Legal center

Data Processing Addendum

MIAMI POOL CONSULTANTS, DOING BUSINESS AS POOL AI · LAST UPDATED: OCTOBER 2026

1. Scope and roles

This Data Processing Addendum ("DPA") is part of the Terms of Service between Miami Pool Consultants ("MPC") and a business that uses Pool AI Pro ("Company"). It covers the personal data in Customer Data that MPC processes for the Company ("Company Personal Data"). This includes data about:

• the Company's customers;
• its team members;
• people whose emails appear in a connected Inbox;
• visitors to the Company's Pool AI website.

For this data, the Company decides why and how the data is used (it is the "business" or "controller"), and MPC processes it on the Company's behalf (MPC is the "service provider" or "processor").

This DPA doesn't cover data that MPC controls itself, for example a homeowner's own use of the Pool AI app, Company owners' account and billing details, and website analytics. Our Privacy Policy covers that data.

2. Processing only on your instructions

• MPC processes Company Personal Data only to provide, secure, support and improve the Services, as the Terms describe, and on the Company's documented instructions. The Terms, this DPA and the Company's settings and actions in Pool AI Pro are those instructions.
• MPC won't sell or share Company Personal Data, and won't use it for targeted advertising.
• MPC won't keep, use or disclose it outside the direct business relationship with the Company, except as the law allows for service providers.
• MPC won't combine it with personal data from other sources, except as needed to provide the Services or as the law allows.
• MPC won't use it to train AI models.
• If MPC believes an instruction breaks the law, it will tell the Company.

3. The Company's responsibilities

The Company:

• has a lawful basis to collect Company Personal Data and give it to MPC;
• gives the notices the law requires and gets any consents it requires, for example telling technicians about location tracking, and telling customers about payments and messages;
• handles requests from its customers and staff to see, correct or delete their data, with MPC's help (section 6).

4. Confidentiality and security

Everyone at MPC who can access Company Personal Data is bound by confidentiality and has access only when their job needs it. MPC maintains reasonable technical and organizational security measures, as summarized on our Security page, including:

• encryption in transit (HTTPS with HSTS);
• hashed passwords and sign-in tokens;
• encrypted integration tokens;
• role-based access and separation between companies;
• encrypted, verified backups;
• audit and error logs.

MPC may update these measures as long as overall protection doesn't go down.

5. Sub-processors

• The Company authorizes MPC to use the sub-processors listed on Services we use, for example hosting, email, AI, payments, maps and the integrations the Company chooses to connect.
• MPC requires each sub-processor to protect data at least as well as this DPA requires, and MPC remains responsible for them.
• MPC will update that page at least 14 days before adding a new sub-processor, except in an emergency.
• If the Company has a reasonable data-protection objection, it may object by email. If we can't resolve the objection, the Company may cancel the affected service without penalty.

6. Help with requests and assessments

If MPC receives a privacy request from one of the Company's customers or team members, MPC will pass it to the Company and won't answer it directly, unless the law requires otherwise. Taking into account what the Services can do, MPC will reasonably help the Company:

• answer access, correction, deletion and similar requests;
• meet its security obligations;
• carry out any privacy assessment the law requires.

7. Security incidents

If MPC confirms a breach of security that leads to unauthorized access to, or loss of, Company Personal Data, MPC will:

• notify the Company owner without undue delay, aiming for within 72 hours of confirming it;
• say what happened, what data was involved, what MPC has done, and what the Company should do;
• update the Company as more is learned;
• reasonably help the Company meet its own legal duties, for example notices to customers under state breach laws.

Telling the Company about an incident doesn't mean MPC accepts fault.

8. Return and deletion

While the account is active, the Company can export its customer list in Pool AI Pro and ask MPC for a copy of its other records. After the account ends, MPC:

• keeps Company Personal Data for at least 90 days so the Company can still get it;
• after that, deletes it (or makes it impossible to identify anyone) when the Company asks, or when MPC removes inactive accounts;
• keeps only what the law requires it to keep.

Copies in encrypted backups are deleted as the backups age out, normally within 30 days.

9. Audits and information

MPC will answer reasonable written security questionnaires once a year, or after an incident. MPC doesn't hold third-party security certifications at this time. Any on-site audit must be agreed in writing in advance, at the Company's cost, and must not expose other customers' data.

10. Location of data and transfers

Company Personal Data is hosted in the United States. Some sub-processors may process data in other countries, as listed on Services we use. Before Pool AI is offered outside the United States, MPC will add the transfer terms that region requires.

11. Order of precedence

If this DPA conflicts with the Terms about personal data, this DPA controls. The limits of liability in the Terms apply to this DPA, unless the law doesn't allow it.