A1Scope and roles. These processing terms apply when Raven handles personal information on the Customer's behalf. The Customer determines the business purposes and authorized scope; Raven acts as its service provider or processor as those terms apply under relevant law. Raven may separately determine the lawful purposes for its own business contacts, billing, account administration, security and legally required records, as explained in the Privacy Policy. A role label does not override the parties' actual legal responsibilities.
A2Processing description. Processing consists of collecting, hosting, extracting, organizing, matching, classifying, displaying, approving, synchronizing, supporting, exporting and deleting business financial and related records. It lasts for the Service and the limited permitted retention period. Data subjects may include Customer users, employees, suppliers, customers, homeowners and other project contacts. Data may include names, work contact details, optional phone numbers, account and device identifiers, IP addresses, project addresses and imported project location information, document images and metadata, amounts, transaction details, notes, support material and audit events, only within the actual enabled and disclosed scope.
A3Instructions and limits. Raven will process personal information only on documented lawful Customer instructions, including the accepted agreement and authorized product settings, or as required by law. It will notify the Customer if it reasonably believes an instruction infringes applicable privacy law and may suspend the affected processing. It will not sell the information, share it for cross-context behavioural advertising, use it for unrelated marketing, or combine it with other customers' personal information except where necessary and legally permitted for the contracted service or security. Identifiable data is not authorized for unrelated model training, experiments or external benchmarking.
A4Customer duties. The Customer must establish its lawful authority, provide required notices, obtain any required consents, minimize submissions, maintain appropriate permissions and respond to its data subjects. It must promptly inform Raven of relevant corrections, restrictions, legal holds and deletion instructions. The Customer's duties do not eliminate Raven's own legal duties. Information accidentally submitted outside the permitted scope must be addressed under Section 9.4.
A5Safeguards and confidentiality. Raven will apply safeguards appropriate to the sensitivity and risks, limit access to authorized persons under confidentiality duties, and maintain procedures for incident response and secure disposal. It will make reasonable, relevant information about its safeguards available on request, without disclosing secrets, another customer's data or information that would compromise security. No SOC 2, ISO 27001, penetration-test result or specified control is incorporated as a warranty merely because it appears in an unaccepted marketing or working document.
A6Providers and transfers. The Customer gives general authorization to engage suitable processing providers within the permitted purposes. Current AI and hosting arrangements may include AWS services, OpenAI and models supplied through Amazon Bedrock, as accurately described in the provider list and Privacy Policy. Raven must bind subprocessors to appropriate written protections for the processing, exercise reasonable diligence, and remain responsible for their performance of delegated data-protection obligations as applicable law requires. Additional or replacement providers are governed by Section 10.4. Cross-border processing must satisfy applicable legal transfer, transparency and safeguard requirements; this agreement alone does not establish that every required transfer assessment or permission has been completed.
A7Individual requests. Raven will promptly direct requests concerning Customer-controlled information to the Customer and provide reasonable assistance with access, correction, deletion, withdrawal, objections and other applicable rights. It will not require the individual to surrender a statutory right or pay a commercial migration fee. Requests concerning Raven's independently controlled information will be handled by Raven under applicable deadlines. Any legally required direct response, verification, extension, refusal explanation or appeal process remains available.
A8Incidents. Raven will notify the Customer without undue delay after becoming aware of a breach of security safeguards involving the Customer's personal information and provide information then available about its nature, affected information and mitigation. Notice must not be delayed until every fact is confirmed. Raven will investigate, contain, preserve relevant evidence and provide reasonable updates and assistance. The parties will coordinate regulatory and individual notifications while each retains its own legal duties. No fixed 72-hour waiting period or contractual deadline replaces a shorter applicable legal obligation.
A9Compliance assistance. Raven will provide reasonable assistance and relevant information for legally required assessments, investigations and compliance checks relating to its processing. Where applicable law requires a contractual audit or inspection right, the parties will arrange a proportionate process using available evidence first, subject to confidentiality and safeguards for other customers. Reasonable administrative arrangements must not prevent a required audit, regulator access or remedy. Raven will inform the Customer if it can no longer meet applicable processing obligations and cooperate in appropriate remediation or stopping the affected processing.
A10Return deletion and legal requests. Return, live deletion, residual copies, legal holds and retained records follow Section 19 and applicable law. Raven will protect retained information and limit it to the permitted purpose. On reasonable request it will confirm completion of the agreed live-data deletion, explaining lawful exceptions. Government or legal disclosure requests must be reviewed, limited to lawful requirements and notified to the Customer where permitted and practicable.
A11Required local terms. Where a US state privacy law applies and requires service-provider, contractor or processor terms, Raven will process the information for the specific business purposes in this Schedule, provide the legally required level of protection, and permit the Customer to take the reasonable compliance-monitoring and remediation steps required by that law. The Customer may require an appropriate jurisdiction-specific addendum before the affected processing begins. No blanket claim of compliance with every jurisdiction is made by including this Schedule.
A12Contractual liability. Section 17 applies to claims under these processing terms to the extent legally permitted. It does not waive individual rights, regulator powers, mandatory reporting duties or liability that cannot lawfully be limited. The same event does not create separate contractual caps under the main Terms and this Schedule.