Data Processing Addendum

Last updated: October 19, 2026

This Addendum forms part of the Terms of Service between REXOR GROUP LLC ("Processor") and the customer ("Controller"). It applies to personal data that the Processor processes on the Controller's behalf when running its closer ("Customer Data").

1. Subject, duration and nature

• Subject: replying to the Controller's prospects on the agreed channels, qualifying them, handing over to the Controller's team and reporting.
• Data subjects: people who contact the Controller through those channels.
• Data: names, contact details, message contents and any information they choose to share. The Controller instructs its closer not to request sensitive data, card numbers, passwords or identity documents.
• Duration: the term of the subscription, plus the deletion period below.

2. Processor obligations

• Process Customer Data only on the Controller's documented instructions, including these Terms and its knowledge sheet, unless the law requires otherwise (in which case the Processor informs the Controller, unless prohibited).
• Ensure that anyone authorised to process Customer Data is bound by confidentiality.
• Apply appropriate security measures, including encryption in transit, access control, logging and limited retention.
• Not sell or share Customer Data, not use it for its own purposes, and not use it to train AI models.
• Help the Controller respond to requests from data subjects and with its security and impact assessments, as far as reasonably possible.
• Notify the Controller without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information available.
• At the end of the service, delete Customer Data within 30 days, or return it if the Controller asks before then, unless the law requires it to be kept.
• Make available the information reasonably needed to demonstrate compliance with this Addendum.

3. Sub-processors

The Controller authorises the Processor to use the following sub-processors: Cloudflare (hosting, network), DigitalOcean (servers), OpenRouter, DeepInfra and Parasail (AI model routing and inference), Stripe (payments), an email delivery provider, and Telegram (for the Telegram channel). The Processor imposes data protection obligations on them that are no less protective than this Addendum. It gives at least 14 days' notice before adding or replacing a sub-processor; the Controller may object on reasonable grounds and, if no solution is found, cancel without charge.

4. International transfers

Customer Data may be processed in the United States and accessed remotely by the Processor's team, including from the Philippines. The Processor applies the protections of this Addendum wherever the data is processed.

5. Regional terms

• United States (California): the Processor acts as a "service provider". It does not sell or share Customer Data, does not retain, use or disclose it outside the direct business relationship with the Controller, and does not combine it with other data except as permitted by law.
• Singapore: the Processor acts as a "data intermediary" and complies with its protection, retention and breach notification obligations.
• Australia: the Processor handles Customer Data consistently with the Australian Privacy Principles that apply to the Controller.

6. Liability

Liability under this Addendum is subject to the limits in the Terms of Service.