How we process your data.

This Data Processing Addendum ("DPA") is between ArbiBase, LLC ("ArbiBase", "we") and any business that uses ArbiBase under our Terms of Service ("Customer", "you"). Customers include operator companies, property managers and concierge clients. It applies when you put personal information about other people into ArbiBase and we process it on your behalf. It forms part of the Terms and takes effect when you accept them. It is effective October 12, 2026.

If you need a countersigned copy for your records, email [email protected].

Customer Personal Data

Personal information about people other than ArbiBase's own users that you upload, enter or connect to ArbiBase, and that we process to provide the Services to you.

Services

The ArbiBase app at app.arbibase.com, the concierge client portal, and related support.

Subprocessor

A company we engage to process Customer Personal Data for us.

Security Incident

A confirmed breach of security that leads to unauthorized access to, or the loss, alteration, disclosure or destruction of, Customer Personal Data.

Privacy Laws

US federal and state privacy and data security laws that apply to the processing, including state consumer privacy laws such as California's.

For Customer Personal Data, you decide why and how it is processed (you are the "controller" or "business"). We process it only on your behalf (we are the "processor" or "service provider").

For our own data, ArbiBase is responsible, and our Privacy Policy applies, not this DPA. Our own data includes your account and billing information and your users' sign-in details. It also includes our marketplace data: the properties we source, owner consent records, verification results, and owner contact details.

Owner details you receive through an unlock become yours to look after once we deliver them. You are responsible for that data on your own account, and you must use it only to pursue that property, in line with the Terms and the owner's opt-out requests.

Purpose

To provide the Services: store your records, run analyses you ask for (Greenlight underwriting, lease analysis, Copilot and chat), send the emails and signature requests you trigger, run concierge searches, and provide support.

People concerned

Your team members and contacts; landlords, owners and agents you add to your pipeline; and people named in documents you upload, such as leases.

Types of data

Names, email addresses, phone numbers, postal and property addresses, business details, lease terms and other contents of documents you upload, notes, and messages.

Sensitive data

The Services aren't designed for sensitive data such as government ID numbers, financial account numbers or health information. Don't upload it unless a feature asks for it.

Duration

For as long as you use the Services, and afterwards until the data is returned or deleted under section 11.

For Customer Personal Data, ArbiBase will:

• Process it only on your documented instructions. Your instructions are the Terms, this DPA, and the way you use and configure the Services. We'll tell you if we believe an instruction breaks the law.
• Not sell it, and not share it for cross-context behavioral advertising.
• Not keep, use or disclose it for any purpose other than providing the Services to you, or outside our direct business relationship with you, except as the law allows.
• Not combine it with personal information from other sources, except as needed to provide the Services or as the law allows.
• Limit access to staff who need it for their role, and make sure they're bound by confidentiality.
• Apply the security measures in section 07.
• Notify you if we can no longer meet our obligations under the Privacy Laws.

• You have the right to give us the Customer Personal Data, and you have given the people concerned any notices and obtained any consents the law requires.
• Your instructions to us comply with the law.
• You keep your account secure: use strong passwords, turn on two-step sign-in, and remove team members who leave.
• You honor opt-out and do-not-contact requests from owners and other people you reach through ArbiBase.

• Access control in the database: every table has row-level security rules, so each account can reach only its own records. Public endpoints use limited server-side access.
• Staff access: staff tools are restricted to signed-in ArbiBase staff, and access is limited by team.
• Sign-in: Supabase Auth handles passwords; we don't store them in readable form. Google sign-in, one-time email codes and optional two-step sign-in with an authenticator app are also available.
• Encryption: all traffic to the website, app and APIs uses HTTPS. Tokens for connected accounts, such as Gmail, are encrypted with AES-256-GCM. Links in emails and portals are signed and expire.
• Abuse protection: public forms and APIs are rate-limited, and website forms use Cloudflare Turnstile to block bots.
• Payments: Stripe processes and stores card data. We never receive full card numbers.
• Monitoring: Sentry reports errors in the app, with session replay turned off.

We review and update these measures as the Services change. More detail is on our Security page. ArbiBase does not hold security certifications or third-party audit reports.

You authorize us to use the subprocessors below. They are the same service providers named in our Privacy Policy. Each is bound by contract terms that require it to protect the data.

Apify, BatchData and AirROI supply ArbiBase's own marketplace data (section 03), so they aren't subprocessors for Customer Personal Data.

We'll update this list and the effective date of this DPA before a new subprocessor starts processing Customer Personal Data. If you'd like an email when this list changes, ask at [email protected]. If you object to a new subprocessor on reasonable data protection grounds, tell us within 30 days of the change. We'll work with you on an alternative, and if we can't find one, you can cancel the affected Services.

If someone asks us to access, correct, delete or export Customer Personal Data, we'll pass the request to you rather than answer it ourselves, unless the law requires otherwise. We'll help you respond, for example by exporting or deleting records you can't reach in the app, when you email [email protected].

If we become aware of a Security Incident affecting Customer Personal Data, we will notify you without undue delay and as required by law. We'll tell you what we know: what happened, what data was involved, and what we're doing about it. We'll update you as we learn more. We'll take reasonable steps to contain the incident and limit the harm, and we'll give you the information you reasonably need to meet your own notice obligations. Telling you about an incident is not an admission of fault.

At any time, including after your subscription ends, you can email [email protected] to ask for an export of your Customer Personal Data in a common format (CSV or JSON), or to have it deleted. We'll do so within 30 days of the request. We may keep data the law requires us to keep, and copies in our providers' backups are deleted as those backups expire. Whatever we keep remains protected by this DPA.

On reasonable request, no more than once a year unless the law or a Security Incident requires more, we'll answer written questions about how we process Customer Personal Data, such as a security questionnaire. This lets you check that we meet this DPA. If the law gives you a right to an audit, we'll agree a reasonable scope, timing and confidentiality terms with you first. Any review must not disrupt the Services or expose other customers' data.

ArbiBase serves the United States, and our main systems are hosted there. Some subprocessors may process data in other countries under their own terms. We don't currently offer international data transfer agreements, such as the EU Standard Contractual Clauses. If you need one, contact us before you put data about people outside the United States into ArbiBase.

This DPA forms part of our Terms of Service. If the two conflict on how Customer Personal Data is handled, this DPA wins. Everything else, including the limits of liability, governing law (Delaware) and how disputes are resolved, is governed by the Terms. This DPA ends when we no longer process Customer Personal Data for you.