ClarityCommand Service™

1. Introduction

Nitty Gritty Powerwashing & Mobile Services, LLC d/b/a JoMar Business Solutions ("JoMar," "we," "us," or "our") operates ClarityCommand Service™, a field service operations and business management platform accessible at portal.jomarbusinesssolutions.com. ClarityCommand Service™ is designed for business owners and operators managing jobs, crew, clients, vendors, finances, payroll records, bids, and business growth — all in one place.

By creating an account, you acknowledge that you have read and agree to this Privacy Policy. JoMar Business Solutions operates nationally, serving business clients across the United States.

2. Legal Framework & Compliance

We maintain a written information security program that includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of business and personal information. ClarityCommand Service™ is a business recordkeeping and operations tool, not a financial services provider. We extend CCPA-equivalent rights to all users regardless of state and comply with the Texas Data Privacy and Security Act (TDPSA) and analogous state privacy laws.

Your Role as Data Controller: Because ClarityCommand Service™ is a business operations platform, you — the account owner — are the data controller for all business data you enter, including information about your employees, clients, vendors, and subcontractors. JoMar acts as your data processor, handling it solely on your behalf and under your direction per our Data Processing Agreement (Document IV).

3. Information We Collect

3.1 Account & Identity Information

• Full name and email address
• Password (stored as an encrypted hash — your plaintext password is never stored)
• Phone number (used for two-factor authentication only)
• Business name and program enrollment type
• Account creation date and subscription tier

3.2 Job & Field Operations Data

• Job entries: client name, service type, date, crew, job location notes, amount, and completion status
• Job photos uploaded from the field
• Daily Field Cards: zone-by-zone time tracking, safety checklists, and field notes
• Site walkthrough reports including surface assessments, chemical usage notes, and equipment observations
• QC site walk records and inspection checklists
• Incident reports: injuries, near-misses, chemical exposures, and vehicle accidents

3.3 Financial & Business Data

• Accounts Receivable (AR): client invoices, pay applications, payment timelines, and retainage contracts
• Accounts Payable (AP): vendor invoices, payment records, and outstanding balances
• Expense records: fuel, supplies, equipment costs, and business expense categorizations
• Profit & Loss (P&L) data entered or generated within the platform
• Bid and proposal records including scope, pricing, and win/loss outcomes
• Lien waiver records (template forms only)
• QuickBooks Online cost code mappings and export data, if the QBO integration is enabled

3.4 Payroll Recordkeeping Data

• Employee full name, role, and employment type (W-2 or 1099 contractor)
• Pay rate, pay type (hourly, salary, or 1099), and payroll notes
• Pay run records and gross/net calculations
• Employee profile photos uploaded by you

3.5 Equipment & Asset Data

• Vehicle and equipment records including make, model, and asset details
• Fuel logs, maintenance records, and equipment inventory counts

3.6 Technical & Usage Information

• Login timestamps and session activity
• Device type, browser type, and IP address
• Features accessed and actions taken within the platform
• Error logs and performance data (captured via Sentry.io, with PII stripped before transmission)

4. How We Use Your Information

We use the information we collect solely to provide and improve ClarityCommand Service™. We do not use your information for targeted advertising, third-party marketing, or any purpose unrelated to delivering the Service. Specifically, we use information to authenticate users, operate and maintain platform features, respond to support requests, detect and prevent security incidents and abuse, and comply with legal obligations.

5. Third-Party Service Providers

JoMar does not sell, rent, trade, or share your data with third parties for their own commercial purposes. We engage the following sub-processors, each bound by confidentiality and data protection obligations:

Provider	Purpose	Data
Google Firebase / Firestore / Cloud Storage	Database, authentication, file storage	All operational data
Cloudflare (Workers)	Backend API gateway, edge compute	Request metadata only
Netlify	Frontend hosting and CDN	Standard web request data
Anthropic, PBC (Claude API)	AI features — real-time inference	AI prompts and job photos when requested; zero-retention terms
Stripe	Subscription billing	Name, email, payment token (no card numbers stored by JoMar)
Sentry.io	Error monitoring	Technical error data; PII stripped before transmission
Twilio / SendGrid (optional)	Email and SMS notifications	Name, email, phone (if enabled)
Intuit / QuickBooks Online (optional)	Accounting export	Financial data you choose to export

6. Data Security

• All data transmitted over encrypted HTTPS/TLS 1.2 or higher
• Data at rest encrypted using AES-256 within Google Cloud Firestore and Firebase Storage
• Firebase Identity Platform with SMS multi-factor authentication enforced for all accounts
• Automatic session timeout after 15 minutes of inactivity
• Account lockout after five consecutive failed login attempts
• Role-based access controls; administrative access limited to authorized personnel and logged
• Immutable, append-only audit logs for sensitive data access events
• Custom claim-based admin authorization with token-level enforcement at the database layer

In the event of a Security Incident affecting your account, we will notify you within 72 hours of confirmation as further described in the Data Processing Agreement.

7. Browser Local Storage & Offline Caching

ClarityCommand Service™ uses browser localStorage as a temporary offline fallback cache. Image data is stripped before being written to localStorage and is not stored in plaintext on your device. Cached data is automatically cleared on logout.

8. Job Photos & Media

Photos are stored in Google Cloud Firebase Storage under your private account partition. Photos may be processed by the Anthropic AI API for bid analysis when you request it — this occurs in real time under Anthropic's commercial terms and is not retained for model training. You may delete photos at any time.

9. Data Export & Portability

A self-service Data Export tool lets you download your business data in CSV format at any time under Data Export & Portability in the platform. This includes jobs, financial records, payroll records, employee records, and bid history.

10. Data Retention & Deletion

When you cancel your account or request deletion, all personal and business data associated with your account will be permanently deleted within 30 days, except where we are required by law to retain certain records (audit log records may be retained for up to seven years). To request deletion, contact leslie@jomarbusinesssolutions.com with the subject line "Data Deletion Request."

11. Your Rights

• Right to Access — Request a copy of the data we hold about you
• Right to Correction — Request correction of inaccurate information
• Right to Deletion — Request deletion of your data, subject to legal retention requirements
• Right to Portability — Download your data anytime via the self-service Export tool
• Right to Opt Out — Opt out of any future non-essential communications
• Right to Non-Discrimination — We will not discriminate against you for exercising these rights

12. Children's Privacy

ClarityCommand Service™ is intended for business owners and operators aged 18 or older. We do not knowingly collect personal information from minors under 18.

13. Changes to This Policy

When we make material changes, we will notify you by email and by posting a prominent notice within ClarityCommand Service™ at least 14 days before the changes take effect. Your continued use of the platform after the effective date of an updated policy constitutes acceptance.

14. Contact Us

1. Definitions

"Service" means ClarityCommand Service™, accessible at portal.jomarbusinesssolutions.com. "Agreement" means these Terms together with the Master Service Agreement, Privacy Policy, and Data Processing Agreement. "Authorized User" means any individual permitted by Customer to access the Service under Customer's account.

2. Eligibility

The Service is intended for business owners and operators aged 18 or older. By subscribing, Customer represents and warrants that (a) Customer is a legal entity or individual aged 18 or older; (b) Customer has the authority to bind the business to this Agreement; and (c) Customer's use of the Service will comply with all applicable laws and regulations.

3. Account Registration and Security

Customer must provide accurate and complete information when creating an account and must keep that information current. Customer is responsible for maintaining the confidentiality of account credentials and for all activity that occurs under the account. Customer must not share credentials across separate businesses. Customer must notify JoMar immediately at leslie@jomarbusinesssolutions.com of any unauthorized access to or use of the account.

4. Acceptable Use

Customer and Authorized Users may use the Service only for lawful business purposes consistent with this Agreement. Customer agrees not to:

• Use the Service to process, store, or transmit Social Security Numbers, full payment card numbers, protected health information, or other regulated sensitive data
• Attempt to gain unauthorized access to any portion of the Service or connected systems
• Use the Service to transmit any malicious code, viruses, or other harmful software
• Reverse engineer, decompile, or disassemble the Service or attempt to derive source code
• Resell, sublicense, or otherwise provide access to the Service to third parties outside Customer's own business operations
• Use the Service in any way that violates applicable federal, state, or local law
• Store or process data on behalf of a third-party business that has not accepted these Terms
• Attempt to circumvent security controls, rate limits, or access controls

5. AI Features

The Service includes AI-powered features including conversational business assistance, bid analysis, and document drafting tools, powered by Anthropic's Claude models. AI outputs are for informational and operational convenience only — not legal, financial, tax, accounting, or professional advice. Lien waiver, invoice, and contract templates generated by AI features may not satisfy specific statutory form requirements in all jurisdictions. Customer bears sole responsibility for reviewing all AI outputs and consulting a licensed professional before relying on them for legal or financial decisions.

Customer may not use AI features to generate content that is false, misleading, harassing, defamatory, or unlawful, or to attempt prompt injection, jailbreaks, or other adversarial techniques intended to bypass safety controls.

6. Customer Data and Recordkeeping

The Service is a recordkeeping and reporting tool. JoMar does not initiate, originate, or process any payment, fund transfer, ACH origination, or money transmission on behalf of Customer or any third party. Customer remains solely responsible for executing payments through Customer's own banking, payroll, or accounting providers.

Customer owns all Customer Data. Customer is responsible for the accuracy, quality, integrity, and legality of all data entered into the Service, including data about Customer's employees, clients, vendors, and subcontractors. JoMar's obligations regarding Customer Data are governed by the Data Processing Agreement.

7. Intellectual Property

The Service, including all software, designs, trademarks, and documentation, is owned by JoMar and protected by applicable intellectual property laws. Customer receives only the limited license to use the Service as described in the Master Service Agreement. "ClarityCommand Service™," "JoMar Business Solutions," and related marks are trademarks of Nitty Gritty Powerwashing & Mobile Services, LLC. Customer may not use these marks without prior written authorization.

8. Third-Party Services and Integrations

The Service integrates with third-party services including QuickBooks Online, Stripe, Google Firebase, and others listed in the Data Processing Agreement. Customer's use of these integrations is subject to the applicable third-party terms of service. JoMar is not responsible for the availability, accuracy, or practices of third-party services.

9. Disclaimers

EXCEPT AS EXPRESSLY SET FORTH IN THE MASTER SERVICE AGREEMENT, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND. JOMAR DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. JOMAR DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, JOMAR'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS WILL NOT EXCEED THE FEES PAID BY CUSTOMER IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM. IN NO EVENT WILL JOMAR BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS OR DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE LIMITATIONS IN THIS SECTION ARE SUBJECT TO THE CARVE-OUTS IN THE MASTER SERVICE AGREEMENT.

11. Indemnification

Customer will indemnify, defend, and hold harmless JoMar and its officers, directors, employees, and agents from and against any third-party claims arising out of or related to (a) Customer Data; (b) Customer's violation of these Terms or applicable law; or (c) Customer's violation of any third-party right. JoMar will indemnify Customer for third-party claims that the Service, used as authorized, infringes a U.S. patent, copyright, or trademark, as further described in the Master Service Agreement.

12. Modifications to These Terms

JoMar may update these Terms from time to time. Material changes will be communicated by email and by posting a notice within the Service at least 30 days before the changes take effect. Customer's continued use of the Service after the effective date of updated Terms constitutes acceptance. If Customer does not agree, Customer may terminate the subscription before the effective date without penalty for the remaining prepaid period.

13. Suspension and Termination

JoMar may suspend or terminate Customer's access immediately upon written notice if Customer (a) violates the Acceptable Use Policy; (b) enters regulated data (such as SSNs) into the Service; (c) materially breaches the Master Service Agreement and fails to cure within the applicable cure period; or (d) becomes subject to bankruptcy or insolvency proceedings. Termination rights and post-termination data handling are governed by the Master Service Agreement.

14. Governing Law and Venue

These Terms are governed by the laws of the State of Texas, without regard to conflict-of-law provisions. Subject to the arbitration agreement in Section 15, any dispute not subject to arbitration will be resolved exclusively in the state or federal courts located in Tarrant County, Texas.

15. Binding Arbitration and Class Action Waiver

15.1 Agreement to Arbitrate

Except as provided in Section 15.3, any dispute arising out of or relating to these Terms, the Master Service Agreement, the Service, or any prior agreement between the parties will be resolved by final and binding individual arbitration administered by the AAA under its Commercial Arbitration Rules. The Federal Arbitration Act (9 U.S.C. § 1 et seq.) governs the interpretation and enforcement of this arbitration agreement.

15.2 Class Action Waiver

EACH PARTY AGREES THAT ALL DISPUTES WILL BE RESOLVED ONLY ON AN INDIVIDUAL BASIS AND NOT IN ANY CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. EACH PARTY WAIVES ANY RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN A CLASS ACTION OR REPRESENTATIVE PROCEEDING. If a court finds this waiver unenforceable as to a particular claim, that claim (and only that claim) will be severed from arbitration and proceed in court.

15.3 Exceptions

Either party may seek relief in small claims court for disputes within that court's jurisdiction. Either party may seek emergency injunctive or other equitable relief in any court of competent jurisdiction to prevent irreparable harm pending resolution of the underlying dispute. JoMar may pursue collection of overdue fees through judicial process.

15.4 Arbitration Procedure

Arbitration will take place in Tarrant County, Texas, or by remote proceeding if both parties agree. The arbitrator will apply Texas law and the Federal Arbitration Act. The arbitrator's award will be final and binding and may be entered as a judgment in any court of competent jurisdiction.

15.5 Opt-Out Right

16. Electronic Signatures and Records

This Agreement is entered into electronically. By clicking "I Agree & Continue," completing account registration, or otherwise affirmatively accepting these Terms, Customer provides an electronic signature with the same legal effect as a handwritten signature under the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act as adopted in Texas (Tex. Bus. & Com. Code Ch. 322).

17. General Provisions

Provision	Detail
Entire Agreement	These Terms + Master Service Agreement + Privacy Policy + Data Processing Agreement
Order of Precedence	DPA (data processing) → MSA (commercial) → Terms of Service (acceptable use/operations) → Privacy Policy
Severability	Unenforceable provisions don't void remaining ones
No Waiver	Failure to enforce ≠ waiver; any waiver must be in writing
Assignment	Customer may not assign without consent; JoMar may assign in connection with M&A
Notices	To leslie@jomarbusinesssolutions.com; deemed delivered on date sent with confirmation
Independent Contractors	The parties are independent contractors; no partnership, agency, or employment relationship
Force Majeure	Neither party liable for delay or failure due to causes beyond reasonable control

Document status: Pending licensed-attorney review prior to deployment with paying customers. Effective: May 1, 2026.

This Master Service Agreement ("MSA") supplements the Terms of Service and governs the commercial relationship between Nitty Gritty Powerwashing & Mobile Services, LLC d/b/a JoMar Business Solutions and Customer for use of ClarityCommand Service™. In the event of a conflict between this MSA and the Terms of Service, this MSA controls with respect to commercial terms; the Terms of Service control with respect to acceptable use and other operational matters.

1. Service Provision

JoMar will provide the Service to Customer during the Subscription Term in accordance with this Agreement. Customer may permit Authorized Users to access the Service within Customer's account; Customer remains responsible for all acts and omissions of its Authorized Users.

2. Subscription Term & Renewal

• The initial Subscription Term begins on the date Customer's first payment is processed and continues for one (1) month
• The Subscription Term automatically renews for successive one (1) month periods unless Customer cancels prior to the next renewal
• Either party may terminate as set forth in Section 10

3. Service Levels & Support

3.1 Availability Target

JoMar will use commercially reasonable efforts to make the Service available with a target uptime of 99.5% per calendar month, excluding (a) scheduled maintenance windows announced at least 24 hours in advance, (b) emergency maintenance, (c) downtime caused by third-party services outside JoMar's reasonable control, and (d) Force Majeure events.

3.2 Support

• Email support available at leslie@jomarbusinesssolutions.com Monday–Friday, 9:00 AM – 5:00 PM Central Time, excluding U.S. federal holidays
• Critical issues (Service unavailable): initial response within 4 business hours
• Non-critical issues: initial response within 1 business day

3.3 Maintenance

Scheduled maintenance will be announced at least 24 hours in advance for maintenance expected to result in downtime exceeding 10 minutes. Emergency maintenance may be performed without prior notice when necessary to protect Service integrity or security.

4. Fees & Payment

4.1 Fees

Customer will pay the subscription fees corresponding to the selected plan tier (Growth, Pro, or GC Command) as published on portal.jomarbusinesssolutions.com. Fees are payable monthly in advance via Stripe.

4.2 Price Changes

JoMar may adjust subscription pricing with at least 30 days' prior notice. Price changes take effect on Customer's next renewal following the notice period; Customer may cancel before the renewal to avoid the new pricing.

4.3 Late Payments & Suspension

• Failed payments will be retried by Stripe according to its standard retry schedule
• If a payment remains unpaid for 14 days after the original due date, JoMar may suspend access
• If a payment remains unpaid for 30 days, JoMar may terminate the account and delete Customer Data after a 30-day retention window from the date of suspension

4.4 Refunds

Except for the 30-day money-back guarantee for new subscribers (as described in the Terms of Service), all fees are non-refundable. No prorated refunds are issued for cancellations within a billing period.

4.5 Taxes

All fees are exclusive of taxes. Customer is responsible for any sales, use, value-added, or similar taxes assessed on Customer's subscription, except for taxes based on JoMar's net income.

5. Customer Obligations

• Use the Service in accordance with the Acceptable Use Policy in the Terms of Service
• Be solely responsible for the accuracy, quality, integrity, and legality of Customer Data
• Obtain and maintain all necessary rights, consents, and authorizations to upload Customer Data
• Not enter Social Security Numbers or other regulated PII into the Service
• Keep account credentials confidential and not share credentials across separate businesses
• Pay all fees when due and maintain a valid payment method on file

6. Data Security & Processing

JoMar will implement and maintain commercially reasonable administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data, as further described in the Privacy Policy and the Data Processing Agreement (Document IV), which is incorporated by reference into this MSA. Customer is the data controller, and JoMar is the data processor, with respect to Customer Data.

7. Confidentiality

"Confidential Information" means non-public information disclosed by one party to the other in connection with this Agreement, marked as confidential or that a reasonable person would understand to be confidential. Each party will (a) use Confidential Information only as necessary to perform under this Agreement, (b) not disclose Confidential Information to any third party except to its employees and contractors with a need to know bound by confidentiality obligations no less protective than those in this Agreement, and (c) protect Confidential Information using at least reasonable care. Obligations under this Section survive termination for three (3) years.

8. Intellectual Property

As between the parties, JoMar owns all right, title, and interest in and to the Service, including all software, designs, documentation, trademarks, and improvements. As between the parties, Customer owns all right, title, and interest in and to Customer Data. Customer grants JoMar a limited, non-exclusive, worldwide, royalty-free license to host, store, transmit, display, process, and back up Customer Data solely as necessary to provide the Service.

If Customer provides feedback or suggestions regarding the Service, Customer grants JoMar a perpetual, irrevocable, royalty-free license to use such feedback for any purpose.

9. Warranties & Disclaimers

Each party represents and warrants that (a) it has full power and authority to enter into this Agreement, and (b) its performance will not violate any applicable law or agreement to which it is a party. Customer represents and warrants that it has all necessary rights and consents to upload Customer Data and will not enter Social Security Numbers, full payment card numbers, or other regulated PII into the Service.

JoMar warrants that it will provide the Service in a professional and workmanlike manner consistent with general industry standards. Except as expressly set forth in this Section, the Service is provided "AS IS" and JoMar disclaims all other warranties, express or implied.

10. Term & Termination

10.1 Termination for Convenience

Customer may terminate by canceling within the Service. Cancellation takes effect at the end of the current billing period. JoMar may terminate this Agreement on 30 days' written notice for any reason, in which case Customer will receive a prorated refund of any prepaid unused fees.

10.2 Termination for Cause

Either party may terminate immediately upon written notice if the other party (a) materially breaches this Agreement and fails to cure within 15 days after receiving written notice (or 5 days for failure to pay), or (b) becomes insolvent or is the subject of bankruptcy proceedings.

10.3 Effect of Termination

• Customer's access to the Service ends on the effective date of termination
• JoMar will retain Customer Data for 30 days after termination to allow Customer to export data, after which Customer Data will be permanently deleted except as required by law
• Customer remains liable for any fees accrued prior to termination

11. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, OR BUSINESS INTERRUPTION, REGARDLESS OF THE THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EXCEPT FOR THE CARVE-OUTS BELOW, EACH PARTY'S TOTAL AGGREGATE LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

Carve-outs: The limitations above do not apply to (A) Customer's payment obligations; (B) either party's indemnification obligations; (C) breaches of confidentiality; or (D) gross negligence or willful misconduct. For liability under carve-out (D), JoMar's total aggregate liability will not exceed the greater of (x) two times (2x) the fees paid by Customer in the preceding twelve months, or (y) the limits of JoMar's cyber liability insurance policy then in effect.

12. Indemnification

JoMar will defend Customer against any third-party claim alleging that the Service, when used as authorized, infringes a U.S. patent, copyright, or trademark, and will pay damages and costs finally awarded or agreed to in settlement. Customer will defend JoMar against any third-party claim arising out of (a) Customer Data, (b) Customer's use of the Service in violation of this Agreement or applicable law, or (c) Customer's violation of any third-party right.

13. Insurance

JoMar maintains commercially reasonable insurance coverage, including general liability, errors & omissions, and cyber liability coverage. JoMar will provide a certificate of insurance upon written request, no more than once per twelve (12) months.

14. Dispute Resolution

Disputes under this Agreement are subject to the dispute resolution, arbitration, class action waiver, and governing law provisions in the Terms of Service (Sections 14 and 15), which are incorporated by reference into this MSA.

15. General Provisions

Provision	Detail
Order of Precedence	DPA (data processing) → MSA (commercial) → Terms of Service → Privacy Policy
Independent Contractors	No partnership, joint venture, agency, or employment relationship
Assignment	Neither party may assign without consent, except in connection with M&A or asset sale
Notices	In writing; delivered by email to leslie@jomarbusinesssolutions.com; deemed delivered on date sent with confirmation
Force Majeure	Neither party liable for delay or failure due to causes beyond reasonable control
Severability	Unenforceable provisions don't void remaining ones
Amendment	JoMar may modify with at least 30 days' prior notice; continued use = acceptance
Entire Agreement	This Agreement constitutes the entire agreement regarding the subject matter

Acceptance

This MSA is accepted electronically by Customer at the time of subscription enrollment and re-acceptance is required upon material updates. The version in effect at the time of each renewal applies to that renewal term.

Document status: Pending licensed-attorney review prior to deployment with paying customers. Effective: May 1, 2026.

This Data Processing Agreement ("DPA") supplements the Terms of Service and Master Service Agreement and governs the processing of Customer Data by JoMar Business Solutions on Customer's behalf in connection with ClarityCommand Service™. Customer is the data controller of Customer Data and JoMar Business Solutions is the data processor. JoMar processes Customer Data only on documented instructions from Customer, as set forth in the Agreement and in any applicable feature configurations within the Service.

1. Definitions

Term	Definition
Personal Data	Any information relating to an identified or identifiable natural person contained within Customer Data
Processing	Any operation performed on Personal Data, including collection, storage, use, transmission, and deletion
Sub-processor	A third-party data processor engaged by JoMar to process Customer Data
Security Incident	A confirmed unauthorized access, acquisition, disclosure, or destruction of Personal Data while under JoMar's control
Data Subject	An identified or identifiable natural person whose Personal Data is processed under this DPA, including Customer's employees, clients, vendors, and contractors

2. Subject Matter, Duration, Nature & Purpose

• Subject matter: provision of ClarityCommand Service™ as described in the Agreement
• Duration: for the Subscription Term plus the post-termination retention window described in Section 11
• Nature & purpose: hosting, storing, transmitting, displaying, processing, and backing up Customer Data so Customer can manage its business operations, including jobs, crew, finances, payroll records, bids, and clients
• Categories of Data Subjects: Customer's Authorized Users; Customer's employees and contractors; Customer's clients, general contractors, vendors, and subcontractors
• Categories of Personal Data: identity and contact data, employment and payroll recordkeeping data (excluding Social Security Numbers), business financial data, photos, and technical and usage information as described in the Privacy Policy

3. Processor Obligations

JoMar will:

• Process Personal Data only on Customer's documented instructions
• Ensure that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations
• Implement and maintain the technical and organizational measures described in Section 6
• Comply with the conditions for engaging Sub-processors set out in Section 4
• Assist Customer in fulfilling its obligations to respond to Data Subject requests
• Notify Customer of any confirmed Security Incident within 72 hours of confirmation
• At Customer's choice, delete or return all Personal Data after the end of the provision of the Service

4. Sub-processors

Customer authorizes JoMar to engage the following sub-processors. JoMar will provide at least 14 days' notice of new sub-processors. Customer may object within the notice period; if the parties cannot resolve the objection, Customer may terminate the Service without penalty for the affected portion.

Sub-Processor	Function & Data Access	Location
Google LLC (Firebase, Firestore, Cloud Storage, GCP)	Application database, file storage, compute infrastructure	USA
Cloudflare, Inc. (Workers)	Backend API gateway, authentication services, edge compute	Global
Netlify, Inc.	Frontend hosting and CDN	USA
Anthropic, PBC	AI features — real-time inference; zero-retention terms; data not used for model training	USA
Stripe, Inc.	Subscription billing data only (cardholder data processed by Stripe directly to Customer)	USA
Functional Software, Inc. (Sentry.io)	Error monitoring — PII stripped before transmission	USA
Twilio Inc. (SendGrid) — optional	Transactional email	USA
Twilio Inc. — optional	SMS notifications	USA
Intuit Inc. (QuickBooks Online) — optional	Accounting export	USA

JoMar will enter into written agreements with each sub-processor that impose data protection obligations no less protective than those in this DPA, and remains liable for the acts and omissions of its sub-processors with respect to Personal Data.

5. Security Measures

Control	Implementation
Encryption in transit	HTTPS/TLS 1.2 or higher for all client-server communication
Encryption at rest	AES-256 or equivalent within Google Cloud Firestore and Firebase Storage
Multi-factor authentication	Enforced via Firebase Identity Platform for all Customer accounts
Access controls	Role-based authorization; custom-claim admin gating; 15-minute session timeout; account lockout after 5 failed logins
Audit logging	Append-only, immutable logs for sensitive data access events
Application security	HTTP security headers; Content Security Policy; rate limiting on sensitive endpoints
Personnel safeguards	Confidentiality obligations; least-privilege access for JoMar staff
Incident response	Documented procedures for detecting, investigating, and responding to security events
Backup and recovery	Infrastructure-level backups maintained by Google Cloud Platform

6. Security Incident Notification

Upon becoming aware of a Security Incident, JoMar will notify Customer within 72 hours of confirmation and provide information reasonably available about the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the incident and mitigate its effects. Notification of a Security Incident is not an acknowledgment of fault or liability.

7. Assistance with Data Subject Rights

Taking into account the nature of the processing, JoMar will provide reasonable assistance to Customer in responding to Data Subject requests for access, correction, deletion, restriction, portability, or objection, including by providing self-service tools (such as the Data Export tool) within the Service. Customer is primarily responsible for responding to Data Subject requests, as Customer maintains direct control over Customer Data within the Service.

8. Audit Rights

JoMar will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including security questionnaire responses and summaries of policies and procedures. In the event of a confirmed Security Incident affecting Customer's Personal Data, the parties will discuss in good faith additional audit measures conducted (a) by a mutually agreed independent third-party auditor bound by confidentiality, (b) at Customer's expense (or at JoMar's expense for a Security Incident attributable to JoMar's breach), (c) no more than once per twelve (12) months, and (d) on at least 30 days' prior notice during normal business hours.

9. International Data Transfers

ClarityCommand Service™ is operated within the United States. Customer Data is stored on infrastructure located in the United States. The Application is intended for U.S. customers only; JoMar does not currently offer the Application to residents of the European Union or United Kingdom.

10. CCPA / TDPSA / State Privacy Law

Where the California Consumer Privacy Act (CCPA), as amended by the CPRA, the Texas Data Privacy and Security Act (TDPSA), or analogous state privacy laws apply, JoMar is a "service provider" (CCPA) or "processor" (TDPSA and analogous laws) with respect to Personal Data processed under this DPA. JoMar will not (a) sell or share Personal Data, (b) retain, use, or disclose Personal Data for any purpose other than the business purposes specified in this DPA, (c) retain, use, or disclose Personal Data outside the direct business relationship between the parties, or (d) combine Personal Data received from Customer with Personal Data received from any other source, except as permitted by law.

11. Return & Deletion of Personal Data

• Upon termination, Customer may export Personal Data via the self-service Data Export tool for up to 30 days
• After the 30-day retention window, JoMar will delete Personal Data from active systems within a commercially reasonable time, except where retention is required by applicable law
• Backup copies are deleted in accordance with JoMar's standard backup retention schedule
• Upon written request, JoMar will provide a written certification of deletion

12. Conflict

If conflict between this DPA and other parts of the Agreement regarding data processing matters, this DPA controls. For all other matters, the Agreement remains in full force and effect.

13. Contact for DPA Matters

Your acceptance of this Data Processing Agreement is recorded electronically at signup. Document version: 1.0 · Effective: May 1, 2026 · Status: Pending licensed-attorney review prior to deployment with paying customers.