Qonductor US Data Processing Agreement

United States | Version 1.0 | 6 November 2026

1 Parties and scope

1.1 This Data Processing Agreement (DPA) is between Qonductor, Inc., a Delaware corporation (Qonductor), and the organization that accepts it through an authorized representative (Customer). It forms part of the Terms of Service or another service agreement between them (Agreement). It applies when Qonductor processes personal data on Customer's behalf through the Qonductor service (Service), regardless of whether access is paid, complimentary, or provided for evaluation. Its United States scope is set out in Section 11.

1.2 Before Customer connects its CRM, an authorized Customer representative accepts the Terms of Service and Data Processing Agreement on Customer’s behalf by explicitly agreeing to both in a written reply to Qonductor’s email identifying and linking the applicable versions. The representative confirms authority to bind Customer. Qonductor retains the reply with the organization, representative, acceptance date, and document versions accepted.

1.3 Qonductor contact: pete@qonductor.ai. Delaware registered office: 16192 Coastal Highway, Lewes, DE 19958, United States. Registered agent: Harvard Business Services, Inc. The registered office is not designated as an ordinary support address. Customer's identity and notice contact are those supplied during onboarding or otherwise agreed in writing.

2 Definitions and roles

2.1 Applicable Data Protection Law means United States federal and state privacy, data protection, and data security laws that apply to the processing covered by this DPA. Customer Personal Data means personal data provided by or on behalf of Customer, or generated from that data in providing the Service, including source content, extracted action items, AI assessments, and related records. Personal data includes personal information where that term is used by applicable law. Controller, processor, business, service provider, and contractor have their meanings under the applicable law.

2.2 Customer determines the purposes of processing. Qonductor acts as Customer's processor or service provider, as applicable. If Customer acts as a processor for another organization, Qonductor acts as its subprocessor and Customer must obtain the necessary authority and instructions. Each party remains responsible for its own legal obligations.

3 Instructions and permitted processing

3.1 Customer instructs Qonductor to process Customer Personal Data to provide the Service described in Annex A. Documented instructions include this DPA, the Agreement, authorized integration settings, enabled capabilities, and instructions from authorized Customer representatives. Processing locations are addressed in Section 11 and Annex C.

3.2 Qonductor will process Customer Personal Data only on those instructions, unless applicable law requires otherwise. Where legally permitted, Qonductor will notify Customer of such a requirement before processing. Qonductor will promptly inform Customer if it believes an instruction violates Applicable Data Protection Law and may suspend the affected processing while the parties resolve the issue.

4 Use restrictions and AI processing

4.1 Qonductor will not sell Customer Personal Data, use it for targeted or cross-context behavioral advertising, or disclose it for another customer's use. Qonductor will not use it to train or fine-tune a general-purpose or shared AI model, and will not authorize an AI provider to do so, without Customer's separate express written authorization.

4.2 Qonductor may send relevant source content and context to an authorized AI subprocessor to identify obligations, assess evidence, organize action items, or prepare suggested actions. Prompts and outputs may contain personal data. Processing records, temporary storage, provider abuse-monitoring logs, and API application state may be retained under the agreed processing arrangements; this DPA does not promise zero retention by AI providers.

4.3 AI subprocessors must be engaged under Section 7. Absent the separate authorization described above, Qonductor will not opt Customer Personal Data into voluntary model training or data-sharing programs. Qonductor may use Customer Personal Data as reasonably necessary to provide, support, or secure the Service for Customer, including proactive review of Service quality in Customer’s workspace and investigation of issues before Customer reports them. This processing is subject to Customer’s documented instructions and this DPA’s access, purpose, and retention limits.

4.4 Where Qonductor acts as a service provider or contractor under applicable US state privacy law, it will not retain, use, or disclose Customer Personal Data outside the direct business relationship or for purposes beyond the specified services, except as that law permits. It will not combine the data with personal data from other customers or its own independent interactions except as that law permits. It will provide the required level of protection, notify Customer if it can no longer comply, and permit reasonable steps to verify compliance and stop and remedy unauthorized use.

4.5 Optional product improvement. Customer may separately authorize Qonductor in writing to use specified Customer Personal Data for a defined product improvement activity, to the extent permitted by applicable law. Before processing begins, the parties will document the purpose, data involved, who may access it, and how long it may be kept. Participation is optional, and Customer may withdraw authorization for future use at any time. The safeguards in this DPA continue to apply, including the separate authorization requirement for model training under Section 4.1.

5 Customer responsibilities

5.1 Customer is responsible for the lawful collection and disclosure of Customer Personal Data, required notices and permissions, and its instructions to Qonductor. Customer must have authority to connect source systems, permit AI processing, and authorize access by its users and chosen recipients. Customer is responsible for managing its users, integration permissions, and enabled actions.

5.2 Customer will not intentionally supply the restricted data identified in Annex A without a separate written agreement establishing the required safeguards. Customer will promptly report access concerns, unlawful instructions, or restricted data it discovers in the Service so the parties can limit further processing and arrange appropriate handling.

6 Confidentiality and security

6.1 Qonductor will restrict access to Customer Personal Data to authorized people who need it to provide, support, or secure the Service or meet a legal obligation. Those people must be bound by confidentiality obligations. Founder, contractor, and support access is subject to these requirements.

6.2 Qonductor will implement and maintain technical and organizational measures appropriate to the processing risks, including the baseline in Annex B. It will assess the effectiveness of those measures and address identified material weaknesses. Measures may evolve provided the overall protection is not materially reduced. These obligations apply throughout the processing covered by this DPA.

7 Subprocessors and connected services

7.1 Customer generally authorizes Qonductor to engage the subprocessors identified in the completed Annex C. Qonductor will evaluate each subprocessor's ability to protect Customer Personal Data and impose written obligations that provide the protection required by this DPA for the activities delegated to it. Qonductor remains responsible to Customer for its subprocessors' performance of those obligations.

7.2 Qonductor will give Customer at least 15 calendar days' advance written notice of a new or replacement subprocessor, including its role and processing locations. Customer may object on reasonable data-protection grounds within that notice period. The parties will seek a reasonable alternative. If none is available, Customer may end the affected use before the new processing starts.

7.3 Customer may instruct Qonductor to exchange data with services under Customer's own accounts, such as its CRM, email, calendar, Slack, or an AI client connected through MCP. Their role depends on the account, contract, and processing arrangement. A customer-selected destination is not automatically a Qonductor subprocessor. If Qonductor engages that provider to process data on its own behalf, this Section applies. Customer's instructions do not release Qonductor from its own obligations.

8 Personal data breaches

8.1 A Personal Data Breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Qonductor or its subprocessors. Qonductor will notify Customer without undue delay after becoming aware of a Personal Data Breach and sooner where applicable law requires.

8.2 The notice will describe the breach, affected data and people where known, likely consequences, mitigation taken or proposed, and a contact for follow-up. Qonductor may provide information in stages as it becomes available, without delaying the initial notice to complete its investigation. It will take reasonable containment and remediation steps, preserve relevant evidence, and cooperate with Customer.

8.3 Notice will go to Customer's designated administrative or security contact. Customer determines its own notifications to affected people and authorities, except where law requires Qonductor to notify directly. Notice does not constitute an admission of liability.

9 Requests and compliance assistance

9.1 Taking account of the processing and information available to it, Qonductor will reasonably assist Customer with data-subject requests, security obligations, breach assessment, impact assessments, and required regulator consultations. It will promptly refer requests concerning Customer Personal Data to Customer and will not independently respond except on Customer's instructions or where legally required.

9.2 Assistance will include reasonable retrieval, correction, restriction, return, or deletion where required and feasible. Authorized personnel may fulfill requests through manual procedures; this DPA does not require a self-service interface or automated request system. If a request requires substantial work beyond routine assistance, the parties may agree reasonable charges in advance. Charges will not be used to withhold assistance that law requires Qonductor to provide.

10 Retention return and deletion

10.1 During the Service, Qonductor will retain Customer Personal Data only as needed for the authorized purposes, documented instructions, and applicable legal requirements. This covers raw staging records, action-item history, logs, local exports, evaluation datasets, support artifacts, and AI inputs, outputs, and session records within Qonductor's control. Disabling an integration stops future authorized collection; it does not itself erase previously stored data.

10.2 After the affected Service ends, Customer may choose return or deletion by contacting Qonductor. Customer may request return within 30 calendar days after termination. Qonductor will complete return and delete live copies within 60 calendar days after termination, unless Customer instructs earlier deletion or applicable law requires a shorter period. Returned data will use a reasonably usable electronic format. Return does not authorize continued use of retained copies. Qonductor may fulfill these obligations manually or through automated procedures.

10.3 Qonductor will delete or expire residual backup copies no later than 90 calendar days after deletion of the corresponding live copies, unless applicable law requires retention or a shorter period. Until expired or deleted, residual backups must be protected, isolated from ordinary use, and processed only for recovery, security, or a legal requirement. If restored, applicable deletion instructions must be reapplied. Legally required copies must be limited to that purpose and period. Qonductor will instruct subprocessors to return or delete data and confirm completion on reasonable request, identifying any lawful residual retention.

11 United States scope and processing locations

11.1 This version is intended for United States customers and processing governed by Applicable Data Protection Law as defined in Section 2. It is not an international transfer addendum and does not provide terms specifically required under non-US data protection law. A Customer's US location does not by itself determine every law that may apply to its data. If a proposed use requires additional non-US terms or transfer safeguards, the parties must agree them before that use begins.

11.2 United States contractual scope does not mean exclusive United States data residency. Customer instructs Qonductor to use the processing locations and providers disclosed in Annex C, including any disclosed processing outside the United States. Qonductor will follow applicable US requirements and the safeguards in this DPA for that processing. No exclusive residency commitment applies unless separately agreed in writing.

12 Information and audits

12.1 Qonductor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow and contribute to audits and inspections by Customer or its independent auditor. The parties will normally begin with relevant documentation and written questions. If insufficient, they will arrange a proportionate audit with reasonable notice, confidentiality, and safeguards for other customers' data and system security. Such arrangements will not prevent an audit required by law, a regulator, or a material incident. This DPA does not represent that Qonductor holds a particular certification.

13 Duration changes and priority

13.1 This DPA continues for as long as Qonductor processes Customer Personal Data on Customer's behalf. It controls over inconsistent Agreement terms on that processing; mandatory law takes priority. Material changes require agreement through the Agreement's valid amendment process. Posting a revised document alone does not expand permitted processing for an existing Customer. General commercial terms, liability, and dispute provisions remain for the Agreement, subject to mandatory law.

Annex A Processing details

Service and purpose

A.1 The Service helps Customer identify, remember, monitor, and carry out commercial obligations and next steps. It processes customer-selected records to create and maintain action items called Cues, track supporting evidence and outcomes, prepare recommendations, and provide authorized reminders and reporting. Processing is limited to the features and integrations authorized for Customer's workspace.

Data subjects

A.2 Customer's employees, contractors, and authorized users; its prospects, customers, business contacts, and partners; and other people whose personal data appears in records Customer is authorized to provide, including email and meeting participants.

Personal data categories

A.3 Business names, contact details, roles, account associations, and user identifiers; email headers and message content; CRM activity records, notes, and call or meeting summaries and transcripts where present in connected records; calendar identities, event details, availability, and attendee information where enabled; source identifiers, URLs, and timestamps; and obligations, evidence excerpts, assessments, recommendations, execution records, and communications derived from those inputs.

A.4 Related information may include workspace membership and permission records, integration identifiers and authorization credentials, audit events, model-usage records, and technical diagnostics. These remain covered by this DPA where they contain Customer Personal Data processed on Customer's behalf. Qonductor does not promise that source content is limited to short excerpts: raw CRM records and message content may be staged and retained.

Processing operations and frequency

A.5 Collection through authorized APIs or user input; transfer, normalization, staging, storage, retrieval, AI inference, classification, linking, updating, access-controlled display, and deletion. Processing may occur on an ongoing scheduled basis and in response to user actions or new evidence. Selected source content and context may be sent to authorized AI subprocessors. Qonductor may also review Service quality and investigate issues in Customer’s workspace as described in Section 4.3.

A.6 Where specifically enabled and authorized, operations may also include CRM updates, internal notifications, messages sent through a linked identity, calendar availability checks, and meeting creation. This DPA describes permitted processing; it does not enable a capability or grant blanket authority to send messages or change external records.

Duration and restrictions

A.7 Processing continues for the authorized Service period and the limited return, deletion, backup, or legal-retention periods in Section 10. Customer may issue documented instructions within the agreed Service scope.

A.8 The Service is not designed to process patient-level health records or HIPAA-regulated data, payment-card details, government identification numbers, account passwords contained in source content, sensitive health, genetic or biometric data, criminal-offense data, or children's data. Customer must not intentionally provide these without separate written approval and appropriate safeguards. Necessary integration authorization credentials are handled as restricted service credentials. Incidental restricted content remains protected and must be addressed under Section 5.

Annex B Security baseline

B.1 This Annex describes the security measures supporting the processing covered by this DPA. Qonductor may use provider-managed controls and manual operating procedures. It does not represent that Qonductor maintains a particular certification, a staffed security operations center, automated rights-request tooling, or a separately tested disaster-recovery service.

Identity and workspace access

B.2 Application access requires an authenticated identity. Server-side access checks use active user and workspace membership records and apply workspace, role, and record restrictions to customer-facing reads and actions. Privileged support or administrative access is limited to people with an authorized operational need and is subject to Section 6.1.

Credentials and data protection

B.3 Qonductor uses HTTPS for application and provider API traffic and provider-managed encryption for stored production database data. Server keys and provider credentials are held in server-side environment secrets or encrypted secret storage where supported, rather than exposed as browser configuration. The application binds credential use to the relevant authorized integration and, where applicable, the connected user. These measures do not imply separate application-level encryption of every data field.

Authorized execution

B.4 External actions are subject to application authorization and enabled capability controls. Connected identities and credentials are bound to the relevant authorized context. Relevant decision, action, and integration records support troubleshooting and reconciliation. This DPA does not enable an action or authorize bypassing those controls.

Engineering and diagnostics

B.5 Qonductor will review changes affecting access, identity, and customer data and use appropriate tests before release. Customer content used in troubleshooting or evaluation remains subject to this DPA. Qonductor will limit diagnostic access and copies to the task, keep customer content out of source control, and refrain from intentionally including secrets in logs. Section 10 governs support copies and AI session records.

Operational response and recovery

B.6 Authorized personnel may handle incident response, customer notices, data return, and deletion manually. Reports and requests may be sent to pete@qonductor.ai. Deletion must cover production data, exports, support artifacts, AI sessions, and provider-held copies as required by Section 10. No specific restoration time or recovery point is committed.

People and providers

B.7 People with data access must meet Section 6.1. Qonductor will assess provider terms and periodically review privileged access and security measures.

Annex C Subprocessors and processing locations

C.1 Customer authorizes the providers below for the stated processing roles, subject to Section 7. Provider-managed infrastructure and onward processing remain subject to the applicable provider agreements and Qonductor's obligations under this DPA.

Additional providers

C.2 Qonductor will use support and development tools to process Customer Personal Data only as listed in this Annex. Qonductor will keep customer-derived data out of source-code repositories and AI coding assistants.

C.3 Customer-owned HubSpot, Google, Slack, and MCP client accounts are addressed under Section 7.3. Qonductor reads Customer's HubSpot data through Customer's authorization and may send notifications to Customer's own Slack workspace if Customer connects it. These services act under Customer's own accounts and are not Qonductor subprocessors. If Qonductor engages one of those providers as its own subprocessor, that arrangement will be added to this Annex under Section 7.2.

Notices and version record

C.4 Qonductor will send subprocessor change notices to Customer’s designated administrative contact under Section 7.2. Customer may send data-protection requests to pete@qonductor.ai. Qonductor will retain the provider list and accepted DPA version with Customer’s acceptance record under Section 1.2. Qonductor may maintain these records and notices manually.