Archived version effective October 13, 2026 (version 2026-10-13). This copy never changes; agreements that incorporate version 2026-10-13 are governed by it. The current version is at northreeve.com/dpa. All versions: northreeve.com/legal/archive.

Data Processing Addendum

Last updated: October 13, 2026

This Data Processing Addendum ("DPA") is entered into between NorthReeve Software LLC ("NorthReeve", "we", "us", or the "Processor") and the customer that accepts the NorthReeve Terms of Service (the "Customer", "you", or the "Controller"). This DPA is incorporated into and forms part of the Agreement described in the Terms of Service (the "Terms"). If there is a conflict between this DPA and the rest of the Agreement on the processing of personal information, this DPA controls. If the parties sign a separate data processing addendum, that addendum controls on its own subject matter. Capitalized terms not defined here, including "Agreement", "Order", "Services", "Product", and "Product Schedule", have the meanings given in the Terms.

This DPA governs NorthReeve's processing of personal information that the Customer submits to or generates within the Services: any NorthReeve software product or service the Customer uses, including ServiceAven (formerly Glide by Blade), GetLibre PBX, and the other hosted products described in the Product Schedules of the Terms, and custom software developed under a Statement of Work. NorthReeve acts only as a service provider and processor for that data; the Customer is the business and controller and determines the purposes and means of processing.

1. Definitions

"Applicable Data Protection Law" means all US federal and state privacy and data protection laws applicable to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA") and its regulations, and the comprehensive privacy laws of other US states as they apply. "Customer Personal Data" means personal information within Customer Data that NorthReeve processes on the Customer's behalf under the Agreement. "Personal Data", "personal information", "business", "service provider", "contractor", "third party", "sell", "share", "process", and "consumer" have the meanings given under Applicable Data Protection Law. "Sub-processor" means a third party engaged by NorthReeve to process Customer Personal Data. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by NorthReeve.

2. Roles of the parties

As between the parties, the Customer is the business and controller of Customer Personal Data, and NorthReeve is the service provider and processor. NorthReeve processes Customer Personal Data only on the Customer's documented instructions, which include the Agreement, this DPA, and the Customer's configuration and use of the Services. The Customer is responsible for the accuracy of Customer Personal Data and for having a lawful basis and any required notices or consents to collect it and to have NorthReeve process it, including any consents required for calls, text messages, call recordings, and email as described in the Terms.

3. Scope, nature, and purpose of processing

The subject matter of the processing is NorthReeve's provision of the Services. The nature and purpose of processing is to host, operate, secure, support, and provide the features of the Services, which vary by Product and are described in the applicable Product Schedule or Statement of Work, and may include scheduling and routing, field applications, invoicing and payments, telephony and messaging, email and marketing, chat, leads and CRM, property measurement from aerial or satellite imagery, AI-assisted features, data migration, backups, and related functions. Processing continues for the term of the Agreement and the periods described in Section 10.

Categories of data subjects

The Customer's own customers, prospects, and leads
The Customer's owners, office staff, field technicians, and other authorized users
Other individuals whose information the Customer chooses to enter into the Services

Categories of Customer Personal Data

Depending on the Products the Customer uses and the features it enables, Customer Personal Data may include:

Identifiers and contact details (name, mailing and service address, email, phone number)
Account, scheduling, service history, and property information, including measurements derived from aerial or satellite imagery where a Product includes them
Field and operational data, including job notes, photographs, barcode scans, and crew GPS and live location while on duty, where a Product includes those features
Financial and billing data, including invoices, statements, payment card tokens, and ACH or eCheck details processed through the payment processor
Communications data, including call recordings, transcripts, and metadata, voicemail, SMS and MMS content and metadata, email content, and chat messages, where a Product includes communications features
Registered 911 dispatchable locations for numbers, extensions, and devices, where a Product includes calling
Records migrated from a prior system of record
User credentials and role-based access information
For custom software developed under a Statement of Work, the categories described in that Statement of Work

NorthReeve does not intend for the Services to be used to process special categories of sensitive data beyond what is described above. The Customer is responsible for not submitting data outside these categories without first agreeing appropriate terms with NorthReeve.

4. NorthReeve's processing obligations

NorthReeve will:

Process Customer Personal Data only on the Customer's documented instructions and only as needed to provide and support the Services, and not for any other purpose;
Not "sell" or "share" Customer Personal Data, and not retain, use, or disclose it for any purpose other than the specific business purposes of providing the Services, or as otherwise permitted by Applicable Data Protection Law;
Not combine Customer Personal Data with personal information NorthReeve receives from or on behalf of any other person, or collects from its own interaction with a consumer, except as permitted by Applicable Data Protection Law to perform a business purpose;
Comply with its obligations as a service provider and processor under Applicable Data Protection Law and provide the same level of privacy protection as is required of the Customer;
Promptly inform the Customer if NorthReeve determines it can no longer meet its obligations under Applicable Data Protection Law, and, in that case, allow the Customer to take reasonable steps to stop and remediate unauthorized use;
Grant the Customer the right to take reasonable and appropriate steps, as described in Section 9, to help ensure that NorthReeve uses Customer Personal Data consistent with the Customer's obligations.

5. Confidentiality

NorthReeve will treat Customer Personal Data as the Customer's confidential information, will limit access to personnel who need it to provide the Services, and will ensure those personnel are bound by appropriate confidentiality obligations and are trained on their data protection responsibilities.

6. Security measures

NorthReeve will implement and maintain reasonable and appropriate technical and organizational measures designed to protect Customer Personal Data against a Security Incident, taking into account the nature of the data and the risks. These measures include, at a minimum:

Encryption of data in transit using HTTPS and TLS, and encryption of backups at rest;
Role-based access controls and the principle of least privilege for personnel and users of the Services;
Authentication controls and protection of credentials and secrets;
Network and application security controls, logging, and monitoring;
Nightly encrypted backups and documented restoration procedures;
Vulnerability management and timely application of security updates;
Personnel confidentiality obligations and security awareness practices.

The Customer is responsible for the security of its own account, including managing its users and roles, protecting its login credentials, and configuring the Services appropriately.

7. Sub-processors

The Customer provides NorthReeve general authorization to engage Sub-processors to help provide the Services. Which Sub-processors are used depends on the Products the Customer uses; the specific services each Product sends data to are listed per product in the Privacy Policy, and NorthReeve will provide the current list for a Product before the Customer begins production use of it. NorthReeve engages the following categories of Sub-processor:

Category	Function
Cloud hosting and infrastructure	Hosting of the Services, databases, and encrypted backups
Telephony and messaging providers	Business phone, voice, and two-way SMS and MMS features
Email delivery provider	Transactional and marketing email sending
Payment processor and accounting integration	Card and ACH payment processing and QuickBooks Online sync
Maps and aerial or satellite imagery provider	Routing, mapping, and property measurement
Object storage provider	Encrypted storage of documents, photos, and recordings
AI and transcription service providers	AI-assisted features such as detection and measurement, chat assistance, transcription, and pricing suggestions
Analytics and error monitoring	Reliability and performance of the Services

NorthReeve will impose data protection obligations on each Sub-processor that are substantially the same as those in this DPA, and NorthReeve remains responsible for its Sub-processors' performance. NorthReeve will maintain a current list of Sub-processors and will give the Customer at least thirty (30) days' notice before adding or replacing a Sub-processor that processes Customer Personal Data. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Services as its exclusive remedy.

8. Assistance with data-subject requests and compliance

Taking into account the nature of the processing, NorthReeve will provide reasonable assistance to enable the Customer to respond to verifiable requests from consumers to exercise their rights under Applicable Data Protection Law, including rights to know, access, correct, delete, and obtain a portable copy, and to honor opt-out and limitation requests. Where NorthReeve receives a request directly from a consumer relating to Customer Personal Data, NorthReeve will not respond directly except to direct the consumer to the Customer, and will promptly inform the Customer. NorthReeve will also provide the Customer reasonable assistance with data protection impact or risk assessments and consultations to the extent required by Applicable Data Protection Law and relevant to the Services.

9. Audits and verification

NorthReeve will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. No more than once per twelve (12) month period, and on reasonable prior written notice, the Customer may take reasonable and appropriate steps to verify NorthReeve's compliance, which may be satisfied by NorthReeve providing responses to a reasonable written security questionnaire and any then-current audit reports or certifications. Any on-site review must be at reasonable times, must not unreasonably disrupt NorthReeve's operations, must be subject to confidentiality obligations, and must not require NorthReeve to disclose data of other customers or information that would compromise security.

10. Return and deletion on termination

On expiration or termination of the Agreement or a Subscription, NorthReeve will, at the Customer's choice, make Customer Personal Data available for export during the Export Period stated in the Terms (90 days unless the Order states otherwise), and thereafter will delete or de-identify Customer Personal Data in its production systems within a commercially reasonable period, except for copies retained in routine backups (which are deleted on the ordinary backup cycle) or as required to be retained by law. During any retention of residual copies, this DPA continues to apply.

11. Security Incident notification

NorthReeve will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed to address it. NorthReeve will take reasonable steps to mitigate and remediate the incident and will reasonably cooperate with the Customer's investigation. As the controller, the Customer is responsible for determining whether and how to notify affected individuals and authorities. NorthReeve's notice is not an acknowledgment of fault or liability.

12. Service provider certification (CCPA)

NorthReeve certifies that it understands the restrictions in Section 4 and this DPA and will comply with them. NorthReeve is a service provider that receives Customer Personal Data solely to perform the services described in the Agreement. NorthReeve does not sell or share Customer Personal Data, does not retain, use, or disclose it outside the direct business relationship or for any purpose other than the business purposes specified, and does not combine it with personal information from other sources except as permitted by Applicable Data Protection Law.

13. International transfers

NorthReeve processes and stores Customer Personal Data in the United States. The Services are intended for use by US-based businesses and their US operations. If the Customer chooses to submit personal data originating outside the United States, the Customer is responsible for ensuring it may lawfully transfer that data to the United States for processing under this DPA, and the parties will cooperate in good faith to put in place any additional transfer terms then required by law.

14. General

This DPA is governed by the same law and dispute resolution provisions as the Terms. Except as this DPA provides, the rest of the Agreement remains in full force and effect. If any provision of this DPA is held invalid, the remainder continues in effect. This DPA takes effect when the Agreement does and continues for as long as NorthReeve processes Customer Personal Data.

15. Contact

Data protection questions and notices under this DPA: forms@northreeve.com or sales@northreeve.com.