Data Processing Addendum

This Addendum is part of the Terms of Service between you and FullBricks LLC ("FullBricks", "we", "us"), 30 N Gould St Ste N, Sheridan, WY 82801, USA, and applies whenever we process Customer Data on your behalf. Terms defined in the Terms of Service have the same meaning here.

If you need a countersigned copy for your records, email legal@skilltap.ai.

1. Roles

You are the business and the controller of Customer Data. We are your service provider and processor. We process Customer Data only on your documented instructions — your use of the Service, and this Addendum, are those instructions.

2. Scope of processing

Subject matter — providing SkillTap: hosting your account, generating AI roleplay, transcribing practice calls, and scoring transcripts against your rubrics.

Duration — the term of the Terms of Service, plus the deletion window in section 7.

Nature and purpose — hosting, transmission, transcription, AI inference, storage, and retrieval, solely to deliver the Service to you.

Types of data — as described in our Privacy Policy: account details, organization content, practice-call transcripts, AI scores and feedback, usage records, diagnostics, and support messages. Call audio is streamed for processing and not retained.

Categories of data subjects — your Authorized Users: your sales representatives, their managers, and your administrators.

3. Processing restriction

We will not retain, use, or disclose Customer Data for any purpose other than performing the Service for you. We will not sell or share Customer Data. We will not combine Customer Data with data from any other source, except as permitted by law to perform the Service.

We will not use Customer Data to train AI models, and we will not use it to improve SkillTap. This restriction survives termination for as long as we hold any Customer Data.

We will tell you if we determine we can no longer meet these obligations.

4. Subprocessors

You authorize us to engage subprocessors to perform the Service. We maintain a current list of subprocessors, available on request at legal@skilltap.ai. We will give you at least 30 days' notice before adding a subprocessor, and you may object on reasonable data-protection grounds.

Every subprocessor is bound to obligations no less protective than those in this Addendum, and we remain responsible to you for their performance.

5. Security

We maintain the technical and organizational controls described in our Security Overview, including no stored passwords, per-request tenant isolation, role-based access, encryption in transit and at rest, and not retaining call audio.

We will not materially weaken those controls during the term.

6. Assistance

We will give you reasonable assistance with:

• requests from your Authorized Users to access, correct, delete, or port their data;
• any data protection assessment you are required to carry out; and
• inquiries from a regulator concerning Customer Data we process.

If a request comes to us directly, we will refer it to you rather than answer it ourselves, since you control that data.

7. Deletion and return

On termination, we will delete Customer Data within 30 days, or return it to you on request before deletion.

We may retain records we are legally required to keep, such as billing records, and copies in routine backups that expire on their normal schedule. Sections 3 and 5 keep applying to anything we retain.

8. Incident notification

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Customer Data, we will notify you without undue delay.

The notice will describe what we know, the categories and approximate volume of data involved, the likely consequences, and the steps we are taking. We will keep you updated as we learn more, and we will not condition notification on completing our investigation first.

9. Audit

On reasonable written request, and no more than once a year unless a regulator or an incident requires otherwise, we will give you the information you reasonably need to verify our compliance with this Addendum — including our security documentation and, once available, our SOC 2 Type II report under NDA.

This is a documentation-based right. It does not include access to our premises, systems, or other customers' data.

10. Liability

Each party's liability under this Addendum is subject to the limitations in the Terms of Service.

11. Conflicts

If this Addendum conflicts with the Terms of Service on the processing of Customer Data, this Addendum controls. If you have signed a separate written agreement with us covering data processing, that agreement controls.

Contact

FullBricks LLC 30 N Gould St Ste N Sheridan, WY 82801, USA

legal@skilltap.ai