1. Parties & Roles
This Data Processing Agreement ("DPA") is between Reaper Software LLC, operator of AirQuote ("Processor," "AirQuote"), and the business using AirQuote ("Controller," "Customer"). Customer determines the purposes and means of processing personal data about its own customers and employees ("Personal Data"); AirQuote processes that Personal Data solely on Customer's behalf and instructions, as needed to provide the Service.
2. Scope & Nature of Processing
AirQuote processes Personal Data that Customer enters into or generates through the Service, including customer contact details, service addresses, appointment and job data, quote and invoice records, and payment metadata. Processing consists of storage, retrieval, transmission (e.g., email/SMS notifications), and AI-assisted analysis of Customer-submitted content as described in Section 5.
3. Customer Instructions
AirQuote will process Personal Data only to provide the Service, in accordance with the Terms of Service and Customer's own configuration of the Service (e.g., which notifications are enabled). AirQuote will not sell Personal Data or use it for independent marketing purposes.
4. Subprocessors
AirQuote uses the following subprocessors to deliver the Service. This list matches the disclosures in the Privacy Policy and is kept up to date there.
- Supabase — database, authentication, and file storage.
- Stripe — subscription billing and invoice payment processing.
- Resend — transactional email (quotes, invoices, reminders, notifications).
- Twilio — SMS text notifications (such as technician-on-the-way alerts).
- Anthropic — AI-assisted features send the job notes, symptoms, or descriptions entered into those features to Anthropic's Claude API to generate a diagnostic report or quote draft.
- Netlify — application hosting and infrastructure.
AirQuote will provide reasonable advance notice by email before adding a new subprocessor that will process Customer's Personal Data, allowing Customer to raise objections.
5. AI Processing Disclosure
When Customer or its end customers use AI-assisted features (AI Diagnostics, AI Quote Builder, AI Field Assistant, AI Assistant), the notes, symptoms, or descriptions entered are transmitted to Anthropic's Claude API to generate a diagnostic report or quote draft. Customer should avoid entering unnecessary sensitive personal data (such as government ID numbers or health information unrelated to HVAC service) into free-text fields used by AI features.
6. Security Measures
- Data is transmitted over encrypted connections (TLS/HTTPS).
- Access to production systems is restricted and authenticated.
- Customer data is logically separated by account (multi-tenant isolation enforced at the database and application layer).
- Automated/scheduled processes that trigger customer-facing actions are authenticated with server-side secrets.
AirQuote is currently operated as a small/single-operator business and does not maintain a dedicated 24/7 security team, formal SOC 2 certification, or penetration-testing program as of this document's effective date. Customer should factor this into its own risk assessment. See the Security page for more detail on how incidents are handled.
7. Breach Notification
If AirQuote becomes aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data, AirQuote will notify Customer without undue delay. Exact notification deadlines vary by jurisdiction and applicable law; Customer is responsible for its own downstream notification obligations to its end customers and regulators.
8. Data Return & Deletion
Upon termination of the Terms of Service, AirQuote will make Customer Data available for export upon written request for 30 days, after which AirQuote may delete Customer Data from active production systems. Data may persist in encrypted backups for a limited period consistent with standard backup retention before being purged.
9. Assistance with Data Subject Requests
AirQuote will provide reasonable assistance to Customer in responding to verified requests from individuals to access, correct, or delete their Personal Data, to the extent such data resides within the Service.
10. International Transfers
Subprocessors listed in Section 4 primarily operate in the United States. If Customer or its end customers are located outside the United States, Customer is responsible for confirming this arrangement satisfies applicable cross-border data transfer requirements in its jurisdiction.
11. Liability & Term
Liability under this DPA is subject to the limitations of liability set out in the Terms of Service, except where such limitation is not permitted by applicable data protection law. This DPA remains in effect for as long as AirQuote processes Personal Data on Customer's behalf under the Terms of Service.
12. Governing Law
This DPA is governed by the laws of the state in which Reaper Software LLC is organized, consistent with the Terms of Service.
13. Contact
Privacy and data protection inquiries: legal@reaper.software
This page is provided for transparency to prospective and current business customers. For a countersigned copy referencing your specific account, contact legal@reaper.software.