Data processing addendum

Last updated October 15, 2026

1. What this addendum is

This data processing addendum ("DPA") is part of the agreement between Powerhouse Holdings, LLC, doing business as Project Keryx ("Keryx", "we"), and the business that uses Keryx ("you"), described in our terms of service. It applies automatically, without a signature, whenever we process personal information in your customer data for you. Words defined in the terms mean the same here. If this DPA and the terms conflict about personal information, this DPA comes first. If you need a signed copy, email hello@trykeryx.com.

"Privacy laws" means the US federal and state laws on personal information that apply to the processing, including the California Consumer Privacy Act as amended (CCPA) and the comprehensive state privacy laws of other states, such as Alabama's Personal Data Protection Act once it takes effect. "Personal information" has the meaning those laws give it (some call it "personal data"). "Customer personal information" is personal information in your customer data.

2. Who does what

For customer personal information, you are the business or controller: you decide what to collect, why, and whom to contact. We are your service provider, contractor or processor, and we process it only on your behalf. You are responsible for your instructions, for having a lawful basis for the processing, and for giving people any notice the law requires. For information about your own account (your name, login and billing), we are the business or controller, as our privacy policy explains.

3. The processing

• Purpose. Providing Keryx to you: finding and scoring businesses, storing your leads, contacts and deals, sending and receiving your email, booking meetings, sending proposals and recording their acceptance, syncing the services you connect, producing your reports, writing AI drafts you ask for, and supporting, securing and fixing the service.
• People. The people in your customer data: contacts and owners at businesses you find or add, people who reply to you, book through your booking pages or open and accept your proposals, and your own team members.
• Information. Names, job titles, business email addresses, phone numbers, business addresses, messages and their contents, meeting details, notes, deal details, proposal acceptances (typed name, time, IP address and browser) and anything else you choose to add. You agree not to add the sensitive information our acceptable use policy rules out.
• How long. For as long as you use Keryx, then until it's deleted as section 10 describes.
• Your instructions. The agreement, your settings and how you use Keryx are your instructions. If we think an instruction breaks a privacy law, we'll tell you.

4. What we won't do

We will process customer personal information only for the purposes in section 3 and as the privacy laws allow a service provider to. In particular, we will not:

• sell it or share it (including for cross-context behavioral advertising);
• keep, use or disclose it for any other purpose, including our own commercial purposes, or outside our direct business relationship with you;
• combine it with personal information we get from anyone else, or that we collect from our own dealings with people, except as the privacy laws allow (for example, to detect security incidents or prevent fraud);
• use it to train or improve AI models, or let our AI provider do so.

We understand these restrictions and will follow them. We'll give customer personal information the same level of privacy protection the privacy laws require of you, and we'll tell you if we decide we can no longer meet our obligations under them. If we do, or if you reasonably believe we're using it in a way that breaks this DPA, you can tell us to stop and to fix the problem, and we'll work with you to do so.

We may use information about how Keryx is used, and combined statistics that identify no one, as the terms describe. Those don't contain customer personal information.

5. Our people

Only people who need access to run, support or secure Keryx can reach customer personal information, and each of them is bound to keep it confidential.

6. Security

We use reasonable technical and organizational measures to protect customer personal information, suited to the risks. They include: encryption in transit (HTTPS) everywhere; mailbox passwords, sign-in tokens and connection keys encrypted at rest; passwords stored only as one-way hashes; API keys stored only as fingerprints; each workspace's data kept separate; optional two-step sign-in; access at Keryx limited to the people who need it; hosting with providers that keep their own security programs; and backups. We review these measures and may improve them, but won't make them less protective overall.

7. Subprocessors

You allow us to use the service providers listed in our privacy policy under "Who helps us run Keryx" to help us process customer personal information. Providers that only act because you connect them (such as your own mailbox, calendar, CRM, Stripe, Calendly or Zoom) process data under your agreement with them, not ours. Each subprocessor we choose is bound by written terms that protect the information at least as well as this DPA, and we are responsible for their work.

Before we add a new subprocessor that will process customer personal information, we'll update that list and email your account's owner at least 15 days ahead. If you object for a reasonable data protection reason, tell us within that time. We'll try to address it, and if we can't, you can end the affected part of your plan and we'll refund what you prepaid for the time after it ends.

8. Helping with privacy requests

Keryx lets you find, export, correct and delete the information about a person in your workspace, and add them to your do-not-contact list. If you need more help answering a request from a person, or with a privacy assessment the law requires, we'll provide reasonable help. If a person sends a request about your customer data to us, we'll pass it to you and won't answer it ourselves, except to tell them we've done so.

9. Security incidents

If we confirm a breach of security that leads to unauthorized access to, or loss, disclosure or alteration of, customer personal information, we'll tell your account's owner without undue delay and in any case within 72 hours of confirming it. We'll share what we know about what happened, the information and people affected, and what we're doing about it, and update you as we learn more. We'll help you meet any duty you have to notify people or regulators. Telling you about an incident isn't an admission of fault.

10. When you leave

When your account ends, you can export your customer data as the terms describe. We then delete customer personal information within 30 days, and copies in backups are overwritten within a few weeks after that. We may keep what the law requires us to keep (such as billing records), and we'll keep protecting it under this DPA while we have it.

11. Showing our compliance

You may take reasonable and appropriate steps to make sure we use customer personal information in a way consistent with your obligations under the privacy laws. On reasonable written request, at least once every 12 months (or after a security incident), we'll answer reasonable questions and give you information needed to show that we meet this DPA, such as a description of our security measures. Information we share this way is our confidential information. Anything more, such as an on-site audit, needs a separate written agreement, including on costs.

12. Where data is processed

We store customer personal information in the United States. Some subprocessors may process it elsewhere under the protections in section 7. Keryx is offered to US businesses. If you need contract terms for data about people in the European Economic Area, the UK or Switzerland, email us before you add that data to Keryx.

13. Everything else

This DPA lasts as long as we process customer personal information for you. The limits on liability in the terms apply to this DPA. We may update this DPA to reflect changes in the law or in how Keryx works. We'll tell you about changes that matter as the terms describe, and we won't make it less protective of customer personal information unless the law requires it.

Contact

Questions about this addendum, or a privacy request about customer data? Email hello@trykeryx.com.