Draft for legal review. This addendum is not yet in effect. Until a lawyer approves it, ask us for the terms that apply to your company.

Data Processing Addendum

Last updated October 30, 2026

This addendum is part of the Terms of Service between Porter Solutions LLC (“we”, “Processor”) and the business that uses Hawk Aerie (“Customer”). It applies to personal information in Customer Data that we process for Customer. Where it conflicts with the terms, this addendum wins for personal information.

1. Roles

Customer decides why and how personal information in Customer Data is processed and is the business (controller) for it. We process it only on Customer’s behalf, as Customer’s service provider (processor). Customer is responsible for having a lawful basis and giving any notices its employees, clients and others are owed, including notices about time-clock location and recordings.

2. What we process

• People: Customer’s Users (employees and others working for Customer); Customer’s clients and their contacts; people who appear in photos, videos or recordings.
• Information: names, work and client contact details, addresses, roles, time records and clock locations, photos, videos and recordings and their transcripts, notes, documents, access codes, and technical logs.
• Sensitive information: Aerie isn’t designed for health, financial-account, government-ID or biometric information, and Customer shouldn’t put it in Aerie except as incidental content of its work records. Aerie doesn’t identify people by face or voice.
• Purpose and duration: to provide, secure and support Aerie under the terms, for as long as Customer uses Aerie and the export window after.

3. Customer’s instructions

We process personal information only on Customer’s documented instructions: the terms, this addendum, and Customer’s choices in Aerie (for example its settings, the features it turns on, and the services it connects). We’ll tell Customer if we believe an instruction breaks the law. We may process it otherwise only where the law requires us to, and then we’ll tell Customer first unless the law forbids it.

4. Service provider terms (California and similar laws)

Where the California Consumer Privacy Act or a similar US state law applies, we act as Customer’s service provider (or processor) and:

• won’t sell or share personal information, as those laws define it;
• won’t retain, use or disclose it for any purpose other than the business purposes in Section 2, including any commercial purpose other than providing Aerie, or outside our direct business relationship with Customer;
• won’t combine it with personal information we receive from others or collect ourselves, except as those laws allow;
• will comply with those laws and give the same level of privacy protection they require, and tell Customer if we can no longer meet them;
• allow Customer to take reasonable steps to stop and remediate unauthorized use.

5. Confidentiality

Only people who need personal information to provide Aerie can access it, and they’re bound to keep it confidential. Our own access to a customer’s records, for support, is limited to what the support request needs.

6. Security

We keep appropriate technical and organizational measures, including:

• encryption in transit (HTTPS with HSTS) and at rest (by our hosting providers);
• separation of each customer’s records enforced by the database, and role-based permissions within a customer;
• sign-in by emailed code, an authenticator second step, and sessions that end after a week without use;
• access codes shown only to people who need them, with every view logged;
• an activity log of changes; nightly encrypted off-site backups locked against deletion for 30 days;
• least-privilege access to production systems, with production changes approved one by one;
• regular security review of code and settings.

7. Subprocessors

• Customer authorizes the subprocessors listed on our subprocessors page. Those marked “if you use it” receive information only when Customer uses that feature or connects that service.
• Each subprocessor is bound by written terms that protect personal information at least as well as this addendum does, as far as its part requires. We remain responsible for our subprocessors.
• We’ll update the page and tell Customer’s admins by email at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds within that time; if we can’t address the objection, Customer may end the affected part of Aerie and get a refund of prepaid fees for it.

8. Requests from people

Aerie lets Customer’s admins see, correct, export and delete personal information, and lets Users ask for their account to be deleted. If someone sends us a request about Customer Data, we’ll pass it to Customer and won’t answer it ourselves unless Customer asks us to or the law requires it. We’ll help Customer answer requests it can’t handle in Aerie.

9. Security incidents

• We’ll notify Customer without undue delay, and in any case within 72 hours, after we become aware of a breach of security leading to unauthorized access to, or loss, change or disclosure of, Customer’s personal information.
• Where Idaho law applies and misuse of an Idaho resident’s personal information has occurred or is reasonably likely, we’ll give that notice immediately and cooperate with Customer, as Idaho Code § 28-51-105(2) requires of a business that maintains information it doesn’t own.
• The notice will say what happened, what information and people are affected (as far as known), what we’ve done and recommend, and who to contact. We’ll update it as we learn more and help Customer meet its own notification duties. Notifying people and regulators is Customer’s decision unless the law requires us to.

10. Help with assessments

We’ll give Customer the information it reasonably needs about our processing for its own privacy assessments and to show compliance with this addendum, including answers to reasonable security questionnaires once a year.

11. Deletion and return

When Customer’s use of Aerie ends, Customer can download its data for 30 days (terms, Section 10). After that we delete personal information in Customer Data from Aerie, and the encrypted backup copies expire within a year, unless the law requires us to keep it.

12. Where it’s processed

Customer Data is stored in the United States and North America. Some subprocessors may process information elsewhere under their own safeguards, as listed on the subprocessors page.

Contact

Privacy questions: privacy@hawkaerie.app. Porter Solutions LLC, Idaho.