clarification for Sign in with Apple + Sign in with Google identity providers — these handle landlord identity only, NOT Tenant Personal Data, so the §4 sub-processor obligations do not contractually apply to them)

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service entered into between you ("Customer," "Controller," or "you") and Efkan Turen, doing business as ClearDeduct ("ClearDeduct," "we," "us," "Processor," or "Service Provider"). It governs the processing of Personal Data that you, acting as Controller, upload to or generate through the ClearDeduct Service (the "Service") concerning your tenants and other third-party data subjects.

By accepting the Terms of Service at signup, you accept this DPA. If you require a signed counter-party version, contact privacy@cleardeduct.com with subject line "DPA Request".

1. Definitions

For the purposes of this DPA, the following terms have the meanings set out below. Capitalized terms not otherwise defined in this DPA have the meanings given to them in the Terms of Service.

• "Applicable Data Protection Law" means all data-protection and privacy laws applicable to the processing of Personal Data under this DPA, including but not limited to: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"); the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK Data Protection Act 2018 and UK GDPR ("UK GDPR"); and California Assembly Bill 2801 / Civil Code §1950.5(g) ("AB 2801").
• "Controller" (under GDPR) and "Business" (under CCPA/CPRA) mean the entity that determines the purposes and means of processing Personal Data. For Tenant Personal Data uploaded through the Service, you are the Controller / Business.
• "Processor" (under GDPR) and "Service Provider" (under CCPA/CPRA) mean the entity that processes Personal Data on behalf of the Controller. ClearDeduct is the Processor / Service Provider for Tenant Personal Data.
• "Personal Data" has the meaning given to "personal data" under GDPR and "personal information" under CCPA/CPRA, and includes Sensitive Personal Information ("SPI") such as the precise geolocation embedded in photograph EXIF metadata.
• "Tenant Personal Data" means Personal Data of your tenants and other natural persons whose information you upload to the Service (including names, contact details, lease dates, photographs of dwellings, deduction descriptions).
• "Sub-processor" means any third party engaged by ClearDeduct to process Tenant Personal Data on our behalf.
• "Data Subject Request" means a verifiable request submitted by a data subject (typically a tenant) exercising rights granted under Applicable Data Protection Law (e.g., right to know, delete, correct, opt-out, limit).
• "Personal Data Breach" has the meaning given to that term under GDPR Article 4(12) and California Civil Code §1798.82 (as amended by Senate Bill 446).

2. Scope and Roles

2.1 Bifurcated Roles

For Personal Data processed under this Agreement, the parties acknowledge the following bifurcated role allocation:

This DPA exclusively governs the second category. Processing of Customer Account Data is governed by ClearDeduct's Privacy Policy.

2.2 Lawful Basis

You represent and warrant that:

• (a) You have a lawful basis under Applicable Data Protection Law to upload Tenant Personal Data to the Service;
• (b) Where required, you have given tenants notice that their personal information is collected for the AB 2801 documentation purpose and may be processed by service providers such as ClearDeduct;
• (c) You have established the legal and contractual relationships with your tenants necessary to enable ClearDeduct's processing under this DPA.

3. Description of Processing

3.1 Subject Matter

ClearDeduct processes Tenant Personal Data to deliver the Service: documenting rental-unit condition through timestamped/geolocated photographs, generating AB 2801 compliance reports, tracking the 21-day security-deposit deadline, and securely sharing reports with tenants per Customer instructions.

3.2 Duration

The processing duration is the term of the Customer's subscription, plus the sixty (60) day download period after the plan ends (thirty (30) days after an account deletion; no download period on termination for cause, Terms of Service §8.2) described in Terms of Service §4.5 and §8.1. While the plan is active, photographs are kept until four (4) years after the tenancy's move-out (the limitations period for written-contract claims under Cal. Code Civ. Proc. §337) and then deleted within thirty (30) days.

3.3 Nature and Purpose

The nature of processing includes: collection, organization, structuring, storage, retrieval, generation of derivative documents (AB 2801 reports), transmission to tenants (via secure share links), and erasure. The purpose is solely to enable the Customer to fulfill its obligations under California AB 2801 and related landlord-tenant law.

3.4 Categories of Personal Data

3.5 Categories of Data Subjects

Natural persons whose Personal Data is processed under this DPA are: (i) tenants of residential rental properties managed by the Customer, and (ii) other natural persons whose images may incidentally appear in property photographs.

4. Sub-Processors

4.1 General Authorization

You grant ClearDeduct general written authorization under GDPR Article 28(2) and CPRA §1798.140(ag)(2) to engage the Sub-processors listed in Privacy Policy §5.1 (and incorporated by reference in Terms of Service §16.1) to process Tenant Personal Data on your behalf.

The current Sub-processor list, with purposes and locations, is maintained in Privacy Policy §5.1. As of the Effective Date, the Sub-processors are: Supabase (database / storage / authentication), Resend (transactional email), Vercel (web hosting), Expo / Apple APNs (push notifications), Sentry (crash reporting), and Cloudflare (DNS / email routing). Stripe, Apple (App Store) and PostHog are not Sub-processors of Tenant Personal Data (§4.1b).

4.1a Identity Provider Scope Exclusion

Privacy Policy §5.1 additionally discloses two identity sub-processors — Sign in with Apple (Apple Inc.) and Sign in with Google (Google LLC) — that authenticate the landlord at signup and login in the iPhone app (Apple) and on cleardeduct.com (Apple and Google). These identity providers do not process Tenant Personal Data under any circumstance; their scope is strictly limited to landlord email address, display name (as transmitted by the provider at OAuth handshake), and standard OAuth/OIDC authentication artifacts (PKCE codes, ID tokens, refresh tokens).

Accordingly, the Sub-processor obligations enumerated in §4.2 below (written data-protection agreements, liability flow-down, processing-purpose restrictions, breach notification, etc.) are designed for and apply to Sub-processors that handle Tenant Personal Data. They are not contractually applicable to Apple's or Google's identity verification services, which are governed instead by each provider's own published terms (Apple — developer.apple.com/sign-in-with-apple; Google — developers.google.com/identity) and by Privacy Policy §5.1a. Sign-In with Apple / Google is also entirely optional — landlords may always create accounts using email + password without invoking either identity provider.

4.1b Billing and Analytics Providers (Stripe, Apple, PostHog)

Privacy Policy §5.1 also discloses Stripe (subscription billing on the website), Apple (App Store billing of subscriptions bought in the iPhone app) and PostHog (product analytics in the iPhone app). Stripe and Apple process only the Customer's own billing data; PostHog receives app usage events linked to a random account ID, without names, email addresses, property addresses, photographs or tenant information. None of them processes Tenant Personal Data, so they are not Sub-processors under this DPA and §4.2 does not apply to them (Privacy Policy §5.1b).

4.2 Sub-processor Obligations

ClearDeduct will:

• (a) Enter into a written agreement with each Sub-processor that imposes data-protection terms no less protective than those of this DPA;
• (b) Remain liable to you for the acts and omissions of Sub-processors that breach the terms of their engagement;
• (c) Prohibit each Sub-processor from selling, sharing, or using Tenant Personal Data for cross-context behavioral advertising, profiling, or proprietary model training.

4.3 Notification of Changes and Right to Object

ClearDeduct will notify you (via email or in-app notification) at least fourteen (14) days prior to adding or replacing a Sub-processor that handles Tenant Personal Data. You may object on legitimate data-protection grounds within that 14-day period. If ClearDeduct cannot reasonably accommodate your objection, your sole and exclusive remedy is to end your subscription before the new Sub-processor processes your data, by cancelling it (Terms of Service §4.6) or closing your account (Terms of Service §8.1) and telling us at privacy@cleardeduct.com. We then refund prepaid, unused website subscription fees as for a termination for convenience (Terms of Service §8.2); for an App Store subscription, you can request a refund from Apple at reportaproblem.apple.com.

5. Data Subject Rights Assistance

5.1 General

Taking into account the nature of the processing, ClearDeduct will assist you, by appropriate technical and organizational measures, in fulfilling your obligation to respond to Data Subject Requests under Applicable Data Protection Law (including CCPA/CPRA §§1798.100 et seq. and GDPR Articles 12–22).

5.2 Procedure

If ClearDeduct receives a Data Subject Request directly from one of your tenants, ClearDeduct will:

• (a) Promptly inform you of the request (within five business days);
• (b) Not respond to the request directly unless instructed by you or required by law;
• (c) Provide the technical means (in-app export and deletion tools, manual extraction if needed) to enable you to respond within statutory deadlines (CCPA: 45 days; GDPR: 30 days).

5.3 Tenant Deletion Requests

ClearDeduct does not decline a tenant's deletion request on the Customer's behalf. It forwards the request to the Customer, who decides — as the business that collected the data — whether an exception applies (for example, records the Customer needs for a pending deposit dispute) and, if not, deletes the data with the Service's tools or instructs ClearDeduct to delete it.

6. Personal Data Breach Notification

6.1 ClearDeduct's Obligations

ClearDeduct will notify you of any confirmed Personal Data Breach affecting Tenant Personal Data without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach.

The notification will contain (to the extent then known):

• (a) The nature of the breach, including the categories and approximate number of data subjects and records affected;
• (b) The likely consequences of the breach;
• (c) The measures taken or proposed to address the breach and mitigate its effects;
• (d) The contact details of ClearDeduct's privacy team (privacy@cleardeduct.com) for further information.

6.2 California Statutory Timelines

Where the breach falls within the scope of California Civil Code §1798.82 (as amended by Senate Bill 446, effective January 1, 2026):

• ClearDeduct will assist you in providing notification to affected California residents within the statutory thirty (30) calendar day consumer-notification window;
• Where the breach affects more than 500 California residents, ClearDeduct will assist you with the fifteen (15) calendar day submission to the California Attorney General following consumer notification.

6.3 GDPR Statutory Timelines

Where the breach falls within the scope of GDPR Article 33, ClearDeduct's 72-hour notification to you supports your separate obligation to notify the competent supervisory authority within 72 hours.

7. Security, Confidentiality, and Data Return / Destruction

7.1 Security Measures

ClearDeduct will implement and maintain appropriate technical and organizational security measures consistent with industry standards and Applicable Data Protection Law, including those described in Privacy Policy §9 (encryption in transit and at rest, database ownership rules with server-only writes to evidence records, limited access to production systems, dependency checks for known security advisories, password checks).

7.2 Personnel Confidentiality

ClearDeduct will ensure that personnel authorized to process Tenant Personal Data are bound by appropriate confidentiality obligations (whether by contract or statute).

7.3 Return / Destruction at End of Processing

Upon termination of the Customer's subscription, the data destruction protocol is governed by Terms of Service §4.5 (Data Lifecycle), §8.1 (account deletion) and §8.2 (Termination): the Customer may download all Tenant Personal Data for sixty (60) days after the plan ends (thirty (30) days after an account deletion; no download period on termination for cause), after which ClearDeduct permanently deletes it, including from Storage. Backups expire within thirty (30) days of deletion.

7.4 Audit Rights

ClearDeduct will make available to the Customer, on reasonable request and no more frequently than once per calendar year, information necessary to demonstrate compliance with this DPA. ClearDeduct may satisfy this obligation by providing third-party audit reports (such as Supabase's SOC 2 or equivalent reports for our infrastructure providers) or, where reasonably necessary, by permitting a Customer-conducted audit subject to mutually agreed terms (including confidentiality, scope limitations, and reimbursement of reasonable costs).

8. International Data Transfers

The Service is operated from the United States. Tenant Personal Data may be transferred to and processed in the United States and other jurisdictions where Sub-processors operate (see Privacy Policy §6).

For transfers originating from the EEA, UK, or Switzerland, ClearDeduct relies on the European Commission's Standard Contractual Clauses (2021/914/EU) and, where applicable, the UK International Data Transfer Addendum, supplemented with the technical safeguards described in §7.1 above. By accepting this DPA, the Customer (acting on behalf of any EEA / UK / Swiss data subjects whose Personal Data the Customer uploads) agrees to be bound by Module Two (Controller-to-Processor) of the SCCs as incorporated herein by reference.

9. Liability and Limitations

9.1 Limitation of Liability

The liability of each party under this DPA is subject to the Limitation of Liability set forth in Terms of Service §14, including the statutory carve-outs under California Civil Code §1668 for gross negligence, willful misconduct, fraud, and personal injury.

9.2 Customer Indemnification

The Customer indemnification obligations set forth in Terms of Service §15 apply to claims arising from or relating to the Customer's processing of Tenant Personal Data, including but not limited to:

• (a) The Customer's failure to provide statutorily required notices to tenants;
• (b) The Customer's failure to obtain necessary consents prior to uploading Tenant Personal Data;
• (c) Any claim by a tenant that Customer's use of the Service infringed the tenant's privacy rights;
• (d) The Customer's bad-faith security-deposit deductions or evidentiary fabrication.

10. Term, Termination, and Survival

10.1 Term

This DPA is effective upon the Customer's acceptance of the Terms of Service and remains in effect for the duration of the Customer's subscription and until the Tenant Personal Data is deleted under §7.3.

10.2 Survival

The provisions of this DPA that by their nature should survive termination of the Customer's subscription (including but not limited to §6 Personal Data Breach Notification, §7.3 Return / Destruction, §7.4 Audit Rights, §9 Liability) expressly survive the termination of the Customer's subscription until the underlying Tenant Personal Data is legally and permanently destroyed in accordance with §7.3 and Privacy Policy §7.1.

This survival is reinforced by Terms of Service §8.3 (Effect of Termination and Survival of Obligations).

11. Order of Precedence

In the event of any conflict between this DPA and the Terms of Service or Privacy Policy with respect to the processing of Tenant Personal Data, this DPA shall prevail. In all other respects, the Terms of Service control.

12. Notices and Counter-Party Execution

For matters arising under this DPA (including Data Subject Requests, Sub-processor objections, breach notifications, audit requests), contact privacy@cleardeduct.com. Written notices: Efkan Turen, doing business as ClearDeduct, 5040 Haven Place #302, Dublin, CA 94568, USA.

If you require a counter-party-signed copy of this DPA for your records or for enterprise procurement review, request via the same email with subject line "Signed DPA Request". ClearDeduct will deliver a signed counter-party version within ten (10) business days following review.

This Data Processing Agreement is provided in English. Translations are for convenience only; the English version controls in the event of any discrepancy.