Data Processing Addendum

KeystoneIQ is operated by Intellibricks Inc. ("Intellibricks," "we," "us"), a federal corporation incorporated under the Canada Business Corporations Act. This Data Processing Addendum ("DPA") forms part of the Terms of Service between Intellibricks and the customer that accepted them ("Customer," "you"). It describes how we handle personal data that we process for you, and it states only commitments that reflect how KeystoneIQ works today.

Effective date: October 5, 2026 Last updated: October 5, 2026 (revised: scoped to how the Service works today; EU, UK and Swiss transfer terms available on request)

At a glance

• Roles. You decide what data goes into your workspace. We process it only to provide the Service, as your service provider (US state privacy laws, including California) or processor (Canada and elsewhere).
• Never sold, never used for ads, never used to train AI models.
• Sub-processors are listed at keystoneiq.ai/subprocessors.
• EU, UK or Swiss personal data? Email support@keystoneiq.ai and we will discuss transfer terms, including the EU Standard Contractual Clauses, case by case. They do not apply automatically.

1. Definitions

"Customer Personal Data" means personal data that Intellibricks processes on your behalf in providing the Service, including personal data in data you upload, sync from integrations you connect, or enter into the Service. "Privacy Laws" means the privacy laws that apply to that processing, which may include the California Consumer Privacy Act as amended (CCPA), other US state privacy laws, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and Quebec's Act respecting the protection of personal information in the private sector.

2. Roles and scope

2.1 You control what Customer Personal Data enters your workspace and how the Service is configured. Intellibricks processes Customer Personal Data on your behalf, as your service provider or processor.

2.2 This DPA does not cover personal data that Intellibricks handles for its own purposes, such as account, billing and website analytics data. Our Privacy Policy covers that data.

2.3 Annex 1 describes the processing.

3. How we use Customer Personal Data

Intellibricks will:

1. process Customer Personal Data only to provide the Service as described in the Terms of Service and as you configure and use it, unless the law requires otherwise;
2. not sell or share Customer Personal Data, including for cross-context behavioral advertising, and not use it for advertising;
3. not use Customer Personal Data to train AI models. We use AI providers only under API terms that exclude using that data for model training;
4. not retain, use or disclose Customer Personal Data for any purpose other than providing the Service, or outside our direct business relationship with you, except as Privacy Laws allow;
5. not combine Customer Personal Data with personal data we receive from other customers or sources, except as Privacy Laws allow for providing the Service. Each workspace is kept separate;
6. require anyone we authorize to process Customer Personal Data to keep it confidential;
7. tell you if we determine that we can no longer meet our obligations under applicable Privacy Laws.

4. Security

We maintain the measures in Annex 2. We may update them over time, provided the overall level of protection does not decrease.

5. Sub-processors

5.1 We use the sub-processors listed at keystoneiq.ai/subprocessors, under their data processing terms, to provide the Service. We update that page when we add or replace a sub-processor that processes Customer Personal Data.

5.2 If you have a concern about a sub-processor, email support@keystoneiq.ai. If we cannot address it, you may stop using the Service and delete your account.

5.3 Services you choose to connect to your workspace, such as your CRM, call recorder or file storage, are not our sub-processors. They act under their own terms with you.

6. Your requests and our help

6.1 Workspace owners can export workspace data, and you can delete it, from account settings, which lets you respond to access and deletion requests from individuals.

6.2 We will provide reasonable help with other requests from individuals and with your compliance obligations under Privacy Laws, taking into account the nature of the processing and the information available to us.

6.3 On reasonable request, no more than once a year, we will answer a security questionnaire or provide information reasonably necessary to show that we meet this DPA. If you have reasonable grounds to believe Customer Personal Data is being used in a way that this DPA does not allow, tell us and we will work with you to stop and remediate it.

7. Security incidents

We will notify you without undue delay after we become aware of a security incident that affects Customer Personal Data, and share the information you reasonably need to meet your own obligations as it becomes available.

8. Where data is stored

Intellibricks is based in Canada. Customer Personal Data is hosted in the United States, and our sub-processors may process it there.

9. Deletion

When you delete your account, Customer Personal Data in workspaces where you were the only member is deleted within 30 days, and from backups within 90 days, as described in section 9 of our Privacy Policy. Workspace owners can export data first from account settings. Cancelling a paid plan does not delete data. We may keep data where the law requires it, protected under this DPA.

10. EU, UK and Swiss personal data

The Service is offered primarily to customers in North America. If you need to process personal data subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection, email support@keystoneiq.ai before you do. We will discuss data processing and transfer terms, including the EU Standard Contractual Clauses, with you case by case. Those terms apply only once both parties have agreed to them in writing.

11. General

This DPA lasts as long as Intellibricks processes Customer Personal Data for you. The limitations of liability in the Terms of Service apply to this DPA to the extent the law allows. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption: all traffic uses TLS. Integration credentials are encrypted at rest, and data is stored with a hosting provider that encrypts data at rest.
• Isolation: row-level security keeps each workspace's data separate.
• Access control: optional two-factor sign-in is available to every user and, once turned on, is enforced on every sign-in; workspace owners manage members, roles and API keys, and can revoke keys at any time.
• Least privilege for integrations: you choose which sources to connect, with consent per source. Read access by default; we write to your CRM only after you turn on CRM write-back.
• Logging: security-relevant events and API and connector calls are logged and kept for up to 90 days.
• Backups: the database is backed up weekly; backups are encrypted before they leave our infrastructure and are kept for 60 days.
• AI providers: used only under API terms that exclude using Customer data for model training.
• Incident response: containment, investigation, and notification under section 7.