Last updated: June 30, 2026
Version: 1.1
This Data Processing Agreement ("DPA") is between Moon Sherpa Labs ("Processor," "we," "us") and the business customer that uses Follow Up Ace ("Controller," "Customer," "you"). It forms part of, and is governed by, the Terms of Service between the Controller and Moon Sherpa Labs (together, the "Agreement"). It applies where Moon Sherpa Labs processes Personal Data on behalf of the Controller in providing Follow Up Ace (also styled "Ace AI"), the "Service." Where there is a conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA controls.
Under the CCPA/CPRA, the Controller is a "business" and Moon Sherpa Labs is a "service provider." Moon Sherpa Labs will not sell or share Personal Data and will not retain, use, or disclose it except to perform the Service and as permitted by law.
Moon Sherpa Labs processes Personal Data to provide the Service — AI-powered real estate CRM assistance, including conversational AI, voice features, and the Ace Trove account-wide intelligence layer (real-time enrichment, intent and accountability scoring, machine-learning models that score contacts and generate predictive insights, a cloud-based data warehouse and analytics environment, and automated workflow actions). Details of processing are in Annex A. The duration of processing is the term of the Agreement plus any wind-down period in Section 11.
Moon Sherpa Labs will: (a) process Personal Data only on the Controller's documented instructions, including those in the Agreement and as configured in the Service, unless required by law (in which case we will notify the Controller where permitted); (b) ensure persons authorized to process Personal Data are bound by confidentiality; (c) implement appropriate technical and organizational measures (Annex B); (d) assist the Controller, taking into account the nature of processing, in responding to Data Subject requests (Section 8); (e) assist the Controller with security, breach notification, and data protection impact assessments; (f) retain, and on the Controller's choice delete or return, Personal Data as described in Section 11; and (g) make available information reasonably necessary to demonstrate compliance and allow for audits (Section 10).
Under our agreements with our AI providers, Controller Personal Data is contractually excluded from use in training their foundation models, and we do not sell Personal Data. We use Controller Personal Data to provide and improve the Service for the Controller's own account. Any improvement of our general models uses only de-identified or aggregated data that cannot reasonably be linked to the Controller or any individual; we commit not to attempt to re-identify it and require our providers and recipients (including our data-warehouse and analytics infrastructure) to do the same. We do not use the Controller's identifiable data to build or train models that serve other customers.
For purposes of the CCPA/CPRA, the Controller is the "business" and Moon Sherpa Labs is a "service provider." Moon Sherpa Labs designates OpenAI, Anthropic, Google (paid Gemini API / Vertex AI), and ElevenLabs as its own service providers (not third parties) under written contracts containing the terms in this Section. Moon Sherpa Labs agrees and certifies that it will:
These same service-provider obligations flow down by contract to each Sub-processor that processes Personal Data (Section 4).
For Personal Data subject to the Texas Data Privacy and Security Act, Moon Sherpa Labs, as processor, will: (a) ensure each person processing Personal Data is subject to a duty of confidentiality; (b) at the Controller's direction, delete or return all Personal Data to the Controller on termination of services, unless retention is required by law; (c) make available to the Controller information reasonably necessary to demonstrate compliance with its processor obligations; (d) cooperate with reasonable assessments and audits by the Controller or its designated assessor, or arrange for a qualified independent assessor, and provide a report to the Controller on request; and (e) engage Sub-processors only under a written contract that flows down these same processor duties.
The Controller provides general authorization for Moon Sherpa Labs to engage Sub-processors to provide the Service. The current Sub-processors are listed in the Sub-processor List (incorporated as Annex C), which expressly includes Google Cloud Platform / Firebase (infrastructure, database, and data warehouse / analytics), as well as OpenAI, Anthropic, Google (paid Gemini API / Vertex AI), Stripe, Twilio, the Google Gmail API, and Zillow. Moon Sherpa Labs will: impose data-protection obligations on each Sub-processor that are no less protective than this DPA (including the CCPA service-provider terms in Section 3A and the TDPSA processor duties in Section 3B, which flow down by contract); remain responsible for each Sub-processor's performance; and provide at least thirty (30) days' advance notice before adding or replacing a Sub-processor that processes Personal Data, during which the Controller may object on reasonable data-protection grounds. Consistent with the Colorado Privacy Act, this advance notice gives the Controller a genuine opportunity to object to any new or replacement Sub-processor before it begins processing. If an objection cannot be resolved, the Controller may terminate the affected Service as its exclusive remedy.
The Service is operated from the United States and serves customers in the United States and Canada. Personal Data of Canadian residents may be processed and stored in the United States; by using the Service the Controller authorizes this cross-border processing, and Moon Sherpa Labs maintains protections consistent with PIPEDA and Quebec Law 25 for such data (including honoring access and deletion requests). Moon Sherpa Labs does not target or knowingly serve residents of the EU, EEA, or UK. If Moon Sherpa Labs ever processes EU/EEA/UK Personal Data, the applicable EU Standard Contractual Clauses (Module Two: Controller to Processor), and the UK Addendum where relevant, would apply to such transfers, together with any supplementary measures reasonably required.
Moon Sherpa Labs maintains the technical and organizational measures described in Annex B, including encryption in transit and at rest, access controls, audit logging, backup and disaster recovery, vulnerability management, and personnel training. Measures may be updated provided they do not materially decrease the overall level of protection.
We will notify the affected business customer (Controller) without undue delay, and in any event within 72 hours, after confirming a personal-data breach affecting their data, and will provide the information reasonably necessary for the Controller to meet its notification obligations. We will also cooperate with and document the breach and remediation.
Taking into account the nature of the processing, Moon Sherpa Labs will assist the Controller by appropriate technical and organizational measures, insofar as possible, to fulfill the Controller's obligation to respond to Data Subject requests (access, correction, deletion, portability, objection, restriction, opt-out of profiling, and human review of automated assessments). If Moon Sherpa Labs receives such a request directly, it will, where lawful, advise the Data Subject to contact the Controller.
Moon Sherpa Labs will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the processing under this DPA, including assistance regarding Ace Trove's automated profiling and predictive models.
Moon Sherpa Labs will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or its mandated auditor on reasonable prior notice, no more than once per year (except as required by a supervisory authority or following a breach), subject to confidentiality. Moon Sherpa Labs may satisfy audit requests by providing third-party audit reports or security documentation where available.
This DPA is effective for the duration of the Agreement. Following termination or expiry, the Controller instructs Moon Sherpa Labs to retain the Controller's Personal Data so the Controller may reactivate the Service, export, or continue to access it, and Moon Sherpa Labs may retain it on that documented-instruction basis until the Controller instructs otherwise, in accordance with the retention approach in the Privacy Policy. At any time — during the term or after — the Controller may direct Moon Sherpa Labs, at the Controller's choice, to delete or return the Controller's Personal Data, and Moon Sherpa Labs will action a verified request within 30 days and delete existing copies. Moon Sherpa Labs will certify deletion on written request.
The foregoing is subject to the following exceptions, under which Moon Sherpa Labs may retain data: (a) where retention is required by applicable law or to establish, exercise, or defend legal claims; (b) Personal Data contained in routine cold backups, which is not actively queried and is overwritten on the ordinary backup-rotation cycle rather than erased on demand; and (c) data that Moon Sherpa Labs has aggregated or de-identified such that it no longer identifies, and cannot reasonably be used to re-identify, any individual — such data is not Personal Data, falls outside this DPA, and may be retained and used indefinitely, including to operate, secure, and improve the Service and its models. Personal Data that the Controller independently maintains in its own connected systems (for example, its Follow Up Boss account) remains under the Controller's control and is unaffected by deletion from the Service.
On a verified deletion request (whether at termination or for an individual Data Subject under Section 8), Moon Sherpa Labs will erase, de-identify, or aggregate the affected Personal Data across its active systems — including its data-warehouse and analytics environment and its historical change data — and will direct its Sub-processors to do likewise. The active analytics environment is an actively-queried production system, not a "backup," and is included in deletion. Only genuine cold backups that are not actively queried follow a delete-on-cycle schedule and are overwritten in the ordinary course.
The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, including the liability cap (the greater of $100 or fees paid in the trailing 12 months).
This DPA is governed by the law stated in the Terms of Service (State of Texas, USA), except that, for EU/EEA/UK Personal Data, the governing law and forum of the Standard Contractual Clauses apply to matters arising under those clauses.
Encryption in transit (TLS 1.2+) and at rest; encryption of sensitive credentials such as API keys; role-based access controls and authentication; least-privilege employee access; audit logging; network and application security controls; backup and disaster recovery; vulnerability management and patching; secure software development practices; incident-response procedures; and personnel confidentiality and security training.
See the Sub-processor List, which is incorporated into this DPA and expressly includes Google Cloud Platform / Firebase (infrastructure, authentication, database, and data warehouse / analytics). OpenAI, Anthropic, Google (paid Gemini API / Vertex AI), and ElevenLabs are engaged as CCPA service providers under the terms of Section 3A. The list also names TypeSafe (typed classification of CRM text, no text generation); its written data-processing terms are being documented, and it is not included in the Section 3A designation until they are.
Moon Sherpa Labs operates in the United States and does not target or knowingly serve EU/EEA/UK residents. If Moon Sherpa Labs ever processes EU/EEA/UK Personal Data, the EU Standard Contractual Clauses (Module Two: Controller to Processor) and, where applicable, the UK International Data Transfer Addendum would apply to such transfers, with Annexes populated from Annexes A–C of this DPA.